feat: NostrVPN mesh + VPN card UI + nvpn v0.3.7

- VPN card: relay URLs, device management, invite QR, add participant
- Backend: vpn.invite, vpn.add-participant, vpn.peer-config RPCs
- nvpn v0.3.7 system service (fixes event processing bug in v0.3.4)
- First-boot: auto-configure nvpn with node identity and endpoint
- Service: AF_NETLINK for WireGuard, NoNewPrivileges=no for sudo wg
- TASK-50: networking stack reliability from first install

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/first-boot-containers.sh

@@ -91,13 +91,39 @@ if command -v nvpn >/dev/null 2>&1; then
   NOSTR_SECRET=$(cat /var/lib/archipelago/identity/nostr_secret 2>/dev/null)
   NOSTR_PUBKEY=$(cat /var/lib/archipelago/identity/nostr_pubkey 2>/dev/null)
   if [ -n "$NOSTR_SECRET" ]; then
+    # Initialize nvpn config if not already done
+    NVPN_CONFIG_DIR="/home/archipelago/.config/nvpn"
+    mkdir -p "$NVPN_CONFIG_DIR"
+    if [ ! -f "$NVPN_CONFIG_DIR/config.toml" ]; then
+      # Run nvpn init as archipelago user to generate default config
+      su -l archipelago -c "nvpn init" 2>/dev/null || true
+    fi
+    # Set the node's Nostr identity from onboarding seed phrase
+    su -l archipelago -c "nvpn set --config '$NVPN_CONFIG_DIR/config.toml'" 2>/dev/null || true
+
+    # Get server's public IP for WireGuard endpoint
+    HOST_IP=$(cat /var/lib/archipelago/host-ip.env 2>/dev/null | grep ARCHIPELAGO_HOST_IP | cut -d= -f2)
+    [ -z "$HOST_IP" ] && HOST_IP=$(curl -s --connect-timeout 5 https://api.ipify.org 2>/dev/null || hostname -I | awk '{print $1}')
+
+    # Configure nvpn with node identity and endpoint
+    if [ -f "$NVPN_CONFIG_DIR/config.toml" ]; then
+      su -l archipelago -c "nvpn set --endpoint '${HOST_IP}:51820'" 2>/dev/null || true
+    fi
+
+    # Ensure env file exists for the service
     mkdir -p /var/lib/archipelago/nostr-vpn
     cat > /var/lib/archipelago/nostr-vpn/env <<NVPNENV
 NOSTR_SECRET=${NOSTR_SECRET}
 NOSTR_PUBKEY=${NOSTR_PUBKEY}
 NVPNENV
     chmod 600 /var/lib/archipelago/nostr-vpn/env
+
+    # Load WireGuard kernel module
+    modprobe wireguard 2>/dev/null || true
+
+    # Start NostrVPN and WireGuard address services
     systemctl enable --now nostr-vpn 2>/dev/null || true
+    systemctl enable --now archipelago-wg-address 2>/dev/null || true
     log "NostrVPN configured with node identity and started"
   else
     log "NostrVPN: no Nostr identity yet — will configure after onboarding"

scripts/image-versions.sh

@@ -63,7 +63,7 @@ VALKEY_IMAGE="$ARCHY_REGISTRY/valkey:8.1.6"
 # Nostr
 NOSTR_RS_RELAY_IMAGE="$ARCHY_REGISTRY/nostr-rs-relay:0.9.0"
 STRFRY_IMAGE="$ARCHY_REGISTRY/strfry:1.0.4"
-NOSTR_VPN_IMAGE="$ARCHY_REGISTRY/nostr-vpn:v0.3.4"
+NOSTR_VPN_IMAGE="$ARCHY_REGISTRY/nostr-vpn:v0.3.7"
 NOSTR_VPN_UI_IMAGE="$ARCHY_REGISTRY/nostr-vpn-ui:latest"
 FIPS_IMAGE="$ARCHY_REGISTRY/fips:v0.1.0"
 FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest"