v0.0.9:2

README.md

@@ -39,8 +39,10 @@ through a browser-based terminal.
 | --- | --- |
 | Spaces image | `docker.io/horologger/spaces` |
 | PostgreSQL image | `docker.io/postgres:16.3` |
-| Indexer-Go image | `docker.io/golang:1.23-alpine` |
-| Explorer-UI image | `docker.io/node:20-alpine` |
+| Subspaces image | `docker.io/horologger/subs:v0.1.0` |
+| Certrelay image | `docker.io/horologger/certrelay:v0.2.3` |
+| Indexer image | _**TODO** — prebuilt explorer-indexer image, not yet produced_ |
+| Explorer image | _**TODO** — prebuilt explorer (SvelteKit) image_ |
 | Architectures | `linux/amd64`, `linux/arm64` |
 | Entrypoint | StartOS-managed (image entrypoints are **not** used directly) |
 
@@ -48,10 +50,15 @@ The Spaces image bundles `spaced`, `space-cli`, `bitcoin-cli`, `gotty`, `node`,
 `npm`, `screen`, and a small shell environment. StartOS ignores the Spaces
 image's `docker_entrypoint.sh`; daemons are defined in `startos/main.ts`. The
 PostgreSQL image is the upstream `postgres:16.3`, launched via its official
-`docker-entrypoint.sh`. The Indexer-Go image is the upstream
-`golang:1.23-alpine`, used both to compile the indexer's `sync` binary +
-`goose` migrator (one-time, at install) and to run the compiled binaries on
-each start.
+`docker-entrypoint.sh`.
+
+> **Note (build-from-source removed):** earlier builds compiled the Go indexer
+> and the SvelteKit explorer from source inside `golang:1.23-alpine` and
+> `node:20-alpine` builder images. Those images and their build chains were
+> removed to shrink the `.s9pk` and eliminate the multi-minute first-enable
+> compile. They will be replaced with prebuilt images (see the **TODO** rows
+> above). Until then, enabling the embedded explorer starts **PostgreSQL only**
+> — the indexer and explorer-UI daemons are stubbed out in `startos/main.ts`.
 
 ## Volume and Data Layout
 
@@ -61,14 +68,13 @@ each start.
 | `/data/mainnet/.cookie` | `main` | Spaced RPC cookie (auto-generated by `spaced` at startup) |
 | `/data/store.json` | `main` | StartOS-managed credentials (web-UI password, bitcoind RPC user/password, PostgreSQL user/password/database) |
 | `/data/postgres` | `main` | PostgreSQL data directory (`PGDATA`). Owned by uid 999 (`postgres`). The whole `main` volume is backed up, so the database is included. |
-| `/data/explorer-indexer` | `main` | Spaces-protocol explorer-indexer source (`spacesprotocol/explorer-indexer`), fetched from GitHub on first start. Contains `cmd/sync/`, `pkg/`, `sql/schema/`, `go.mod`, etc. |
-| `/data/explorer-indexer/bin/sync` | `main` | Compiled indexer sync binary (`go build ./cmd/sync`). |
-| `/data/explorer-indexer/bin/goose` | `main` | Compiled goose migrator (`go install github.com/pressly/goose/v3/cmd/goose`). Used by `indexer-migrate` to apply `sql/schema/*.sql`. |
-| `/data/explorer-indexer/.installed-sha` | `main` | Marker file recording the pinned commit + build-ID currently extracted. If the build-ID in the package code differs from the marker, the next start wipes and re-fetches. |
-| `/data/explorer-ui` | `main` | SvelteKit explorer source (`randomlogin/explorer`), fetched on first explorer-enable. Contains `src/`, `static/`, `server.js`, `package.json`, etc. |
-| `/data/explorer-ui/build` | `main` | SvelteKit node-adapter build output. `node build` (i.e. `node /data/explorer-ui/build`) runs the production server. |
-| `/data/explorer-ui/node_modules` | `main` | npm dependencies (~300-500 MB). Re-fetched on `Reset Explorer UI State`. |
-| `/data/explorer-ui/.installed-sha` | `main` | Marker file for the pinned explorer commit + build-ID. |
+| `/data/explorer-indexer` | `main` | **TODO** — reserved for the prebuilt indexer's runtime data. The build-from-source layout (source, `bin/sync`, `bin/goose`, marker) is gone; `reset-indexer-state` still wipes this path. |
+| `/data/explorer-ui` | `main` | **TODO** — reserved for the prebuilt explorer's runtime data. The build-from-source layout (source, `build/`, `node_modules`, marker) is gone; `reset-explorer-state` still wipes this path. |
+| `/data/subspaces/data` | `main` | `subs` runtime data (`SUBS_DATA_DIR`) — handles, proofs, config.db. Persists across restarts and enable/disable toggles. |
+| `/data/subspaces/prover` | `main` | Working directory for the `subs-prover` daemon. |
+| `/data/subspaces/registry` | `main` | Working directory for the `registry-server` daemon. |
+| `/data/certrelay/data` | `main` | Certrelay data directory (`CERTRELAY_DATA_DIR`) — anchors, peer state, sqlite. |
+| `/data/bin/fabric` | `main` | The `fabric` CLI, copied from the certrelay image on each start so the gotty terminal (which has `/data/bin` on PATH) can resolve handles. |
 
