Update to upstream Spaces 0.3.0 and refresh bundled images (subs v0.1.2c, certrelay v0.2.8, nacho v1.0.0b). Add Create/Show Registry API Keys for registry-server, remove Configure Subspaces and SUBS_PUBLISH_REQUIRE_FINALIZED, and align README/instructions with the new tags. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Cursor
@@ -37,10 +37,10 @@ through a browser-based terminal.
|
||||
|
||||
| Field | Value |
|
||||
| --- | --- |
|
||||
| Spaces image | `docker.io/horologger/spaces:v0.2.1a` |
|
||||
| Subspaces image | `docker.io/horologger/subs:v0.1.2b` |
|
||||
| Certrelay image | `docker.io/horologger/certrelay:v0.2.7b` |
|
||||
| Nacho image | `docker.io/horologger/nacho:v1.0.0` |
|
||||
| Spaces image | `docker.io/horologger/spaces:v0.3.0` |
|
||||
| Subspaces image | `docker.io/horologger/subs:v0.1.2c` |
|
||||
| Certrelay image | `docker.io/horologger/certrelay:v0.2.8` |
|
||||
| Nacho image | `docker.io/horologger/nacho:v1.0.0b` |
|
||||
| Architectures | `linux/amd64`, `linux/arm64` |
|
||||
| Entrypoint | StartOS-managed (image entrypoints are **not** used directly) |
|
||||
|
||||
@@ -54,7 +54,7 @@ image's `docker_entrypoint.sh`; daemons are defined in `startos/main.ts`.
|
||||
| --- | --- | --- |
|
||||
| `/data` | `main` | Spaces data directory (`SPACED_DATA_DIR`), wallets, indexes, and `store.json` |
|
||||
| `/data/mainnet/.cookie` | `main` | Spaced RPC cookie (auto-generated by `spaced` at startup) |
|
||||
| `/data/store.json` | `main` | StartOS-managed credentials (Space-CLI Web UI password, bitcoind RPC user/password, spaced RPC user/password) and feature config (Subspaces toggles, Certrelay + Nacho settings). |
|
||||
| `/data/store.json` | `main` | StartOS-managed credentials (Space-CLI Web UI password, bitcoind RPC user/password, spaced RPC user/password, registry API keys) and feature config (Subspaces toggles, Certrelay + Nacho settings). |
|
||||
| `/data/subspaces/data` | `main` | `subs` runtime data (`SUBS_DATA_DIR`) — handles, proofs, config.db. Persists across restarts and enable/disable toggles. |
|
||||
| `/data/subspaces/prover` | `main` | Working directory for the `subs-prover` daemon. |
|
||||
| `/data/subspaces/registry` | `main` | Working directory for the `registry-server` daemon. |
|
||||
@@ -87,6 +87,9 @@ On the first install, StartOS:
|
||||
The nacho ignore-names list lives in `/data/nacho/ignore_names.txt` (not
|
||||
in the store); the `nacho-setup` oneshot creates that file with the
|
||||
default (`fold,swifty`) on first daemon start if it doesn't exist.
|
||||
Registry API keys (`registryApiKey` / `subsdApiKey`) are **not** seeded at
|
||||
install — run **Create Registry API Keys** before (or when prompted after)
|
||||
enabling Subspaces; `registry-server` will not start without them.
|
||||
6. Launches `spaced` as a managed daemon (no `screen`, no shell auto-start)
|
||||
and the `gotty` web terminal once the bashrc oneshot completes.
|
||||
7. Runs `certrelay-setup` (creates `/data/certrelay/data`, copies `fabric` and
|
||||
@@ -110,7 +113,6 @@ mainnet-only.
|
||||
| Bitcoin RPC username / password (registered on bitcoind) | Wallet creation, bidding, and registration -- all driven via `space-cli` inside the terminal |
|
||||
| Spaced RPC username / password (`SPACED_RPC_USER`/`SPACED_RPC_PASSWORD`) | `space-cli` flags and subcommands |
|
||||
| Subspaces auth toggle + credentials (`SUBS_BASIC_AUTH_USER`/`SUBS_BASIC_AUTH_PASSWORD`, off by default) | |
|
||||
| `SUBS_PUBLISH_REQUIRE_FINALIZED` (off by default; via **Configure Subspaces**) | |
|
||||
| Subspaces Prover auth toggle + credentials (`SUBS_PROVER_BASIC_AUTH_USER`/`SUBS_PROVER_BASIC_AUTH_PASSWORD`, off by default) | |
|
||||
| Chain selection (locked to `mainnet`) | |
|
||||
| Spaced data directory and RPC bind | |
|
||||
@@ -145,7 +147,6 @@ mainnet-only.
