spacesops/spacesops-startos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1.0.4:0

Browse Source
This commit is contained in:
spacesops
2026-08-25 16:54:57 -04:00
parent d026857b99
commit d054ba22c9
18 changed files with 1434 additions and 301 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+32 -17
View File
@@ -39,7 +39,9 @@ auto-connects to it — see [Installation and First-Run Flow](#installation-and-
| Field | Value |
| --- | --- |
| Image | `docker.io/spacesops/spacesops:v1.0.3` |
| Package version | `1.0.4:0` |
| Requires | StartOS `0.4.0-beta.10` or later (built with `@start9labs/start-sdk` 2.x) |
| Image | `docker.io/spacesops/spacesops:v1.0.4` |
| Base | `node:20-alpine` |
| Architectures | `x86_64` (linux/amd64), `aarch64` (linux/arm64) |
| Entrypoint | The image's `/app/docker-entrypoint.sh` is **kept**. StartOS runs `/app/docker-entrypoint.sh node server.js` as the daemon. |
@@ -106,9 +108,13 @@ declarations do not gate startup; SpacesOps handles readiness itself.)
## Network Access and Interfaces
| Interface | Port | Protocol | Exposure | Notes |
| Interface | Port | Protocol | Type | Notes |
| --- | --- | --- | --- | --- |
| Web UI | 7264 | HTTP | LAN / `.local` / Tor / clearnet (via StartOS) | The SpacesOps web platform + admin area. The app provides its own auth; the admin area uses a **fixed built-in credential** (see warning below). |
| Web UI | 7264 | HTTP | `ui` | The SpacesOps web platform + admin area. The app provides its own auth; the admin area uses a **fixed built-in credential** (see warning below). |
The package binds port 7264 and exports a single `ui` interface. **Where that
interface is reachable is the user's choice**, made in StartOS — the package
neither provisions nor implies any particular address.
## Actions
@@ -139,11 +145,15 @@ volume is **not** part of this package's backup.
by reading the Spaces RPC credentials from the mounted Spaces volume. Install
and sync Spaces before (or alongside) SpacesOps; the service restarts until
those credentials are available.
2. **The admin password is fixed and well-known.** Admin Basic Auth is hardcoded
in the v1.0.3 image as `admin` / `Whatever!` with **no environment override**.
It cannot be changed without rebuilding the image. **Keep this service private
(Tor-only) and never expose its admin routes to the public internet** — the
admin area can run SQL and manage tenants. See **Show Admin Credentials**.
2. **The admin password is well-known.** The app resolves admin Basic Auth as
`process.env.PLATFORM_ADMIN_USERNAME || 'admin'` and
`process.env.PLATFORM_ADMIN_PASSWORD || 'Whatever!'`. This package does not
currently set either variable, so the well-known defaults are live. **Keep
this service private and do not make its admin routes broadly reachable** —
the admin area can run SQL and manage tenants. See **Show Admin
Credentials**. Setting `PLATFORM_ADMIN_PASSWORD` to a generated secret (as
this package already does for `PLATFORM_SESSION_SECRET`) would close this
gap; see `TODO.md`.
3. **`PLATFORM_HOST` is forced to `0.0.0.0` and `PLATFORM_PORT` to `7264`** so the
StartOS reverse proxy can reach the app (it otherwise binds `127.0.0.1:3000`).
4. **Subname-purchase and pricing are off by default.** They activate only when
@@ -154,11 +164,12 @@ volume is **not** part of this package's backup.
5. **The SUBS backend is not auto-wired to the Spaces subs daemon in v1.** The
Spaces service's subs daemon listens on 7777 with a different API/auth than
the SUBS endpoint (port 7244) SpacesOps expects, so SUBS must be configured
manually if used. StartOS always sets `NODE_EXTRA_CA_CERTS` to the StartOS
root CA (fetched via `sdk.getSslCertificate` for the SUBS `*.startos`
hostname when configured, otherwise `spaces.startos`) so outbound HTTPS to
same-host StartOS services succeeds and the v1.0.3 image entrypoint does not
crash on its broken `_SCRIPT_DIR` default.
manually if used. StartOS always sets `NODE_EXTRA_CA_CERTS` to this box's
StartOS root CA (fetched via `sdk.getSslCertificate` for the SUBS `*.startos`
hostname when configured, otherwise `spaces.startos`). This overrides the
image's own default of `/app/certs/startos-local-root-ca.pem`, a root CA
baked in at build time from a different machine, so outbound HTTPS to
same-host StartOS services succeeds.
## What Is Unchanged from Upstream
@@ -173,8 +184,11 @@ volume is **not** part of this package's backup.
```yaml
package_id: spacesops
upstream_version: 1.0.3
image: docker.io/spacesops/spacesops:v1.0.3
package_version: 1.0.4:0
upstream_version: 1.0.4
image: docker.io/spacesops/spacesops:v1.0.4
min_startos_version: 0.4.0-beta.10
start_sdk_version: 2.0.9
architectures: [x86_64, aarch64]
volumes:
main: /data
@@ -206,8 +220,9 @@ optional_env_vars: # only set when configured via configure-platform
- SUBS_RPC_PASSWORD
- NODE_EXTRA_CA_CERTS # /data/.startos/startos-root-ca.crt (always set)
admin_credentials:
username: admin
password: Whatever! # FIXED, baked into image, cannot be changed
username: admin # app default; override via PLATFORM_ADMIN_USERNAME
password: Whatever! # app default; override via PLATFORM_ADMIN_PASSWORD
overridden_by_package: false # package does not set either var today
note: keep service private; admin area can run SQL and manage tenants
actions:
- show-operator-credentials