 ## Installation and First-Run Flow
 
@@ -92,8 +98,16 @@ On the first install, StartOS:
    gotty terminal's `spaces` alias and the indexer share a single auth path.
 6. Seeds `store.json.enableExplorer = false`. The embedded explorer
    (PostgreSQL + Go indexer) is **opt-in**.
-7. Launches `spaced` as a managed daemon (no `screen`, no shell auto-start)
+7. Seeds `store.json` certrelay defaults: `certrelaySelfUrl =
+   https://certrelay.spacesops.com`, `certrelayBootstrap = false`,
+   `certrelayHealthcheckHandle = account-digital-useful.genesis@key`.
+8. Launches `spaced` as a managed daemon (no `screen`, no shell auto-start)
    and the `gotty` web terminal once the bashrc oneshot completes.
+9. Runs `certrelay-setup` (creates `/data/certrelay/data`, copies the `fabric`
+   CLI to `/data/bin/fabric`) and launches the **certrelay** daemon on 7778.
+   Certrelay is **always on**; its `CERTRELAY_SPACED_RPC_URL` uses the local
+   spaced credentials from `store.spacedAuth`. Configure its self URL etc. via
+   the **Configure Certrelay** action.
 
 The user is **not** prompted to choose a chain or RPC mode — this package is
 mainnet-only.
@@ -101,31 +115,20 @@ mainnet-only.
 ### Enabling the embedded explorer
 
 Run the **Enable Embedded Explorer** action. That flips
-`store.json.enableExplorer = true` and the service auto-restarts with the full
-daemon graph:
+`store.json.enableExplorer = true` and the service auto-restarts:
 
