Build SpacesOps StartOS package (v1.0.0:0)

Initial .s9pk for SpacesOps, targeting StartOS 0.4.0.x with SDK 1.5.1. - Single managed daemon from spacesops/spacesops:v1.0.0 (x86_64 + aarch64), keeping the image entrypoint (/app/docker-entrypoint.sh node server.js). Forces PLATFORM_HOST=0.0.0.0 / PLATFORM_PORT=7264 so the StartOS proxy can reach the app. Single `ui` interface on 7264. - Depends on the Spaces service (>=0.0.9:3) and auto-wires the spaced RPC creds: main.ts mounts the Spaces `main` volume read-only at /spaces-data, execs a read of its store.json inside the subcontainer, and injects SPACED_RPC_USER/ PASSWORD + SPACED_RPC_URL=http://spaces.startos:7225. Throws to retry until Spaces is installed and seeded. - Generates a Nostr operator keypair (nostr-tools, bundled by ncc) and a strong session secret in idempotent init tasks (.once() reads, allowWriteAfterConst merges). Actions: show-operator-credentials, import-operator-key, show-admin-credentials (surfaces the fixed admin/Whatever! login with a warning), configure-platform (optional relay/mode/CoinGecko/SUBSD). - Install alert warns to install Spaces first and about the fixed admin credential. Backs up the `main` volume. - Icon: icon.svg (source spacesops.svg). The `spaces` dependency uses assets/spaces-icon.png for its Marketplace metadata. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-26 10:28:18 -04:00
parent 1e33944be4
commit 35c1013520
38 changed files with 2071 additions and 0 deletions
@@ -0,0 +1,163 @@
+import { storeJson } from '../fileModels/storeJson'
+import { i18n } from '../i18n'
+import { sdk } from '../sdk'
+import {
+  DEFAULT_COINGECKO_TOKEN_COINS,
+  DEFAULT_OPERATOR_RELAY,
+  DEFAULT_PLATFORM_MODE,
+} from '../utils'
+
+const { InputSpec, Value } = sdk
+
+const inputSpec = InputSpec.of({
+  operatorRelay: Value.text({
+    name: i18n('Operator Nostr Relay'),
+    description: i18n(
+      'The Nostr relay SpacesOps publishes operator events to (OPERATOR_RELAY).',
+    ),
+    warning: null,
+    footnote: null,
+    default: DEFAULT_OPERATOR_RELAY,
+    required: true,
+    masked: false,
+    placeholder: 'wss://relay.example.com',
+    minLength: 1,
+    maxLength: null,
+  }),
+  platformMode: Value.select({
+    name: i18n('Platform Mode'),
+    description: i18n(
+      'Sets PLATFORM_MODE. Only changes the UI theme color; "test" does not change behavior.',
+    ),
+    warning: null,
+    footnote: null,
+    default: DEFAULT_PLATFORM_MODE,
+    values: {
+      prod: 'Production',
+      test: 'Test',
+    },
+  }),
+  coingeckoApiKey: Value.text({
+    name: i18n('CoinGecko API Key'),
+    description: i18n(
+      'Optional CoinGecko API key (COINGECKO_API_KEY) used for pricing features. Leave blank to disable pricing.',
+    ),
+    warning: null,
+    footnote: null,
+    default: null,
+    required: false,
+    masked: true,
+    placeholder: null,
+    minLength: null,
+    maxLength: null,
+  }),
+  coingeckoTokenCoins: Value.text({
+    name: i18n('CoinGecko Token Coins'),
+    description: i18n(
+      'The CoinGecko coin id(s) to price against (COINGECKO_TOKEN_COINS).',
+    ),
+    warning: null,
+    footnote: null,
+    default: DEFAULT_COINGECKO_TOKEN_COINS,
+    required: false,
+    masked: false,
+    placeholder: 'bitcoin',
+    minLength: null,
+    maxLength: null,
+  }),
+  subsdUrl: Value.text({
+    name: i18n('SUBSD URL'),
+    description: i18n(
+      'Optional SUBSD service URL (SUBSD_URI_VALUE) for the subname-purchase flow. Leave blank to disable.',
+    ),
+    warning: null,
+    footnote: null,
+    default: null,
+    required: false,
+    masked: false,
+    placeholder: 'http://host:7244',
+    minLength: null,
+    maxLength: null,
+  }),
+  subsdUser: Value.text({
+    name: i18n('SUBSD RPC User'),
+    description: i18n('Optional SUBSD RPC username (SUBSD_RPC_USER).'),
+    warning: null,
+    footnote: null,
+    default: null,
+    required: false,
+    masked: false,
+    placeholder: null,
+    minLength: null,
+    maxLength: null,
+  }),
+  subsdPassword: Value.text({
+    name: i18n('SUBSD RPC Password'),
+    description: i18n('Optional SUBSD RPC password (SUBSD_RPC_PASSWORD).'),
+    warning: null,
+    footnote: null,
+    default: null,
+    required: false,
+    masked: true,
+    placeholder: null,
+    minLength: null,
+    maxLength: null,
+  }),
+})
+
