Merge pull request #345 from naturallaw777/staging-dev

Merge staging-dev into main

app/icons/nwc.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="128" height="120" fill="none"><g clip-path="url(#a)"><path fill="#472459" d="M127.2 65.67c-5.13 5.11-12.23 3.88-17.35-1.25l-41.4-41.6 19.4-19.47a11.35 11.35 0 0 1 18.4 3.37l21.58 56.22a2.5 2.5 0 0 1-.57 2.67l-13.63 13.57 13.58-13.51Z"/><path fill="url(#b)" d="m109.85 64.42-54.16-54.4a13.13 13.13 0 0 0-18.57-.05L3.87 43.07a13.13 13.13 0 0 0-.05 18.57l54.16 54.4a13.13 13.13 0 0 0 18.57.04l10.7-10.64 3.12-3.12-10-10.03a19.04 19.04 0 0 1-23.83-2.56l-6.8-6.85a2.46 2.46 0 0 1 0-3.5l3.35-3.32-8.4-8.46a3.67 3.67 0 0 1-.34-4.9 3.57 3.57 0 0 1 5.29-.23l8.51 8.56 6.68-6.63-8.41-8.46a3.67 3.67 0 0 1-.33-4.9 3.58 3.58 0 0 1 5.3-.24l8.5 8.57 3.36-3.34a2.47 2.47 0 0 1 3.5.01l6.8 6.84a19.03 19.03 0 0 1 2.41 23.86l10 10.03 5.69-5.67 8.16-8.12 17.4-17.31c-5.15 5.11-12.25 3.88-17.36-1.25Z"/></g><defs><linearGradient id="b" x1="63.6" x2="63.6" y1="6.15" y2="119.91" gradientUnits="userSpaceOnUse"><stop stop-color="#FFCA4A"/><stop offset="1" stop-color="#F7931A"/></linearGradient><clipPath id="a"><path fill="#fff" d="M0 0h128v119.91H0z"/></clipPath></defs></svg>

app/sovran_systemsos_web/nwc_hub_manager.py

@@ -0,0 +1,764 @@
+"""
+Alby Hub manager — shared backend for Wallet Connections API and recovery CLI.
+
+Interfaces with the local Alby Hub instance at
+http://127.0.0.1:18080 by default (override with NWC_ALBY_HUB_API_BASE).
+All sensitive values (passwords, bearer tokens, pairing URIs, macaroon
+contents, Nostr private keys) are redacted from any exception messages
+or log output.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+import threading
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+# ── Constants ──────────────────────────────────────────────────────
+
+DEFAULT_API_BASE = os.environ.get(
+    "NWC_ALBY_HUB_API_BASE",
+    "http://127.0.0.1:18080",
+)
+DEFAULT_UNLOCK_PASSWORD_FILE = "/var/lib/albyhub/unlock-password"
+DEFAULT_MACAROON_FILE = os.environ.get(
+    "NWC_LND_MACAROON_FILE", "/run/lnd/albyhub.macaroon"
+)
+DEFAULT_LND_ADDRESS = os.environ.get("NWC_LND_ADDRESS", "127.0.0.1:10009")
+DEFAULT_LND_CERT_FILE = os.environ.get("NWC_LND_CERT_FILE", "/var/lib/lnd/tls.cert")
+DEFAULT_LND_SOCKET = "/run/lnd/lnd.socket"
+
+LNURL_DESCRIPTION_DEFAULT = "Pay via Lightning"
+NWC_MIN_SENDABLE_MSAT = 1000
+NWC_MAX_SENDABLE_MSAT = 1_000_000_000
+
+# Metadata key used to mark managed isolated wallets
+_MANAGED_APP_STORE_ID = "uncle-jim"
+_MANAGED_META_KEY = "app_store_app_id"
+
+RECEIVE_ONLY_SCOPES = [
+    "get_info",
+    "get_balance",
+    "make_invoice",
+    "lookup_invoice",
+    "list_transactions",
+    "notifications",
+]
+
+LIMITED_SEND_SCOPES = RECEIVE_ONLY_SCOPES + ["pay_invoice"]
+
+# ── Exceptions ─────────────────────────────────────────────────────
+
+
+class AlbyHubError(Exception):
+    """Base error from the Alby Hub manager.
+
+    The message string is safe to surface to the user — it never
+    contains raw secret material.
+    """
+
+    def __init__(self, code: str, message: str) -> None:
+        super().__init__(message)
+        self.code = code
+
+    def __str__(self) -> str:
+        return f"[{self.code}] {self.args[0]}"
+
+
+class AlbyHubHttpError(AlbyHubError):
+    def __init__(self, status_code: int, message: str) -> None:
+        super().__init__(f"http_{status_code}", message)
+        self.status_code = status_code
+
+
+# ── Manager class ──────────────────────────────────────────────────
+
+
+class AlbyHubManager:
+    """Thread-safe manager for Alby Hub API operations."""
+
+    def __init__(
+        self,
+        api_base: str = DEFAULT_API_BASE,
+        unlock_password_file: str = DEFAULT_UNLOCK_PASSWORD_FILE,
+        macaroon_file: str = DEFAULT_MACAROON_FILE,
+        lnd_address: str = DEFAULT_LND_ADDRESS,
+        lnd_cert_file: str = DEFAULT_LND_CERT_FILE,
+    ) -> None:
+        self.api_base = api_base.rstrip("/")
+        self.unlock_password_file = unlock_password_file
+        self.macaroon_file = macaroon_file
+        self.lnd_address = lnd_address
+        self.lnd_cert_file = lnd_cert_file
+        self._lock = threading.Lock()
+        self._token: str | None = None
+
+    # ── Low-level HTTP ─────────────────────────────────────────────
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        body: dict | None = None,
+        token: str | None = None,
+        timeout: int = 30,
+    ) -> dict:
+        """Make a raw HTTP request to the local Alby Hub API.
+
+        Returns the parsed JSON response body.
+        Raises AlbyHubHttpError on non-2xx responses.
+        Secrets in response bodies are never included in raised exceptions.
+        """
+        url = f"{self.api_base}{path}"
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers: dict[str, str] = {
+            "Content-Type": "application/json",
+            "Accept": "application/json",
+        }
+        if token:
+            headers["Authorization"] = "Bearer " + token
+        req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
+            with urllib.request.urlopen(req, timeout=timeout) as resp:
+                raw = resp.read()
+                if not raw:
+                    return {}
+                return json.loads(raw)
+        except urllib.error.HTTPError as exc:
+            code = exc.code
+            # Read and discard the body — we do NOT include it in the exception
+            try:
+                exc.read()
+            except Exception:
+                pass
+            raise AlbyHubHttpError(code, f"Hub API {method} {path} returned HTTP {code}") from None
+        except (urllib.error.URLError, TimeoutError, OSError):
+            raise AlbyHubError(
+                "hub_unreachable",
+                f"Hub API {method} {path} is unreachable",
+            ) from None
+
+    def _authenticated_request(
+        self,
+        method: str,
+        path: str,
+        body: dict | None = None,
+        timeout: int = 30,
+    ) -> dict:
+        """Make an authenticated request; retry once with a fresh token on 401/403."""
+        token = self.ensure_ready()
+        try:
+            return self._request(method, path, body=body, token=token, timeout=timeout)
+        except AlbyHubHttpError as exc:
+            if exc.status_code in (401, 403):
+                with self._lock:
+                    self._token = None
+                token = self.ensure_ready()
+                return self._request(method, path, body=body, token=token, timeout=timeout)
+            raise
+
+    def _paginate(self, path_template: str, page_size: int = 100) -> list[dict]:
+        """Paginate a list API completely, collecting all items.
+
+        ``path_template`` must contain ``{limit}`` and ``{offset}`` placeholders.
+        """
+        token = self.ensure_ready()
+        offset = 0
+        results: list[dict] = []
+        while True:
+            path = path_template.format(limit=page_size, offset=offset)
+            page = self._request("GET", path, token=token)
+            # Alby Hub returns apps at the top level or under "apps"/"transactions"
+            total_count: int | None = None
+            if isinstance(page, list):
+                items = page
+            elif isinstance(page, dict):
+                items = page.get("apps") or page.get("transactions") or []
+                if page.get("totalCount") is not None:
+                    total_count = int(page.get("totalCount"))
+            else:
+                items = []
+            if not isinstance(items, list):
+                break
+            results.extend(items)
+            if total_count is not None:
+                if len(results) >= total_count:
+                    break
+            elif len(items) < page_size:
+                break
+            offset += page_size
+        return results
+
+    # ── Startup / Auth ─────────────────────────────────────────────
+
+    def _read_unlock_password(self) -> str:
+        try:
+            with open(self.unlock_password_file, "r") as fh:
+                return fh.read().strip()
+        except OSError as exc:
+            raise AlbyHubError(
+                "unlock_password_unavailable",
+                "Cannot read Alby Hub unlock password",
+            ) from exc
+
+    def _wait_for_file(self, path: str, timeout: int = 120) -> None:
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            if os.path.exists(path):
+                return
+            time.sleep(2)
+        raise AlbyHubError(
+            "dependency_unavailable",
+            f"Timed out waiting for required file: {path}",
+        )
+
+    def _wait_for_hub_api(self, timeout: int = 120) -> None:
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            try:
+                self._request("GET", "/api/info", timeout=5)
+                return
+            except AlbyHubError:
+                pass
+            time.sleep(3)
+        raise AlbyHubError("hub_unavailable", "Timed out waiting for Alby Hub API")
+
+    def _hub_setup(self, password: str) -> None:
+        """Perform /api/setup idempotently."""
+        try:
+            info = self._request("GET", "/api/info", timeout=10)
+            if info.get("setupCompleted"):
+                return
+        except AlbyHubError:
+            pass
+
+        setup_body = {
+            "backendType": "LND",
+            "unlockPassword": password,
+            "lndAddress": self.lnd_address,
+            "lndCertFile": self.lnd_cert_file,
+            "lndMacaroonFile": self.macaroon_file,
+        }
+        try:
+            self._request("POST", "/api/setup", body=setup_body, timeout=30)
+        except AlbyHubHttpError as exc:
+            if exc.status_code == 409:
+                return  # already setup
+            raise
+
+    def _obtain_token(self, password: str) -> str:
+        info = self._request("GET", "/api/info", timeout=10)
+        if info.get("running"):
+            resp = self._request(
+                "POST",
+                "/api/unlock",
+                body={
+                    "unlockPassword": password,
+                    "permission": "full",
+                },
+                timeout=30,
+            )
+        else:
+            resp = self._request(
+                "POST",
+                "/api/start",
+                body={"unlockPassword": password},
+                timeout=30,
+            )
+        token = (
+            resp.get("token")
+            or resp.get("accessToken")
+            or resp.get("access_token")
+        )
+        if not token or not isinstance(token, str):
+            raise AlbyHubError("auth_failed", "Alby Hub auth response missing token")
+        return token
+
+    def _wait_for_node_ready(self, token: str, timeout: int = 120) -> None:
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            try:
+                status = self._request(
+                    "GET", "/api/node/status", token=token, timeout=10
+                )
+                if status.get("isReady") or status.get("running") or status.get("online"):
+                    return
+            except AlbyHubError:
+                pass
+            time.sleep(3)
+        raise AlbyHubError("node_not_ready", "Timed out waiting for Alby Hub node to be ready")
+
+    def ensure_ready(self) -> str:
+        """Ensure Alby Hub is set up, unlocked, and authenticated.
+
+        Returns a valid bearer token.  Caches it and uses a lock to
+        prevent concurrent setup races.
+        """
+        with self._lock:
+            if self._token:
+                return self._token
+
+            password = self._read_unlock_password()
+            self._wait_for_file(self.macaroon_file, timeout=120)
+            self._wait_for_hub_api(timeout=120)
+            self._hub_setup(password)
+            token = self._obtain_token(password)
+            self._wait_for_node_ready(token, timeout=120)
+            self._token = token
+            return token
+
+    # ── App isolation helpers ──────────────────────────────────────
+
+    @staticmethod
+    def _parse_metadata(raw: Any) -> dict:
+        if isinstance(raw, dict):
+            return raw
+        if isinstance(raw, str):
+            try:
+                result = json.loads(raw)
+                if isinstance(result, dict):
+                    return result
+            except Exception:
+                pass
+        return {}
+
+    def _is_managed_app(self, app: dict) -> bool:
+        meta = self._parse_metadata(app.get("metadata"))
+        alias = str(meta.get("lnurl_alias", "")).strip().lower()
+        return (
+            meta.get(_MANAGED_META_KEY) == _MANAGED_APP_STORE_ID
+            and bool(alias)
+        )
+
+    def _app_to_wallet_meta(self, app: dict, domain: str | None) -> dict:
+        meta = self._parse_metadata(app.get("metadata"))
+        alias = meta.get("lnurl_alias", "")
+        address = f"{alias}@{domain}" if alias and domain else None
+
+        scopes = app.get("scopes") or []
+        access_preset = (
+            "send_receive_limited" if "pay_invoice" in scopes else "receive_only"
+        )
+
+        balance_msat = int(app.get("balanceMsat", 0) or 0)
+        balance_sats = balance_msat // 1000
+        dust_msat = balance_msat % 1000
+
+        spending_limit_sats: int | None = None
+        max_amount = app.get("maxAmountSat") or 0
+        if max_amount:
+            spending_limit_sats = int(max_amount)
+
+        # Count pending transactions from the budget or transactions list
+        pending_txs = int(app.get("pendingTransactionsCount", 0) or 0)
+
+        return {
+            "id": str(app.get("id", "")),
+            "pubkey": app.get("appPubkey") or app.get("nostrPubkey") or app.get("pubkey") or "",
+            "name": app.get("name", ""),
+            "alias": alias,
+            "lightning_address": address,
+            "access_preset": access_preset,
+            "spending_limit_sats": spending_limit_sats,
+            "balance_sats": balance_sats,
+            "dust_msat": dust_msat,
+            "pending_transactions": pending_txs,
+            "created_at": app.get("createdAt") or app.get("created_at"),
+            "min_sendable_msat": int(
+                meta.get("lnurl_min_sendable_msat", NWC_MIN_SENDABLE_MSAT)
+            ),
+            "max_sendable_msat": int(
+                meta.get("lnurl_max_sendable_msat", NWC_MAX_SENDABLE_MSAT)
+            ),
+        }
+
+    def _all_managed_apps(self) -> list[dict]:
+        apps = self._paginate("/api/apps?limit={limit}&offset={offset}&order_by=created_at")
+        return [a for a in apps if a.get("isolated") and self._is_managed_app(a)]
+
+    def _find_managed_app(self, identifier: str) -> dict | None:
+        needle = identifier.strip().lower()
+        for app in self._all_managed_apps():
+            if str(app.get("id", "")).lower() == needle:
+                return app
+            pubkey = (
+                app.get("appPubkey") or app.get("nostrPubkey") or app.get("pubkey") or ""
+            ).lower()
+            if pubkey == needle:
+                return app
+        return None
+
+    # ── Public API ─────────────────────────────────────────────────
+
+    def list_wallets(self, domain: str | None = None) -> list[dict]:
+        """Return all managed isolated app wallets (no secrets)."""
+        wallets = []
+        for app in self._all_managed_apps():
+            app_copy = dict(app)
+            app_copy["pendingTransactionsCount"] = len(self._get_app_pending_txs(int(app["id"])))
+            wallets.append(self._app_to_wallet_meta(app_copy, domain))
+        return wallets
+
+    def create_wallet(
+        self,
+        name: str,
+        alias: str,
+        access_preset: str,
+        spending_limit_sats: int | None,
+        domain: str | None = None,
+    ) -> dict:
+        """Create a new isolated Alby Hub app (wallet connection).
+
+        Returns a dict containing:
+          ``wallet``      — safe metadata (no secrets)
+          ``pairing_uri`` — real Alby Hub pairingUri (returned ONCE)
+          ``result``      — creation status report
+        """
+        # Validate uniqueness
+        managed = self._all_managed_apps()
+        for a in managed:
+            meta = self._parse_metadata(a.get("metadata"))
+            if meta.get("lnurl_alias", "").lower() == alias.lower():
+                raise AlbyHubError(
+                    "alias_exists", "That Lightning Address alias is already in use."
+                )
+            if (a.get("name") or "").lower() == name.lower():
+                raise AlbyHubError(
+                    "wallet_name_exists",
+                    "That Wallet Connection name already exists.",
+                )
+
+        scopes = (
+            LIMITED_SEND_SCOPES
+            if access_preset == "send_receive_limited"
+            else RECEIVE_ONLY_SCOPES
+        )
+        max_amount = (
+            spending_limit_sats
+            if access_preset == "send_receive_limited" and spending_limit_sats
+            else 0
+        )
+
+        create_body: dict = {
+            "name": name,
+            "scopes": scopes,
+            "isolated": True,
+            "budgetRenewal": "never",
+            "maxAmountSat": max_amount,
+            "metadata": {
+                _MANAGED_META_KEY: _MANAGED_APP_STORE_ID,
+                "lnurl_alias": alias,
+                "lnurl_description": LNURL_DESCRIPTION_DEFAULT,
+                "lnurl_min_sendable_msat": NWC_MIN_SENDABLE_MSAT,
+                "lnurl_max_sendable_msat": NWC_MAX_SENDABLE_MSAT,
+            },
+        }
+
+        resp = self._authenticated_request("POST", "/api/apps", body=create_body)
+        pairing_uri: str = resp.get("pairingUri") or resp.get("pairing_uri") or ""
+        app_id = resp.get("id")
+
+        # Fetch full app details for accurate metadata
+        app_detail: dict | None = None
+        if app_id is not None:
+            try:
+                app_detail = self._authenticated_request(
+                    "GET", f"/api/v2/apps/{app_id}"
+                )
+            except AlbyHubError:
+                pass
+
+        if app_detail is None:
+            # Fallback: search recent apps for the one we just created
+            updated = self._all_managed_apps()
+            for a in updated:
+                if str(a.get("id", "")) == str(app_id):
+                    app_detail = a
+                    break
+
+        wallet_meta = self._app_to_wallet_meta(app_detail or resp, domain)
+
+        # Initial internal transfer for limited wallets
+        funding_result: dict = {"attempted": False, "success": False}
+        if (
+            access_preset == "send_receive_limited"
+            and spending_limit_sats
+            and app_id is not None
+        ):
+            funding_result["attempted"] = True
+            try:
+                self._authenticated_request(
+                    "POST",
+                    "/api/transfers",
+                    body={
+                        "toAppId": int(app_id),
+                        "amountSat": spending_limit_sats,
+                        "description": f"Initial funding for {name}",
+                    },
+                )
+                funding_result["success"] = True
+            except AlbyHubError as exc:
+                funding_result["error"] = exc.code
+                funding_result["message"] = (
+                    "The wallet was created successfully and the NWC connection secret is shown "
+                    "above, but initial funding failed. Save the NWC secret now. "
+                    "Do not recreate this wallet."
+                )
+
+        return {
+            "wallet": wallet_meta,
+            "pairing_uri": pairing_uri,  # returned once on create only
+            "result": {
+                "wallet_created": True,
+                "secret_created": bool(pairing_uri),
+                "lightning_address_registered": bool(alias and domain),
+                "funding": funding_result,
+            },
+        }
+
+    def _get_app_balance_msat(self, app: dict) -> int:
+        return int(app.get("balanceMsat", 0) or 0)
+
+    def _get_app_pending_txs(self, app_id: int) -> list[dict]:
+        txs = self._paginate(
+            f"/api/transactions?appId={app_id}&limit={{limit}}&offset={{offset}}"
+        )
+        return [
+            t for t in txs if str(t.get("state", "")).lower() == "pending"
+        ]
+
+    def drain_wallet(self, identifier: str) -> dict:
+        """Drain all whole-satoshi funds from an isolated app to the primary wallet.
+
+        Returns ``{"ok": True, "drained_sats": N, "dust_msat": M}``.
+        Raises AlbyHubError on rejection or failure.
+        """
+        app = self._find_managed_app(identifier)
+        if app is None:
+            raise AlbyHubError("wallet_not_found", "Wallet connection not found.")
+
+        app_id = int(app["id"])
+        balance_msat = self._get_app_balance_msat(app)
+
+        if balance_msat < 0:
+            raise AlbyHubError("negative_balance", "Wallet has a negative balance.")
+
+        pending = self._get_app_pending_txs(app_id)
+        if pending:
+            raise AlbyHubError(
+                "pending_transactions",
+                "Wallet has pending transactions and cannot be drained.",
+            )
+
+        transferable_msat = (balance_msat // 1000) * 1000
+        expected_dust_msat = balance_msat - transferable_msat
+
+        if transferable_msat == 0:
+            return {"ok": True, "drained_sats": 0, "dust_msat": expected_dust_msat}
+
+        # Save original permissions
+        original_scopes = list(app.get("scopes") or [])
+        original_max = app.get("maxAmountSat") or 0
+        original_renewal = app.get("budgetRenewal") or "never"
+
+        # Temporarily grant pay_invoice scope with sufficient budget
+        app_pubkey = app.get("appPubkey") or app.get("nostrPubkey") or app.get("pubkey") or ""
+        if not app_pubkey:
+            raise AlbyHubError(
+                "app_pubkey_missing",
+                "Cannot drain app: app public key not available.",
+            )
+
+        patch_body = {
+            "scopes": sorted(set(original_scopes) | {"pay_invoice"}),
+            "maxAmountSat": 0,
+            "budgetRenewal": "never",
+        }
+        self._authenticated_request("PATCH", f"/api/apps/{app_pubkey}", body=patch_body)
+
+        drain_error: AlbyHubError | None = None
+        drained_sats = 0
+        try:
+            self._authenticated_request(
+                "POST",
+                "/api/transfers",
+                body={
+                    "fromAppId": app_id,
+                    "amountMsat": transferable_msat,
+                    "description": f"Drain isolated subwallet {app.get('name', '')}",
+                },
+            )
+            drained_sats = transferable_msat // 1000
+        except AlbyHubError as exc:
+            drain_error = exc
+        finally:
+            # Restore original permissions whether drain succeeded or not
+            restore_body = {
+                "scopes": original_scopes,
+                "maxAmountSat": original_max,
+                "budgetRenewal": original_renewal,
+            }
+            try:
+                self._authenticated_request(
+                    "PATCH", f"/api/apps/{app_pubkey}", body=restore_body
+                )
+            except AlbyHubError:
+                pass  # best-effort restore; don't mask the original error
+
+        if drain_error is not None:
+            raise drain_error
+
+        # Verify remaining balance equals expected dust
+        refreshed = self._authenticated_request("GET", f"/api/v2/apps/{app_id}")
+        remaining_msat = self._get_app_balance_msat(refreshed)
+        if remaining_msat != expected_dust_msat:
+            raise AlbyHubError(
+                "drain_incomplete",
+                "Drain verification failed: final balance does not match expected dust.",
+            )
+
+        return {
+            "ok": True,
+            "drained_sats": drained_sats,
+            "dust_msat": expected_dust_msat,
+            "remaining_msat": remaining_msat,
+        }
+
+    def delete_wallet(self, identifier: str) -> dict:
+        """Safely drain and delete an isolated app.
+
+        Returns ``{"ok": True, "drained_sats": N}``.
+        """
+        app = self._find_managed_app(identifier)
+        if app is None:
+            raise AlbyHubError("wallet_not_found", "Wallet connection not found.")
+
+        app_id = int(app["id"])
+
+        pending = self._get_app_pending_txs(app_id)
+        if pending:
+            raise AlbyHubError(
+                "pending_transactions",
+                "Wallet has pending transactions and cannot be deleted.",
+            )
+
+        drain_result = self.drain_wallet(identifier)
+
+        # Verify no transferable balance remains
+        refreshed = self._authenticated_request("GET", f"/api/v2/apps/{app_id}")
+        remaining_msat = self._get_app_balance_msat(refreshed)
+        if remaining_msat < 0:
+            raise AlbyHubError(
+                "negative_balance",
+                "Wallet has a negative final balance and cannot be deleted.",
+            )
+        if remaining_msat >= 1000:
+            raise AlbyHubError(
+                "drain_incomplete",
+                f"Drain verification failed: funds still remain.",
+            )
+
+        # Delete by app pubkey
+        pubkey = app.get("appPubkey") or app.get("nostrPubkey") or app.get("pubkey") or ""
+        if not pubkey:
+            raise AlbyHubError(
+                "app_pubkey_missing",
+                "Cannot delete app: nostr pubkey not available.",
+            )
+        self._authenticated_request(
+            "DELETE",
+            f"/api/apps/{urllib.parse.quote(pubkey, safe='')}",
+        )
+
+        return {
+            "ok": True,
+            "drained_sats": drain_result.get("drained_sats", 0),
+            "dust_msat": remaining_msat,
+        }
+
+    def issue_invoice(
+        self, app_id: int, amount_msat: int, description: str = ""
+    ) -> str:
+        """Create an LND invoice attributed to a specific isolated app.
+
+        Returns a valid BOLT11 invoice string.
+        Raises AlbyHubError if the Hub returns an invalid or misattributed invoice.
+        """
+        resp = self._authenticated_request(
+            "POST",
+            "/api/invoices",
+            body={
+                "amountMsat": amount_msat,
+                "description": description or LNURL_DESCRIPTION_DEFAULT,
+                "appId": app_id,
+            },
+        )
+        invoice: str = resp.get("invoice") or ""
+        returned_app_id = resp.get("appId")
+
+        if not invoice:
+            raise AlbyHubError("invoice_creation_failed", "Hub returned empty invoice.")
+
+        # Require a valid BOLT11 prefix (mainnet, testnet, signet, regtest)
+        if not re.match(r"^ln", invoice, re.IGNORECASE):
+            raise AlbyHubError(
+                "invalid_invoice", "Hub returned a non-BOLT11 invoice string."
+            )
+
+        if returned_app_id is None or int(returned_app_id) != app_id:
+            raise AlbyHubError(
+                "invoice_attribution_failed",
+                "Invoice attribution mismatch: returned appId does not match.",
+            )
+
+        return invoice
+
+    def find_app_by_alias(self, alias: str) -> dict | None:
+        """Find a managed isolated app by its ``lnurl_alias`` metadata field."""
+        alias_lower = alias.strip().lower()
+        for a in self._all_managed_apps():
+            meta = self._parse_metadata(a.get("metadata"))
+            if meta.get("lnurl_alias", "").lower() == alias_lower:
+                return a
+        return None
+
+    def health(self) -> dict:
+        """Return a basic health summary."""
+        try:
+            token = self.ensure_ready()
+            status = self._request(
+                "GET", "/api/node/status", token=token, timeout=10
+            )
+            return {
+                "ok": True,
+                "hub_ready": bool(
+                    status.get("isReady") or status.get("running")
+                ),
+            }
+        except AlbyHubError as exc:
+            return {"ok": False, "error": exc.code, "message": str(exc)}
+
+
+# ── Module-level singleton ──────────────────────────────────────────
+
+_manager: AlbyHubManager | None = None
+_manager_lock = threading.Lock()
+
+
+def get_manager() -> AlbyHubManager:
+    """Return the module-level singleton AlbyHubManager."""
+    global _manager
+    if _manager is None:
+        with _manager_lock:
+            if _manager is None:
+                _manager = AlbyHubManager()
+    return _manager