 8. Postgres-chown oneshot creates `/data/postgres` with correct ownership.
 9. PostgreSQL daemon starts on loopback `127.0.0.1:5432`.
-10. `indexer-fetch` downloads the pinned `spacesprotocol/explorer-indexer`
-    tarball into `/data/explorer-indexer` and applies two compatibility
-    patches for our older spaced binary (see Limitations).
-11. `indexer-build` runs `CGO_ENABLED=0 go build -o /data/explorer-indexer/bin/sync ./cmd/sync`
-    and `GOBIN=/data/explorer-indexer/bin go install github.com/pressly/goose/v3/cmd/goose@v3.24.3`.
-12. `indexer-cleanup-legacy` checks for and removes leftover TS-indexer schema
-    if present (from earlier package versions).
-13. `indexer-migrate` runs `goose ... up` to apply `sql/schema/*.sql`.
-14. `indexer` daemon (`/data/explorer-indexer/bin/sync`) starts polling
-    bitcoind + spaced and writes blocks, transactions, spaces, rollouts, etc.
-    to PostgreSQL.
-15. `explorer-fetch` downloads the pinned `randomlogin/explorer` tarball into
-    `/data/explorer-ui` (skipped if marker already matches).
-16. `explorer-install` runs `npm install` + `PUBLIC_BTC_NETWORK=mainnet npm run build`
-    to produce `/data/explorer-ui/build/`. Skipped if `build/index.js` already
-    exists. First-time install can take 1-3 minutes for the npm download.
-17. `explorer-ui` daemon (`node /data/explorer-ui/build`) starts on port 3000.
-    The SvelteKit app reads exclusively from PostgreSQL — it does not talk to
-    spaced or bitcoind directly. The UI link will appear in the StartOS
-    dashboard alongside the gotty terminal.
+
+> **TODO (prebuilt images pending):** the indexer and explorer-UI daemons are
+> currently **stubbed out** in `startos/main.ts`. The build-from-source chain
+> (`indexer-fetch` → `indexer-build` → `indexer-migrate` → `indexer`, and
+> `explorer-fetch` → `explorer-install` → `explorer-ui`) was removed to shrink
+> the `.s9pk` and cut startup time. Until prebuilt images are wired in,
+> enabling the explorer starts **PostgreSQL only**; nothing populates the DB
+> and the Explorer Web UI (port 3000) will not resolve. The `show-db-credentials`,
+> `reset-db-state`, `reset-indexer-state`, and `reset-explorer-state` actions
+> remain available.
 
 Run **Disable Embedded Explorer** to turn it back off; on-disk data at
 `/data/postgres`, `/data/explorer-indexer`, and `/data/explorer-ui` is
@@ -146,7 +149,11 @@ preserved.
 | Interface | Port | Protocol | Exposure | Notes |
 | --- | --- | --- | --- | --- |
 | Space-CLI Web UI (gotty terminal) | 8080 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | Basic auth: `admin:<store.password>` |
-| Explorer Web UI | 3000 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | SvelteKit explorer. No built-in auth — relies on StartOS interface exposure controls. Only useful while the embedded explorer is enabled (otherwise nothing is listening). |
+| Explorer Web UI | 3000 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | SvelteKit explorer. **TODO** — daemon stubbed pending the prebuilt explorer image; the interface is still registered but nothing listens yet. |
+| Subspaces Web UI | 7777 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | `subs` UI. No built-in auth. Only useful while Subspaces is enabled. |
+| Subspaces Prover | 8888 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | `subs-prover` RISC Zero prover server (no GPU). Its own StartOS interface. Only useful while Subspaces is enabled. |
+| Subspaces Registry | 8081 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | `registry-server` for publishing/resolving handles (remapped from its upstream default 8080 to avoid colliding with the gotty terminal on 8080). Its own StartOS interface. Only useful while Subspaces is enabled. |
+| Certrelay | 7778 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | `certrelay` server (always on). Serves cryptographic proofs binding handles to owner keys. **Setup:** run **Configure Certrelay** and set `CERTRELAY_SELF_URL` to the publicly visible URL StartOS exposes for this interface. |
 | Spaced RPC | 7225 | HTTP JSON-RPC | **Loopback only** | Internal use, static-cred-authenticated via `SPACED_RPC_USER` / `SPACED_RPC_PASSWORD` from `store.json.spacedAuth` |
 | PostgreSQL | 5432 | Postgres wire protocol | **Loopback only** (`listen_addresses=127.0.0.1`) | Username/password from `store.json.dbAuth`; full `DB_URL` exported into the web terminal |
 
