changes for build for sxsw

scripts/deploy-to-target.sh

@@ -532,6 +532,15 @@ PYEOF
           if command -v tor >/dev/null 2>&1; then
             sudo cp /var/lib/archipelago/tor/torrc /etc/tor/torrc 2>/dev/null || true
             sudo chown -R debian-tor:debian-tor /var/lib/archipelago/tor 2>/dev/null || true
+            # Let archipelago user read hostname files (group-readable)
+            sudo usermod -aG debian-tor archipelago 2>/dev/null || true
+            sudo chmod 750 /var/lib/archipelago/tor 2>/dev/null || true
+            sudo find /var/lib/archipelago/tor -name 'hidden_service_*' -type d -exec chmod 750 {} \; 2>/dev/null || true
+            sudo find /var/lib/archipelago/tor -name 'hostname' -exec chmod 640 {} \; 2>/dev/null || true
+            # Systemd override so Tor can write to custom data dir
+            sudo mkdir -p /etc/systemd/system/tor@default.service.d
+            echo -e '[Service]\nReadWriteDirectories=-/var/lib/archipelago/tor' | sudo tee /etc/systemd/system/tor@default.service.d/override.conf > /dev/null
+            sudo systemctl daemon-reload
             sudo systemctl enable tor 2>/dev/null
             sudo systemctl restart tor 2>/dev/null
             echo '   Using system Tor daemon'

scripts/first-boot-containers.sh

@@ -19,6 +19,22 @@ TARGET_IP=$(hostname -I 2>/dev/null | awk '{print $1}')
 
 log() { echo "$(date '+%Y-%m-%d %H:%M:%S') $*" | tee -a "$LOG"; }
 
+# Wait for a container to be healthy (accepting connections)
+wait_for_container() {
+  local name="$1" check_cmd="$2" max_wait="${3:-30}"
+  local waited=0
+  while [ $waited -lt $max_wait ]; do
+    if eval "$check_cmd" 2>/dev/null; then
+      log "  $name is ready (${waited}s)"
+      return 0
+    fi
+    sleep 2
+    waited=$((waited + 2))
+  done
+  log "  WARNING: $name not ready after ${max_wait}s, continuing anyway"
+  return 1
+}
+
 log "First-boot container creation starting (host=$TARGET_IP)"
 
 # Ensure network exists (matches deploy)
@@ -44,6 +60,8 @@ else
   $DOCKER network connect archy-net bitcoin-knots 2>/dev/null || true
   log "Bitcoin Knots already running"
 fi
+# Wait for Bitcoin Knots RPC to be responsive (LND, NBXplorer, mempool depend on it)
+wait_for_container "Bitcoin Knots RPC" "$DOCKER exec bitcoin-knots bitcoin-cli -rpcuser=archipelago -rpcpassword=archipelago123 getblockchaininfo" 60
 
 # 2. Mempool stack (matches deploy)
 if ! $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -qE 'archy-mempool-db|mysql-mempool'; then
@@ -54,7 +72,7 @@ if ! $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -qE 'archy-mempool-d
     -e MYSQL_DATABASE=mempool -e MYSQL_USER=mempool -e MYSQL_PASSWORD=mempoolpass \
     -e MYSQL_ROOT_PASSWORD=rootpass \
     docker.io/mariadb:10.11 2>>"$LOG" || true
-  sleep 3
+  wait_for_container "Mempool MariaDB" "$DOCKER exec archy-mempool-db mariadb -uroot -prootpass -e 'SELECT 1'" 30
 fi
 MYSQL_CNT=$($DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -E 'mysql-mempool|archy-mempool-db' | head -1)
 MYSQL_CNT=${MYSQL_CNT:-archy-mempool-db}
@@ -120,7 +138,7 @@ if ! $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -qE 'archy-btcpay-db
     -v /var/lib/archipelago/postgres-btcpay:/var/lib/postgresql/data \
     -e POSTGRES_DB=btcpay -e POSTGRES_USER=btcpay -e POSTGRES_PASSWORD=btcpaypass \
     docker.io/postgres:15-alpine 2>>"$LOG" || true
-  sleep 3
+  wait_for_container "BTCPay PostgreSQL" "$DOCKER exec archy-btcpay-db pg_isready -U postgres" 30
 fi
 # Create nbxplorer DB only if postgres is running
 if $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -qE 'archy-btcpay-db|postgres-btcpay'; then
@@ -328,11 +346,10 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q onlyoffice; then
 fi
 if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q filebrowser; then
   log "Creating File Browser..."
-  mkdir -p /var/lib/archipelago/filebrowser
+  mkdir -p /var/lib/archipelago/filebrowser /var/lib/archipelago/filebrowser-db
   $DOCKER run -d --name filebrowser --restart unless-stopped \
-    --cap-drop ALL --security-opt no-new-privileges:true \
-    --read-only --tmpfs /tmp:rw,noexec,nosuid,size=256m --tmpfs /run:rw,noexec,nosuid,size=64m \
     -p 8083:80 -v /var/lib/archipelago/filebrowser:/srv \
+    -v /var/lib/archipelago/filebrowser-db:/database \
     docker.io/filebrowser/filebrowser:v2.27.0 2>>"$LOG" || true
 fi
 if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q nginx-proxy-manager; then