app/sovran_systemsos_web/nwc_lnurl_service.py

@@ -0,0 +1,232 @@
+"""
+Dedicated LNURL service for Wallet Connections.
+
+Runs as ``nwc-lnurl.service`` on 127.0.0.1:8181 (loopback only).
+Caddy proxies the public Lightning Address domain's LNURL routes to this port.
+
+Routes:
+  GET /.well-known/lnurlp/{alias}
+  GET /lnurlp/{alias}/callback?amount=<msat>
+
+All error responses are safe for public consumption — raw Alby Hub bodies
+and internal credentials are never returned to callers.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+import urllib.parse
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from typing import TYPE_CHECKING
+
+from . import nwc_hub_manager as _mgr_mod
+
+if TYPE_CHECKING:
+    from .nwc_hub_manager import AlbyHubManager
+
+logger = logging.getLogger(__name__)
+
+# ── Configuration ─────────────────────────────────────────────────
+
+LNURL_BIND_HOST = "127.0.0.1"
+LNURL_PORT = int(os.environ.get("NWC_LNURL_PORT", "8181"))
+DOMAIN_FILE = "/var/lib/domains/lightning"
+
+NWC_ALIAS_RE = re.compile(r"^[a-z0-9][a-z0-9_-]{0,31}$")
+
+# ── Helpers ───────────────────────────────────────────────────────
+
+
+def _read_domain() -> str | None:
+    try:
+        with open(DOMAIN_FILE, "r") as fh:
+            raw = fh.read(256).strip().lower()
+        # Basic validation: must look like a hostname
+        if re.match(r"^[a-z0-9][a-z0-9.\-]{1,253}$", raw):
+            return raw
+    except OSError:
+        pass
+    return None
+
+
+def _lnurl_discovery(alias: str, manager: "AlbyHubManager") -> tuple[dict, int]:
+    alias = alias.strip().lower()
+    if not NWC_ALIAS_RE.match(alias):
+        return {"status": "ERROR", "reason": "Unknown Lightning Address alias"}, 404
+
+    domain = _read_domain()
+    if not domain:
+        return {"status": "ERROR", "reason": "Lightning domain is not configured"}, 503
+
+    try:
+        app = manager.find_app_by_alias(alias)
+    except _mgr_mod.AlbyHubError:
+        return {"status": "ERROR", "reason": "Service temporarily unavailable"}, 503
+
+    if app is None:
+        return {"status": "ERROR", "reason": "Unknown Lightning Address alias"}, 404
+
+    meta = _mgr_mod.AlbyHubManager._parse_metadata(app.get("metadata"))
+    min_sendable = int(
+        meta.get("lnurl_min_sendable_msat", _mgr_mod.NWC_MIN_SENDABLE_MSAT)
+    )
+    max_sendable = int(
+        meta.get("lnurl_max_sendable_msat", _mgr_mod.NWC_MAX_SENDABLE_MSAT)
+    )
+
+    callback_alias = urllib.parse.quote(alias, safe="")
+    callback = f"https://{domain}/lnurlp/{callback_alias}/callback"
+    description = meta.get("lnurl_description") or f"Pay {alias}"
+    metadata = json.dumps([["text/plain", description]], separators=(",", ":"))
+
+    return {
+        "tag": "payRequest",
+        "callback": callback,
+        "minSendable": min_sendable,
+        "maxSendable": max_sendable,
+        "metadata": metadata,
+        "commentAllowed": 0,
+    }, 200
+
+
+def _lnurl_callback(
+    alias: str, amount_str: str | None, manager: "AlbyHubManager"
+) -> tuple[dict, int]:
+    payload, status_code = _lnurl_discovery(alias, manager)
+    if status_code != 200:
+        return payload, status_code
+
+    if amount_str is None:
+        return {"status": "ERROR", "reason": "Missing amount parameter"}, 400
+    if not re.match(r"^\d+$", amount_str):
+        return {
+            "status": "ERROR",
+            "reason": "Amount must be an integer millisatoshi value",
+        }, 400
+
+    amount_msat = int(amount_str)
+    min_sendable = int(payload["minSendable"])
+    max_sendable = int(payload["maxSendable"])
+
+    if amount_msat < min_sendable:
+        return {
+            "status": "ERROR",
+            "reason": "Amount is below the minimum sendable value",
+        }, 400
+    if amount_msat > max_sendable:
+        return {
+            "status": "ERROR",
+            "reason": "Amount is above the maximum sendable value",
+        }, 400
+    if amount_msat % 1000 != 0:
+        return {
+            "status": "ERROR",
+            "reason": "Amount must be a whole-satoshi value",
+        }, 400
+
+    try:
+        app = manager.find_app_by_alias(alias)
+    except _mgr_mod.AlbyHubError:
+        return {"status": "ERROR", "reason": "Service temporarily unavailable"}, 503
+
+    if app is None:
+        return {"status": "ERROR", "reason": "Unknown Lightning Address alias"}, 404
+
+    meta = _mgr_mod.AlbyHubManager._parse_metadata(app.get("metadata"))
+    description = meta.get("lnurl_description") or f"Pay {alias}"
+
+    try:
+        app_id = int(app["id"])
+        invoice = manager.issue_invoice(app_id, amount_msat, description)
+    except _mgr_mod.AlbyHubError:
+        return {"status": "ERROR", "reason": "Invoice creation failed"}, 502
+
+    return {"pr": invoice, "routes": []}, 200
+
+
+# ── HTTP server ───────────────────────────────────────────────────
+
+
+def _make_handler(manager: "AlbyHubManager") -> type:
+    """Return a handler class bound to the given manager."""
+
+    class LnurlHandler(BaseHTTPRequestHandler):
+        _manager = manager
+
+        def log_message(self, fmt: str, *args: object) -> None:
+            logger.debug(f"LNURL {self.address_string()} {fmt % args}")
+
+        def _send_json(self, status: int, body: dict) -> None:
+            raw = json.dumps(body, separators=(",", ":")).encode("utf-8")
+            self.send_response(status)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(raw)))
+            self.end_headers()
+            self.wfile.write(raw)
+
+        def do_GET(self) -> None:  # noqa: N802
+            parsed = urllib.parse.urlparse(self.path)
+            path = parsed.path
+            qs = urllib.parse.parse_qs(parsed.query)
+
+            # /.well-known/lnurlp/{alias}
+            m = re.fullmatch(
+                r"/.well-known/lnurlp/([^/]+)", path
+            )
+            if m:
+                alias = urllib.parse.unquote(m.group(1))
+                payload, code = _lnurl_discovery(alias, self._manager)
+                self._send_json(code, payload)
+                return
+
+            # /lnurlp/{alias}/callback
+            m = re.fullmatch(r"/lnurlp/([^/]+)/callback", path)
+            if m:
+                alias = urllib.parse.unquote(m.group(1))
+                amount_values = qs.get("amount")
+                if not amount_values:
+                    amount_str = None
+                elif len(amount_values) != 1:
+                    self._send_json(
+                        400,
+                        {
+                            "status": "ERROR",
+                            "reason": "A single amount parameter is required",
+                        },
+                    )
+                    return
+                else:
+                    amount_str = amount_values[0]
+                payload, code = _lnurl_callback(alias, amount_str, self._manager)
+                self._send_json(code, payload)
+                return
+
+            self._send_json(404, {"status": "ERROR", "reason": "Not found"})
+
+    return LnurlHandler
+
+
+def run(
+    host: str = LNURL_BIND_HOST,
+    port: int = LNURL_PORT,
+    manager: "AlbyHubManager | None" = None,
+) -> None:
+    """Start the blocking LNURL HTTP server."""
+    if manager is None:
+        manager = _mgr_mod.get_manager()
+    handler_class = _make_handler(manager)
+    server = HTTPServer((host, port), handler_class)
+    logger.info("nwc-lnurl service listening on %s:%d", host, port)
+    server.serve_forever()
+
+
+def main() -> None:
+    logging.basicConfig(level=logging.INFO)
+    run()
+
+
+if __name__ == "__main__":
+    main()