@@ -168,6 +175,10 @@ preserved.
 | `reset-db-state` | Reset Database State | Enabled | Any | Deletes `/data/postgres` so the next start re-initializes an empty database. Warning-gated. `store.json` is preserved. |
 | `reset-indexer-state` | Reset Indexer State | Enabled | Any | Deletes `/data/explorer-indexer` so the next start re-fetches the indexer source and rebuilds the sync + goose binaries. Useful when bumping the pinned commit. PostgreSQL data is preserved. Warning-gated. |
 | `reset-explorer-state` | Reset Explorer UI State | Enabled | Any | Deletes `/data/explorer-ui` so the next start re-fetches the SvelteKit source and rebuilds the bundle. PostgreSQL data is preserved. Warning-gated. |
+| `enable-subspaces` | Enable Subspaces | Enabled (hidden when already on) | Any | Sets `store.enableSubspaces = true` and triggers a service restart so the Subspaces chain (build → wallet → subs-prover → subs) takes effect. |
+| `disable-subspaces` | Disable Subspaces | Enabled (hidden when already off) | Any | Sets `store.enableSubspaces = false` and triggers a service restart so the subs and subs-prover daemons stop. On-disk data at `/data/subspaces` is preserved. |
+| `reset-subspaces-state` | Reset Subspaces State | Enabled | Any | Deletes `/data/subspaces` (runtime data only — binaries ship in the image). Use to wipe local handles/proofs. The spaces wallet on spaced is preserved. Warning-gated. |
+| `configure-certrelay` | Configure Certrelay | Enabled | Any | Sets `CERTRELAY_SELF_URL` (text), `CERTRELAY_BOOTSTRAP` (toggle), and `CERTRELAY_HEALTHCHECK_HANDLE` (text) in `store.json`; prefilled with current values. Saving restarts the service so certrelay picks up the new config. |
 
 ## Backups and Restore
 
@@ -182,11 +193,13 @@ the same idempotent init logic runs and reuses the existing credentials in
 | --- | --- | --- | --- |
 | `postgres` (daemon `ready`) | Database | 60 s | TCP listen on `127.0.0.1:5432` |
 | `spaced` (daemon `ready`) | Spaced RPC | 120 s | TCP listen on `127.0.0.1:7225` |
-| `indexer` (daemon `ready`) | Indexer Process | 60 s | Daemon liveness only — health is reported by `indexer-sync` below |
-| `explorer-ui` (daemon `ready`) | Explorer Web UI | 60 s | TCP listen on `0.0.0.0:3000`. Only present when embedded explorer is enabled. |
+| `subs-prover` (daemon `ready`) | Subspaces Prover | 60 s | TCP listen on `0.0.0.0:8888`. Only present when Subspaces is enabled. |
+| `subs-registry` (daemon `ready`) | Subspaces Registry | 60 s | TCP listen on `0.0.0.0:8081`. Only present when Subspaces is enabled. |
+| `subs` (daemon `ready`) | Subspaces Web UI | 60 s | TCP listen on `0.0.0.0:7777`. Only present when Subspaces is enabled. |
+| `certrelay` (daemon `ready`) | Certrelay | 120 s | TCP listen on `0.0.0.0:7778`. Always on. Polled every 30 s. |
 | `web-terminal` (daemon `ready`) | Web Interface | default | TCP listen on `0.0.0.0:8080` |
 | `sync` (standalone) | Spaced Sync | 30 s | Exec `space-cli --output-format json getserverinfo`; reports `success` when `ready=true && progress=100%`, otherwise `loading` with progress percentage |
-| `indexer-sync` (standalone) | Indexer Sync | 60 s | `psql` the `blocks` table for `MAX(height) WHERE orphan = FALSE AND height >= 0`; cross-check against spaced's current tip via `space-cli getserverinfo`. `success` when within 5 blocks of the tip; otherwise `loading` with explicit lag. |
+| `indexer` / `explorer-ui` / `indexer-sync` | — | — | **TODO** — removed with the build-from-source chain. Will return when the prebuilt indexer + explorer images are wired in. |
 
