95f9a805b1
The whole fleet was silently never reaching the FIPS mesh: the default public anchor was configured as fips.v0l.io:8668/udp, but the anchor only answers on TCP/8443. Fix the default to 185.18.221.160:8443/tcp (IPv4 literal — the hostname resolves IPv6-first and the daemon binds v4-only, which fails the handshake with EAFNOSUPPORT), and auto-seed it in anchors::load() so every node dials it without operator action (removal still persists). Proven live on .116: cold start → anchor_connected in ~400ms, anchor became mesh parent. Wire fips::update::apply() against upstream GitHub releases (stable channel only): resolve /releases/latest → SHA256-verify the .deb against checksums-linux.txt → install → restart. dpkg runs via `systemd-run` to escape archipelago's ProtectSystem=strict sandbox (else /var/lib/dpkg is read-only), with --force-confold (archipelago manages /etc/fips conffiles) and --force-downgrade (dev builds sort newer than the stable tag). Validated live: .116 upgraded 0.3.0-dev -> stable v0.3.0. Also: standalone fips-ui dashboard app (apps/fips-ui + docker/fips-ui, static nginx proxying /rpc/v1 same-origin, copiable own-anchor address); reserve UI port 8336; register fips/fips-ui as platform-managed. Includes the Lightning wallet cross-origin (CORS) + LND proxy auth + nginx self-healer fix so the wallet screen connects instead of "failed to fetch". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
20 lines
888 B
Docker
20 lines
888 B
Docker
FROM git.tx1138.com/lfg2025/nginx:1.27.4-alpine
|
|
# Static site content.
|
|
COPY index.html /usr/share/nginx/html/
|
|
#
|
|
# FIPS UI talks only to the archipelago RPC on 127.0.0.1:5678, using the
|
|
# browser's own archipelago session — there is NO per-node secret to
|
|
# substitute, so (unlike bitcoin-ui) the nginx config is baked straight
|
|
# into the image rather than bind-mounted/rendered at container-create.
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
#
|
|
# Run nginx as root to avoid chown failures in rootless Podman user
|
|
# namespaces. The rest of the nginx image is unchanged.
|
|
RUN sed -i 's/^user nginx;/user root;/' /etc/nginx/nginx.conf && \
|
|
mkdir -p /var/cache/nginx/client_temp /var/cache/nginx/proxy_temp \
|
|
/var/cache/nginx/fastcgi_temp /var/cache/nginx/uwsgi_temp \
|
|
/var/cache/nginx/scgi_temp
|
|
EXPOSE 8336
|
|
ENTRYPOINT []
|
|
CMD ["nginx", "-g", "daemon off;"]
|