1.0.4:0

startos/main.ts

@@ -55,7 +55,7 @@ export const main = sdk.setupMain(async ({ effects }) => {
       type: 'directory',
     })
 
-  const sub = await sdk.SubContainer.of(
+  const sub = sdk.SubContainer.of(
     effects,
     { imageId: 'spacesops' },
     mounts,
@@ -114,11 +114,11 @@ export const main = sdk.setupMain(async ({ effects }) => {
   env.PLATFORM_CALLBACK_HOST =
     store.platformCallbackHost ?? DEFAULT_PLATFORM_CALLBACK_HOST
 
-  // v1.0.3's entrypoint sources setup-spacesops-env.sh with set -u. That file
-  // exports NODE_EXTRA_CA_CERTS using ${_SCRIPT_DIR}, but _SCRIPT_DIR is set on
-  // a separate non-export line the entrypoint never evals — startup crashes
-  // unless NODE_EXTRA_CA_CERTS is already set. Fetch the StartOS root CA for
-  // outbound *.startos HTTPS (SUBS_URI host when configured, else Spaces).
+  // The image's setup-spacesops-env.sh defaults NODE_EXTRA_CA_CERTS to
+  // /app/certs/startos-local-root-ca.pem, a root CA baked in at build time from
+  // another box. Fetch this box's StartOS root CA and point the variable at it
+  // instead, so outbound HTTPS to *.startos succeeds (SUBS_URI host when
+  // configured, else Spaces).
   const caHostname =
     (store.subsUrl && startOsHostnameFromUrl(store.subsUrl)) ||
     `${SPACES_PACKAGE_ID}.startos`

startos/manifest/index.ts

@@ -9,26 +9,14 @@ export const manifest = setupManifest({
   upstreamRepo: 'https://git.spacesops.com/spacesops/spacesops',
   marketingUrl: 'https://spacesops.com',
   donationUrl: null,
-  docsUrls: [],
   description: { short, long },
   volumes: ['main'],
   images: {
     spacesops: {
-      source: { dockerTag: 'spacesops/spacesops:v1.0.3' },
+      source: { dockerTag: 'spacesops/spacesops:v1.0.4' },
       arch: ['x86_64', 'aarch64'],
     },
   },
-  alerts: {
-    install: {
-      en_US:
-        'SpacesOps REQUIRES the Spaces service. Install and sync Spaces first — SpacesOps auto-connects to it at spaces.startos:7225 by reading the Spaces RPC credentials, and will not start until they are available.\n\nWARNING: the admin area is protected by a FIXED, well-known credential baked into this image (username "admin", password "Whatever!") that cannot be changed without rebuilding the image. The admin area can run SQL and manage tenants. Keep this service private (Tor-only) and do NOT expose its admin routes to the public internet. See the "Show Admin Credentials" action.',
-    },
-    update: null,
-    uninstall: null,
-    restore: null,
-    start: null,
-    stop: null,
-  },
   dependencies: {
     spaces: {
       description: depSpacesDescription,

startos/utils.ts

@@ -20,16 +20,17 @@ export const SPACES_PACKAGE_ID = 'spaces'
 export const SPACED_RPC_URL = 'http://spaces.startos:7225'
 export const SPACED_WALLETLOAD_NAME = 'default'
 
-// Admin Basic Auth is baked into the v1.0.3 image with NO env override. It
-// cannot be changed without rebuilding the image. Surfaced (with a warning)
-// via the "Show Admin Credentials" action.
+// The app's admin Basic Auth defaults, which it uses when
+// PLATFORM_ADMIN_USERNAME / PLATFORM_ADMIN_PASSWORD are unset. This package
+// does not currently set either, so these well-known values are live —
+// surfaced (with a warning) via the "Show Admin Credentials" action.
 export const ADMIN_USER = 'admin'
 export const ADMIN_PASSWORD = 'Whatever!'
 
-// Where StartOS writes the StartOS root CA for outbound *.startos HTTPS (see
-// main.ts). Always injected as NODE_EXTRA_CA_CERTS — required on v1.0.3+ where
-// the image entrypoint's setup-spacesops-env.sh references _SCRIPT_DIR without
-// defining it under set -u.
+// Where StartOS writes this box's StartOS root CA for outbound *.startos HTTPS
+// (see main.ts). Always injected as NODE_EXTRA_CA_CERTS, which overrides the
+// image's own default of /app/certs/startos-local-root-ca.pem — a CA baked in
+// at build time that does not match this box.
 export const nodeExtraCaCertVolumeSubpath = '.startos/startos-root-ca.crt'
 export const nodeExtraCaCertContainerPath = `${dataDir}/.startos/startos-root-ca.crt`
 