|
||||
| `disable-subspaces` | Disable Subspaces | Enabled (hidden when already off) | Any | Sets `store.enableSubspaces = false` and triggers a service restart so the subs and subs-prover daemons stop. On-disk data at `/data/subspaces` is preserved. |
|
||||
| `reset-subspaces-state` | Reset Subspaces State | Enabled | Any | Deletes `/data/subspaces` (runtime data only — binaries ship in the image). Use to wipe local handles/proofs. The spaces wallet on spaced is preserved. Warning-gated. |
|
||||
| `set-subs-prover` | Enable / Disable Subspaces Prover | Enabled | Any | Toggle (`store.enableSubsProver`, default **off**) that starts/stops only the `subs-prover` daemon, independent of the overall Subspaces toggle. When off, the daemon doesn't start but its interface (8888) stays registered. Saving restarts the service. |
|
||||
| `configure-subspaces` | Configure Subspaces | Enabled | Any | Toggle `SUBS_PUBLISH_REQUIRE_FINALIZED` (default **off**). When on, subs requires finalized commitments before certificate publish. Stored in `store.subsPublishRequireFinalized`; injected into the `subs` daemon env. Saving restarts the service. |
|
||||
| `enable-subs-auth` | Enable Subspaces Auth | Enabled (hidden when already on) | Any | Sets `store.subsAuthEnabled = true`. If no credentials exist yet, generates `{ username: 'spaces', password: random32 }` and stores them in `store.subsAuth`. Restart re-launches `subs` with `SUBS_BASIC_AUTH_USER`/`SUBS_BASIC_AUTH_PASSWORD` env vars set. |
|
||||
| `disable-subs-auth` | Disable Subspaces Auth | Enabled (hidden when already off) | Any | Sets `store.subsAuthEnabled = false`. Stored credentials are preserved so a later re-enable does not regenerate them. Restart re-launches `subs` without the auth env vars. |
|
||||
| `show-subs-credentials` | Show Subspaces Auth Credentials | Enabled | Any | Surfaces the current `SUBS_BASIC_AUTH_USER`/`SUBS_BASIC_AUTH_PASSWORD` (from `store.subsAuth`) plus a loopback connection URL. Reports whether auth is currently enforced. |
|
||||
@@ -154,6 +155,8 @@ mainnet-only.
|
||||
| `disable-subs-prover-auth` | Disable Subspaces Prover Auth | Enabled (hidden when already off) | Any | Sets `store.subsProverAuthEnabled = false`. Stored credentials are preserved. Restart re-launches `subs-prover` without the auth env vars. |
|
||||
| `show-subs-prover-credentials` | Show Subspaces Prover Auth Credentials | Enabled | Any | Surfaces the current `SUBS_PROVER_BASIC_AUTH_USER`/`SUBS_PROVER_BASIC_AUTH_PASSWORD` (from `store.subsProverAuth`) plus a loopback connection URL. Reports whether auth is currently enforced. |
|
||||
| `set-subs-prover-credentials` | Set Subspaces Prover Auth Credentials | Enabled | Any | Set or rotate `store.subsProverAuth`. Same UX as `set-subs-credentials` (blank password → auto-generated). Restarts the service only if prover auth is currently enabled. |
|
||||
| `create-registry-api-keys` | Create Registry API Keys | Enabled | Any | Generates (or rotates) `store.registryApiKey` + `store.subsdApiKey` as 64-char hex (`openssl rand -hex 32`). Both are required and must differ. Injected as `REGISTRY_API_KEY` / `SUBSD_API_KEY` into `registry-server`. Put `SUBSD_API_KEY` in subs Settings → Registry Server → Auth Token. Restarts so the registry picks up the new keys. When Subspaces is enabled without valid keys, a critical task points here. |
|
||||
| `show-registry-api-keys` | Show Registry API Keys | Enabled | Any | Surfaces the stored `REGISTRY_API_KEY` and `SUBSD_API_KEY`. Returns blanks until Create Registry API Keys has been run. |
|
||||
| `configure-certrelay` | Configure Certrelay | Enabled | Any | Sets `CERTRELAY_SELF_URL` (text), `CERTRELAY_BOOTSTRAP` (toggle), and `CERTRELAY_HEALTHCHECK_HANDLE` (text) in `store.json`; prefilled with current values. Saving restarts the service so certrelay picks up the new config. |
|
||||
| `configure-nacho` | Configure Nacho | Enabled | Any | Writes the Ignore Names list to `/data/nacho/ignore_names.txt` (read at runtime by nacho — survives daemon restarts independent of the store) and sets `EXPO_PUBLIC_WORKSHOP_PDF_LINK_TEXT` in `store.json`. Prefill reads the file (with the package default as fallback) plus the current store value. Saving restarts the service. |
|
||||
| `upload-support-pdf` | Upload Support PDF | Enabled | Any | Required `.pdf` file upload that overwrites `/data/support.pdf` on the main volume (read with `fs/promises`, piped via stdin into a temp `spaces` subcontainer's `cat > /data/support.pdf`). Split out from Configure Nacho because StartOS's form serializes an unselected `Value.file` as `{}` rather than `null`, which `Value.file(..., required: false).nullable()` rejects; a `required: true` dedicated action avoids the empty-form path entirely. |
|
||||
@@ -198,18 +201,22 @@ the same idempotent init logic runs and reuses the existing credentials in
|
||||
6. **The web terminal is independent of spaced.** Gotty stays reachable even
|
||||
when `spaced` is crash-looping, so you can always shell in to diagnose.
