packaging: pin the Umbrel and StartOS packages to satd 0.6.0

contrib/packaging/startos/README.md

@@ -165,9 +165,10 @@ action wrote the store without restarting the node; and the manifest pinned
 an image tag that predates `satd-init`, so the package as first written could
 not have started at all.
 
-`bridgeSubnet` is now checked rather than assumed — the `rpcallowip` range it
-feeds is what admits the OS proxy on the real bridge, and the RPC interface
-answers.
+The package used to pass the bridge's subnet (`10.0.3.0/24`) to satd-init
+as `rpcallowip`, which is what admitted the OS proxy on the real bridge. From
+0.6.0 satd-init writes `rpcallowip=0.0.0.0/0` and reads no subnet, so the
+package passes none.
 
 Also checked, now on every PR that touches this directory: the package
 typechecks against `@start9labs/start-sdk` 2.0.9, `test/networks.test.ts`

contrib/packaging/startos/startos/main.ts

@@ -3,7 +3,6 @@ import { storeJson } from './fileModels/store.json'
 import { i18n } from './i18n'
 import { sdk } from './sdk'
 import {
-  bridgeSubnet,
   GetBlockchainInfo,
   p2pPorts,
   rootDir,
@@ -98,10 +97,9 @@ export const main = sdk.setupMain(async ({ effects }) => {
      * points `rpc-cookie` at the network's cookie. A package that
      * re-implemented any of that would drift from the stack within a release.
      *
-     * SATD_STACK_SUBNET becomes satd's `rpcallowip`. On StartOS every service
-     * shares one bridge with the OS at 10.0.3.1, so this range is what admits
-     * the OS reverse proxy and other packages; narrower and the RPC interface
-     * answers nothing.
+     * No SATD_STACK_SUBNET: since 0.6.0 satd-init writes
+     * `rpcallowip=0.0.0.0/0` and reads no subnet, so the OS reverse proxy and
+     * other packages on the bridge are admitted without one.
      */
     .addOneshot('satd-init', {
       subcontainer: satdSub,
@@ -111,7 +109,6 @@ export const main = sdk.setupMain(async ({ effects }) => {
         env: {
           NETWORK: network,
           SATD_MCP: '1',
-          SATD_STACK_SUBNET: bridgeSubnet,
           // The name clients reach this server by. StartOS terminates TLS
           // itself, so this only labels satd's own certificate — the one used
           // on the bridge and for MCP.

contrib/packaging/startos/startos/manifest/index.ts

@@ -19,20 +19,20 @@ export const manifest = setupManifest({
         // the reference stack and the appliance perform and cannot drift from
         // them.
         //
-        // Between releases this pins a master commit's `sha-` image, which
-        // docker.yml publishes unsigned for this purpose: the status page the
-        // UI opens onto, and the `upgradechainstate` switch satd-init writes,
-        // first ship in 0.6.0. sync-store.sh refuses a `sha-` pin, so it
-        // cannot be published. The digest pins the OCI index, which
-        // resolves per architecture, so one pin covers amd64 and arm64.
+        // This pins the 0.6.0 release, the image release.yml built and
+        // cosign-signed for the v0.6.0 tag. Between releases it may pin a
+        // master commit's `sha-` image instead, which docker.yml publishes
+        // unsigned for that purpose; sync-store.sh refuses a `sha-` pin, so
+        // such a pin cannot be published. The digest pins the OCI index,
+        // which resolves per architecture, so one pin covers amd64 and arm64.
         //
         // The `.s9pk` that was installed on a StartOS server was packed from
         // this digest — `pack` resolves the tag and embeds the layers, so the
         // server itself never contacts a registry.
         //
-        // Pinning the 0.6.0 release, with versions/current.ts, is a step in the
-        // release checklist.
-        dockerTag: 'ghcr.io/epochbtc/satd:sha-5e73b1d@sha256:f1d65419241d2ee7efc56b46f6651a27a9657bd35059619c71dcaf809dc64b36',
+        // Moving the pin to the next release, with versions/current.ts, is a
+        // step in the release checklist.
+        dockerTag: 'ghcr.io/epochbtc/satd:0.6.0@sha256:4d963e3cdfd094be26f306d85c6da68f193864ca1f91f0dd31e2df1825bed3d2',
       },
       // The image publishes linux/amd64 and linux/arm64 and nothing else, so
       // there is no riscv64 here and nothing to emulate it from.

contrib/packaging/startos/startos/utils.ts

@@ -44,14 +44,6 @@ export const mcpInterfaceId = 'mcp'
 export const peerInterfaceId = 'peer'
 export const statusInterfaceId = 'status'
 
