Update .gitignore and remove obsolete documentation files
- Added new entries to .gitignore for build artifacts and macOS output directories to streamline the build process. - Deleted outdated documentation files: AUTH_LOGIN_FIX.md, AUTBOOT_CONFIGURATION.md, BACKEND_FIXES.md, BACKEND_STARTUP_FIX.md, BITCOIN_CORE_HEADLESS_FIX.md, BITCOIN_CORE_UI_COMPLETE.md, BITCOIN_STANDALONE_UI_COMPLETE.md, BITCOIN_UI_COMPLETE.md, BOOT_SEQUENCE_DIAGRAM.txt, and BUILD_COMMANDS_REFERENCE.txt to declutter the repository and remove unnecessary content.
This commit is contained in:
@@ -2,16 +2,16 @@
|
||||
|
||||
## Overview
|
||||
|
||||
Archipelago is a next-generation Bitcoin Node OS built on Alpine Linux with Podman containerization, combining the modularity of Parmanode with the security and efficiency of a minimal server OS.
|
||||
Archipelago is a next-generation Bitcoin Node OS built on Debian Linux with Podman containerization, combining the modularity of Parmanode with the security and reliability of a proven server OS. Similar to StartOS, we use Debian Live for reliable USB boot and installation.
|
||||
|
||||
## System Architecture
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────┐
|
||||
│ Alpine Linux Base (130MB) │
|
||||
│ - Minimal kernel │
|
||||
│ - Hardened security │
|
||||
│ - Read-only root filesystem │
|
||||
│ Debian Linux Base (Bookworm) │
|
||||
│ - Stable, well-supported kernel │
|
||||
│ - Systemd service management │
|
||||
│ - Extensive hardware support │
|
||||
└─────────────────────────────────────────────────────────┘
|
||||
│
|
||||
┌───────────────┼───────────────┐
|
||||
@@ -25,10 +25,10 @@ Archipelago is a next-generation Bitcoin Node OS built on Alpine Linux with Podm
|
||||
│
|
||||
┌───────────▼───────────┐
|
||||
│ Container Orchestration│
|
||||
│ Layer (new) │
|
||||
│ Layer │
|
||||
│ - Manifest parser │
|
||||
│ - Podman client │
|
||||
│ - Dependency resolver │
|
||||
│ - Dependency resolver │
|
||||
│ - Health monitor │
|
||||
└───────────┬───────────┘
|
||||
│
|
||||
@@ -45,10 +45,11 @@ Archipelago is a next-generation Bitcoin Node OS built on Alpine Linux with Podm
|
||||
|
||||
## Key Components
|
||||
|
||||
### 1. Alpine Linux Base
|
||||
### 1. Debian Linux Base
|
||||
|
||||
- **Size**: ~130MB (vs 1.5GB+ for Umbrel/StartOS)
|
||||
- **Security**: Hardened kernel, minimal attack surface
|
||||
- **Distribution**: Debian 12 (Bookworm) - stable, LTS support
|
||||
- **Init System**: Systemd for service management
|
||||
- **Security**: AppArmor, standard Debian hardening
|
||||
- **Multi-arch**: ARM64 (Raspberry Pi) and x86_64 support
|
||||
|
||||
### 2. Container Orchestration Layer
|
||||
@@ -61,7 +62,7 @@ Located in `core/container/`:
|
||||
|
||||
### 3. Backend API Extensions
|
||||
|
||||
New RPC endpoints in `core/startos/src/container/`:
|
||||
New RPC endpoints in `core/archipelago/src/container/`:
|
||||
- `container-install`: Install app from manifest
|
||||
- `container-start/stop/remove`: Container lifecycle
|
||||
- `container-status/logs`: Status and debugging
|
||||
@@ -94,7 +95,7 @@ Located in `core/parmanode/`:
|
||||
### 7. Security Modules
|
||||
|
||||
Located in `core/security/`:
|
||||
- **container_policies.rs**: Generates AppArmor/SELinux profiles
|
||||
- **container_policies.rs**: Generates AppArmor profiles
|
||||
- **secrets_manager.rs**: Encrypted secrets storage
|
||||
- **image_verifier.rs**: Cosign signature verification
|
||||
|
||||
@@ -102,7 +103,7 @@ Located in `core/security/`:
|
||||
|
||||
Located in `core/performance/`:
|
||||
- **resource_manager.rs**: CPU/memory/disk allocation
|
||||
- **optimize-alpine.sh**: OS-level optimizations
|
||||
- **optimize-debian.sh**: OS-level optimizations
|
||||
|
||||
## App Categories
|
||||
|
||||
@@ -134,12 +135,12 @@ Located in `core/performance/`:
|
||||
|
||||
## Security Model
|
||||
|
||||
1. **OS Level**: Hardened Alpine, read-only root, minimal kernel
|
||||
1. **OS Level**: Debian hardening, AppArmor, minimal installed packages
|
||||
2. **Container Level**: Rootless Podman, capability dropping, network isolation
|
||||
3. **Secrets**: Encrypted storage, runtime injection only
|
||||
4. **Supply Chain**: Signed images (Cosign), SBOM generation
|
||||
5. **Network**: Firewall, rate limiting, Tor integration
|
||||
6. **Audit**: Immutable logs, configuration tracking
|
||||
5. **Network**: Firewall (nftables/iptables), rate limiting, Tor integration
|
||||
6. **Audit**: Journald logging, configuration tracking
|
||||
|
||||
## Networking
|
||||
|
||||
|
||||
Reference in New Issue
Block a user