+export const configurePlatform = sdk.Action.withInput(
+  // id
+  'configure-platform',
+
+  // metadata
+  async ({ effects }) => ({
+    name: i18n('Configure Platform'),
+    description: i18n(
+      'Set optional SpacesOps settings: Nostr relay, theme mode, CoinGecko pricing, and SUBSD backend. Saving restarts the service so the new settings take effect.',
+    ),
+    warning: null,
+    allowedStatuses: 'any',
+    group: null,
+    visibility: 'enabled',
+  }),
+
+  // input
+  inputSpec,
+
+  // prefill — load current values from store
+  async ({ effects }) => {
+    const store = await storeJson.read().once()
+    return {
+      operatorRelay: store?.operatorRelay ?? DEFAULT_OPERATOR_RELAY,
+      platformMode: store?.platformMode ?? DEFAULT_PLATFORM_MODE,
+      coingeckoApiKey: store?.coingeckoApiKey ?? null,
+      coingeckoTokenCoins:
+        store?.coingeckoTokenCoins ?? DEFAULT_COINGECKO_TOKEN_COINS,
+      subsdUrl: store?.subsdUrl ?? null,
+      subsdUser: store?.subsdUser ?? null,
+      subsdPassword: store?.subsdPassword ?? null,
+    }
+  },
+
+  // run
+  async ({ effects, input }) => {
+    await storeJson.merge(effects, {
+      operatorRelay: input.operatorRelay,
+      platformMode: input.platformMode,
+      coingeckoApiKey: input.coingeckoApiKey || null,
+      coingeckoTokenCoins: input.coingeckoTokenCoins || null,
+      subsdUrl: input.subsdUrl || null,
+      subsdUser: input.subsdUser || null,
+      subsdPassword: input.subsdPassword || null,
+    })
+
+    return {
+      version: '1',
+      title: i18n('Success'),
+      message: i18n(
+        'Platform configuration saved. The service is restarting to apply the new settings.',
+      ),
+      result: null,
+    }
+  },
+)
@@ -0,0 +1,101 @@
+import { storeJson } from '../fileModels/storeJson'
+import { i18n } from '../i18n'
+import { isValidSecretHex, secretHexToPublicHex } from '../nostr'
+import { sdk } from '../sdk'
+
+const { InputSpec, Value } = sdk
+
+const inputSpec = InputSpec.of({
+  secretHex: Value.text({
+    name: i18n('Operator Secret Key (hex)'),
+    description: i18n(
+      'A 64-character hex-encoded secp256k1 / Nostr secret key. The public key is derived automatically.',
+    ),
+    warning: null,
+    footnote: null,
+    default: null,
+    required: true,
+    masked: true,
+    placeholder: '64 hexadecimal characters',
+    minLength: 64,
+    maxLength: 64,
+    patterns: [
+      {
+        regex: '^[0-9a-fA-F]{64}$',
+        description: i18n('Must be exactly 64 hexadecimal characters.'),
+      },
+    ],
+  }),
+})
+
+export const importOperatorKey = sdk.Action.withInput(
+  // id
+  'import-operator-key',
+
+  // metadata
+  async ({ effects }) => ({
+    name: i18n('Import Operator Key'),
+    description: i18n(
+      'Replace the operator keypair with one you provide (hex secret key).',
+    ),
+    warning: i18n(
+      'This changes the operator identity SpacesOps signs events with. Events already published under the old key stay under it. The service restarts to apply the new key.',
+    ),
+    allowedStatuses: 'any',
+    group: null,
+    visibility: 'enabled',
+  }),
+
+  // input
+  inputSpec,
+
+  // prefill — never pre-populate a secret
+  async ({ effects }) => {},
+
+  // run
+  async ({ effects, input }) => {
+    const secretHex = input.secretHex.trim().toLowerCase()
+
+    if (!isValidSecretHex(secretHex)) {
+      return {
+        version: '1',
+        title: i18n('Failure'),
+        message: i18n(
+          'The secret key must be exactly 64 hexadecimal characters.',
+        ),
+        result: null,
+      }
+    }
+
+    let operatorPublicHex: string
+    try {
+      operatorPublicHex = secretHexToPublicHex(secretHex)
+    } catch (e) {
+      return {
+        version: '1',
+        title: i18n('Failure'),
+        message: i18n(
+          'Could not derive a public key from that secret: ${error}',
+          {
+            error: (e as Error).message,
+          },
+        ),
+        result: null,
+      }
+    }
+
+    await storeJson.merge(effects, {
+      operatorSecretHex: secretHex,
+      operatorPublicHex,
+    })
+
+    return {
+      version: '1',
+      title: i18n('Success'),
+      message: i18n(
+        'Operator key imported. The service is restarting to apply the new identity.',
+      ),
+      result: null,
+    }
+  },
+)