app/sovran_systemsos_web/nwc_wallet_cli.py

@@ -0,0 +1,115 @@
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from . import nwc_hub_manager as _mgr_mod
+from .server import _nwc_domain, _nwc_validate_alias, _nwc_test_address
+
+
+def _print(data) -> None:
+    print(json.dumps(data, indent=2, sort_keys=True))
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="nwc-wallet")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+
+    create = sub.add_parser("create")
+    create.add_argument("name")
+    create.add_argument("alias")
+    preset_group = create.add_mutually_exclusive_group()
+    preset_group.add_argument("--receive-only", action="store_true")
+    preset_group.add_argument("--limit-sats", type=int)
+
+    sub.add_parser("list")
+
+    drain = sub.add_parser("drain")
+    drain.add_argument("wallet")
+
+    delete = sub.add_parser("delete")
+    delete.add_argument("wallet")
+
+    addr = sub.add_parser("address")
+    addr_sub = addr.add_subparsers(dest="address_cmd", required=True)
+    addr_show = addr_sub.add_parser("show")
+    addr_show.add_argument("alias")
+
+    sub.add_parser("health")
+
+    args = parser.parse_args(argv)
+    manager = _mgr_mod.get_manager()
+    domain = _nwc_domain()
+
+    if args.cmd == "list":
+        try:
+            wallets = manager.list_wallets(domain)
+        except _mgr_mod.AlbyHubError as exc:
+            print(f"Error: {exc.code} - {exc}", file=sys.stderr)
+            return 1
+        _print({"wallets": wallets})
+        return 0
+
+    if args.cmd == "health":
+        result = manager.health()
+        _print(result)
+        return 0 if result.get("ok") else 1
+
+    if args.cmd == "address" and args.address_cmd == "show":
+        alias = args.alias.strip().lower()
+        test = _nwc_test_address(alias)
+        _print(test)
+        return 0 if test.get("ok") else 1
+
+    if args.cmd == "drain":
+        try:
+            result = manager.drain_wallet(args.wallet)
+        except _mgr_mod.AlbyHubError as exc:
+            print(f"Error: {exc.code} - {exc}", file=sys.stderr)
+            return 1
+        _print(result)
+        return 0
+
+    if args.cmd == "delete":
+        try:
+            result = manager.delete_wallet(args.wallet)
+        except _mgr_mod.AlbyHubError as exc:
+            print(f"Error: {exc.code} - {exc}", file=sys.stderr)
+            return 1
+        _print(result)
+        return 0
+
+    if args.cmd == "create":
+        alias = args.alias.strip().lower()
+        if not _nwc_validate_alias(alias):
+            print("Error: alias_invalid - Alias must be lowercase letters, digits, '_' or '-'.", file=sys.stderr)
+            return 1
+        access_preset = "send_receive_limited" if args.limit_sats is not None else "receive_only"
+        try:
+            result = manager.create_wallet(
+                args.name.strip(),
+                alias,
+                access_preset,
+                args.limit_sats if access_preset == "send_receive_limited" else None,
+                domain,
+            )
+        except _mgr_mod.AlbyHubError as exc:
+            print(f"Error: {exc.code} - {exc}", file=sys.stderr)
+            return 1
+        # Print the pairing URI once — this is the only time it is shown
+        _print(
+            {
+                "wallet": result["wallet"],
+                "pairing_uri": result.get("pairing_uri", ""),
+                "message": "Keep the NWC connection secret private. It cannot be displayed again.",
+                "result": result.get("result", {}),
+            }
+        )
+        return 0
+
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

app/sovran_systemsos_web/scripts/sovran-hub-backup.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # ── Sovran Hub External Backup Script ────────────────────────────
-# Backs up Sovran_SystemsOS data to an external USB hard drive.
+# Backs up Sovran_SystemsOS data to an external USB hard drive using rsync.
 # Designed for the Hub web UI (no GUI dependencies).
 #
 # Your Sovran Pro already backs up your data automatically to its
@@ -8,6 +8,15 @@
 # This script creates an additional copy on an external USB drive —
 # storing your data in a third location for maximum protection.
 #
+# The external drive must be formatted as ext4. Files are stored as
+# directly browsable files under Sovran_SystemsOS_Backup/current/.
+# Later runs update the same mirror and only transfer changed or new
+# files, making repeat backups fast.
+#
+# PostgreSQL and MariaDB/MySQL databases are NOT included. Bitcoin
+# blockchain and Electrs index data are NOT included (they live on
+# the internal second drive).
+#
 # Usage:
 #   BACKUP_TARGET=/run/media/<user>/<drive> bash sovran-hub-backup.sh
 #   (or run with no env var to auto-detect the first external USB drive)
@@ -17,18 +26,28 @@ set -euo pipefail
 BACKUP_LOG="/var/log/sovran-hub-backup.log"
 BACKUP_STATUS="/var/log/sovran-hub-backup.status"
 MEDIA_ROOT="/run/media"
-MIN_FREE_GB=10
 HUB_CONFIG_JSON="/var/lib/sovran-hub/config.json"
 ROLE_STATE_NIX="/etc/nixos/role-state.nix"
+SECOND_DRIVE_MOUNT="/run/media/Second_Drive"
+SAFETY_MARGIN_BYTES=$((1024 * 1024 * 1024))
 
 # ── Internal drive labels/paths to NEVER use as backup targets ───
 INTERNAL_LABELS=("BTCEcoandBackup" "sovran_systemsos")
-INTERNAL_MOUNTS=("/run/media/Second_Drive" "/boot/efi" "/")
+INTERNAL_MOUNTS=("$SECOND_DRIVE_MOUNT" "/boot/efi" "/")
+
+FAILED_ALREADY=0
+BACKUP_COMPLETE=0
+RSYNC_WARNINGS=()
+
+# Stable rsync mirror sub-path under the target drive. Not timestamped
+# so later runs update the same destination and only transfer new or changed files.
+BACKUP_SUBPATH="Sovran_SystemsOS_Backup/current"
 
 # ── Logging helpers ──────────────────────────────────────────────
 
 log() {
-  local msg="[$(date '+%Y-%m-%d %H:%M:%S')] $*"
+  local msg
+  msg="[$(date '+%Y-%m-%d %H:%M:%S')] $*"
   echo "$msg" | tee -a "$BACKUP_LOG"
 }
 
@@ -37,16 +56,47 @@ set_status() {
 }
 
 fail() {
+  FAILED_ALREADY=1
   log "ERROR: $*"
   set_status "FAILED"
   exit 1
 }
 
+cleanup() {
+  local rc=$?
+
+  # Release the concurrency lock file descriptor if it was opened
+  if [[ -n "${LOCK_FD:-}" ]]; then
+    exec {LOCK_FD}>&- 2>/dev/null || true
+  fi
+
+  if [[ "$BACKUP_COMPLETE" -eq 1 && "$rc" -eq 0 ]]; then
+    return
+  fi
+
+  if [[ "$FAILED_ALREADY" -eq 0 ]]; then
+    log "ERROR: Backup terminated unexpectedly (exit code $rc)."
+    set_status "FAILED"
+  fi
+
+  # Mark the backup directory as incomplete so failed runs are identifiable
+  if [[ -n "${BACKUP_DIR:-}" && -d "${BACKUP_DIR:-}" && ! -f "${BACKUP_DIR:-}/BACKUP_COMPLETE" ]]; then
+    touch "${BACKUP_DIR}/INCOMPLETE" 2>/dev/null || true
+  fi
+}
+
+trap cleanup EXIT
+trap 'exit 1' INT TERM
+
+require_cmd() {
+  local cmd="$1"
+  command -v "$cmd" >/dev/null 2>&1 || fail "Required command not found: $cmd"
+}
+
 # ── Check whether a mount point is an internal drive ────────────
 
 is_internal() {
   local mnt="$1"
-  # Reject known internal mount points and their subdirectories
   for internal in "${INTERNAL_MOUNTS[@]}"; do
     if [[ "$mnt" == "$internal" || "$mnt" == "${internal}/"* ]]; then
       return 0
@@ -59,22 +109,18 @@ is_internal() {
 
 find_external_drive() {
   local target=""
-  # lsblk JSON output: NAME,LABEL,MOUNTPOINT,HOTPLUG,RM,TYPE
+
-  if command -v lsblk &>/dev/null; then
   while IFS=$'\t' read -r dev_type hotplug removable label mountpoint; do
-      # Must be a partition or disk, and be removable/hotplug
     [[ "$dev_type" == "part" || "$dev_type" == "disk" ]] || continue
     [[ "$hotplug" == "1" || "$removable" == "1" ]] || continue
     [[ -n "$mountpoint" ]] || continue
 
-      # Filter out internal labels
     local skip=0
     for lbl in "${INTERNAL_LABELS[@]}"; do
       [[ "$label" == "$lbl" ]] && skip=1 && break
     done
     [[ "$skip" -eq 1 ]] && continue
 
-      # Filter out internal mount points
     is_internal "$mountpoint" && continue
 
     if mountpoint -q "$mountpoint" 2>/dev/null; then
@@ -84,14 +130,16 @@ find_external_drive() {
   done < <(lsblk -J -o NAME,LABEL,MOUNTPOINT,HOTPLUG,RM,TYPE 2>/dev/null | \
     python3 -c "
 import sys, json
-data = json.load(sys.stdin)
+
 def flatten(devs):
     for d in devs:
         yield d
         for c in d.get('children', []):
             yield from flatten([c])
+
+data = json.load(sys.stdin)
 for d in flatten(data.get('blockdevices', [])):
-    print('\t'.join([
+    print('\\t'.join([
         d.get('type') or '',
         str(d.get('hotplug') or '0'),
         str(d.get('rm') or '0'),
@@ -99,24 +147,10 @@ for d in flatten(data.get('blockdevices', [])):
         d.get('mountpoint') or '',
     ]))
 " 2>/dev/null || true)
-  fi
 
-  # Fallback: walk /run/media/ if lsblk produced nothing
   if [[ -z "$target" && -d "$MEDIA_ROOT" ]]; then
     while IFS= read -r -d '' mnt; do
       is_internal "$mnt" && continue
-      # Check label via lsblk on the device backing this mount
-      local dev
-      dev=$(findmnt -n -o SOURCE "$mnt" 2>/dev/null || true)
-      if [[ -n "$dev" ]]; then
-        local lbl
-        lbl=$(lsblk -n -o LABEL "$dev" 2>/dev/null || true)
-        local skip=0
-        for internal_lbl in "${INTERNAL_LABELS[@]}"; do
-          [[ "$lbl" == "$internal_lbl" ]] && skip=1 && break
-        done
-        [[ "$skip" -eq 1 ]] && continue
-      fi
       if mountpoint -q "$mnt" 2>/dev/null; then
         target="$mnt"
         break
@@ -128,16 +162,10 @@ for d in flatten(data.get('blockdevices', [])):
 }
 
 # ── Detect the configured system role ───────────────────────────
-#
-# Priority:
-#   1. Hub config JSON  (/var/lib/sovran-hub/config.json)  — "role" key
-#   2. role-state.nix   (/etc/nixos/role-state.nix)        — grep for true flag
-#   3. Default: server_plus_desktop
 
 detect_role() {
   local role="server_plus_desktop"
 
-  # 1. Try the Hub config JSON
   if [[ -f "$HUB_CONFIG_JSON" ]] && command -v python3 &>/dev/null; then
     local r
     r=$(python3 -c \
@@ -149,7 +177,6 @@ detect_role() {
     fi
   fi
 
-  # 2. Fall back to parsing role-state.nix
   if [[ -f "$ROLE_STATE_NIX" ]]; then
     if grep -q 'roles\.desktop = lib\.mkDefault true' "$ROLE_STATE_NIX" 2>/dev/null; then
       role="desktop"
@@ -161,6 +188,119 @@ detect_role() {
   echo "$role"
 }
 
+validate_target_mount() {
+  local target="$1"
+  [[ "$target" == "${MEDIA_ROOT}/"* ]] || fail "Target '$target' must be mounted under $MEDIA_ROOT."
+  [[ -d "$target" ]] || fail "Target path '$target' does not exist."
+  mountpoint -q "$target" || fail "Target path '$target' is not a mount point."
+
+  local fstype=""
+  fstype=$(findmnt -n -o FSTYPE -T "$target" 2>/dev/null || true)
+  [[ -n "$fstype" ]] || fail "Could not determine filesystem type for '$target'."
+
+  if [[ "$fstype" != "ext4" ]]; then
+    fail "Target '$target' must be formatted as ext4 (detected filesystem: $fstype). Manual Backup requires an ext4-formatted external drive for Linux metadata preservation. exFAT, FAT32, and NTFS are not supported."
+  fi
+
+  local write_test
+  write_test="$target/.sovran-write-test-$$"
+  if ! ( : > "$write_test" && echo "ok" >> "$write_test" && rm -f "$write_test" ); then
+    fail "Target '$target' is not writable."
+  fi
+
+  log "Verified backup target filesystem: $fstype"
+}
+
+estimate_path_bytes() {
+  local path="$1"
+  shift || true
+  [[ -e "$path" ]] || {
+    echo 0
+    return
+  }
+
+  local size
+  size=$(du -s -B1 -x "$@" "$path" 2>/dev/null | awk '{print $1}' || true)
+  [[ -n "$size" ]] || size=0
+  echo "$size"
+}
+
+# ── Sync one source tree to its backup destination ───────────────
+# Usage: sync_tree <label> <allow_vanished> <source> <destination> [rsync options...]
+#
+# allow_vanished: "yes" means rsync exit 24 (vanished files) is nonfatal.
+# Used for /home only — files may disappear while the desktop is active.
+# All other nonzero exit codes are always fatal.
+#
+# Before every rsync call this helper:
+#   1. Re-verifies $TARGET is still a mount point (fails if drive disconnected).
+#   2. Verifies the destination path remains beneath $BACKUP_DIR and $BACKUP_DIR
+#      remains beneath $TARGET (safe-path check).
+#   3. Creates the full destination directory hierarchy with mkdir -p so that
+#      rsync never fails trying to create a directory whose parent is absent.
+sync_tree() {
+  local label="$1"
+  local allow_vanished="$2"
+  local source="$3"
+  local destination="$4"
+  shift 4
+  # Remaining "$@" are rsync options (--exclude, etc.)
+
+  # ── Re-verify the external drive is still mounted ────────────────
+  mountpoint -q "$TARGET" 2>/dev/null || \
+    fail "Stage $label: external drive '$TARGET' is no longer mounted. Refusing to write."
+
+  # ── Verify path safety ────────────────────────────────────────────
+  # BACKUP_DIR must remain beneath TARGET.
+  case "$BACKUP_DIR" in
+    "$TARGET"/*) ;;
+    *) fail "Stage $label: BACKUP_DIR '$BACKUP_DIR' is outside TARGET '$TARGET'." ;;
+  esac
+  # Destination must remain beneath BACKUP_DIR.
+  case "$destination" in
+    "$BACKUP_DIR"/*|"$BACKUP_DIR") ;;
+    *) fail "Stage $label: destination '$destination' is outside BACKUP_DIR '$BACKUP_DIR'. Refusing to write." ;;
+  esac
+
+  # ── Create complete destination directory hierarchy ───────────────
+  # This is the fix for the production failure:
+  #   rsync: [Receiver] mkdir ".../current/etc/nixos" failed: No such file or directory
+  # mkdir -p creates all intermediate parents (e.g. current/etc/) before rsync runs.
+  mkdir -p -- "$destination" || \
+    fail "Stage $label: failed to create destination directory '$destination' (source: '$source')."
+
+  local rsync_err_tmp
+  rsync_err_tmp="$(mktemp /tmp/sovran-rsync-err.XXXXXX)"
+
+  local rc=0
+  rsync \
+    --archive \
+    --acls \
+    --xattrs \
+    --hard-links \
+    --numeric-ids \
+    --one-file-system \
+    --partial \
+    "$@" "$source" "$destination" 2>"$rsync_err_tmp" || rc=$?
+
+  if [[ -s "$rsync_err_tmp" ]]; then
+    while IFS= read -r rline; do
+      log "rsync: $rline"
+    done < "$rsync_err_tmp"
+  fi
+  rm -f "$rsync_err_tmp"
+
+  if [[ "$rc" -eq 0 ]]; then
+    return 0
+  elif [[ "$allow_vanished" == "yes" && "$rc" -eq 24 ]]; then
+    log "NOTE: $label — some files vanished during sync (normal on an active desktop). Your important data is backed up."
+    RSYNC_WARNINGS+=("$label: some files vanished during sync (rsync exit 24 — normal on active desktop)")
+    return 0
+  else
+    fail "rsync failed for $label (exit code $rc). See the rsync errors above."
+  fi
+}
+
 # ── Initialise log file ──────────────────────────────────────────
 
 : > "$BACKUP_LOG"
@@ -169,6 +309,30 @@ set_status "RUNNING"
 log "=== Sovran_SystemsOS External Hub Backup ==="
 log "Starting backup process…"
 
+# ── Acquire exclusive run lock ────────────────────────────────────
+# Prevents two simultaneous backup runs (e.g. from double-click or
+# stale RUNNING status after a Hub restart).
+
+LOCK_FILE="/var/lock/sovran-hub-backup.lock"
+# Note: exec {LOCK_FD}>>file requires bash 4.1+ (NixOS provides bash 5.x).
+exec {LOCK_FD}>>"$LOCK_FILE" 2>/dev/null || \
+  fail "Cannot open lock file: $LOCK_FILE. Ensure /var/lock is writable."
+flock --nonblock "$LOCK_FD" 2>/dev/null || \
+  fail "Another backup is already running. Wait for it to complete or check $BACKUP_STATUS."
+
+require_cmd rsync
+require_cmd findmnt
+require_cmd lsblk
+require_cmd mountpoint
+require_cmd df
+require_cmd du
+require_cmd awk
+require_cmd find
+require_cmd hostname
+require_cmd date
+require_cmd python3
+require_cmd flock
+
 # ── Detect system role ───────────────────────────────────────────
 
 ROLE="$(detect_role)"
@@ -184,7 +348,6 @@ log "Detected role: $ROLE_LABEL"
 
 if [[ -n "${BACKUP_TARGET:-}" ]]; then
   TARGET="$BACKUP_TARGET"
-  # Safety: never allow internal drives even if explicitly passed
   if is_internal "$TARGET"; then
     fail "Target '$TARGET' is an internal system drive and cannot be used for external backup."
   fi
@@ -193,39 +356,74 @@ else
   log "Auto-detecting external USB drives…"
   TARGET="$(find_external_drive)"
   if [[ -z "$TARGET" ]]; then
-    fail "No external USB drive detected. " \
+    fail "No external USB drive detected. Please plug in an ext4-formatted USB drive and try again."
-         "Please plug in an exFAT-formatted USB drive (≥500 GB) and try again."
   fi
   log "Detected external drive: $TARGET"
 fi
 
-# ── Verify mount point ───────────────────────────────────────────
+validate_target_mount "$TARGET"
 
-[[ -d "$TARGET" ]] || fail "Target path '$TARGET' does not exist."
+# ── Set up stable backup destination ────────────────────────────
-mountpoint -q "$TARGET" || fail "Target path '$TARGET' is not a mount point."
+# Subsequent runs update the same mirror, transferring only new or changed files.
 