 ## Limitations and Differences
 
@@ -195,44 +208,52 @@ the same idempotent init logic runs and reuses the existing credentials in
    `spaced` inside `screen` would conflict with the StartOS-managed daemon.
 3. **Space-CLI Web UI is a terminal, not a graphical app.** All Spaces operations happen
    via `space-cli` (aliased as `spaces` inside the shell).
-4. **Only port 8080 (gotty) is exposed externally.** Spaced RPC (7225) and
-   PostgreSQL (5432) are loopback-only, and any other ports present in the
-   image (e.g. 22253, 3000, 5173, 8081) are not bound.
+4. **Externally exposed ports** (each a StartOS interface): 8080 (gotty
+   Space-CLI Web UI, always on), 7778 (Certrelay, always on), and — only while
+   their feature is enabled — 3000 (Explorer Web UI, currently stubbed), 7777
+   (Subspaces Web UI), 8888 (Subspaces Prover), 8081 (Subspaces Registry).
+   **Loopback-only:** spaced RPC (7225) and PostgreSQL (5432). The Subspaces
+   registry is remapped from its upstream default 8080 to 8081 to avoid
+   colliding with the gotty terminal.
 5. **Bitcoin Core 31.x is the only supported dependency.** Earlier majors are
    not allowed by the manifest version range.
 6. **The web terminal is independent of spaced.** Gotty stays reachable even
    when `spaced` is crash-looping, so you can always shell in to diagnose.
-7. **The embedded explorer is opt-in.** Fresh installs run in spaces-only
-   mode (spaced + gotty). Run **Enable Embedded Explorer** to start
-   PostgreSQL + the Go indexer; **Disable Embedded Explorer** stops them. The
-   `postgres` and `indexer-go` images are bundled in the .s9pk regardless so
-   toggling is instant, no re-download. Indexed data is preserved across
-   toggles.
+7. **The embedded explorer is opt-in — and currently PostgreSQL-only.** Fresh
+   installs run in spaces-only mode (spaced + gotty). Run **Enable Embedded
+   Explorer** to start PostgreSQL; **Disable Embedded Explorer** stops it. The
+   indexer and explorer-UI daemons are **stubbed out** pending prebuilt images
+   (the build-from-source chain was removed to shrink the `.s9pk` and cut
+   startup time). So enabling the explorer today brings up an empty database
+   and nothing else. PostgreSQL data is preserved across toggles.
 8. **PostgreSQL is embedded, not a separate service.** There is no
    cross-service dependency on a postgres .s9pk; the database is local to this
-   package, lives at `/data/postgres`, and is intended for the embedded
-   indexer (and any future explorer UI). Connect to it from inside the gotty
-   terminal with `psql $DB_URL` (only meaningful while the explorer is
-   enabled).
-9. **Enabling the explorer requires internet on its first start.** The pinned
-   commit of `spacesprotocol/explorer-indexer` is downloaded from GitHub into
-   `/data/explorer-indexer`, and `go build` + `go install github.com/pressly/goose/v3/cmd/goose`