startos/versions/current.ts

@@ -0,0 +1,18 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+export const current = VersionInfo.of({
+  version: '1.0.4:0',
+  releaseNotes: {
+    en_US: `Updates SpacesOps to v1.0.4 and rebuilds the package on the current StartOS packaging SDK.
+
+- Upstream image is spacesops/spacesops:v1.0.4 on x86_64 and aarch64. The application itself is updated; the container entrypoint and Node runtime are unchanged from v1.0.3.
+- Rebuilt against start-sdk 2.x, so this release requires StartOS 0.4.0-beta.10 or later.
+- The install-time warning about the fixed admin credentials now lives in the service instructions, since StartOS no longer shows install alerts.
+
+Your operator keypair, session secret, and Configure Platform settings are preserved.`,
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: IMPOSSIBLE,
+  },
+})

startos/versions/index.ts

@@ -1,11 +1,7 @@
 import { VersionGraph } from '@start9labs/start-sdk'
-import { v_1_0_1_0 } from './v1.0.1.0'
-import { v_1_0_1_1 } from './v1.0.1.1'
-import { v_1_0_2_0 } from './v1.0.2.0'
-import { v_1_0_2_1 } from './v1.0.2.1'
-import { v_1_0_3_0 } from './v1.0.3.0'
+import { current } from './current'
 
 export const versionGraph = VersionGraph.of({
-  current: v_1_0_3_0,
-  other: [v_1_0_2_1, v_1_0_2_0, v_1_0_1_1, v_1_0_1_0],
+  current,
+  other: [],
 })

startos/versions/v1.0.1.0.ts

@@ -1,14 +0,0 @@
-import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
-
-export const v_1_0_1_0 = VersionInfo.of({
-  version: '1.0.1:0',
-  releaseNotes: {
-    en_US: `Upstream upgrade to SpacesOps v1.0.1.
-- Bumps the image to spacesops/spacesops:v1.0.1 on x86_64 and aarch64.
-- No StartOS-side configuration, action, or migration changes; existing operator keypair, session secret, and Configure-Platform settings are preserved.`,
-  },
-  migrations: {
-    up: async ({ effects }) => {},
-    down: IMPOSSIBLE,
-  },
-})

startos/versions/v1.0.1.1.ts

@@ -1,13 +0,0 @@
-import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
-
-export const v_1_0_1_1 = VersionInfo.of({
-  version: '1.0.1:1',
-  releaseNotes: {
-    en_US: `- Always sets NODE_EXTRA_CA_CERTS before the v1.0.1 image entrypoint runs, fetching the StartOS root CA via sdk.getSslCertificate (SUBS *.startos hostname when configured, otherwise spaces.startos). Fixes startup crash where setup-spacesops-env.sh references unset _SCRIPT_DIR under set -u.
-- Enables outbound HTTPS to same-host StartOS services from SpacesOps.`,
-  },
-  migrations: {
-    up: async ({ effects }) => {},
-    down: IMPOSSIBLE,
-  },
-})

startos/versions/v1.0.2.0.ts

@@ -1,14 +0,0 @@
-import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
-
-export const v_1_0_2_0 = VersionInfo.of({
-  version: '1.0.2:0',
-  releaseNotes: {
-    en_US: `Upstream upgrade to SpacesOps v1.0.2.
-- Bumps the image to spacesops/spacesops:v1.0.2 on x86_64 and aarch64.
-- No StartOS-side configuration, action, or migration changes; existing operator keypair, session secret, and Configure-Platform settings are preserved.`,
-  },
-  migrations: {
-    up: async ({ effects }) => {},
-    down: IMPOSSIBLE,
-  },
-})

startos/versions/v1.0.2.1.ts

@@ -1,13 +0,0 @@
-import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
-
-export const v_1_0_2_1 = VersionInfo.of({
-  version: '1.0.2:1',
-  releaseNotes: {
-    en_US: `- Adds PLATFORM_CALLBACK_HOST to Configure Platform (defaults to spacesops.startos) for cert-callback and payment callback URLs.
-- Sets SPACED_WALLETLOAD_NAME to default (was main).`,
-  },
-  migrations: {
-    up: async ({ effects }) => {},
-    down: IMPOSSIBLE,
-  },
-})

startos/versions/v1.0.3.0.ts

@@ -1,14 +0,0 @@
-import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
-
-export const v_1_0_3_0 = VersionInfo.of({
-  version: '1.0.3:0',
-  releaseNotes: {
-    en_US: `Upstream upgrade to SpacesOps v1.0.3.
-- Bumps the image to spacesops/spacesops:v1.0.3 on x86_64 and aarch64.
-- No StartOS-side configuration, action, or migration changes; existing operator keypair, session secret, and Configure-Platform settings are preserved.`,
-  },
-  migrations: {
-    up: async ({ effects }) => {},
-    down: IMPOSSIBLE,
-  },
-})