|
||||
7. **Subspaces is opt-in.** Fresh installs do not run Subspaces. Run **Enable
|
||||
Subspaces** to start it. It ships as the prebuilt `horologger/subs:v0.1.2b`
|
||||
Subspaces** to start it. It ships as the prebuilt `horologger/subs:v0.1.2c`
|
||||
image (no compile step), so enabling is fast — the daemons start as soon
|
||||
as the image is on the box. Enabling runs three daemons, each with its own
|
||||
StartOS interface: **subs** (Web UI + Subs API, 7777), **registry-server**
|
||||
(8081), and — only if the separate **Enable / Disable Subspaces Prover**
|
||||
toggle is on (default **off**) — **subs-prover** (8888, no GPU). The
|
||||
prover's interface is always registered even when its daemon is off. subs
|
||||
loads the existing `default` spaces wallet at startup and does **not**
|
||||
create it — create it first from the Space-CLI Web UI with `spaces
|
||||
createwallet` if you haven't.
|
||||
prover's interface is always registered even when its daemon is off. Before
|
||||
(or when prompted after) enabling, run **Create Registry API Keys** —
|
||||
`registry-server` requires distinct `REGISTRY_API_KEY` and `SUBSD_API_KEY`
|
||||
env vars at boot. Paste `SUBSD_API_KEY` into subs Settings → Registry
|
||||
Server → Auth Token, then click Test. Use `REGISTRY_API_KEY` as the Bearer
|
||||
token for intake/`POST /register` clients. subs loads the existing
|
||||
`default` spaces wallet at startup and does **not** create it — create it
|
||||
first from the Space-CLI Web UI with `spaces createwallet` if you haven't.
|
||||
8. **Certrelay is always on.** It ships as the prebuilt
|
||||
`horologger/certrelay:v0.2.7b` image (static musl binaries) and runs on
|
||||
`horologger/certrelay:v0.2.8` image (static musl binaries) and runs on
|
||||
7778 from service start. It talks to the local spaced over loopback using
|
||||
the `store.spacedAuth` credentials. The `fabric` and `monitor` binaries are copied to
|
||||
`/data/bin/` for manual use from the Space-CLI Web UI; neither is auto-started
|
||||
@@ -250,10 +257,10 @@ spaces balance
|
||||
package_id: spaces
|
||||
upstream_version: subspacesplus
|
||||
images:
|
||||
spaces: docker.io/horologger/spaces:v0.2.1a
|
||||
subspaces: docker.io/horologger/subs:v0.1.2b
|
||||
certrelay: docker.io/horologger/certrelay:v0.2.7b
|
||||
nacho: docker.io/horologger/nacho:v1.0.0
|
||||
spaces: docker.io/horologger/spaces:v0.3.0
|
||||
subspaces: docker.io/horologger/subs:v0.1.2c
|
||||
certrelay: docker.io/horologger/certrelay:v0.2.8
|
||||
nacho: docker.io/horologger/nacho:v1.0.0b
|
||||
architectures: [x86_64, aarch64]
|
||||
volumes:
|
||||
main: /data
|
||||
@@ -286,18 +293,26 @@ spaced_env_vars:
|
||||
- APP_USER
|
||||
- APP_PASSWORD
|
||||
spaces:
|
||||
image: horologger/spaces:v0.2.1a # spaced, space-cli, gotty (terminal image)
|
||||
image: horologger/spaces:v0.3.0 # spaced, space-cli, gotty (terminal image)
|
||||
subspaces:
|
||||
default_enabled: false # opt-in via Enable Subspaces action
|
||||
store_field: enableSubspaces
|
||||
subs_prover_default_enabled: false # separate toggle: set-subs-prover (store.enableSubsProver)
|
