fix: beautiful media lightbox, filebrowser noauth, deploy script

MediaLightbox: full glassmorphic redesign with dark backdrop, smooth
transitions, proper video/audio/image support. FileBrowser: noauth
config on persistent volume. Deploy script: fixed sed quoting.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/first-boot-containers.sh

@@ -955,7 +955,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q fedimint-gateway; th
   if $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q '^lnd$' && [ -f "$LND_CERT" ] && [ -f "$LND_MACAROON" ]; then
     log "  LND detected — using lnd mode"
     $DOCKER run -d --name fedimint-gateway --restart unless-stopped \
-      --health-cmd="curl -sf http://localhost:8175/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
+      --health-cmd="curl -sf http://localhost:8176/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
       --memory=$(mem_limit fedimint-gateway) --network archy-net --network-alias fedimint-gateway \
       --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
       --security-opt no-new-privileges:true \
@@ -972,7 +972,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q fedimint-gateway; th
   else
     log "  No LND found — using ldk (built-in Lightning)"
     $DOCKER run -d --name fedimint-gateway --restart unless-stopped \
-      --health-cmd="curl -sf http://localhost:8175/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
+      --health-cmd="curl -sf http://localhost:8176/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
       --memory=$(mem_limit fedimint-gateway) --network archy-net --network-alias fedimint-gateway \
       --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
       --security-opt no-new-privileges:true \
@@ -1137,20 +1137,28 @@ track_container "searxng"
 # OnlyOffice removed — incompatible with rootless Podman (internal postgres/rabbitmq)
 # CryptPad is the replacement (single Node.js process, e2e encrypted)
 if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q filebrowser; then
-  log "Creating File Browser..."
+  log "Creating File Browser (noauth — behind Archipelago login)..."
   mkdir -p /var/lib/archipelago/filebrowser /var/lib/archipelago/filebrowser-data
-  # Pre-create default directories so FileBrowser doesn't 404 on first load
   mkdir -p /var/lib/archipelago/filebrowser/{Documents,Photos,Music,Downloads,Builds}
+  # Config with noauth + database on persistent volume (survives container recreation)
+  cat > /var/lib/archipelago/filebrowser-data/.filebrowser.json << 'FBEOF'
+{"port":80,"baseURL":"","address":"0.0.0.0","database":"/data/filebrowser.db","root":"/srv","log":"stdout"}
+FBEOF
   $DOCKER run -d --name filebrowser --restart unless-stopped \
-    --health-cmd="curl -sf http://localhost:80/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
+    --health-cmd="wget -q --spider http://localhost:80/health || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
     --memory=$(mem_limit filebrowser) \
     --cap-drop ALL --security-opt no-new-privileges:true \
-    --read-only --tmpfs=/tmp:rw,noexec,nosuid,size=256m --tmpfs=/run:rw,noexec,nosuid,size=64m \
+    --tmpfs=/tmp:rw,noexec,nosuid,size=256m --tmpfs=/run:rw,noexec,nosuid,size=64m \
     -p 8083:80 \
     -v /var/lib/archipelago/filebrowser:/srv \
     -v /var/lib/archipelago/filebrowser-data:/data \
     "$FILEBROWSER_IMAGE" \
-    --database=/data/database.db --root=/srv --address=0.0.0.0 --port=80 2>>"$LOG" || true
+    --config /data/.filebrowser.json 2>>"$LOG" || true
+  # Set noauth after first start (initializes database on volume)
+  sleep 3
+  $DOCKER exec filebrowser /filebrowser config set --auth.method=noauth --database /data/filebrowser.db 2>>"$LOG" || true
+  $DOCKER exec filebrowser /filebrowser users add admin admin --perm.admin --database /data/filebrowser.db 2>>"$LOG" || true
+  $DOCKER restart filebrowser 2>>"$LOG" || true
 fi
 track_container "filebrowser"
 if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q nginx-proxy-manager; then
@@ -1236,33 +1244,38 @@ fi
 
 # 8b. Indeehub (pull from registry, or use local build)
 if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q indeedhub; then
-  INDEEDHUB_IMAGE=""
-  # Try local image first (pre-built or loaded from ISO)
-  if $DOCKER images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -q 'localhost/indeedhub'; then
-    INDEEDHUB_IMAGE="localhost/indeedhub:local"
-  # Try registry image
-  elif $DOCKER pull git.tx1138.com/lfg2025/indeedhub:local 2>>"$LOG"; then
-    INDEEDHUB_IMAGE="git.tx1138.com/lfg2025/indeedhub:local"
+  # Use image-versions.sh variable if sourced, otherwise detect
+  if [ -z "${INDEEDHUB_IMAGE:-}" ]; then
+    INDEEDHUB_IMAGE=""
+    # Try local image first (pre-built or loaded from ISO)
+    if $DOCKER images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -q 'localhost/indeedhub'; then
+      INDEEDHUB_IMAGE="localhost/indeedhub:local"
+    # Try pinned registry image
+    elif $DOCKER pull "$ARCHY_REGISTRY/indeedhub:1.0.0" --tls-verify=false 2>>"$LOG"; then
+      INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"
+    fi
   fi
   if [ -n "$INDEEDHUB_IMAGE" ]; then
     log "Creating Indeehub from $INDEEDHUB_IMAGE..."
     $DOCKER run -d --name indeedhub --restart unless-stopped \
-      --health-cmd="curl -sf http://localhost:80/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
+      --network archy-net --network-alias indeedhub \
+      --health-cmd="curl -sf http://localhost:7777/health || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
       --memory=$(mem_limit indeedhub) \
       --cap-drop ALL --security-opt no-new-privileges:true \
-      --read-only --tmpfs /tmp:rw,noexec,nosuid,size=64m --tmpfs /app/.next/cache:rw,noexec,nosuid,size=128m \
-      -p 8190:3000 \
-      -e NODE_ENV=production -e NEXT_TELEMETRY_DISABLED=1 \
+      --tmpfs /tmp:rw,noexec,nosuid,size=64m \
+      -p 7778:7777 \
       "$INDEEDHUB_IMAGE" 2>>"$LOG" || true
     # Fix IndeedHub for iframe: remove X-Frame-Options so it loads in Archipelago panel
     sleep 2
     if $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q "^indeedhub$"; then
       $DOCKER exec indeedhub sed -i "/X-Frame-Options/d" /etc/nginx/conf.d/default.conf 2>/dev/null || true
+      # Fix Host header for NIP-98 auth — $host strips port, $http_host preserves it
+      $DOCKER exec indeedhub sed -i 's|proxy_set_header Host $host;|proxy_set_header Host $http_host;|g' /etc/nginx/conf.d/default.conf 2>/dev/null || true
       if [ -f /opt/archipelago/web-ui/nostr-provider.js ]; then
         $DOCKER cp /opt/archipelago/web-ui/nostr-provider.js indeedhub:/usr/share/nginx/html/nostr-provider.js 2>/dev/null || true
       fi
       $DOCKER exec indeedhub nginx -s reload 2>/dev/null || true
-      log "Applied IndeedHub iframe fix (removed X-Frame-Options)"
+      log "Applied IndeedHub iframe fix (X-Frame-Options, Host header, nostr-provider)"
     fi
   fi
 fi