-# ── Check free disk space (require ≥ 10 GB) ──────────────────────
+BACKUP_DIR="${TARGET}/${BACKUP_SUBPATH}"
+mkdir -p -- "$BACKUP_DIR"
 
-FREE_KB=$(df -k --output=avail "$TARGET" | tail -1)
+# Remove any stale BACKUP_COMPLETE left by a previous successful run.
-FREE_GB=$(( FREE_KB / 1024 / 1024 ))
+# The new run will re-earn it only after all stages succeed.
-log "Free space on drive: ${FREE_GB} GB"
+rm -f "$BACKUP_DIR/BACKUP_COMPLETE"
-(( FREE_GB >= MIN_FREE_GB )) || \
-  fail "Not enough free space on drive (${FREE_GB} GB available, ${MIN_FREE_GB} GB required)."
 
-# ── Create timestamped backup directory ─────────────────────────
+# Write an INCOMPLETE marker immediately; replaced by BACKUP_COMPLETE only
-
+# after all rsync stages and manifest write succeed. Failed or interrupted
-TIMESTAMP="$(date '+%Y%m%d_%H%M%S')"
+# runs keep this marker so they are clearly identifiable.
-BACKUP_DIR="${TARGET}/Sovran_SystemsOS_Backup/${TIMESTAMP}"
+touch "$BACKUP_DIR/INCOMPLETE"
-mkdir -p "$BACKUP_DIR"
 log "Backup destination: $BACKUP_DIR"
 
+# ── Estimate required free space ─────────────────────────────────
+# PostgreSQL/MariaDB raw directories and Bitcoin/Electrs data are excluded
+# from the estimate to avoid inflating the required size.
+
+ETC_NIXOS_BYTES=$(estimate_path_bytes /etc/nixos)
+HOME_BYTES=$(estimate_path_bytes /home --exclude='*/.cache' --exclude='*/.local/share/Trash' --exclude='*/Trash')
+SECRETS_BYTES=0
+if [[ "$ROLE" != "desktop" ]]; then
+  SECRETS_BYTES=$(estimate_path_bytes /etc/nix-bitcoin-secrets)
+fi
+
+VAR_LIB_BYTES=$(estimate_path_bytes /var/lib \
+  --exclude='postgresql' \
+  --exclude='mysql' \
+  --exclude='mariadb' \
+  --exclude='bitcoind' \
+  --exclude='electrs' \
+  --exclude='*/log' \
+  --exclude='*/logs' \
+  --exclude='*/cache' \
+  --exclude='*/tmp')
+
+ESTIMATED_BYTES=$(( ETC_NIXOS_BYTES + HOME_BYTES + SECRETS_BYTES + VAR_LIB_BYTES ))
+# Require 20% growth headroom plus a fixed 1 GiB safety margin.
+# Later incremental runs need far less space, but a conservative first-run
+# check protects against running out of space mid-backup.
+REQUIRED_BYTES=$(( ESTIMATED_BYTES + (ESTIMATED_BYTES / 5) + SAFETY_MARGIN_BYTES ))
+
+FREE_BYTES=$(df -B1 --output=avail "$TARGET" | tail -1 | tr -d ' ')
+FREE_GB=$(( FREE_BYTES / 1024 / 1024 / 1024 ))
+REQUIRED_GB=$(( REQUIRED_BYTES / 1024 / 1024 / 1024 ))
+
+log "Estimated backup size: $(( ESTIMATED_BYTES / 1024 / 1024 / 1024 )) GB"
+log "Required free space (with safety margin): ${REQUIRED_GB} GB"
+log "Free space on drive: ${FREE_GB} GB"
+
+(( FREE_BYTES >= REQUIRED_BYTES )) || \
+  fail "Not enough free space on drive (${FREE_GB} GB available, ${REQUIRED_GB} GB required)."
+
 # ── Stage 1/4: NixOS configuration ──────────────────────────────
 
 log ""
 log "── Stage 1/4: NixOS configuration (/etc/nixos) ──────────────"
 if [[ -d /etc/nixos ]]; then
-  rsync -a --info=progress2 /etc/nixos/ "$BACKUP_DIR/nixos/" 2>&1 | tee -a "$BACKUP_LOG" || \
+  sync_tree "/etc/nixos" no /etc/nixos/ "$BACKUP_DIR/etc/nixos/"
-    fail "Stage 1 failed while copying /etc/nixos"
   log "Stage 1 complete."
 else
   log "WARNING: /etc/nixos not found — skipping."
@@ -234,64 +432,64 @@ fi
 # ── Stage 2/4: Secrets ──────────────────────────────────────────
 
 log ""
-log "── Stage 2/4: Secrets ───────────────────────────────────────"
+log "── Stage 2/4: Secrets (/etc/nix-bitcoin-secrets) ───────────"
-mkdir -p "$BACKUP_DIR/secrets"
-
 if [[ "$ROLE" == "desktop" ]]; then
   log "Skipping /etc/nix-bitcoin-secrets — not applicable for Desktop Only role."
+elif [[ -e /etc/nix-bitcoin-secrets ]]; then
+  sync_tree "/etc/nix-bitcoin-secrets" no /etc/nix-bitcoin-secrets/ "$BACKUP_DIR/etc/nix-bitcoin-secrets/"
 else
-  if [[ -e /etc/nix-bitcoin-secrets ]]; then
+  log "(not found: /etc/nix-bitcoin-secrets — skipping)"
-    rsync -a --info=progress2 /etc/nix-bitcoin-secrets "$BACKUP_DIR/secrets/" 2>&1 | tee -a "$BACKUP_LOG" || \
-      log "WARNING: Could not copy /etc/nix-bitcoin-secrets — continuing."
-  else
-    log "  (not found: /etc/nix-bitcoin-secrets — skipping)"
-  fi
 fi
-
 log "Stage 2 complete."
 
-# ── Stage 3/4: Home directory ────────────────────────────────────
+# ── Stage 3/4: Home directory ───────────────────────────────────
+# Rsync exit code 24 (vanished source files) is treated as nonfatal here
+# because the desktop may be active and files can disappear between the
+# directory scan and the copy. All other nonzero exit codes remain fatal.
 
 log ""
 log "── Stage 3/4: Home directory (/home) ───────────────────────"
 if [[ -d /home ]]; then
-  rsync -a --info=progress2 \
+  sync_tree "/home" yes /home/ "$BACKUP_DIR/home/" \
     --exclude='.cache/' \
     --exclude='.local/share/Trash/' \
-    --exclude='*/Trash/' \
+    --exclude='Trash/' \
-    /home/ "$BACKUP_DIR/home/" 2>&1 | tee -a "$BACKUP_LOG" || \
+    --exclude='.mozilla/firefox/*/cache2/' \
-    fail "Stage 3 failed while copying /home"
+    --exclude='.mozilla/firefox/*/startupCache/' \
+    --exclude='.mozilla/firefox/*/thumbnails/' \
+    --exclude='.config/google-chrome/*/Cache/' \
+    --exclude='.config/google-chrome/*/Code Cache/' \
+    --exclude='.config/chromium/*/Cache/' \
+    --exclude='.config/chromium/*/Code Cache/' \
+    --exclude='.config/BraveSoftware/Brave-Browser/*/Cache/' \
+    --exclude='.config/BraveSoftware/Brave-Browser/*/Code Cache/' \
+    --exclude='.local/share/baloo/' \
+    --exclude='.thumbnails/' \
+    --exclude='.xsession-errors' \
+    --exclude='.xsession-errors.old'
   log "Stage 3 complete."
 else
   log "WARNING: /home not found — skipping."
 fi
 
-# ── Stage 4/4: System data ───────────────────────────────────────
+# ── Stage 4/4: System data ──────────────────────────────────────
+# PostgreSQL/MariaDB raw database directories are excluded. Application
+# databases must be backed up separately with native database tools.
+# Bitcoin/Electrs data are excluded; they live on the internal second drive.
 
 log ""
-log "── Stage 4/4: System data (/var/lib) ────────────────────────"
+log "── Stage 4/4: System data (/var/lib) ───────────────────────"
-if [[ "$ROLE" == "desktop" ]]; then
+if [[ -d /var/lib ]]; then
-  if [[ -d /var/lib ]]; then
+  sync_tree "/var/lib" no /var/lib/ "$BACKUP_DIR/var/lib/" \
-    rsync -a --info=progress2 \
+    --exclude='postgresql/' \
-      --filter='- /lnd/***' \
+    --exclude='mysql/' \
-      --exclude='logs/' \
+    --exclude='mariadb/' \
-      --exclude='log/' \
+    --exclude='bitcoind/' \
-      --exclude='*/logs/' \
+    --exclude='electrs/' \
     --exclude='*/log/' \
-      /var/lib/ "$BACKUP_DIR/var-lib/" 2>&1 | tee -a "$BACKUP_LOG" || \
-      fail "Stage 4 failed while copying /var/lib for Desktop Only role"
-    log "Stage 4 complete (Desktop Only role excludes /var/lib/lnd)."
-  else
-    log "WARNING: /var/lib not found — skipping."
-  fi
-elif [[ -d /var/lib ]]; then
-  rsync -a --info=progress2 \
-    --exclude='logs/' \
-    --exclude='log/' \
     --exclude='*/logs/' \
-    --exclude='*/log/' \
+    --exclude='*/cache/' \
-    /var/lib/ "$BACKUP_DIR/var-lib/" 2>&1 | tee -a "$BACKUP_LOG" || \
+    --exclude='*/tmp/'
-    fail "Stage 4 failed while copying /var/lib"
   log "Stage 4 complete."
 else
   log "WARNING: /var/lib not found — skipping."
@@ -301,21 +499,91 @@ fi
 
 log ""
 log "Generating BACKUP_MANIFEST.txt …"
+MANIFEST_FILE="$BACKUP_DIR/BACKUP_MANIFEST.txt"
+
 {
   echo "Sovran_SystemsOS Backup Manifest"
-  echo "Generated: $(date)"
+  echo "Updated:   $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
   echo "Hostname:  $(hostname)"
   echo "Role:      $ROLE_LABEL"
   echo "Target:    $TARGET"
   echo ""
-  echo "Contents:"
+  echo "Backup type: Live rsync mirror (directly browsable files)"
-  find "$BACKUP_DIR" -mindepth 1 -maxdepth 2 | sort
+  echo "Location:    ${BACKUP_DIR}"
-} > "$BACKUP_DIR/BACKUP_MANIFEST.txt"
+  echo ""
-log "Manifest written to $BACKUP_DIR/BACKUP_MANIFEST.txt"
+  echo "Source paths mirrored:"
+  echo "- /etc/nixos  →  current/etc/nixos/"
+  if [[ "$ROLE" != "desktop" ]]; then
+    echo "- /etc/nix-bitcoin-secrets (when present)  →  current/etc/nix-bitcoin-secrets/"
+  fi
+  echo "- /home  →  current/home/"
+  echo "- /var/lib  →  current/var/lib/"
+  echo ""
+  echo "Exclusions:"
+  echo "- /var/lib/postgresql (PostgreSQL raw database files — not included)"
+  echo "- /var/lib/mysql, /var/lib/mariadb (MariaDB raw database files — not included)"
+  echo "- /var/lib/bitcoind (Bitcoin blockchain — excluded; lives on internal second drive)"
+  echo "- /var/lib/electrs (Electrs index — excluded; lives on internal second drive)"
+  echo "- /run/media/Second_Drive (internal second drive — never traversed)"
+  echo "- /var/lib/*/log, /var/lib/*/logs, /var/lib/*/cache, /var/lib/*/tmp"
+  echo "- Browser disk caches, thumbnail caches, trash directories, X session error logs"
+  echo ""
+  echo "Important limitations:"
+  echo "- PostgreSQL and MariaDB/MySQL application databases are NOT included in this"
+  echo "  backup. If you use Nextcloud, Matrix/Synapse, or other database-backed"
+  echo "  applications, their data must be backed up separately using native tools."
+  echo "- Bitcoin blockchain data and Electrs indexes are NOT included; they are"
+  echo "  reconstructable or stored on the internal second drive."
+  echo "- This is a live file-level mirror, not a transactional database backup."
+  echo "  Files being written during the backup may be in an inconsistent state."
+  echo ""
+  echo "Restore guidance:"
+  echo "- Files are directly browsable on the backup drive under: ${BACKUP_DIR}"
+  echo "- To restore a directory:"
+  echo "    sudo rsync -aAXH --numeric-ids current/etc/nixos/ /etc/nixos/"
+  echo "    sudo rsync -aAXH --numeric-ids current/home/ /home/"
+  echo "    sudo rsync -aAXH --numeric-ids current/var/lib/ /var/lib/"
+  echo "- To copy individual files:"
+  echo "    sudo cp -a current/home/username/ /home/username/"
+  echo "- When restoring /etc/nixos to replacement hardware, regenerate"
+  echo "  hardware-configuration.nix for the new hardware before rebuilding."
+  echo ""
+  echo "Nonfatal warnings:"
+  if [[ "${#RSYNC_WARNINGS[@]}" -eq 0 ]]; then
+    echo "- none"
+  else
+    for warning in "${RSYNC_WARNINGS[@]}"; do
+      echo "- $warning"
+    done
+  fi
+  echo ""
+  echo "Note: Bitcoin blockchain and Electrs index data are intentionally excluded"
+  echo "from manual external backup because they already live on the internal second drive"
+  echo "(/run/media/Second_Drive) and are reconstructable/internal-backup data."
+} > "$MANIFEST_FILE"
+
+log "Manifest written to $MANIFEST_FILE"
 
 # ── Done ─────────────────────────────────────────────────────────
 
 log ""
+if [[ "${#RSYNC_WARNINGS[@]}" -gt 0 ]]; then
+  log "Backup completed with nonfatal warnings:"
+  for warning in "${RSYNC_WARNINGS[@]}"; do
+    log "  WARNING: $warning"
+  done
+  log "Your important data is backed up. The warnings above indicate files that"
+  log "vanished during backup, which is normal on an active desktop."
+  log ""
+fi
 log "All Finished! Your data is now backed up to a third location."
+log "Files are directly browsable on the drive under: ${BACKUP_DIR}"
 log "Please eject the drive safely before removing it from your Sovran Pro."
+
+# Remove incomplete marker and write completion marker only after all work succeeds.
+# A later successful run will update the same mirror and replace any INCOMPLETE state.
+rm -f "$BACKUP_DIR/INCOMPLETE"
+date -u '+%Y-%m-%dT%H:%M:%SZ' > "$BACKUP_DIR/BACKUP_COMPLETE"
+
+BACKUP_COMPLETE=1
 set_status "SUCCESS"

app/sovran_systemsos_web/static/css/domain-setup.css

@@ -171,3 +171,15 @@ domain-field-actions {
 .port-req-status {
   font-weight: 600;
 }
+
+/* ── Wallet Connections unique-hostname warning ───────────────────── */
+
+.domain-nwc-warning {
+  margin-bottom: 14px;
+  padding: 10px 14px;
+  background: rgba(255, 180, 0, 0.10);
+  border: 1px solid var(--warning-color, #f59e0b);
+  border-radius: 8px;
+  font-size: 0.88rem;
+  line-height: 1.6;
+}

app/sovran_systemsos_web/static/css/header.css

@@ -91,3 +91,30 @@
   border-color: var(--accent-color);
   color: var(--accent-color);
 }
+
+/* ── Header reboot button ───────────────────────────────────────── */
+
+.btn-header-reboot {
+  background: transparent;
+  border: 1px solid rgba(184, 125, 0, 0.35);
+  color: #c98d08;
+  font-size: 0.78rem;
+  font-weight: 600;
+  padding: 4px 12px;
+  border-radius: var(--radius-btn);
+  cursor: pointer;
+  transition: border-color 0.15s, color 0.15s, background-color 0.15s;
+}
+
+.btn-header-reboot:hover {
+  border-color: #b87d00;
+  color: #e0a010;
+  background-color: rgba(184, 125, 0, 0.1);
+}
+
+@media (max-width: 480px) {
+  .btn-header-reboot {
+    padding: 4px 8px;
+    font-size: 0.72rem;
+  }
+}

app/sovran_systemsos_web/static/css/modals.css

@@ -102,6 +102,48 @@ button.btn-reboot:hover:not(:disabled) {
   background-color: #529E7E;
 }
 