-   fetch Go modules. After that the indexer runs offline; the only network it
-   needs is bitcoind (already a StartOS dependency) and the local spaced RPC.
-10. **Explorer first-enable latency is ~2-5 minutes.** The Go indexer needs to
-    download modules and compile from scratch the first time you turn it on.
-    Subsequent restarts (and toggle off→on) skip `indexer-fetch` +
-    `indexer-build` because the binaries already exist on the volume. Use the
-    **Reset Indexer State** action to force a rebuild.
-11. **Subspaces pointers data is not indexed.** Our spaced binary predates the
-    pointers feature. The indexer source is patched during `indexer-fetch` to
-    treat `ptrs_root` as optional and to skip the `getptrblockmeta` RPC call.
-    All other spaces protocol data — blocks, transactions, spaces, rollouts,
-    root anchors with empty pointers root — indexes normally. A future
-    rebuild of `horologger/spaces` with a newer spaced will let us drop these
-    patches.
-
-## What Is Unchanged from Upstream
+   package, lives at `/data/postgres`, and is intended for the (pending)
+   prebuilt indexer + explorer UI. Connect to it from inside the gotty
+   terminal with `psql $DB_URL`.
+9. **Subspaces pointers data note.** When the prebuilt indexer is wired back
+   in, be aware our spaced binary predates the spaces pointers feature; the
+   prior build-from-source indexer was patched to treat `ptrs_root` as optional
+   and to skip the `getptrblockmeta` RPC. A future rebuild of
+   `horologger/spaces` with a newer spaced will let us drop those patches.
+10. **Subspaces is opt-in.** Fresh installs do not run Subspaces. Run **Enable
+    Subspaces** to start it. It ships as the prebuilt `horologger/subs:v0.1.0`
+    image (no compile step), so enabling is fast — the three daemons start as
+    soon as the image is on the box. Enabling runs three daemons, each with its
+    own StartOS interface: **subs** (Web UI, 7777), **subs-prover** (8888, no
+    GPU), **registry-server** (8081). subs loads the existing `default` spaces
+    wallet at startup and does **not** create it — create it first from the
+    Space-CLI Web UI with `spaces createwallet` if you haven't. Subspaces is
+    independent of the Embedded Explorer toggle — you can run any combination
+    of {explorer, subspaces}.
+11. **Certrelay is always on.** It ships as the prebuilt
+    `horologger/certrelay:v0.2.3` image (static musl binaries) and runs on
+    7778 from service start. It talks to the local spaced over loopback using
+    the `store.spacedAuth` credentials. The bundled `fabric` CLI is copied to
+    `/data/bin/fabric` so it's runnable from the Space-CLI Web UI. **You must
+    set `CERTRELAY_SELF_URL`** (via **Configure Certrelay**) to the publicly
+    visible URL StartOS exposes for the Certrelay interface, or peers/clients
+    won't be able to reach this relay at the advertised address.
 
