409543c41e
fmcd crash-looped "Operation not permitted (os error 1)" on .116 (kernel 6.12.74): the default rootless seccomp profile blocks a syscall its Mainline-DHT / iroh transport needs, so the REST API never came up (:8178 → HTTP 000) and federations couldn't be joined. Verified: with seccomp=unconfined fmcd boots and answers /v2/* (HTTP 401 instead of dead). fmcd works on other nodes, so this is kernel/seccomp-specific — but the relaxation is safe for an outbound-networking daemon and harmless where not needed. - new `security.seccomp_unconfined` manifest flag (SecurityPolicy); - libpod backend sets `seccomp_profile_path: "unconfined"` (== --security-opt seccomp=unconfined); quadlet backend emits `SeccompProfile=unconfined`; - enabled in apps/fedimint-clientd/manifest.yml. NOTE: manifests live on-disk at /opt/archipelago/apps/<id>/manifest.yml, so the node needs the updated manifest deployed + the fmcd container recreated to apply. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
90 lines
4.0 KiB
YAML
90 lines
4.0 KiB
YAML
app:
|
|
id: fedimint-clientd
|
|
name: Fedimint Client
|
|
version: 0.8.0
|
|
description: Fedimint ecash client daemon (fmcd). Lets the node hold Fedimint ecash and join federations; the wallet talks to it over a local REST API.
|
|
|
|
container:
|
|
# fmcd built from source (github.com/minmoto/fmcd v0.8.0, fedimint-client
|
|
# 0.8.2 — iroh-capable). No usable upstream image exists, so we build + push
|
|
# this to the node registry. Pin the tag to match the REST shapes coded in
|
|
# core/archipelago/src/wallet/fedimint_client.rs (validated against 0.8.2).
|
|
image: 146.59.87.168:3000/lfg2025/fmcd:0.8.0
|
|
pull_policy: if-not-present
|
|
network: archy-net
|
|
# No entrypoint override: the image's resilient `fmcd-run` launcher loops
|
|
# fmcd and retries on join failure (fmcd needs >=1 federation to boot), so an
|
|
# unreachable default never crash-loops. All config comes from FMCD_* env
|
|
# below. Nodes can join more federations via wallet.fedimint-join.
|
|
secret_env:
|
|
- key: FMCD_PASSWORD
|
|
secret_file: fmcd-password
|
|
data_uid: "1000:1000"
|
|
|
|
# NOTE: this is a CLIENT, not the guardian — it does not require the local
|
|
# `fedimint` app. It joins external federations (default below), so it can be
|
|
# bundled standalone on every node.
|
|
dependencies:
|
|
- storage: 2Gi
|
|
|
|
resources:
|
|
cpu_limit: 1
|
|
memory_limit: 1Gi
|
|
disk_limit: 2Gi
|
|
|
|
security:
|
|
capabilities: []
|
|
readonly_root: true
|
|
# NOT isolated: fmcd needs outbound UDP + Mainline DHT (port 6881) + iroh
|
|
# relays to reach iroh-transport federations. `bridge` gives NAT'd outbound
|
|
# (UDP/DHT/iroh hole-punch all work) plus the published 8178→8080 port the
|
|
# wallet bridge targets. ("open" is not a valid policy — it made the loader
|
|
# skip this whole manifest, so fmcd never ran and federations never joined.)
|
|
# Lock down once the default federation's reachability model is finalized.
|
|
network_policy: bridge
|
|
# fmcd's Mainline-DHT / iroh transport uses syscalls the default rootless
|
|
# seccomp profile blocks on some kernels (e.g. .116, kernel 6.12.74), where
|
|
# fmcd crash-loops "Operation not permitted (os error 1)" and never serves
|
|
# its REST API — so federations can't be joined (#7). Verified: with
|
|
# seccomp=unconfined fmcd boots and answers /v2/* (HTTP 401 vs dead 000).
|
|
seccomp_unconfined: true
|
|
|
|
ports:
|
|
# fmcd REST bound to 8080 in-container; 8080 collides with LND REST on the
|
|
# host, so map to 8178. The Rust bridge targets http://127.0.0.1:8178.
|
|
- host: 8178
|
|
container: 8080
|
|
protocol: tcp
|
|
|
|
volumes:
|
|
# Same dir the first-boot bundled path uses + where the wallet bridge reads
|
|
# the password (/var/lib/archipelago/fmcd/password) — keep install paths aligned.
|
|
- type: bind
|
|
source: /var/lib/archipelago/fmcd
|
|
target: /data
|
|
options: [rw]
|
|
|
|
environment:
|
|
- FMCD_ADDR=0.0.0.0:8080
|
|
- FMCD_MODE=rest
|
|
- FMCD_DATA_DIR=/data
|
|
# Default federation joined out-of-the-box (guardian on .116, iroh
|
|
# transport; validated to join with fmcd 0.8.2). iroh does NAT traversal so
|
|
# it's reachable fleet-wide. Keep in sync with DEFAULT_FEDERATION_INVITE in
|
|
# core/.../wallet/fedimint_client.rs. CAVEAT: iroh is experimental — validate
|
|
# join reliability from a real second node before relying on auto-bundle.
|
|
- FMCD_INVITE_CODE=fed11qgqyj3mfwfhksw309uuxywtxxfjrjc35xuexverpxdsnxcnrxucxvenzveskgc3kvvun2c34xp3k2ep38yunzdpexcekxe3hvd3rvvmx8pnrvdenx5mnzvtzqqqjqt0t6pc3s5z0ynqjw9s4njf6svwgu59kweawc0vvrddcjeemw6yyn4pcdp
|
|
|
|
# fmcd serves only authenticated /v2/* routes — there is no unauthenticated
|
|
# /health endpoint, so an http probe to /health 404s forever and pins the
|
|
# container in "(starting)". fmcd's own image also ships neither curl nor wget.
|
|
# Use a TCP probe: the Quadlet renderer skips it (no HealthCmd emitted) and the
|
|
# host-side lifecycle layer verifies reachability, so the container reports
|
|
# "running" instead of a perpetual false-negative "(starting)".
|
|
health_check:
|
|
type: tcp
|
|
endpoint: localhost:8080
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|