+/* Restart = AMBER (manual restart action) */
+.btn-restart-amber {
+  background-color: #b87d00;
+  color: #fff;
+}
+
+.btn-restart-amber:hover:not(:disabled) {
+  background-color: #9a6800;
+}
+
+/* Restart conflict warning box */
+.restart-conflict-box {
+  background-color: rgba(180, 100, 0, 0.12);
+  border-left: 3px solid #c97a00;
+  border-radius: 6px;
+  padding: 12px 14px;
+  margin-bottom: 14px;
+}
+
+.restart-conflict-title {
+  font-size: 0.88rem;
+  font-weight: 700;
+  color: #e69000;
+  margin: 0 0 6px 0;
+}
+
+.restart-conflict-desc {
+  font-size: 0.83rem;
+  color: var(--text-secondary);
+  line-height: 1.5;
+  margin: 0;
+}
+
+/* Reboot error card actions row */
+.reboot-error-actions {
+  display: flex;
+  gap: 12px;
+  justify-content: center;
+  flex-wrap: wrap;
+  margin-top: 20px;
+}
+
 .btn-save {
   background-color: var(--yellow);
   color: #0A1A10;
@@ -436,3 +478,46 @@ button.btn-reboot:hover:not(:disabled) {
   color: var(--text-secondary);
   font-style: italic;
 }
+
+.nwc-secret-warning {
+  margin: 0 0 14px;
+  padding: 10px 12px;
+  border-radius: 8px;
+  border: 1px solid #f59e0b;
+  background: rgba(245, 158, 11, 0.12);
+  color: #fbbf24;
+  font-size: 0.86rem;
+}
+
+.nwc-wallet-list {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+  margin-top: 12px;
+}
+
+.nwc-wallet-card {
+  border: 1px solid var(--border-color);
+  border-radius: 10px;
+  padding: 12px;
+  background: rgba(255, 255, 255, 0.02);
+}
+
+.nwc-wallet-card-title {
+  font-weight: 700;
+  margin-bottom: 8px;
+  color: var(--text-primary);
+}
+
+.nwc-wallet-actions {
+  display: flex;
+  gap: 8px;
+  flex-wrap: wrap;
+  margin-top: 10px;
+}
+
+.nwc-wallet-actions .matrix-form-back,
+.nwc-wallet-actions .btn-close-modal {
+  padding: 8px 12px;
+  font-size: 0.82rem;
+}

app/sovran_systemsos_web/static/css/tiles.css

@@ -155,6 +155,69 @@
   white-space: nowrap;
 }
 
+/* ── BIP-110 status badge (tile + detail modal) ───────────────────── */
+
+.tile-bip110-badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 3px;
+  font-size: 0.64rem;
+  font-weight: 600;
+  border-radius: 4px;
+  padding: 2px 6px;
+  margin-top: 4px;
+  white-space: nowrap;
+  letter-spacing: 0.02em;
+}
+
+.tile-bip110-badge--active {
+  background: rgba(109, 191, 139, 0.18);
+  color: var(--green);
+  border: 1px solid rgba(109, 191, 139, 0.3);
+}
+
+.tile-bip110-badge--locked_in {
+  background: rgba(94, 173, 138, 0.15);
+  color: var(--accent-color);
+  border: 1px solid rgba(94, 173, 138, 0.3);
+}
+
+.tile-bip110-badge--signaling {
+  background: rgba(94, 173, 138, 0.12);
+  color: var(--accent-color);
+  border: 1px solid rgba(94, 173, 138, 0.2);
+}
+
+.tile-bip110-badge--not_signaling {
+  background: rgba(229, 165, 10, 0.12);
+  color: var(--yellow);
+  border: 1px solid rgba(229, 165, 10, 0.25);
+}
+
+.tile-bip110-badge--unsupported {
+  background: rgba(94, 122, 106, 0.12);
+  color: var(--grey);
+  border: 1px solid rgba(94, 122, 106, 0.2);
+}
+
+.tile-bip110-badge--unknown {
+  background: transparent;
+  color: var(--text-dim);
+  border: 1px solid var(--border-color);
+}
+
+.bip110-status-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+
+.bip110-source-label {
+  color: var(--text-dim);
+  font-size: 0.75rem;
+}
+
 /* ── Service detail modal sections ───────────────────────────────── */
 
 .svc-detail-section {

app/sovran_systemsos_web/static/js/events.js

@@ -44,6 +44,28 @@ if ($upgradeCloseBtn) $upgradeCloseBtn.addEventListener("click", closeUpgradeMod
 if ($upgradeCancelBtn) $upgradeCancelBtn.addEventListener("click", closeUpgradeModal);
 if ($upgradeModal) $upgradeModal.addEventListener("click", function(e) { if (e.target === $upgradeModal) closeUpgradeModal(); });
 
+// Restart confirm dialog
+if ($restartConfirmCancel) $restartConfirmCancel.addEventListener("click", closeRestartConfirmDialog);
+if ($restartConfirmModal) $restartConfirmModal.addEventListener("click", function(e) { if (e.target === $restartConfirmModal) closeRestartConfirmDialog(); });
+if ($restartConfirmModal) $restartConfirmModal.addEventListener("keydown", function(e) { if (e.key === "Escape") closeRestartConfirmDialog(); });
+
+// Header Reboot button
+if ($headerRebootBtn) $headerRebootBtn.addEventListener("click", function() { openRestartConfirmDialog(); });
+if ($restartConfirmOk) $restartConfirmOk.addEventListener("click", function() {
+  if ($restartConfirmOk.disabled) return;
+  $restartConfirmOk.disabled = true;
+  closeRestartConfirmDialog();
+  doReboot();
+});
+
+// Reboot error card buttons
+var $rebootErrorCloseBtn = document.getElementById("reboot-error-close-btn");
+var $rebootErrorRetryBtn = document.getElementById("reboot-error-retry-btn");
+if ($rebootErrorCloseBtn) $rebootErrorCloseBtn.addEventListener("click", function() {
+  if ($rebootOverlay) $rebootOverlay.classList.remove("visible");
+});
+if ($rebootErrorRetryBtn) $rebootErrorRetryBtn.addEventListener("click", doReboot);
+
 // ── Upgrade modal functions ───────────────────────────────────────
 
 function openUpgradeModal() {
@@ -54,6 +76,37 @@ function closeUpgradeModal() {
   if ($upgradeModal) $upgradeModal.classList.remove("open");
 }
 
+// ── Restart confirm dialog functions ─────────────────────────────
+
+var _restartDialogOpener = null;
+
+function openRestartConfirmDialog() {
+  if (!$restartConfirmModal) return;
+  _restartDialogOpener = document.activeElement;
+
+  // Detect conflicting operations
+  var isOperationInProgress = !!_updatePollTimer || !!_rebuildPollTimer;
+  if ($restartConflictBox) $restartConflictBox.style.display = isOperationInProgress ? "" : "none";
+  if ($restartConfirmOk) $restartConfirmOk.disabled = isOperationInProgress;
+
+  $restartConfirmModal.classList.add("open");
+
+  // Focus Cancel initially for safety
+  var cancelBtn = document.getElementById("restart-confirm-cancel-btn");
+  if (cancelBtn) setTimeout(function() { cancelBtn.focus(); }, 50);
+}
+
+function closeRestartConfirmDialog() {
+  if ($restartConfirmModal) $restartConfirmModal.classList.remove("open");
+  // Re-enable confirm button for next open
+  if ($restartConfirmOk) $restartConfirmOk.disabled = false;
+  // Return focus to the element that opened the dialog
+  if (_restartDialogOpener && _restartDialogOpener.focus) {
+    try { _restartDialogOpener.focus(); } catch (_) {}
+    _restartDialogOpener = null;
+  }
+}
+
 async function doUpgradeToServer() {
   var confirmBtn = $upgradeConfirmBtn;
   if (confirmBtn) { confirmBtn.disabled = true; confirmBtn.textContent = "Upgrading…"; }

app/sovran_systemsos_web/static/js/features.js

@@ -59,6 +59,8 @@ function openDomainSetupModal(feat, onSaved) {
   if (!$domainSetupModal) return;
   if ($domainSetupTitle) $domainSetupTitle.textContent = "🌐 Domain Setup — " + feat.name;
 
+  var isWalletConnections = (feat.id === "nwc-wallets" || feat.domain_name === "lightning");
+
   var npubField = "";
   if (feat.id === "haven") {
     var currentNpub = "";
@@ -73,23 +75,60 @@ function openDomainSetupModal(feat, onSaved) {
     npubField = '<div class="domain-field-group"><label class="domain-field-label" for="domain-npub-input">Nostr Public Key (npub1...):</label><input class="domain-field-input" type="text" id="domain-npub-input" placeholder="npub1..." value="' + escHtml(currentNpub) + '" /></div>';
   }
 
-  var externalIp = _cachedExternalIp || "your external IP";
+  var nwcWarning = isWalletConnections
+    ? '<div class="domain-nwc-warning">' +
+      '<strong>⚠ Wallet Connections requires its own unique hostname.</strong> ' +
+      'Use a new subdomain such as <code>lightning.yourdomain.com</code>, or a separate domain. ' +
+      'Do not reuse a domain already assigned to Matrix, Nextcloud, WordPress, BTCPay Server, Vaultwarden, Haven, or another Caddy site.' +
+      '</div>'
+    : '';
+
+  var domainPlaceholder = isWalletConnections ? "lightning.yourdomain.com" : "myservice.example.com";
+  var domainLabelExample = isWalletConnections ? "lightning.yourdomain.com" : "call.yourdomain.com";
+
+  var introHtml;
+  if (_currentRole === "node") {
+    introHtml =
+      '<p>To enable <strong>' + escHtml(feat.name) + '</strong>, it needs its own domain from Njal.la.</p>' +
+      '<ol style="margin:8px 0 0 16px;padding:0;line-height:1.7;">' +
+      '<li>Create an account at <a href="https://njal.la" target="_blank" rel="noopener noreferrer" style="color:var(--accent-color);">njal.la</a>.</li>' +
+      '<li>Set up a domain for it — either a free subdomain or a separate domain. Pick one option:</li>' +
+      '</ol>';
+  } else {
+    introHtml =
+      '<p>To enable <strong>' + escHtml(feat.name) + '</strong>, it needs its own domain from Njal.la. ' +
+      'In your Njal.la account, set up a domain for it — either a free subdomain or a separate domain. Pick one option:</p>';
+  }
 
   $domainSetupBody.innerHTML =
     '<div class="domain-setup-intro">' +
-    '<p><strong>Before continuing:</strong></p>' +
+    nwcWarning +
-    '<ol>' +
+    introHtml +
-    '<li>Create an account at <a href="https://njal.la" target="_blank" rel="noopener noreferrer" style="color:var(--accent-color);">https://njal.la</a></li>' +
+    '<details style="margin-top:10px;">' +
-    '<li>Purchase a new domain on Njal.la, or create a subdomain from a domain you already own. Tip: Subdomains are free to create — you only need to purchase one domain, and you can add as many subdomains as you need at no extra cost.</li>' +
+    '<summary style="cursor:pointer;font-weight:600;">Option A — Free subdomain (recommended)</summary>' +
-    '<li>In the Njal.la web interface, create a <strong>Dynamic</strong> record pointing to this machine\'s external IP address:<br>' +
+    '<ol style="margin:8px 0 0 16px;padding:0;line-height:1.7;">' +
-    '<span style="display:inline-block;margin-top:4px;padding:4px 10px;background:var(--card-color);border:1px solid var(--border-color);border-radius:6px;font-family:monospace;font-size:1em;font-weight:700;">' + escHtml(externalIp) + '</span></li>' +
+    '<li>In Njal.la, open a domain you own and click &quot;Add record&quot;.</li>' +
-    '<li>Njal.la will give you a curl command like:<br>' +
+    '<li>Set record type to <strong>Dynamic</strong>.</li>' +
-    '<code style="font-size:0.8em;">curl &quot;https://njal.la/update/?h=sub.domain.com&amp;k=abc123&amp;auto&quot;</code></li>' +
+    '<li>In the <strong>Name</strong> field, type ONLY the host part — the word before your domain.<br>' +
-    '<li>Enter the subdomain and paste that curl command below</li>' +
+    '(Example only, your choice — for &quot;' + domainLabelExample + '&quot; you&apos;d type just: &nbsp;<code>' + (isWalletConnections ? 'lightning' : 'call') + '</code>)<br>' +
+    '&#9888; Do NOT type the full domain here — Njal.la adds it automatically.</li>' +
+    '<li>A Dynamic record has NO IP field — the IP auto-fills after the rebuild/reboot.</li>' +
+    '<li>Copy the curl command Njal.la gives you, e.g.:<br>' +
+    '<code style="font-size:0.8em;">curl &quot;https://njal.la/update/?h=' + domainLabelExample + '&amp;k=abc123&amp;auto&quot;</code></li>' +
     '</ol>' +
+    '</details>' +
+    '<details style="margin-top:6px;">' +
+    '<summary style="cursor:pointer;font-weight:600;">Option B — Separate / new domain</summary>' +
+    '<ol style="margin:8px 0 0 16px;padding:0;line-height:1.7;">' +
+    '<li>In Njal.la, buy the domain you want.</li>' +
+    '<li>Add a Dynamic record as in Option A. If this domain is dedicated to the service, leave the Name field blank or use <code>@</code>.</li>' +
+    '<li>Copy the curl command Njal.la gives you.</li>' +
+    '</ol>' +
+    '</details>' +
+    '<p style="margin-top:10px;">Below, enter the full domain for this service — a subdomain (e.g. ' + domainLabelExample + ') or a separate domain — and paste its curl command.</p>' +
     '</div>' +
-    '<div class="domain-field-group"><label class="domain-field-label" for="domain-subdomain-input">Subdomain (e.g. myservice.example.com):</label><input class="domain-field-input" type="text" id="domain-subdomain-input" placeholder="myservice.example.com" /></div>' +
+    '<div class="domain-field-group"><label class="domain-field-label" for="domain-subdomain-input">Service domain (e.g. ' + domainLabelExample + '):</label><input class="domain-field-input" type="text" id="domain-subdomain-input" placeholder="' + domainPlaceholder + '" /></div>' +
-    '<div class="domain-field-group"><label class="domain-field-label" for="domain-ddns-input">Njal.la Dynamic DNS Update Command:</label><input class="domain-field-input" type="text" id="domain-ddns-input" placeholder="curl &quot;https://njal.la/update/?h=myservice.example.com&amp;k=abc123&amp;auto&quot;" /><p class="domain-field-hint">ℹ Paste the full curl command from your Njal.la dashboard\'s Dynamic record</p></div>' +
+    '<div class="domain-field-group"><label class="domain-field-label" for="domain-ddns-input">Njal.la Dynamic DNS Update Command:</label><input class="domain-field-input" type="text" id="domain-ddns-input" placeholder="curl &quot;https://njal.la/update/?h=' + domainPlaceholder + '&amp;k=abc123&amp;auto&quot;" /><p class="domain-field-hint">ℹ Paste the full curl command from your Njal.la dashboard\'s Dynamic record</p></div>' +
     npubField +
     '<div class="domain-field-actions"><button class="btn btn-close-modal" id="domain-setup-cancel-btn">Cancel</button><button class="btn btn-primary" id="domain-setup-save-btn">Save &amp; Enable</button></div>';
 
@@ -103,7 +142,7 @@ function openDomainSetupModal(feat, onSaved) {
     ddnsUrl   = ddnsUrl.trim();
     npub      = npub.trim();
 
-    if (!subdomain) { alert("Please enter a subdomain."); return; }
+    if (!subdomain) { alert("Please enter a domain."); return; }
     if (feat.id === "haven" && !npub) { alert("Please enter your Nostr public key."); return; }
 
     var saveBtn = document.getElementById("domain-setup-save-btn");
@@ -125,7 +164,8 @@ function openDomainSetupModal(feat, onSaved) {
     } catch (err) {
       saveBtn.disabled = false;
       saveBtn.textContent = "Save & Enable";
-      alert("Failed to save domain. Please try again.");
+      var msg = (err && err.message) ? err.message : "Failed to save domain. Please try again.";
+      alert(msg);
     }
   });
 
@@ -136,6 +176,8 @@ function openDomainReconfigureModal(feat, existingDomain, onSaved) {
   if (!$domainSetupModal) return;
   if ($domainSetupTitle) $domainSetupTitle.textContent = "🔄 Reconfigure Domain — " + feat.name;
 
+  var isWalletConnections = (feat.id === "nwc-wallets" || feat.domain_name === "lightning");
+
   var npubField = "";
   if (feat.id === "haven") {
     var currentNpub = "";
@@ -150,24 +192,36 @@ function openDomainReconfigureModal(feat, existingDomain, onSaved) {
     npubField = '<div class="domain-field-group"><label class="domain-field-label" for="domain-npub-input">Nostr Public Key (npub1...):</label><input class="domain-field-input" type="text" id="domain-npub-input" placeholder="npub1..." value="' + escHtml(currentNpub) + '" /></div>';
   }
 
+  var nwcWarning = isWalletConnections
+    ? '<div class="domain-nwc-warning">' +
+      '<strong>⚠ Wallet Connections requires its own unique hostname.</strong> ' +
+      'Use a new subdomain such as <code>lightning.yourdomain.com</code>, or a separate domain. ' +
+      'Do not reuse a domain already assigned to Matrix, Nextcloud, WordPress, BTCPay Server, Vaultwarden, Haven, or another Caddy site.' +
+      '</div>'
+    : '';
+
+  var domainPlaceholder = isWalletConnections ? "lightning.yourdomain.com" : "myservice.example.com";
+  var domainLabelExample = isWalletConnections ? "lightning.yourdomain.com" : "call.yourdomain.com";
+
   var externalIp = _cachedExternalIp || "your external IP";
   var currentDomain = existingDomain || "";
 
   $domainSetupBody.innerHTML =
     '<div class="domain-setup-intro">' +
+    nwcWarning +
     '<p>Your domain <strong>' + escHtml(currentDomain || "this domain") + '</strong> is configured but isn\'t resolving correctly.</p>' +
     '<p><strong>Troubleshooting steps:</strong></p>' +
     '<ol>' +
     '<li>Log into your Njal.la dashboard at <a href="https://njal.la" target="_blank" rel="noopener noreferrer" style="color:var(--accent-color);">https://njal.la</a></li>' +
-    '<li>Find the DNS record for <strong>' + escHtml(currentDomain || "your domain") + '</strong></li>' +
+    '<li>Find the DNS record for <strong>' + escHtml(currentDomain || "your domain") + '</strong>. In Njal.la\'s Name field, note that only the host part is stored (the word before the domain) — not the full domain.</li>' +
     '<li>Verify it has a <strong>Dynamic</strong> record pointing to your current external IP:<br>' +
     '<span style="display:inline-block;margin-top:4px;padding:4px 10px;background:var(--card-color);border:1px solid var(--border-color);border-radius:6px;font-family:monospace;font-size:1em;font-weight:700;">' + escHtml(externalIp) + '</span></li>' +
     '<li>If the IP is wrong or the record is missing, update it</li>' +
     '<li>If you changed the DDNS curl command, paste the updated one below</li>' +
     '</ol>' +
     '</div>' +
-    '<div class="domain-field-group"><label class="domain-field-label" for="domain-subdomain-input">Subdomain (e.g. myservice.example.com):</label><input class="domain-field-input" type="text" id="domain-subdomain-input" placeholder="myservice.example.com" value="' + escHtml(currentDomain) + '" /></div>' +
+    '<div class="domain-field-group"><label class="domain-field-label" for="domain-subdomain-input">Service domain (e.g. ' + domainLabelExample + '):</label><input class="domain-field-input" type="text" id="domain-subdomain-input" placeholder="' + domainPlaceholder + '" value="' + escHtml(currentDomain) + '" /></div>' +
-    '<div class="domain-field-group"><label class="domain-field-label" for="domain-ddns-input">Njal.la Dynamic DNS Update Command:</label><input class="domain-field-input" type="text" id="domain-ddns-input" placeholder="curl &quot;https://njal.la/update/?h=myservice.example.com&amp;k=abc123&amp;auto&quot;" /><p class="domain-field-hint">ℹ Paste the full curl command from your Njal.la dashboard\'s Dynamic record</p></div>' +
+    '<div class="domain-field-group"><label class="domain-field-label" for="domain-ddns-input">Njal.la Dynamic DNS Update Command:</label><input class="domain-field-input" type="text" id="domain-ddns-input" placeholder="curl &quot;https://njal.la/update/?h=' + domainPlaceholder + '&amp;k=abc123&amp;auto&quot;" /><p class="domain-field-hint">ℹ Paste the full curl command from your Njal.la dashboard\'s Dynamic record</p></div>' +
     npubField +
     '<div class="domain-field-actions"><button class="btn btn-close-modal" id="domain-setup-cancel-btn">Cancel</button><button class="btn btn-primary" id="domain-setup-save-btn">Save &amp; Update</button></div>';
 