 - `space-cli` subcommands and flags work exactly as documented upstream.
 - `spaced` honours all `SPACED_*` environment variables not otherwise set by
@@ -256,8 +277,8 @@ Examples:
 
 ```bash
 spaces getserverinfo
-spaces walletcreate default
-spaces walletbalance default
+spaces createwallet           # creates the `default` wallet (--wallet defaults to "default")
+spaces balance
 ```
 
 ## Quick Reference for AI Consumers
@@ -268,14 +289,20 @@ upstream_version: subspacesplus
 images:
   spaces: docker.io/horologger/spaces:v0.0.9s
   postgres: docker.io/postgres:16.3
-  indexer-go: docker.io/golang:1.23-alpine
-  explorer-ui: docker.io/node:20-alpine
+  subspaces: docker.io/horologger/subs:v0.1.0
+  certrelay: docker.io/horologger/certrelay:v0.2.3
+  # TODO: prebuilt indexer image (was golang:1.23-alpine builder, removed)
+  # TODO: prebuilt explorer image (was node:20-alpine builder, removed)
 architectures: [x86_64, aarch64]
 volumes:
   main: /data
 ports:
   ui: 8080
-  explorer_ui: 3000     # external, only useful while explorer enabled
+  explorer_ui: 3000     # interface registered; daemon stubbed (TODO prebuilt image)
+  subspaces_ui: 7777    # external, only useful while subspaces enabled
+  subspaces_prover: 8888  # external (its own interface), subspaces only
+  subspaces_registry: 8081  # external (its own interface), subspaces only; remapped from upstream 8080
+  certrelay: 7778       # external (its own interface), always on
   spaced_rpc: 7225      # loopback only
   postgres: 5432        # loopback only
 dependencies:
@@ -307,27 +334,45 @@ postgres_env_vars:
 explorer:
   default_enabled: false   # opt-in via Enable Embedded Explorer action
   store_field: enableExplorer
-  bundled_when_disabled: true   # images stay in .s9pk; data on /data preserved
+  status: postgres_only     # indexer + explorer-ui daemons stubbed; see TODOs
+  reset_actions: [reset-db-state, reset-indexer-state, reset-explorer-state]
 indexer:
-  source_repo: spacesprotocol/explorer-indexer
-  pinned_commit: 00ae1e548734d93f1a8bb9f48d2290f459e12b35
-  install_dir: /data/explorer-indexer
-  bin_dir: /data/explorer-indexer/bin
-  schema_dir: /data/explorer-indexer/sql/schema
-  language: Go
-  build_image: golang:1.23-alpine
-  migrations_tool: goose
-  goose_version: v3.24.3
+  status: TODO              # build-from-source (Go) removed; prebuilt image pending
+  prior_source_repo: spacesprotocol/explorer-indexer
+  data_dir: /data/explorer-indexer   # reset-indexer-state still wipes this
 explorer_ui:
-  source_repo: randomlogin/explorer
-  pinned_commit: c827da1754c3cba5c5507d2c29f21b8fa231344d
-  install_dir: /data/explorer-ui
-  build_dir: /data/explorer-ui/build
-  language: TypeScript (SvelteKit)
-  build_image: node:20-alpine
-  build_command: PUBLIC_BTC_NETWORK=mainnet npm run build
-  daemon_command: node /data/explorer-ui/build
-  port: 3000
+  status: TODO              # build-from-source (SvelteKit) removed; prebuilt image pending
+  prior_source_repo: randomlogin/explorer
+  data_dir: /data/explorer-ui        # reset-explorer-state still wipes this
+  port: 3000                # interface registered; daemon stubbed
+subspaces:
+  default_enabled: false   # opt-in via Enable Subspaces action
+  store_field: enableSubspaces
+  image: horologger/subs:v0.1.0   # prebuilt; no compile step
+  data_dir: /data/subspaces/data
+  wallet: default          # loaded by subs, NOT created (create via space-cli first)
+  daemons:                 # three separate daemons, each its own interface
+    subs: { bin: /usr/local/bin/subs, port: 7777 }
+    subs-prover: { bin: /usr/local/bin/subs-prover, port: 8888, gpu: none }
+    registry-server: { bin: /usr/local/bin/registry-server, port: 8081 }  # remapped from upstream 8080
+certrelay:
+  always_on: true
+  image: horologger/certrelay:v0.2.3   # prebuilt; static musl binaries
+  server_bin: /usr/local/bin/certrelay
+  fabric_bin: /usr/local/bin/fabric    # copied to /data/bin/fabric for the CLI
+  data_dir: /data/certrelay/data
+  port: 7778
+  spaced_rpc_creds: from store.spacedAuth (local spaced)
+  configurable_via_action: configure-certrelay
+  env:
+    CERTRELAY_CHAIN: mainnet
+    CERTRELAY_BIND: 0.0.0.0
+    CERTRELAY_PORT: '7778'
+    CERTRELAY_REMOTE_IP_HEADER: x-forwarded-for
+    CERTRELAY_ANCHOR_REFRESH: '300'
+    CERTRELAY_SELF_URL: https://certrelay.spacesops.com   # default; set to your public URL
+    CERTRELAY_BOOTSTRAP: 'false'                          # toggle via action
+    CERTRELAY_HEALTHCHECK_HANDLE: account-digital-useful.genesis@key  # via action
   managed_env_vars:
     - POSTGRES_URI
     - BITCOIN_NODE_URI
@@ -360,4 +405,8 @@ actions:
   - reset-db-state
   - reset-indexer-state
   - reset-explorer-state
+  - enable-subspaces
+  - disable-subspaces
+  - reset-subspaces-state
+  - configure-certrelay
 ```