-/**
- * StartOS puts every service container on one bridge, `lxcbr0`, with the OS
- * itself at a fixed 10.0.3.1. satd's `rpcallowip` has to admit that range or
- * the OS reverse proxy — and every other package on the box — is refused at
- * the RPC surface.
- */
-export const bridgeSubnet = '10.0.3.0/24'
-
 export const satdMounts = sdk.Mounts.of().mountVolume({
   volumeId: 'main',
   mountpoint: rootDir,

contrib/packaging/startos/startos/versions/current.ts

@@ -1,12 +1,12 @@
 import { VersionInfo } from '@start9labs/start-sdk'
 
 export const current = VersionInfo.of({
-  // Tagged `v0.5.2_0` in the package repository: Start9's convention swaps
+  // Tagged `v0.6.0_0` in the package repository: Start9's convention swaps
   // the `:` for `_` and adds no package prefix.
-  version: '0.5.2:0',
+  version: '0.6.0:0',
   releaseNotes: {
     en_US:
-      'First StartOS release of satd, packaging satd 0.5.2. Backups leave out the chain and chainstate, including the AssumeUTXO background chainstate, which the node downloads again on its own.',
+      'Updates satd to 0.6.0. The first start after the update rebuilds the chainstate once from the block files already on disk: nothing is downloaded again, but on mainnet it takes about as long as a fresh sync, and the Blockchain Sync check shows its progress. There is no going back to 0.5.2 afterwards without another rebuild. The service UI now opens onto satd\'s status page. Full notes: https://github.com/epochbtc/satd/blob/v0.6.0/docs/release-notes/0.6.0.md',
   },
   migrations: {},
 })

contrib/packaging/umbrel/epochbtc-satd/docker-compose.yml

@@ -18,13 +18,13 @@ version: "3.7"
 #
 # The tag is bare. The registry has never published a `v`-prefixed tag.
 #
-# Between releases this pins a master commit's `sha-` image, which docker.yml
-# publishes unsigned for exactly this: the status page this package opens
-# onto, and the `upgradechainstate` switch its satd-init writes, first ship
-# in 0.6.0. `contrib/packaging/sync-store.sh` refuses a
-# `sha-` pin, so it cannot reach the store; when 0.6.0 is released, pin that
-# tag and bump `version` with it (a step in the release checklist).
-x-satd-image: &satd-image ghcr.io/epochbtc/satd:sha-5e73b1d@sha256:f1d65419241d2ee7efc56b46f6651a27a9657bd35059619c71dcaf809dc64b36
+# This pins the 0.6.0 release, the image release.yml built and cosign-signed
+# for the v0.6.0 tag. Between releases it may pin a master commit's `sha-`
+# image instead, which docker.yml publishes unsigned for that purpose;
+# `contrib/packaging/sync-store.sh` refuses a `sha-` pin, so such a pin cannot
+# reach the store. Moving the pin to the next release, with `version`, is a
+# step in the release checklist.
+x-satd-image: &satd-image ghcr.io/epochbtc/satd:0.6.0@sha256:4d963e3cdfd094be26f306d85c6da68f193864ca1f91f0dd31e2df1825bed3d2
 
 services:
   app_proxy:
@@ -72,7 +72,6 @@ services:
     environment:
       NETWORK: ${APP_SATD_NETWORK:-mainnet}
       SATD_MCP: "1"
-      SATD_STACK_SUBNET: "10.21.0.0/16"
       # The name clients reach this node by. Umbrel publishes <hostname>.local
       # over mDNS, and the certificate has to carry that name or every LAN
       # client sees a mismatch.

contrib/packaging/umbrel/epochbtc-satd/umbrel-app.yml

@@ -2,7 +2,7 @@ manifestVersion: 1.1
 id: epochbtc-satd
 category: bitcoin
 name: satd
-version: "0.5.2"
+version: "0.6.0"
 tagline: A Bitcoin full node in Rust, with Electrum and Esplora built in
 description: >-
   satd is a Bitcoin Core-compatible full node written in Rust. It speaks
@@ -58,20 +58,22 @@ path: "/status"
 # A community store may host its own icon; the official store hosts its own
 # and wants this unset. Pinned to the release tag so a later change on master
 # cannot alter an already-published listing.
-icon: https://raw.githubusercontent.com/epochbtc/satd/v0.5.2/contrib/packaging/startos/icon.png
+icon: https://raw.githubusercontent.com/epochbtc/satd/v0.6.0/contrib/packaging/startos/icon.png
 releaseNotes: >-
-  Moves this app off the host ports other Bitcoin apps use, so it installs
-  alongside Bitcoin Node, Fulcrum and Ride The Lightning. P2P is now 8433,
-  Electrum TLS 50012, JSON-RPC TLS 8436 and MCP 8439; reconfigure any client
-  that used the old ports.
+  Updates satd to 0.6.0. The app now opens onto satd's status page, which
+  shows sync progress and the connection strings for Electrum, Esplora and
+  JSON-RPC.
 
 
-  Backups leave out the chain and chainstate, which the node downloads again
-  on its own.
+  The first start after the update rebuilds the chainstate once, from the
+  block files already on disk. Nothing is downloaded again, but on mainnet
+  it takes about as long as a fresh sync, and the status page shows its
+  progress. There is no going back to 0.5.2 afterwards without another
+  rebuild.
 
 
-  Updates satd to 0.5.2. See
-  https://github.com/epochbtc/satd/blob/v0.5.2/docs/release-notes/0.5.2.md
+  Full notes:
+  https://github.com/epochbtc/satd/blob/v0.6.0/docs/release-notes/0.6.0.md
 # Regenerable, and hundreds of gigabytes. What stays in the backup is what
 # cannot be re-derived: tls/ (the CA clients have imported), secrets/ (the MCP
 # token), authfile.toml and bitcoin.conf. `data/` is the directory mounted at