spacesops/spacesops-startos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pre

Browse Source
This commit is contained in:
spacesops
2026-08-25 16:20:05 -04:00
parent feb32a1456
commit d026857b99
13 changed files with 93 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13 -9
View File
@@ -39,7 +39,7 @@ auto-connects to it — see [Installation and First-Run Flow](#installation-and-
| Field | Value |
| --- | --- |
| Image | `docker.io/spacesops/spacesops:v1.0.1` |
| Image | `docker.io/spacesops/spacesops:v1.0.3` |
| Base | `node:20-alpine` |
| Architectures | `x86_64` (linux/amd64), `aarch64` (linux/arm64) |
| Entrypoint | The image's `/app/docker-entrypoint.sh` is **kept**. StartOS runs `/app/docker-entrypoint.sh node server.js` as the daemon. |
@@ -86,7 +86,7 @@ credentials. Instead, at startup it:
2. Reads `spacedAuth.{username,password}` from the Spaces `store.json`.
3. Connects to spaced at `http://spaces.startos:7225` with those credentials,
exporting `SPACED_RPC_URL`, `SPACED_RPC_USER`, `SPACED_RPC_PASSWORD`, and
`SPACED_WALLETLOAD_NAME=main`.
`SPACED_WALLETLOAD_NAME=default`.
If Spaces is not installed yet, or its credentials have not been seeded, the
service **restarts until they appear** — this is expected. (Dependency
@@ -101,6 +101,7 @@ declarations do not gate startup; SpacesOps handles readiness itself.)
| `OPERATOR_SECRET_HEX` / `OPERATOR_PUBLIC_HEX` (generated or imported) | |
| `PLATFORM_SESSION_SECRET` (generated) | |
| `SPACED_RPC_*` (auto-wired from Spaces) | |
| `PLATFORM_CALLBACK_HOST` (defaults to `spacesops.startos`; override via **Configure Platform**) | |
| Optional: `OPERATOR_RELAY`, `PLATFORM_MODE`, `COINGECKO_*`, `SUBS_*` (via **Configure Platform**) | |
## Network Access and Interfaces
@@ -116,7 +117,7 @@ declarations do not gate startup; SpacesOps handles readiness itself.)
| `show-operator-credentials` | Show Operator Credentials | Enabled | Any | — | Displays the Nostr operator keypair: npub (QR), hex public key, and the masked nsec / hex secret. |
| `import-operator-key` | Import Operator Key | Enabled | Any | 64-char hex secret key | Replaces the operator keypair. Derives the public key automatically. **Warns** that it changes the operator identity; the service restarts to apply it. |
| `show-admin-credentials` | Show Admin Credentials | Enabled | Any | — | Displays the **fixed** built-in admin login (`admin` / `Whatever!`) with a security warning. |
| `configure-platform` | Configure Platform | Enabled | Any | relay, mode, CoinGecko, SUBS (all optional) | Sets the Nostr relay, theme mode, pricing, and SUBS backend. Saving restarts the service. |
| `configure-platform` | Configure Platform | Enabled | Any | relay, mode, CoinGecko, SUBS, callback host | Sets the Nostr relay, theme mode, pricing, SUBS backend, and `PLATFORM_CALLBACK_HOST`. Saving restarts the service. |
## Backups and Restore
@@ -139,7 +140,7 @@ volume is **not** part of this package's backup.
and sync Spaces before (or alongside) SpacesOps; the service restarts until
those credentials are available.
2. **The admin password is fixed and well-known.** Admin Basic Auth is hardcoded
in the v1.0.1 image as `admin` / `Whatever!` with **no environment override**.
in the v1.0.3 image as `admin` / `Whatever!` with **no environment override**.
It cannot be changed without rebuilding the image. **Keep this service private
(Tor-only) and never expose its admin routes to the public internet** — the
admin area can run SQL and manage tenants. See **Show Admin Credentials**.
@@ -147,14 +148,16 @@ volume is **not** part of this package's backup.
StartOS reverse proxy can reach the app (it otherwise binds `127.0.0.1:3000`).
4. **Subname-purchase and pricing are off by default.** They activate only when
you fill in the relevant fields in **Configure Platform** (`COINGECKO_*` for
pricing, `SUBS_*` for subname purchase + cert-callback flows).
pricing, `SUBS_*` for subname purchase + cert-callback flows). Payment
callback URLs use `PLATFORM_CALLBACK_HOST`, which defaults to `spacesops.startos`
and can be overridden in **Configure Platform**.
5. **The SUBS backend is not auto-wired to the Spaces subs daemon in v1.** The
Spaces service's subs daemon listens on 7777 with a different API/auth than
the SUBS endpoint (port 7244) SpacesOps expects, so SUBS must be configured
manually if used. StartOS always sets `NODE_EXTRA_CA_CERTS` to the StartOS
root CA (fetched via `sdk.getSslCertificate` for the SUBS `*.startos`
hostname when configured, otherwise `spaces.startos`) so outbound HTTPS to
same-host StartOS services succeeds and the v1.0.1 image entrypoint does not
same-host StartOS services succeeds and the v1.0.3 image entrypoint does not
crash on its broken `_SCRIPT_DIR` default.
## What Is Unchanged from Upstream
@@ -170,8 +173,8 @@ volume is **not** part of this package's backup.
```yaml
package_id: spacesops
upstream_version: 1.0.1
image: docker.io/spacesops/spacesops:v1.0.1
upstream_version: 1.0.3
image: docker.io/spacesops/spacesops:v1.0.3
architectures: [x86_64, aarch64]
volumes:
main: /data
@@ -193,7 +196,8 @@ startos_managed_env_vars:
- SPACED_RPC_URL # http://spaces.startos:7225
- SPACED_RPC_USER # from Spaces store.json
- SPACED_RPC_PASSWORD # from Spaces store.json
- SPACED_WALLETLOAD_NAME # main
- SPACED_WALLETLOAD_NAME # default
- PLATFORM_CALLBACK_HOST # store.platformCallbackHost ?? spacesops.startos
optional_env_vars: # only set when configured via configure-platform
- COINGECKO_API_KEY
- COINGECKO_TOKEN_COINS