@@ -203,7 +257,8 @@ function openDomainReconfigureModal(feat, existingDomain, onSaved) {
     } catch (err) {
       saveBtn.disabled = false;
       saveBtn.textContent = "Save & Update";
-      alert("Failed to save domain. Please try again.");
+      var msg = (err && err.message) ? err.message : "Failed to save domain. Please try again.";
+      alert(msg);
     }
   });
 
@@ -413,16 +468,11 @@ function handleFeatureToggle(feat, newEnabled) {
       });
   }
 
-  if (conflictNames.length > 0) {
+  if (feat.id === "bitcoin-core") {
-    var confirmMsg;
+    var confirmMsg = "Only one Bitcoin node implementation can be active. Enabling Bitcoin Core will replace Bitcoin Knots + BIP110 as the active node. Your timechain data will be preserved — you will not need to re-download the timechain. Continue?";
-    if (feat.id === "bip110") {
-      confirmMsg = "Only one Bitcoin node implementation can be active. Enabling Bitcoin Knots + BIP110 will disable Bitcoin Core (if active). Your timechain data will be preserved — you will not need to re-download the timechain. Continue?";
-    } else if (feat.id === "bitcoin-core") {
-      confirmMsg = "Only one Bitcoin node implementation can be active. Enabling Bitcoin Core will disable Bitcoin Knots + BIP110 (if active). Your timechain data will be preserved — you will not need to re-download the timechain. Continue?";
-    } else {
-      confirmMsg = "This will disable " + conflictNames.join(", ") + ". Continue?";
-    }
     openFeatureConfirm(confirmMsg, proceedAfterConflictCheck);
+  } else if (conflictNames.length > 0) {
+    openFeatureConfirm("This will disable " + conflictNames.join(", ") + ". Continue?", proceedAfterConflictCheck);
   } else {
     proceedAfterConflictCheck();
   }

app/sovran_systemsos_web/static/js/helpers.js

@@ -55,8 +55,31 @@ async function apiFetch(path, options) {
   const res = await fetch(path, options || {});
   if (!res.ok) {
     let detail = res.status + " " + res.statusText;
-    try { const body = await res.json(); if (body && body.detail) detail = body.detail; } catch (e) {}
+    try {
+      const body = await res.json();
+      if (body && body.detail) {
+        if (typeof body.detail === "string") {
+          detail = body.detail;
+        } else if (body.detail && typeof body.detail.message === "string") {
+          detail = body.detail.message;
+        }
+      }
+    } catch (e) {}
     throw new Error(detail);
   }
   return res.json();
 }
+
+
+// ── BIP-110 badge state config ────────────────────────────────────
+// Shared lookup used by tiles.js and service-detail.js.
+// Keys match the "state" values returned by /api/bitcoin/bip110.
+
+var BIP110_BADGE_CONFIG = {
+  active:        { cls: 'tile-bip110-badge--active',       label: 'Active',         title: 'BIP-110 is active on this node' },
+  locked_in:     { cls: 'tile-bip110-badge--locked_in',    label: 'Locked In',      title: 'BIP-110 is locked in and will activate shortly' },
+  signaling:     { cls: 'tile-bip110-badge--signaling',    label: 'Signaling',      title: 'Node is signaling readiness for BIP-110' },
+  not_signaling: { cls: 'tile-bip110-badge--not_signaling',label: 'Not Signaling',  title: 'Node supports BIP-110 but is not signaling this period' },
+  unsupported:   { cls: 'tile-bip110-badge--unsupported',  label: 'Not Supported',  title: 'This node build does not include BIP-110' },
+  unknown:       { cls: 'tile-bip110-badge--unknown',      label: '\u2014',          title: 'Status unavailable (node syncing or RPC not ready)' }
+};

app/sovran_systemsos_web/static/js/rebuild.js

@@ -69,7 +69,7 @@ function onRebuildDone(result) {
     // Auto-reload the page after a short delay so tiles and toggles reflect the new state
     setTimeout(function() { window.location.reload(); }, 1200);
   } else if (result === "reboot_required") {
-    if ($rebuildStatus) $rebuildStatus.textContent = "✓ Done — reboot required";
+    if ($rebuildStatus) $rebuildStatus.textContent = "✓ Done — restart required";
     if ($rebuildReboot) $rebuildReboot.style.display = "inline-flex";
   } else {
     if ($rebuildStatus) $rebuildStatus.textContent = "✗ Something went wrong";

app/sovran_systemsos_web/static/js/security.js

@@ -145,28 +145,25 @@ function openSecurityModal() {
           if (rebootBtn) {
             // Keep button disabled for 5 seconds to prevent accidental clicks
             var countdown = 5;
-            rebootBtn.textContent = "I have written down my new password \u2014 Reboot now (" + countdown + ")";
+            rebootBtn.textContent = "I have written down my new password \u2014 Restart Entire System (" + countdown + ")";
             var timer = setInterval(function() {
               countdown--;
               if (countdown <= 0) {
                 clearInterval(timer);
                 rebootBtn.disabled = false;
-                rebootBtn.textContent = "I have written down my new password \u2014 Reboot now";
+                rebootBtn.textContent = "I have written down my new password \u2014 Restart Entire System";
               } else {
-                rebootBtn.textContent = "I have written down my new password \u2014 Reboot now (" + countdown + ")";
+                rebootBtn.textContent = "I have written down my new password \u2014 Restart Entire System (" + countdown + ")";
               }
             }, 1000);
 
             rebootBtn.addEventListener("click", function() {
               rebootBtn.disabled = true;
-              rebootBtn.textContent = "Rebooting\u2026";
+              rebootBtn.textContent = "Restarting\u2026";
-              if ($rebootOverlay) $rebootOverlay.classList.add("visible");
+              // Hide the security reset overlay so the shared reboot overlay is visible
-              _rebootStartTime = Date.now();
+              var $secResetOverlay2 = document.getElementById("security-reset-overlay");
-              _serverWentDown = false;
+              if ($secResetOverlay2) $secResetOverlay2.classList.remove("visible");
-              setTimeout(waitForServerReboot, REBOOT_INITIAL_DELAY);
+              doReboot();
-              var rebootCtrl = new AbortController();
-              setTimeout(function() { rebootCtrl.abort(); }, REBOOT_REQUEST_TIMEOUT);
-              fetch("/api/reboot", { method: "POST", signal: rebootCtrl.signal }).catch(function() {});
             }, { once: true });
           }
         } catch (err) {

app/sovran_systemsos_web/static/js/service-detail.js

@@ -58,6 +58,359 @@ function _attachCopyHandlers(container) {
   });
 }
 
+var _nwcModalState = null;
+
+function _nwcStateMessageHtml() {
+  if (!_nwcModalState || !_nwcModalState.message) return "";
+  var msgClass = _nwcModalState.messageKind === "success" ? "success" : "error";
+  return '<div class="matrix-form-result ' + msgClass + '">' + escHtml(_nwcModalState.message) + '</div>';
+}
+
+function _nwcSetMessage(kind, text) {
+  if (!_nwcModalState) return;
+  _nwcModalState.messageKind = kind || "error";
+  _nwcModalState.message = text || "";
+}
+
+function _nwcClearMessage() {
+  if (!_nwcModalState) return;
+  _nwcModalState.messageKind = "";
+  _nwcModalState.message = "";
+}
+
+function _nwcWalletSectionEl() {
+  return document.getElementById("nwc-wallets-body");
+}
+
+function _nwcRenderWalletState() {
+  var host = _nwcWalletSectionEl();
+  if (!host || !_nwcModalState) return;
+  var state = _nwcModalState;
+  var html = "";
+  html += _nwcStateMessageHtml();
+
+  if (state.view === "create") {
+    var selectedLimited = state.createForm.access_preset === "send_receive_limited";
+    html +=
+      '<p class="svc-detail-desc">Create a new isolated wallet connection for your app.</p>' +
+      '<div class="matrix-form-group"><label class="matrix-form-label" for="nwc-wallet-name">Wallet Connection Name</label>' +
+        '<input class="matrix-form-input" id="nwc-wallet-name" type="text" placeholder="My Wallet" value="' + escHtml(state.createForm.name || "") + '" autocomplete="off"></div>' +
+      '<div class="matrix-form-group"><label class="matrix-form-label" for="nwc-wallet-alias">Lightning Address Alias</label>' +
+        '<input class="matrix-form-input" id="nwc-wallet-alias" type="text" placeholder="my-wallet" value="' + escHtml(state.createForm.alias || "") + '" autocomplete="off">' +
+        '<div class="creds-qr-hint">Lowercase letters, numbers, "_" and "-" only.</div></div>' +
+      '<div class="matrix-form-group"><label class="matrix-form-label" for="nwc-wallet-preset">Access Preset</label>' +
+        '<select class="matrix-form-input" id="nwc-wallet-preset">' +
+          '<option value="receive_only"' + (state.createForm.access_preset === "receive_only" ? " selected" : "") + '>Receive only</option>' +
+          '<option value="send_receive_limited"' + (selectedLimited ? " selected" : "") + '>Send + receive (limited)</option>' +
+        '</select></div>' +
+      '<div class="matrix-form-group"><label class="matrix-form-label" for="nwc-wallet-limit">Spending Limit (sats)</label>' +
+        '<input class="matrix-form-input" id="nwc-wallet-limit" type="number" min="1" step="1" placeholder="50000" value="' + escHtml(state.createForm.spending_limit_sats || "") + '"' + (selectedLimited ? "" : " disabled") + "></div>" +
+      '<div class="matrix-form-actions">' +
+        '<button class="matrix-form-back" id="nwc-create-cancel-btn"' + (state.busy ? " disabled" : "") + '>← Back</button>' +
+        '<button class="matrix-form-submit" id="nwc-create-submit-btn"' + (state.busy ? " disabled" : "") + '>' + (state.busy ? "Creating…" : "Create Wallet") + '</button>' +
+      '</div>';
+    host.innerHTML = html;
+    var presetSel = document.getElementById("nwc-wallet-preset");
+    if (presetSel) {
+      presetSel.addEventListener("change", function() {
+        state.createForm.access_preset = presetSel.value;
+        _nwcRenderWalletState();
+      });
+    }
+    var cancelBtn = document.getElementById("nwc-create-cancel-btn");
+    if (cancelBtn) {
+      cancelBtn.addEventListener("click", function() {
+        if (state.busy) return;
+        state.view = state.wallets.length > 0 ? "list" : "empty";
+        _nwcClearMessage();
+        _nwcRenderWalletState();
+      });
+    }
+    var submitBtn = document.getElementById("nwc-create-submit-btn");
+    if (submitBtn) submitBtn.addEventListener("click", _nwcCreateWallet);
+    return;
+  }
+
+  if (state.view === "created" && state.lastCreated) {
+    var created = state.lastCreated;
+    var pairId = "nwc-pairing-uri-" + Math.random().toString(36).substring(2, 8);
+    html += '<div class="nwc-secret-warning">⚠ One-time pairing secret. Save it now — it will not be shown again.</div>';
+    if (created.pairing_qrcode) {
+      html += '<div class="creds-qr-wrap"><img class="creds-qr-img" src="' + created.pairing_qrcode + '" alt="QR code for Wallet Connections pairing secret"><div class="creds-qr-hint">Scan now in Zeus or copy the URI below.</div></div>';
+    }
+    html += '<div class="creds-row"><div class="creds-label">Pairing URI</div>' +
+      '<div class="creds-value-wrap"><div class="creds-value" id="' + pairId + '">' + escHtml(created.pairing_uri || "Unavailable") + '</div><button class="creds-copy-btn" data-target="' + pairId + '">Copy</button></div></div>';
+    if (created.wallet && created.wallet.lightning_address) {
+      html += '<div class="creds-row"><div class="creds-label">Lightning Address</div>' +
+        '<div class="creds-value-wrap"><div class="creds-value">' + escHtml(created.wallet.lightning_address) + '</div></div></div>';
+    }
+    html += '<div class="matrix-form-actions">' +
+      '<button class="matrix-form-back" id="nwc-created-another-btn"' + (state.busy ? " disabled" : "") + '>Create Another Wallet</button>' +
+      '<button class="matrix-form-submit" id="nwc-created-continue-btn"' + (state.busy ? " disabled" : "") + '>I Saved This Secret</button>' +
+    '</div>';
+    host.innerHTML = html;
+    _attachCopyHandlers(host);
+    var continueBtn = document.getElementById("nwc-created-continue-btn");
+    if (continueBtn) {
+      continueBtn.addEventListener("click", async function() {
+        if (state.busy) return;
+        state.lastCreated = null;
+        state.view = "list";
+        await _nwcRefreshWallets();
+      });
+    }
+    var anotherBtn = document.getElementById("nwc-created-another-btn");
+    if (anotherBtn) {
+      anotherBtn.addEventListener("click", function() {
+        if (state.busy) return;
+        state.view = "create";
+        _nwcClearMessage();
+        _nwcRenderWalletState();
+      });
+    }
+    return;
+  }
+
+  html += '<div class="matrix-actions-row">' +
+    '<button class="matrix-action-btn" id="nwc-open-create-btn"' + (state.busy ? " disabled" : "") + '>➕ Create Wallet Connection</button>' +
+    '<button class="matrix-form-back" id="nwc-refresh-btn"' + (state.busy ? " disabled" : "") + '>Refresh</button>' +
+  '</div>';
+  if (state.domain) {
+    html += '<p class="svc-detail-desc">Lightning Address domain: <strong>' + escHtml(state.domain) + '</strong></p>';
+  } else {
+    html += '<p class="svc-detail-desc">Lightning Address domain is not configured yet. Configure your domain first, then create wallet connections.</p>';
+  }
+
+  if (!state.wallets || state.wallets.length === 0) {
+    html += '<p class="creds-empty">No wallet connections yet. Create your first wallet connection to generate a one-time pairing secret.</p>';
+    host.innerHTML = html;
+    var openCreateBtn = document.getElementById("nwc-open-create-btn");
+    if (openCreateBtn) {
+      openCreateBtn.addEventListener("click", function() {
+        if (state.busy) return;
+        _nwcClearMessage();
+        state.view = "create";
+        _nwcRenderWalletState();
+      });
+    }
+    var refreshBtnEmpty = document.getElementById("nwc-refresh-btn");
+    if (refreshBtnEmpty) refreshBtnEmpty.addEventListener("click", _nwcRefreshWallets);
+    return;
+  }
+
+  html += '<div class="nwc-wallet-list">';
+  state.wallets.forEach(function(wallet) {
+    var id = wallet.id || wallet.pubkey || "";
+    var addressId = "nwc-wallet-addr-" + Math.random().toString(36).substring(2, 8);
+    html += '<div class="nwc-wallet-card">' +
+      '<div class="nwc-wallet-card-title">' + escHtml(wallet.name || "Wallet") + '</div>' +
+      '<div class="creds-row"><div class="creds-label">Alias</div><div class="creds-value-wrap"><div class="creds-value">' + escHtml(wallet.alias || "") + '</div></div></div>' +
+      (wallet.lightning_address
+        ? '<div class="creds-row"><div class="creds-label">Lightning Address</div><div class="creds-value-wrap"><div class="creds-value" id="' + addressId + '">' + escHtml(wallet.lightning_address) + '</div><button class="creds-copy-btn" data-target="' + addressId + '">Copy</button></div></div>'
+        : "") +
+      '<div class="creds-row"><div class="creds-label">Balance</div><div class="creds-value-wrap"><div class="creds-value">' + escHtml(String(wallet.balance_sats || 0)) + ' sats</div></div></div>' +
+      '<div class="creds-row"><div class="creds-label">Pending TX</div><div class="creds-value-wrap"><div class="creds-value">' + escHtml(String(wallet.pending_transactions || 0)) + '</div></div></div>' +
+      '<div class="nwc-wallet-actions">' +
+        '<button class="matrix-form-back nwc-wallet-action-btn" data-action="test" data-wallet-alias="' + escHtml(wallet.alias || "") + '"' + (state.busy ? " disabled" : "") + '>Verify Address</button>' +
+        '<button class="matrix-form-back nwc-wallet-action-btn" data-action="drain" data-wallet-id="' + escHtml(id) + '"' + (state.busy ? " disabled" : "") + '>Drain</button>' +
+        '<button class="btn btn-close-modal nwc-wallet-action-btn" data-action="delete" data-wallet-id="' + escHtml(id) + '"' + (state.busy ? " disabled" : "") + '>Delete</button>' +
+      '</div>' +
+    '</div>';
+  });
+  html += "</div>";
+  host.innerHTML = html;
+  _attachCopyHandlers(host);
+
+  var createBtn = document.getElementById("nwc-open-create-btn");
+  if (createBtn) {
+    createBtn.addEventListener("click", function() {
+      if (state.busy) return;
+      _nwcClearMessage();
+      state.view = "create";
+      _nwcRenderWalletState();
+    });
+  }
+
+  var refreshBtn = document.getElementById("nwc-refresh-btn");
+  if (refreshBtn) refreshBtn.addEventListener("click", _nwcRefreshWallets);
+
+  host.querySelectorAll(".nwc-wallet-action-btn").forEach(function(btn) {
+    btn.addEventListener("click", function() {
+      var action = btn.getAttribute("data-action");
+      if (action === "test") _nwcVerifyWallet(btn.getAttribute("data-wallet-alias"));
+      else if (action === "drain") _nwcDrainWallet(btn.getAttribute("data-wallet-id"));
+      else if (action === "delete") _nwcDeleteWallet(btn.getAttribute("data-wallet-id"));
+    });
+  });
+}
+
+async function _nwcRefreshWallets() {
+  if (!_nwcModalState) return;
+  var host = _nwcWalletSectionEl();
+  if (host) host.innerHTML = '<p class="creds-loading">Loading wallet connections…</p>';
+  try {
+    var payload = await apiFetch("/api/nwc/wallets");
+    _nwcModalState.wallets = Array.isArray(payload.wallets) ? payload.wallets : [];
+    _nwcModalState.domain = payload.domain || null;
+    if (_nwcModalState.view !== "create" && _nwcModalState.view !== "created") {
+      _nwcModalState.view = _nwcModalState.wallets.length > 0 ? "list" : "empty";
+    }
+    _nwcRenderWalletState();
+  } catch (err) {
+    _nwcSetMessage("error", (err && err.message) ? err.message : "Could not load wallet connections.");
+    _nwcRenderWalletState();
+  }
+}
+
+function _nwcBusy(on) {
+  if (!_nwcModalState) return;
+  _nwcModalState.busy = !!on;
+}
+
+async function _nwcCreateWallet() {
+  if (!_nwcModalState || _nwcModalState.busy) return;
+  var nameEl = document.getElementById("nwc-wallet-name");
+  var aliasEl = document.getElementById("nwc-wallet-alias");
+  var presetEl = document.getElementById("nwc-wallet-preset");
+  var limitEl = document.getElementById("nwc-wallet-limit");
+  if (!nameEl || !aliasEl || !presetEl || !limitEl) return;
+
+  var name = (nameEl.value || "").trim();
+  var alias = (aliasEl.value || "").trim().toLowerCase();
+  var preset = presetEl.value || "receive_only";
+  var limitRaw = (limitEl.value || "").trim();
+  var limit = null;
+
+  _nwcModalState.createForm = {
+    name: name,
+    alias: alias,
+    access_preset: preset,
+    spending_limit_sats: limitRaw
+  };
+
+  if (!name) {
+    _nwcSetMessage("error", "Wallet Connection name is required.");
+    _nwcRenderWalletState();
+    return;
+  }
+  if (!/^[a-z0-9][a-z0-9_-]{0,31}$/.test(alias)) {
+    _nwcSetMessage("error", 'Alias must start with a letter or number and use only lowercase letters, numbers, "_" or "-".');
+    _nwcRenderWalletState();
+    return;
+  }
+  if (preset === "send_receive_limited") {
+    limit = parseInt(limitRaw, 10);
+    if (!Number.isFinite(limit) || limit <= 0) {
+      _nwcSetMessage("error", "A positive spending limit is required for limited send access.");
+      _nwcRenderWalletState();
+      return;
+    }
+  }
+
+  _nwcBusy(true);
+  _nwcClearMessage();
+  _nwcRenderWalletState();
+  try {
+    var payload = await apiFetch("/api/nwc/wallets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        name: name,
+        alias: alias,
+        access_preset: preset,
+        spending_limit_sats: preset === "send_receive_limited" ? limit : null
+      })
+    });
+    _nwcModalState.lastCreated = {
+      wallet: payload.wallet || null,
+      pairing_uri: payload.pairing_uri || "",
+      pairing_qrcode: payload.pairing_qrcode || "",
+      lightning_address: payload.lightning_address || null
+    };
+    _nwcModalState.view = "created";
+    _nwcSetMessage("success", "Wallet created. Save the one-time secret before you continue.");
+    _nwcBusy(false);
+    _nwcRenderWalletState();
+  } catch (err) {
+    _nwcBusy(false);
+    _nwcSetMessage("error", (err && err.message) ? err.message : "Failed to create wallet connection.");
+    _nwcRenderWalletState();
+  }
+}
+
+async function _nwcVerifyWallet(alias) {
+  if (!_nwcModalState || _nwcModalState.busy || !alias) return;
+  _nwcBusy(true);
+  _nwcClearMessage();
+  _nwcRenderWalletState();
+  try {
+    await apiFetch("/api/nwc/addresses/" + encodeURIComponent(alias) + "/test", { method: "POST" });
+    _nwcSetMessage("success", "Lightning Address verification succeeded for " + alias + ".");
+  } catch (err) {
+    _nwcSetMessage("error", (err && err.message) ? err.message : "Lightning Address verification failed.");
+  }
+  _nwcBusy(false);
+  _nwcRenderWalletState();
+}
+
+async function _nwcDrainWallet(walletId) {
+  if (!_nwcModalState || _nwcModalState.busy || !walletId) return;
+  if (!window.confirm("Drain this wallet connection now? This cannot be undone.")) return;
+  _nwcBusy(true);
+  _nwcClearMessage();
+  _nwcRenderWalletState();
+  try {
+    var resp = await apiFetch("/api/nwc/wallets/" + encodeURIComponent(walletId) + "/drain", { method: "POST" });
+    _nwcSetMessage("success", "Wallet drained (" + String(resp.drained_sats || 0) + " sats).");
+    _nwcBusy(false);
+    await _nwcRefreshWallets();
+  } catch (err) {
+    _nwcBusy(false);
+    _nwcSetMessage("error", (err && err.message) ? err.message : "Failed to drain wallet.");
+    _nwcRenderWalletState();
+  }
+}
+
+async function _nwcDeleteWallet(walletId) {
+  if (!_nwcModalState || _nwcModalState.busy || !walletId) return;
+  if (!window.confirm("Delete this wallet connection? This removes the wallet alias from Wallet Connections.")) return;
+  _nwcBusy(true);
+  _nwcClearMessage();
+  _nwcRenderWalletState();
+  try {
+    await apiFetch("/api/nwc/wallets/" + encodeURIComponent(walletId), { method: "DELETE" });
+    _nwcSetMessage("success", "Wallet connection deleted.");
+    _nwcBusy(false);
+    await _nwcRefreshWallets();
+  } catch (err) {
+    _nwcBusy(false);
+    _nwcSetMessage("error", (err && err.message) ? err.message : "Failed to delete wallet connection.");
+    _nwcRenderWalletState();
+  }
+}
+
+async function _nwcInitWalletFlow(unit, name, icon) {
+  _nwcModalState = {
+    unit: unit,
+    name: name,
+    icon: icon,
+    view: "empty",
+    wallets: [],
+    domain: null,
+    busy: false,
+    message: "",
+    messageKind: "",
+    lastCreated: null,
+    createForm: {
+      name: "",
+      alias: "",
+      access_preset: "receive_only",
+      spending_limit_sats: ""
+    }
+  };
+  await _nwcRefreshWallets();
+}
+
 async function openServiceDetailModal(unit, name, icon) {
   if (!$credsModal) return;
   if ($credsTitle) {
@@ -107,6 +460,21 @@ async function openServiceDetailModal(unit, name, icon) {
       '</div>' +
       '</div>';
 
