archipelago
fc68c5b680
Demo images / Build & push demo images (push) Failing after 36s
Nginx Proxy Manager, Tailscale, Ollama, CryptPad, and AdGuard Home now carry full manifests: the app gate fronts their web ports (TLS on the same port, node login where appropriate), installs run through the orchestrator, and pins live in the signed catalog. Tailscale mirrors its legacy shape exactly (userspace networking, web console on 8240, plain HTTP for the gate to front). Ollama stays loopback-only — the assistant's local model backend, not a web app. Retires the four already-removed apps for good (FIPS, Nostr VPN, Routstr, Penpot pins dropped from image-versions.sh, the generator map, and image_versions.rs), fixes Cuprate's duplicated metadata block that strict YAML parsers reject, and updates the port-inventory review gates for the new open (3 own-login consoles) and exempt (2 DNS) ports.
75 lines
1.9 KiB
YAML
75 lines
1.9 KiB
YAML
app:
|
|
id: nginx-proxy-manager
|
|
name: Nginx Proxy Manager
|
|
version: 2.12.1
|
|
upstream:
|
|
kind: github
|
|
repo: NginxProxyManager/nginx-proxy-manager
|
|
description: >-
|
|
Reverse proxy with SSL. Beautiful web interface for managing proxies.
|
|
On a node, this manages its admin UI and upstream configuration — the
|
|
proxy's own :80/:443 listeners are not published (the node's web server
|
|
owns those ports).
|
|
|
|
container:
|
|
image: source.archipelago-foundation.org/lfg2025/nginx-proxy-manager:latest
|
|
pull_policy: if-not-present
|
|
network: pasta
|
|
|
|
dependencies:
|
|
- storage: 1Gi
|
|
|
|
resources:
|
|
memory_limit: 512Mi
|
|
disk_limit: 1Gi
|
|
|
|
security:
|
|
capabilities: [CHOWN, SETUID, SETGID, DAC_OVERRIDE]
|
|
readonly_root: false
|
|
no_new_privileges: true
|
|
network_policy: isolated
|
|
|
|
ports:
|
|
- host: 8081
|
|
container: 81
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
# open, not gated: NPM carries a complete admin login of its own. The
|
|
# gate still fronts the port (TLS on the same port, header fixes, retry
|
|
# page, Tor) without putting a cookie challenge in front of it.
|
|
auth: open
|
|
auth_rationale: >-
|
|
Nginx Proxy Manager enforces its own admin account on every page;
|
|
the initial setup wizard also has to answer before any account exists.
|
|
|
|
volumes:
|
|
- type: bind
|
|
source: /var/lib/archipelago/nginx-proxy-manager
|
|
target: /data
|
|
options: [rw]
|
|
|
|
environment: []
|
|
|
|
health_check:
|
|
type: tcp
|
|
endpoint: localhost:81
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
interfaces:
|
|
main:
|
|
name: Admin UI
|
|
description: Nginx Proxy Manager admin interface
|
|
type: ui
|
|
port: 8081
|
|
protocol: http
|
|
path: /
|
|
|
|
metadata:
|
|
author: Nginx Proxy Manager
|
|
category: networking
|
|
icon: /assets/img/app-icons/nginx.svg
|
|
repo: https://github.com/NginxProxyManager/nginx-proxy-manager
|
|
tier: optional
|