a6f1ab8d53
Full context for resuming: rootless podman migration, security hardening, .198 container creation needed, remaining tasks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2.4 KiB
2.4 KiB
Session 2026-03-18 — Resume Guide
What Was Done
Rootless Podman Migration (TASK-11 DONE)
- .228: 30 containers running rootless with full security hardening
- All
sudo podmanremoved from Rust backend (9 files) + deploy script - UID mapping: container UID N → host UID (100000 + N - 1)
- Deploy script auto-fixes ownership + sysctl + linger on every deploy
.198 Migration (IN PROGRESS)
- Root containers stopped, UID ownership fixed, IndeedHub images migrated
/etc/hostsfixed to 644 (rootless podman needs read access)- Only 2 containers running — needs full container recreation
- Next: run container setup (Bitcoin, LND, ElectrumX, all apps)
- The
--bothdeploy only copies binary+frontend, doesn't create containers
Security Hardening (TASK-8 — 9/12 pentest findings fixed)
- C1: /lnd-connect-info requires session auth
- C3: DEV_MODE removed from production service
- H1: node-message verifies ed25519 signatures
- M1: content.add rejects
..path traversal - M2: NIP-07 postMessage uses specific origin
- M3: AIUI nginx checks session_id cookie
- L2: Strict v3 onion validation
- Still open: H2/H3 (federation signature verification), H4 (bind ports to 127.0.0.1)
UI/UX Fixes
- Mesh serial: auto-detect, backoff, udev rule, Connect button
- External iframes: CSP https: added
- Container startup: "Checking..." shimmer, marketplace sort
- Port mapping: all nginx+frontend+backend synced
- ElectrumX: shows index size during indexing
- Fedimintd → "Fedimint Guardian"
- IndeedHub Studio version
- On-Chain first in receive modals
- Tab-launch icons, iframe error screen, CPU alert threshold
- Mesh mobile: header hidden, overflow fixed
- Federation/Cloud: DID on hover
Git Tags
- v1.2.0-alpha.1 through v1.2.0-alpha.8 (current)
Resume Checklist
- Finish .198 containers — create Bitcoin, LND, ElectrumX, MariaDB, Mempool, BTCPay, Grafana, etc.
- H2/H3 — federation peer-joined/address-changed signature verification
- H4 — bind service ports to 127.0.0.1
- BUG-1 — CSRF mismatch (P0 critical)
- Many /task items in MASTER_PLAN.md from testing session
- Tailscale migration for other nodes (preserve auth state)
Key Facts
- Rootless subnet: 10.89.0.0/16
- Bitcoin RPC: rpcallowip=0.0.0.0/0, password in /var/lib/archipelago/secrets/
- .198 /etc/hosts must be 644
- Deploy --both only copies, --live creates containers