+    // Section B2: BIP-110 live status (bip110 tile only)
+    if (icon === 'bip110' && data.bip110) {
+      var bip110 = data.bip110;
+      var bip110State = bip110.state || 'unknown';
+      var bip110Cfg = BIP110_BADGE_CONFIG[bip110State] || BIP110_BADGE_CONFIG.unknown;
+      var bip110Source = bip110.source ? ' <span class="bip110-source-label">(source: ' + escHtml(bip110.source) + ')</span>' : '';
+      html += '<div class="svc-detail-section">' +
+        '<div class="svc-detail-section-title">BIP-110 Deployment Status</div>' +
+        '<div class="bip110-status-row">' +
+          '<span class="tile-bip110-badge ' + bip110Cfg.cls + '" title="' + escHtml(bip110Cfg.title) + '">' + escHtml(bip110Cfg.label) + '</span>' +
+          bip110Source +
+        '</div>' +
+        '</div>';
+    }
+
     // Section C: Domain diagnostics (domain services)
     if (data.needs_domain) {
       var steps = data.domain_check_steps || [];
@@ -139,20 +507,36 @@ async function openServiceDetailModal(unit, name, icon) {
         '</div>';
 
       if (unit === "livekit.service" && data.extra_ports && data.extra_ports.length > 0) {
+        var trimmedInternalIp = data.internal_ip ? String(data.internal_ip).trim() : "";
+        var internalIp = trimmedInternalIp || "";
+        var internalIpHtml = internalIp ? escHtml(internalIp) : "Could not detect";
+        var routerIpHelp = internalIp
+          ? "Use this IP address as the destination/internal IP when creating each router forwarding rule."
+          : "Use this computer’s internal IP as the destination/internal IP when creating each router forwarding rule.";
+        var routerNextStep = internalIp
+          ? 'Next step: Log in to your router and create forwarding rules for the ports above. Set the destination/internal IP to <strong>' + internalIpHtml + '</strong>.'
+          : 'Next step: Log in to your router and create forwarding rules for the ports above. Use this computer’s internal IP as the destination/internal IP.';
+        var domainConfigured = !!(data.domain && String(data.domain).trim());
         var extraRows = "";
         data.extra_ports.forEach(function(p) {
           var statusIcon, statusClass2;
-          if (p.status === "listening") {
+          if (!effectiveEnabled) {
-            statusIcon = "✅ Open";
+            statusIcon = "⚠ Configure Element Call first";
+            statusClass2 = "port-status-open";
+          } else if (!domainConfigured) {
+            statusIcon = "⚠ Configure domain first";
+            statusClass2 = "port-status-open";
+          } else if (p.status === "listening") {
+            statusIcon = "✅ Ready";
             statusClass2 = "port-status-listening";
           } else if (p.status === "firewall_open") {
-            statusIcon = "🟡 Firewall open";
+            statusIcon = "✅ Ready";
             statusClass2 = "port-status-open";
           } else if (p.status === "closed") {
-            statusIcon = "❌ Closed";
+            statusIcon = "❌ Not ready yet";
             statusClass2 = "port-status-closed";
           } else {
-            statusIcon = "— Unknown";
+            statusIcon = "— Could not check";
             statusClass2 = "port-status-unknown";
           }
           extraRows += '<tr>' +
@@ -163,11 +547,16 @@ async function openServiceDetailModal(unit, name, icon) {
             '</tr>';
         });
         html += '<div class="svc-detail-section">' +
-          '<div class="svc-detail-section-title">Step 4: Additional Ports</div>' +
+          '<div class="svc-detail-section-title">Ports to Forward in Your Router</div>' +
+          '<div class="svc-detail-port-note">Forward these ports in your router to this Sovran_SystemsOS computer.</div>' +
+          '<div class="svc-detail-port-note"><strong>Router Forward-To IP:</strong> ' + internalIpHtml + '</div>' +
+          '<div class="svc-detail-port-note">' + routerIpHelp + '</div>' +
           '<table class="svc-detail-port-table">' +
-            '<thead><tr><th>Port</th><th>Protocol</th><th>Description</th><th>Status</th></tr></thead>' +
+            '<thead><tr><th>Port</th><th>Protocol</th><th>Used For</th><th>Sovran_SystemsOS Status</th></tr></thead>' +
             '<tbody>' + extraRows + '</tbody>' +
           '</table>' +
+          '<div class="svc-detail-port-note">The Hub can check whether Sovran_SystemsOS is ready on this computer, but full public port verification requires an outside internet check.</div>' +
+          '<div class="svc-detail-port-note">' + routerNextStep + '</div>' +
           '</div>';
       }
     } else if (data.port_statuses && data.port_statuses.length > 0) {
@@ -176,16 +565,16 @@ async function openServiceDetailModal(unit, name, icon) {
       data.port_statuses.forEach(function(p) {
         var statusIcon, statusClass2;
         if (p.status === "listening") {
-          statusIcon = "✅ Open";
+          statusIcon = "✅ Ready";
           statusClass2 = "port-status-listening";
         } else if (p.status === "firewall_open") {
-          statusIcon = "🟡 Firewall open";
+          statusIcon = "✅ Ready";
           statusClass2 = "port-status-open";
         } else if (p.status === "closed") {
-          statusIcon = "🔴 Closed";
+          statusIcon = "❌ Not ready";
           statusClass2 = "port-status-closed";
         } else {
-          statusIcon = "— Unknown";
+          statusIcon = "— Could not check";
           statusClass2 = "port-status-unknown";
         }
         portTableRows += '<tr>' +
@@ -196,16 +585,22 @@ async function openServiceDetailModal(unit, name, icon) {
           '</tr>';
       });
       html += '<div class="svc-detail-section">' +
-        '<div class="svc-detail-section-title">Port Status</div>' +
+        '<div class="svc-detail-section-title">Port Requirements</div>' +
+        '<div class="svc-detail-port-note">This shows whether Sovran_SystemsOS is ready to use this port on this computer. If you need access from outside your home network, forward this port in your router.</div>' +
         '<table class="svc-detail-port-table">' +
-          '<thead><tr><th>Port</th><th>Protocol</th><th>Description</th><th>Status</th></tr></thead>' +
+          '<thead><tr><th>Port</th><th>Protocol</th><th>Used For</th><th>Sovran_SystemsOS Status</th></tr></thead>' +
           '<tbody>' + portTableRows + '</tbody>' +
         '</table>' +
         '</div>';
     }
 
     // Section E: Credentials & Links
-    if (data.has_credentials && data.credentials && data.credentials.length > 0) {
+    if (unit === "nwc-wallets.service") {
+      html += '<div class="svc-detail-section">' +
+        '<div class="svc-detail-section-title">Wallet Connections</div>' +
+        '<div id="nwc-wallets-body"><p class="creds-loading">Loading wallet connections…</p></div>' +
+        '</div>';
+    } else if (data.has_credentials && data.credentials && data.credentials.length > 0) {
       html += '<div class="svc-detail-section">' +
         '<div class="svc-detail-section-title">Credentials &amp; Access</div>' +
         _renderCredsHtml(data.credentials, unit) +
@@ -242,7 +637,7 @@ async function openServiceDetailModal(unit, name, icon) {
       var addonBtnCls      = feat.enabled ? "btn btn-close-modal" : "btn btn-primary";
 
       // Section title: use a more specific label for mutually-exclusive Bitcoin node features
-      var addonSectionTitle = (feat.id === "bip110" || feat.id === "bitcoin-core")
+      var addonSectionTitle = (feat.id === "bitcoin-core")
         ? "\u20BF Bitcoin Node Selection"
         : "\uD83D\uDD27 Addon Feature";
 
@@ -286,6 +681,9 @@ async function openServiceDetailModal(unit, name, icon) {
 
     $credsBody.innerHTML = html;
     _attachCopyHandlers($credsBody);
+    if (unit === "nwc-wallets.service") {
+      await _nwcInitWalletFlow(unit, name, icon);
+    }
 
     if (unit === "matrix-synapse.service") {
       var addBtn = document.getElementById("matrix-add-user-btn");

app/sovran_systemsos_web/static/js/state.js

@@ -49,6 +49,9 @@ const $btnSave        = document.getElementById("btn-save-report");
 const $btnCloseModal  = document.getElementById("btn-close-modal");
 
 const $rebootOverlay  = document.getElementById("reboot-overlay");
+const $rebootMainCard = document.getElementById("reboot-main-card");
+const $rebootErrorCard = document.getElementById("reboot-error-card");
+const $rebootSubmessage = document.getElementById("reboot-submessage");
 
 const $credsModal     = document.getElementById("creds-modal");
 const $credsTitle     = document.getElementById("creds-modal-title");
@@ -101,5 +104,14 @@ const $upgradeConfirmBtn  = document.getElementById("upgrade-confirm-btn");
 const $upgradeCancelBtn   = document.getElementById("upgrade-cancel-btn");
 const $upgradeCloseBtn    = document.getElementById("upgrade-close-btn");
 
+// Restart confirm dialog
+const $restartConfirmModal  = document.getElementById("restart-confirm-modal");
+const $restartConfirmOk     = document.getElementById("restart-confirm-ok-btn");
+const $restartConfirmCancel = document.getElementById("restart-confirm-cancel-btn");
+const $restartConflictBox   = document.getElementById("restart-conflict-box");
+
+// Header reboot button
+const $headerRebootBtn = document.getElementById("btn-header-reboot");
+
 // System status banner
 // (removed — health is now shown per-tile via the composite health field)

app/sovran_systemsos_web/static/js/support.js

@@ -491,8 +491,9 @@ function renderBackupReady(drives) {
       '<div class="support-steps-title">Requirements</div>',
       '<ol class="support-backup-steps">',
         '<li>USB hard drive plugged into one of the open USB ports on your Sovran Pro</li>',
-        '<li>At least 500 GB of free space on the drive</li>',
+        '<li>Enough free space for your data (the backup checks this before starting)</li>',
-        '<li>Drive must be formatted as <strong>exFAT</strong></li>',
+        '<li>Drive must be formatted as <strong>ext4</strong> (a Linux filesystem). Drives with exFAT, FAT32, or NTFS are not supported. To format a drive as ext4, use a Linux tool such as GParted or <code>mkfs.ext4</code> — note that formatting erases all data on the drive.</li>',
+        '<li>The drive is intended for Linux/Sovran recovery. It may not be directly readable by Windows or macOS without additional software.</li>',
       '</ol>',
     '</div>',
 
