185 lines
6.3 KiB
YAML
185 lines
6.3 KiB
YAML
app:
|
|
id: qortal
|
|
name: Qortal
|
|
version: 6.1.9
|
|
# Where this app comes from, so scripts/check-upstream-releases.py can
|
|
# tell us when the pin below has fallen behind.
|
|
upstream:
|
|
kind: github
|
|
repo: Qortal/qortal
|
|
description: >-
|
|
Qortal Core node — the blockchain, QDN data network and local API behind
|
|
Qortal Hub. Connect desktop or mobile Hub to your own node, and browse
|
|
Qortal websites and Q-Apps through the built-in gateway.
|
|
category: community
|
|
|
|
container_name: qortal
|
|
|
|
container:
|
|
# Built from the official release jar (SHA-256 pinned) by
|
|
# apps/qortal/Dockerfile — upstream publishes no image.
|
|
image: source.archipelago-foundation.org/lfg2025/qortal-core:6.1.9
|
|
pull_policy: if-not-present
|
|
# Own pasta network, not archy-net: Core talks to no other app, and with
|
|
# pasta inbound p2p peers keep their real addresses (on a rootless bridge
|
|
# every forwarded connection appears to come from the container's own
|
|
# IP). It also keeps Core off the shared rootless netns uplink.
|
|
network: pasta
|
|
generated_secrets:
|
|
- { name: qortal-api-key, kind: hex32 }
|
|
secret_env:
|
|
# Written to /qortal/apikey.txt by the entrypoint; Core requires it
|
|
# (X-API-KEY header) on every admin / sensitive API route.
|
|
- key: QORTAL_API_KEY
|
|
secret_file: qortal-api-key
|
|
# Image runs as uid 1000:100 (upstream's choice) = host 100999:100099.
|
|
data_uid: "100999:100099"
|
|
|
|
# Chain DB, QDN data and settings live here; preserve across repairs.
|
|
backup_before_runtime_change: true
|
|
|
|
dependencies:
|
|
# Measured on archy-x250-pa3 (2026-10-20): bootstrap + full sync = 6.8 GB
|
|
# in ~17 min. QDN data is capped at 20 GiB by maxStorageCapacity below
|
|
# (Core otherwise sizes it from free disk: 110 GB on that node).
|
|
- storage: 40Gi
|
|
|
|
resources:
|
|
# JVM heap is capped at 50% of this (MaxRAMPercentage=50), matching
|
|
# upstream's start.sh guidance for small machines.
|
|
memory_limit: 4Gi
|
|
disk_limit: 40Gi
|
|
|
|
security:
|
|
capabilities: []
|
|
readonly_root: true
|
|
no_new_privileges: true
|
|
network_policy: isolated
|
|
|
|
ports:
|
|
# Companion status UI (nginx in the same container, apps/qortal/ui/).
|
|
- host: 12390
|
|
container: 12390
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
auth: gated
|
|
# Core API — what Qortal Hub (desktop/mobile) connects to.
|
|
- host: 12391
|
|
container: 12391
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
auth: open
|
|
auth_rationale: >-
|
|
Qortal Hub talks to Core's REST API directly and cannot complete a
|
|
browser cookie login. Core enforces its own API key (X-API-KEY) on
|
|
every admin and sensitive route; the remaining routes are the public
|
|
read / signed-transaction-submit API every Qortal public node serves.
|
|
# Built-in gateway: renders Qortal websites and Q-Apps over HTTP.
|
|
- host: 12380
|
|
container: 12380
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
auth: gated
|
|
# Blockchain P2P.
|
|
- host: 12392
|
|
container: 12392
|
|
protocol: tcp
|
|
auth: none
|
|
auth_rationale: >-
|
|
Qortal blockchain p2p. Peers are anonymous by design and speak the
|
|
Qortal wire protocol, not HTTP.
|
|
# QDN (data network) P2P, separate from the chain since Core v6.
|
|
- host: 12394
|
|
container: 12394
|
|
protocol: tcp
|
|
auth: none
|
|
auth_rationale: >-
|
|
Qortal QDN p2p data transfer between nodes. Not HTTP; peers are
|
|
anonymous by design.
|
|
|
|
volumes:
|
|
- type: bind
|
|
source: /var/lib/archipelago/qortal
|
|
target: /qortal
|
|
options: [rw]
|
|
- type: tmpfs
|
|
target: /tmp
|
|
tmpfs_options: "rw,nosuid,size=512m"
|
|
|
|
# Seed settings once; operator edits survive (overwrite: false). The
|
|
# entrypoint refuses to start if localAuthBypassEnabled is ever true or
|
|
# apiRestricted false.
|
|
#
|
|
# IP whitelist is off on purpose: rootless port forwarding delivers the
|
|
# gate's connections from the container's OWN archy-net address (dynamic,
|
|
# not loopback), so no static whitelist can name it, and the port is only
|
|
# reachable via the gate and archy-net anyway. apiRestricted is what
|
|
# guards the API: Core demands the key on every state-changing route
|
|
# (stop/restart, minting keys, repository/bootstrap ops). Reads such as
|
|
# /admin/status are public, exactly as on any Qortal public node.
|
|
files:
|
|
- path: /var/lib/archipelago/qortal/settings.json
|
|
overwrite: false
|
|
content: |
|
|
{
|
|
"bootstrap": true,
|
|
"localAuthBypassEnabled": false,
|
|
"apiRestricted": true,
|
|
"autoUpdateEnabled": false,
|
|
"apiWhitelistEnabled": false,
|
|
"gatewayEnabled": true,
|
|
"gatewayPort": 12380,
|
|
"gatewayLoopbackEnabled": true,
|
|
"maxStorageCapacity": 21474836480
|
|
}
|
|
|
|
# Shown on the app's dashboard page behind the node session (never by the
|
|
# app's own UI, which cannot verify that session). Hub needs the key to
|
|
# use this node; the app itself never asks for it, so no launch prompt.
|
|
credentials:
|
|
title: Connect Qortal Hub
|
|
description: >-
|
|
In Qortal Hub, add a custom node using this node's address on port
|
|
12391, then enter this API key when Hub asks for it. The key unlocks
|
|
node administration (stop, restart, minting keys); share it only with
|
|
Hub installs you control.
|
|
prompt_before_launch: false
|
|
items:
|
|
- label: API key
|
|
secret_file: qortal-api-key
|
|
|
|
health_check:
|
|
# qortal-health: API up, or bootstrap still in progress (see health.sh).
|
|
type: cmd
|
|
endpoint: /usr/local/bin/qortal-health
|
|
interval: 120s
|
|
timeout: 15s
|
|
retries: 5
|
|
|
|
interfaces:
|
|
main:
|
|
name: Qortal Node
|
|
description: Node status, Hub connection details and gateway launcher
|
|
type: ui
|
|
port: 12390
|
|
protocol: http
|
|
path: /
|
|
|
|
metadata:
|
|
author: Qortal Project
|
|
icon: /assets/img/app-icons/qortal.png
|
|
website: https://qortal.org
|
|
repo: https://github.com/Qortal/qortal
|
|
license: GPL-3.0
|
|
tier: optional
|
|
features:
|
|
- Full Qortal Core node (blockchain + QDN data network)
|
|
- Connect Qortal Hub on desktop or mobile to your own node
|
|
- Built-in gateway for Qortal websites and Q-Apps
|
|
- Node status page: sync height, peers, Hub connection details
|
|
- Fast first sync from the official bootstrap
|
|
tags:
|
|
- qortal
|
|
- blockchain
|
|
- p2p
|