||||
image: horologger/subs:v0.1.2b # prebuilt; no compile step
|
||||
image: horologger/subs:v0.1.2c # prebuilt; no compile step
|
||||
data_dir: /data/subspaces/data
|
||||
wallet: default # loaded by subs, NOT created (create via space-cli first)
|
||||
daemons: # three separate daemons, each its own interface
|
||||
subs: { bin: /usr/local/bin/subs, port: 7777 }
|
||||
subs-prover: { bin: /usr/local/bin/subs-prover, port: 8888, gpu: none }
|
||||
registry-server: { bin: /usr/local/bin/registry-server, port: 8081 } # remapped from upstream 8080
|
||||
registry_api_keys: # mandatory for registry-server boot; must differ
|
||||
store_fields: [registryApiKey, subsdApiKey]
|
||||
env_vars: [REGISTRY_API_KEY, SUBSD_API_KEY] # always injected into registry-server
|
||||
generate: openssl-rand-hex-32 # 64 lowercase hex via create-registry-api-keys
|
||||
subs_ui: Settings → Registry Server → Auth Token = SUBSD_API_KEY
|
||||
actions:
|
||||
- create-registry-api-keys
|
||||
- show-registry-api-keys
|
||||
auth: # optional HTTP basic auth in front of subs (Web UI + Subs API on 7777)
|
||||
default_enabled: false
|
||||
store_enabled_field: subsAuthEnabled
|
||||
@@ -306,11 +321,6 @@ subspaces:
|
||||
env_vars: # injected only when subsAuthEnabled=true AND subsAuth!=null
|
||||
- SUBS_BASIC_AUTH_USER
|
||||
- SUBS_BASIC_AUTH_PASSWORD
|
||||
publish_require_finalized:
|
||||
default: false
|
||||
store_field: subsPublishRequireFinalized
|
||||
env_var: SUBS_PUBLISH_REQUIRE_FINALIZED # always 'true' or 'false' on subs daemon
|
||||
action: configure-subspaces
|
||||
actions:
|
||||
- enable-subs-auth
|
||||
- disable-subs-auth
|
||||
@@ -331,7 +341,7 @@ subspaces:
|
||||
- set-subs-prover-credentials
|
||||
certrelay:
|
||||
always_on: true
|
||||
image: horologger/certrelay:v0.2.7b # prebuilt; static musl binaries
|
||||
image: horologger/certrelay:v0.2.8 # prebuilt; static musl binaries
|
||||
server_bin: /usr/local/bin/certrelay
|
||||
fabric_bin: /usr/local/bin/fabric # copied to /data/bin/fabric for the CLI
|
||||
monitor_bin: /usr/local/bin/monitor # copied to /data/bin/monitor (CLI only; not started)
|
||||
@@ -350,7 +360,7 @@ certrelay:
|
||||
CERTRELAY_HEALTHCHECK_HANDLE: account-digital-useful.genesis@key # via action
|
||||
nacho:
|
||||
always_on: true
|
||||
image: horologger/nacho:v1.0.0 # Expo dev server
|
||||
image: horologger/nacho:v1.0.0b # Expo dev server
|
||||
port: 8082
|
||||
data_dir: /data/nacho
|
||||
ignore_names_file: /data/nacho/ignore_names.txt # read at runtime; default 'fold,swifty' seeded by nacho-setup
|
||||
@@ -374,7 +384,6 @@ actions:
|
||||
- enable-subspaces
|
||||
- disable-subspaces
|
||||
- set-subs-prover
|
||||
- configure-subspaces
|
||||
- enable-subs-auth
|
||||
- disable-subs-auth
|
||||
- show-subs-credentials
|
||||
@@ -383,6 +392,8 @@ actions:
|
||||
- disable-subs-prover-auth
|
||||
- show-subs-prover-credentials
|
||||
- set-subs-prover-credentials
|
||||
- create-registry-api-keys
|
||||
- show-registry-api-keys
|
||||
- reset-subspaces-state
|
||||
- configure-certrelay
|
||||
- configure-nacho
|
||||
|
||||
Reference in New Issue
Block a user