dd61a20413
USER DECISION 2026-07-08: accept breaking external wallets pointed at nodeIP:8332. The 0.0.0.0 publish exposed auth-only RPC (and unauthenticated ZMQ 28332/28333 on the legacy path) to the whole LAN. - New `bind` field on manifest port mappings (validated as an IP; the same host port may repeat with distinct binds). Rendered as PublishPort=<ip>:<host>:<container> in quadlet units and host_ip in the podman API create — unbound ports render byte-identical to before, so no fleet-wide false-drift wave. - bitcoin-knots/-core manifests publish 8332 on 127.0.0.1 + 10.89.0.1 only. In-node consumers (lnd, fedimint-gateway, btcpay/nbxplorer) are unaffected: they dial host.archipelago / host.containers.internal, which the orchestrator pins to the archy-net gateway 10.89.0.1. P2P 8333 stays public. - Legacy config.rs port strings get the same treatment incl. ZMQ. Tests: new quadlet bind-render + manifest bind-validation tests; container:: suite 167/167, archipelago-container 63/63. DEPLOY NOTE: PublishPort strings change for bitcoin containers → one planned recreate per node; restart lnd afterwards (it caches the backend IP — see the backend-recreate cascade tracker item). Catalog manifests for bitcoin apps must be regenerated + re-signed for catalog-covered nodes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Archipelago App Manifests
Containerized applications for the Archipelago Bitcoin Node OS. All apps run in rootless Podman with security hardening (cap-drop ALL, readonly root, non-root user, memory limits).
App Categories
Bitcoin & Lightning
- bitcoin-knots — Full Bitcoin node (v28.1)
- lnd — Lightning Network Daemon (v0.17.4-beta)
- btcpay-server — Payment processor (v1.13.5)
- mempool — Block explorer and fee estimator (v2.5.0)
- electrumx — Electrum server
- fedimint — Federated Bitcoin minting (v0.10.0)
Nostr
- nostr-rs-relay — High-performance Rust relay (v0.9.0)
- nostrudel — Nostr web client (v0.40.0)
Web5 & Identity
- did-wallet — Web5 DID Wallet
Self-Hosted Services
- nextcloud (v28), jellyfin (v10.8.13), immich (release), photoprism (v240915)
- vaultwarden (v1.30.0-alpine), penpot (v2.4)
- homeassistant (v2024.1), filebrowser (v2.27.0), searxng (2024.11.17)
- ollama (v0.5.4), grafana (v10.2.0), portainer (v2.19.4)
Networking
- tailscale (stable), nginx-proxy-manager (v2.12.1)
Custom & External
- indeedhub — Bitcoin documentary streaming (custom build)
- router — Mesh routing and network management
- botfights, nwnn, 484-kitchen, call-the-operator, arch-presentation, syntropy-institute, t-zero — External web apps
Manifest Format
Each app has a manifest.yml defining container image, resources, dependencies, security policies, health checks, and network config. See docs/app-manifest-spec.md for the spec.
Quick Reference
- PORTS.md — Complete port mapping
- QUICKSTART.md — Build and run apps
- DEVELOPMENT.md — Development workflow