01 · CLIENT
Browser & Companion
Vue dashboard and Android Companion present controls and show node state.
Explore frontend →Developer architecture / source map
One node.
Clear boundaries.
How the browser, Rust backend, rootless apps and protected host fit together. Follow each layer to the source that owns it.
01 / The system
Request to runtime
The node presents one web surface. Each layer has its own owner and trust boundary.
02 · EDGE
Nginx routes
Serves the UI and routes RPC and app traffic to the right local service.
Routing contract →03 · CONTROL
Rust backend
Owns API, sessions, desired app state, reconciliation and update decisions.
Explore API source →04 · RUNTIME
Rootless apps
Systemd user services and Podman run manifest-driven containers and networks.
Lifecycle contract →Persistent data & secrets
App state lives under /var/lib/archipelago. Cleanup and upgrades follow explicit data contracts.
Protected host
Debian and systemd own boot, packages and protected OS maintenance.
02 / Trust
Boundaries that matter
Presence in source or on a node does not by itself establish an accepted release.
Manifest to app
apps/<id>/manifest.yml is a development input. On published nodes, a verified signed catalog can supply the embedded manifest that wins over disk.
App to host
Rootless app processes do not own host packages, unrestricted container-engine access or live storage cleanup. Backend and protected executor paths enforce those boundaries.
Source to release
Source checks, disposable integration, signed artifacts, installed-node evidence and physical acceptance are distinct gates.
03 / Explore
Start in the right place
These are source and contract entry points. Read the exact handler and tests before changing behavior.
Keep the evidence attached to the build
This page maps current source. It does not certify an installed node, installer or OTA. Use the release and testing index for the exact acceptance boundary, and the text architecture guide for more detail.