Release v0.1.1:2 with certrelay, nacho, and prebuilt subspaces.

Remove the embedded explorer/indexer stack, switch subspaces to prebuilt images, add certrelay and nacho as always-on services, expose Spaces and Subs APIs, and wire optional HTTP basic auth for subs and subs-prover with the correct SUBS_BASIC_AUTH_PASSWORD env var.

Co-authored-by: Cursor <cursoragent@cursor.com>

startos/actions/enableSubsAuth.ts

@@ -0,0 +1,53 @@
+import { storeJson } from '../fileModels/storeJson'
+import { i18n } from '../i18n'
+import { sdk } from '../sdk'
+import { randomPassword } from '../utils'
+
+const DEFAULT_USERNAME = 'spaces'
+
+export const enableSubsAuth = sdk.Action.withoutInput(
+  // id
+  'enable-subs-auth',
+
+  // metadata
+  async ({ effects }) => {
+    const enabled = await storeJson.read((s) => s.subsAuthEnabled).once()
+    return {
+      name: i18n('Enable Subspaces Auth'),
+      description: i18n(
+        'Turn on HTTP basic auth in front of the Subspaces Web UI and the Subs API (both on port 7777). If no credentials have been set yet, a random password is generated (username defaults to "spaces"). Use "Show Subspaces Auth Credentials" afterwards to retrieve them. Service restarts so subs picks up the auth env vars.',
+      ),
+      warning: null,
+      allowedStatuses: 'any',
+      group: null,
+      visibility: enabled === true ? 'hidden' : 'enabled',
+    }
+  },
+
+  // run
+  async ({ effects }) => {
+    const existing = await storeJson.read((s) => s.subsAuth).once()
+    const subsAuth = existing ?? {
+      username: DEFAULT_USERNAME,
+      password: randomPassword(),
+    }
+
+    await storeJson.merge(effects, {
+      subsAuth,
+      subsAuthEnabled: true,
+    })
+
+    return {
+      version: '1',
+      title: i18n('Success'),
+      message: existing
+        ? i18n(
+            'Subspaces Auth enabled with the existing stored credentials. The service is restarting; use "Show Subspaces Auth Credentials" to view them.',
+          )
+        : i18n(
+            'Subspaces Auth enabled and a fresh credential pair was generated. The service is restarting; use "Show Subspaces Auth Credentials" to view them.',
+          ),
+      result: null,
+    }
+  },
+)