@@ -0,0 +1,11 @@
+import { sdk } from '../sdk'
+import { configurePlatform } from './configurePlatform'
+import { importOperatorKey } from './importOperatorKey'
+import { showAdminCredentials } from './showAdminCredentials'
+import { showOperatorCredentials } from './showOperatorCredentials'
+
+export const actions = sdk.Actions.of()
+  .addAction(showOperatorCredentials)
+  .addAction(importOperatorKey)
+  .addAction(showAdminCredentials)
+  .addAction(configurePlatform)
@@ -0,0 +1,52 @@
+import { i18n } from '../i18n'
+import { sdk } from '../sdk'
+import { ADMIN_PASSWORD, ADMIN_USER } from '../utils'
+
+export const showAdminCredentials = sdk.Action.withoutInput(
+  // id
+  'show-admin-credentials',
+
+  // metadata
+  async ({ effects }) => ({
+    name: i18n('Show Admin Credentials'),
+    description: i18n(
+      'Display the built-in admin username and password for the SpacesOps admin area.',
+    ),
+    warning: null,
+    allowedStatuses: 'any',
+    group: null,
+    visibility: 'enabled',
+  }),
+
+  // run
+  async ({ effects }) => ({
+    version: '1',
+    title: i18n('Admin Credentials'),
+    message: i18n(
+      'WARNING: these are FIXED, well-known credentials baked into the image and cannot be changed without rebuilding it. The admin area can run SQL and manage tenants. Keep this service private (Tor-only) and never expose the admin routes to the public internet.',
+    ),
+    result: {
+      type: 'group',
+      value: [
+        {
+          type: 'single',
+          name: i18n('Username'),
+          description: null,
+          value: ADMIN_USER,
+          masked: false,
+          copyable: true,
+          qr: false,
+        },
+        {
+          type: 'single',
+          name: i18n('Password'),
+          description: null,
+          value: ADMIN_PASSWORD,
+          masked: true,
+          copyable: true,
+          qr: false,
+        },
+      ],
+    },
+  }),
+)
@@ -0,0 +1,88 @@
+import { storeJson } from '../fileModels/storeJson'
+import { i18n } from '../i18n'
+import { encodeNpub, encodeNsec } from '../nostr'
+import { sdk } from '../sdk'
+
+export const showOperatorCredentials = sdk.Action.withoutInput(
+  // id
+  'show-operator-credentials',
+
+  // metadata
+  async ({ effects }) => ({
+    name: i18n('Show Operator Credentials'),
+    description: i18n(
+      'Display the Nostr operator keypair SpacesOps signs events with (npub, nsec, and hex public key).',
+    ),
+    warning: null,
+    allowedStatuses: 'any',
+    group: null,
+    visibility: 'enabled',
+  }),
+
+  // run
+  async ({ effects }) => {
+    const store = await storeJson.read().once()
+    const secretHex = store?.operatorSecretHex ?? null
+    const publicHex = store?.operatorPublicHex ?? null
+
+    if (!secretHex || !publicHex) {
+      return {
+        version: '1',
+        title: i18n('Operator Credentials'),
+        message: i18n(
+          'The operator keypair has not been generated yet. Start the service once to generate it.',
+        ),
+        result: null,
+      }
+    }
+
+    return {
+      version: '1',
+      title: i18n('Operator Credentials'),
+      message: i18n(
+        'SpacesOps signs operator events on Nostr with this keypair. Keep the secret (nsec / hex) private.',
+      ),
+      result: {
+        type: 'group',
+        value: [
+          {
+            type: 'single',
+            name: i18n('Public Key (npub)'),
+            description: null,
+            value: encodeNpub(publicHex),
+            masked: false,
+            copyable: true,
+            qr: true,
+          },
+          {
+            type: 'single',
+            name: i18n('Public Key (hex)'),
+            description: null,
+            value: publicHex,
+            masked: false,
+            copyable: true,
+            qr: false,
+          },
+          {
+            type: 'single',
+            name: i18n('Secret Key (nsec)'),
+            description: null,
+            value: encodeNsec(secretHex),
+            masked: true,
+            copyable: true,
+            qr: false,
+          },
+          {
+            type: 'single',
+            name: i18n('Secret Key (hex)'),
+            description: null,
+            value: secretHex,
+            masked: true,
+            copyable: true,
+            qr: false,
+          },
+        ],
+      },
+    }
+  },
+)