@@ -501,17 +502,25 @@ function renderBackupReady(drives) {
       '<ol class="support-backup-steps">',
         '<li>NixOS configuration (<code>/etc/nixos</code>)</li>',
         '<li>nix-bitcoin secrets (<code>/etc/nix-bitcoin-secrets</code>)</li>',
-        '<li>System service data (<code>/var/lib</code>) including Vaultwarden, bitcoind, LND, sovran-hub, domains, and secrets</li>',
+        '<li>System service data (<code>/var/lib</code>) — excluding databases and blockchain data (see note below)</li>',
         '<li>Home directory (<code>/home</code>)</li>',
       '</ol>',
     '</div>',
 
     '<div class="support-wallet-box support-wallet-warning">',
+      '<div class="support-wallet-header">',
+        '<span class="support-wallet-icon">\u2139\ufe0f</span>',
+        '<span class="support-wallet-title">Database and Blockchain Data</span>',
+      '</div>',
+      '<p class="support-wallet-desc">Application databases stored in PostgreSQL or MariaDB/MySQL are <strong>not included</strong> in Manual Backup. Bitcoin blockchain and Electrs index data are also excluded (they are stored on the internal second drive). If you use Nextcloud, Matrix, or other database-backed applications, back up those databases separately with their native tools.</p>',
+    '</div>',
+
+    '<div class="support-wallet-box support-wallet-protected">',
       '<div class="support-wallet-header">',
         '<span class="support-wallet-icon">\u23f1\ufe0f</span>',
         '<span class="support-wallet-title">Time Estimate</span>',
       '</div>',
-      '<p class="support-wallet-desc">This backup can take <strong>up to 4 hours</strong> depending on the amount of data stored on your Sovran Pro and the speed of your external hard drive. Be patient\u2026</p>',
+      '<p class="support-wallet-desc">The first backup may take a while depending on how much data you have. Later backups are much faster because only changed or new files are copied. Files are stored directly on the drive and can be browsed without any special software.</p>',
     '</div>',
 
     driveSelector,
@@ -584,9 +593,10 @@ async function pollBackupStatus() {
       logDiv.scrollTop = logDiv.scrollHeight;
     }
     _backupLogOffset = data.offset;
-    if (!data.running) {
+    const result = (data.result || "").toLowerCase();
+    if (result === "success" || result === "failed") {
       stopBackupPoll();
-      renderBackupDone(data.result === "success");
+      renderBackupDone(result === "success");
     }
   } catch (_) {}
 }
@@ -618,7 +628,7 @@ function renderBackupDone(success) {
       '<div class="support-section">',
       '<div class="support-icon-big">\u26a0\ufe0f</div>',
       '<h3 class="support-heading">Backup Failed</h3>',
-      '<p class="support-desc">The backup did not complete successfully. Please check that the USB drive is still connected, has enough free space, and is formatted as exFAT. Then try again.</p>',
+      '<p class="support-desc">The backup did not complete successfully. Please check that the USB drive is still connected, has enough free space, and is formatted as ext4. Then try again.</p>',
       '<div class="modal-log" id="backup-log-fail" style="text-align:left;"></div>',
       '<button class="btn support-btn-done" id="btn-backup-close">Close</button>',
       '</div>',

app/sovran_systemsos_web/static/js/tiles.js

@@ -4,6 +4,21 @@
 // Keyed by tileId: { progress: float, timestamp: ms }
 var _btcSyncPrev = {};
 
+// ── BIP-110 badge helper ──────────────────────────────────────────
+
+function _renderBip110Badge(bip110) {
+  if (!bip110) return '';
+  var state = bip110.state || 'unknown';
+  var cfg = BIP110_BADGE_CONFIG[state] || BIP110_BADGE_CONFIG.unknown;
+  return '<div class="tile-bip110-badge ' + cfg.cls + '" title="' + escHtml(cfg.title) + '">' + escHtml(cfg.label) + '</div>';
+}
+
+function _firstElementFromHtml(html) {
+  var tmp = document.createElement("div");
+  tmp.innerHTML = html;
+  return tmp.firstElementChild || null;
+}
+
 // ── Render: initial build ─────────────────────────────────────────
 
 function buildTiles(services, categoryLabels) {
@@ -165,7 +180,8 @@ function buildTile(svc) {
 
   var ver = svc.version || svc.bitcoin_version || '';
   var versionLabel = ver ? '<div class="tile-version">' + escHtml(ver) + '</div>' : '';
-  tile.innerHTML = '<img class="tile-icon" src="/static/icons/' + escHtml(svc.icon) + '.svg" alt="' + escHtml(svc.name) + '" onerror="this.style.display=\'none\';this.nextElementSibling.style.display=\'flex\'"><div class="tile-icon-fallback" style="display:none">?</div><div class="tile-name">' + escHtml(svc.name) + '</div>' + versionLabel + '<div class="tile-status"><span class="status-dot ' + sc + '"></span><span class="status-text">' + st + '</span></div>';
+  var bip110Badge = (svc.icon === 'bip110') ? _renderBip110Badge(svc.bip110) : '';
+  tile.innerHTML = '<img class="tile-icon" src="/static/icons/' + escHtml(svc.icon) + '.svg" alt="' + escHtml(svc.name) + '" onerror="this.style.display=\'none\';this.nextElementSibling.style.display=\'flex\'"><div class="tile-icon-fallback" style="display:none">?</div><div class="tile-name">' + escHtml(svc.name) + '</div>' + versionLabel + bip110Badge + '<div class="tile-status"><span class="status-dot ' + sc + '"></span><span class="status-text">' + st + '</span></div>';
 
   tile.style.cursor = "pointer";
   tile.addEventListener("click", function() {
@@ -265,6 +281,23 @@ function updateTiles(services) {
           }
         }
       }
+      // Update BIP-110 badge for bip110 tiles
+      if (svc.icon === 'bip110') {
+        var badgeHtml = _renderBip110Badge(svc.bip110);
+        var badgeEl = tile.querySelector(".tile-bip110-badge");
+        if (badgeEl) {
+          // Replace existing badge in-place
+          var newBadge = _firstElementFromHtml(badgeHtml);
+          if (newBadge) { badgeEl.replaceWith(newBadge); } else { badgeEl.remove(); }
+        } else if (badgeHtml) {
+          // Insert badge after version label (or after tile-name if no version)
+          var anchorEl = tile.querySelector(".tile-version") || tile.querySelector(".tile-name");
+          if (anchorEl) {
+            var newBadgeEl = _firstElementFromHtml(badgeHtml);
+            if (newBadgeEl) anchorEl.insertAdjacentElement("afterend", newBadgeEl);
+          }
+        }
+      }
     }
   }
 }

app/sovran_systemsos_web/static/js/update.js

@@ -154,7 +154,7 @@ function onUpdateDone(result) {
     if ($modalStatus) $modalStatus.textContent = "✓ Update complete";
     if ($btnReboot) $btnReboot.style.display = "inline-flex";
   } else if (result === "reboot_required") {
-    if ($modalStatus) $modalStatus.textContent = "✓ Update complete — reboot required";
+    if ($modalStatus) $modalStatus.textContent = "✓ Update complete — restart required";
     if ($btnReboot) $btnReboot.style.display = "inline-flex";
   } else {
     if ($modalStatus) $modalStatus.textContent = "✗ Update failed";
@@ -179,23 +179,50 @@ function saveErrorReport() {
 
 var _rebootStartTime = 0;
 var _serverWentDown = false;
+var _rebootFailed = false;
+
+function _setRebootStatus(msg) {
+  if ($rebootSubmessage) $rebootSubmessage.textContent = msg;
+}
 
 function doReboot() {
   if ($modal) $modal.classList.remove("open");
   if ($rebuildModal) $rebuildModal.classList.remove("open");
   stopUpdatePoll();
   stopRebuildPoll();
+  // Reset overlay to main card
+  if ($rebootMainCard) $rebootMainCard.style.display = "";
+  if ($rebootErrorCard) $rebootErrorCard.style.display = "none";
+  _setRebootStatus("Sending restart request\u2026");
   if ($rebootOverlay) $rebootOverlay.classList.add("visible");
   _rebootStartTime = Date.now();
   _serverWentDown = false;
+  _rebootFailed = false;
   var rebootCtrl = new AbortController();
   setTimeout(function() { rebootCtrl.abort(); }, REBOOT_REQUEST_TIMEOUT);
-  fetch("/api/reboot", { method: "POST", signal: rebootCtrl.signal }).catch(function() {});
+  fetch("/api/reboot", { method: "POST", signal: rebootCtrl.signal })
+    .then(function(res) {
+      if (!res.ok) {
+        // Definitive HTTP error — server rejected the request before going down
+        _rebootFailed = true;
+        if ($rebootMainCard) $rebootMainCard.style.display = "none";
+        if ($rebootErrorCard) $rebootErrorCard.style.display = "";
+        // Leave overlay visible so the error card is shown
+      }
+      // HTTP 2xx: request accepted, proceed with polling
+    })
+    .catch(function() {
+      // Connection dropped or request aborted — the server is likely already going
+      // down as part of the restart. Treat as success and continue polling.
+    });
   // Wait before the first check — NixOS shutdown after an update can take 20-40s
   setTimeout(waitForServerReboot, REBOOT_INITIAL_DELAY);
 }
 
 function waitForServerReboot() {
+  if (_rebootFailed) return;
+  // Update status on first check (server hasn't gone down yet)
+  if (!_serverWentDown) _setRebootStatus("Waiting for the computer to shut down\u2026");
   var controller = new AbortController();
   var timeoutId = setTimeout(function() { controller.abort(); }, REBOOT_FETCH_TIMEOUT);
 
@@ -205,18 +232,23 @@ function waitForServerReboot() {
       if (_serverWentDown) {
         // Server is responding after having been down — reboot is complete.
         // Any response (even 401/500) means the server process is back.
+        _setRebootStatus("System is back online. Reconnecting\u2026");
         window.location.reload();
       } else if ((Date.now() - _rebootStartTime) < 90000) {
         // Server still responding but hasn't gone down yet — keep waiting
         setTimeout(waitForServerReboot, REBOOT_CHECK_INTERVAL);
       } else {
         // Been over 90 seconds and server is responding — just reload
+        _setRebootStatus("System is back online. Reconnecting\u2026");
         window.location.reload();
       }
     })
     .catch(function() {
       clearTimeout(timeoutId);
+      if (!_serverWentDown) {
         _serverWentDown = true;
+        _setRebootStatus("The computer is restarting\u2026");
+      }
       setTimeout(waitForServerReboot, REBOOT_CHECK_INTERVAL);
     });
 }

app/sovran_systemsos_web/static/onboarding.js

@@ -333,8 +333,6 @@ async function loadStep3() {
     return;
   }
 
-  var externalIp = (networkData && networkData.external_ip) || "Unknown (could not retrieve)";
-
   // Build set of enabled service units
   var enabledUnits = new Set();
   (_servicesData || []).forEach(function(svc) {
@@ -352,25 +350,31 @@ async function loadStep3() {
     html += '<p class="onboarding-body-text">No domain-based services are enabled for your role. You can skip this step.</p>';
   } else {
     html += '<div class="onboarding-port-warn" style="margin-bottom:16px;">'
-      + '<strong>Before you continue:</strong>'
+      + '<p style="margin:0 0 8px;"><strong>Sovran_SystemsOS uses Njal.la for domains and Dynamic DNS.</strong></p>'
       + '<ol style="margin:8px 0 0 16px; padding:0; line-height:1.7;">'
-      + '<li>Create an account at <a href="https://njal.la" target="_blank" style="color:var(--accent-color);">https://njal.la</a></li>'
+      + '<li>Create an account at <a href="https://njal.la" target="_blank" style="color:var(--accent-color);">https://njal.la</a>.</li>'
-      + '<li>Purchase a new domain on Njal.la, or create a subdomain from a domain you already own. Tip: Subdomains are free to create — you only need to purchase one domain, and you can add as many subdomains as you need at no extra cost.</li>'
+      + '<li>Buy at least one domain. Each service below needs its own domain — you can either give each service its own subdomain of a single domain you buy (subdomains are free, and one domain can have many), OR use a separate domain for each. Your choice.</li>'
-      + '<li>In the Njal.la web interface, create a <strong>Dynamic</strong> record pointing to this machine\'s external IP address:<br>'
+      + '<li>For each service, add a <strong>Dynamic</strong> record in Njal.la:'
-      + '<span style="display:inline-block;margin-top:4px;padding:4px 12px;background:var(--card-color);border:1px solid var(--border-color);border-radius:6px;font-family:monospace;font-size:1.1em;font-weight:700;letter-spacing:0.03em;">' + escHtml(externalIp) + '</span></li>'
+      + '<ul style="margin:4px 0 0 16px;padding:0;line-height:1.7;">'
-      + '<li>Njal.la will give you a curl command like:<br>'
+      + '<li>In the Njal.la <strong>Name</strong> field, type ONLY the host part — the word before your domain.<br>'
-      + '<code style="font-size:0.8em;">curl "https://njal.la/update/?h=sub.domain.com&amp;k=abc123&amp;auto"</code></li>'
+      + '(Example only, your choice — for &quot;call.yourdomain.com&quot; you&apos;d type just: <code>call</code>.)<br>'
-      + '<li>Enter the subdomain and paste that curl command below for each service</li>'
+      + 'If you bought a whole separate domain just for this service, leave Name blank or use <code>@</code>.<br>'
+      + '&#9888; Do NOT type the full domain in the Name field — Njal.la adds it automatically.</li>'
+      + '<li>A Dynamic record has NO IP field. You don&apos;t enter an IP anywhere — it auto-fills once Sovran_SystemsOS updates it (on save, and again after reboot).</li>'
+      + '</ul>'
+      + '</li>'
+      + '<li>Njal.la gives you a curl command like:<br>'
+      + '<code style="font-size:0.8em;">curl &quot;https://njal.la/update/?h=call.yourdomain.com&amp;k=abc123&amp;auto&quot;</code></li>'
       + '</ol>'
       + '</div>';
-    html += '<p class="onboarding-hint">Enter each fully-qualified subdomain (e.g. <code>matrix.yourdomain.com</code>) and its Njal.la DDNS curl command.</p>';
+    html += '<p class="onboarding-hint">Enter each service\'s full domain — a subdomain (e.g. <code>call.yourdomain.com</code>) or a separate domain (e.g. <code>call.com</code>) — and its Njal.la DDNS curl command.</p>';
     relevantDomains.forEach(function(d) {
       var currentVal = (_domainsData && _domainsData[d.name]) || "";
       html += '<div class="onboarding-domain-group">';
       html += '<label class="onboarding-domain-label">' + escHtml(d.label) + '</label>';
       html += '<input class="onboarding-domain-input domain-field-input" type="text" id="domain-input-' + escHtml(d.name) + '" data-domain="' + escHtml(d.name) + '" placeholder="e.g. ' + escHtml(d.name) + '.yourdomain.com" value="' + escHtml(currentVal) + '" />';
       html += '<label class="onboarding-domain-label onboarding-domain-label--sub">Njal.la DDNS Curl Command</label>';
-      html += '<input class="onboarding-domain-input domain-field-input" type="text" id="ddns-input-' + escHtml(d.name) + '" data-ddns="' + escHtml(d.name) + '" placeholder="curl &quot;https://njal.la/update/?h=' + escHtml(d.name) + '.yourdomain.com&amp;k=abc123&amp;auto&quot;" />';
+      html += '<input class="onboarding-domain-input domain-field-input" type="text" id="ddns-input-' + escHtml(d.name) + '" data-ddns="' + escHtml(d.name) + '" placeholder="curl &quot;https://njal.la/update/?h=...&amp;k=...&amp;auto&quot;" />';
       html += '<p class="onboarding-hint" style="margin-top:4px;">ℹ Paste the curl URL from your Njal.la dashboard\'s Dynamic record</p>';
       html += '<button type="button" class="btn btn-primary onboarding-domain-save-btn" data-save-domain="' + escHtml(d.name) + '" style="align-self:flex-start;margin-top:8px;font-size:0.82rem;padding:6px 16px;">Save</button>';
       html += '<span class="onboarding-domain-save-status" id="domain-save-status-' + escHtml(d.name) + '" style="font-size:0.82rem;min-height:1.2em;"></span>';
@@ -512,7 +516,7 @@ async function saveStep3() {
 async function loadStep4() {
   var body = document.getElementById("step-4-body");
   if (!body) return;
-  body.innerHTML = '<p class="onboarding-loading">Checking ports…</p>';
+  body.innerHTML = '<p class="onboarding-loading">Loading router setup…</p>';
 
   var networkData = null;
 
@@ -523,51 +527,59 @@ async function loadStep4() {
     return;
   }
 
-  var internalIp = (networkData && networkData.internal_ip) || "unknown";
+  var trimmedInternalIp = (networkData && networkData.internal_ip) ? String(networkData.internal_ip).trim() : "";
-
+  var internalIp = trimmedInternalIp || "";
-  var ip = escHtml(internalIp);
+  var hasInternalIp = !!internalIp;
+  var ip = escHtml(internalIp || "Could not detect");
+  var routerIpHelp = hasInternalIp
+    ? "Use this IP address as the destination/internal IP when creating each router forwarding rule."
+    : "Use this computer’s internal IP as the destination/internal IP when creating each router forwarding rule.";
+  var destinationInstruction = hasInternalIp
+    ? 'Set the destination/internal IP to <strong>' + ip + '</strong>'
+    : 'Use this computer’s internal IP as the destination/internal IP';
 
   var html = '<p class="onboarding-port-note" style="margin-bottom:14px;">'
     + '⚠ <strong>Each port only needs to be forwarded once — all services share the same ports.</strong>'
     + '</p>';
 
   html += '<div class="onboarding-port-ip">';
-  html += '  <span class="onboarding-port-ip-label">Forward ports to this machine\'s internal IP:</span>';
+  html += '  <span class="onboarding-port-ip-label">Forward router traffic to this Sovran_SystemsOS computer:</span>';
   html += '  <span class="port-req-internal-ip">' + ip + '</span>';
   html += '</div>';
+  html += '<div class="onboarding-port-note" style="margin:8px 0 16px;">' + routerIpHelp + '</div>';
 
   // Required ports table
   html += '<div class="onboarding-port-section" style="margin-bottom:20px;">';
-  html += '<div class="onboarding-port-section-title" style="font-weight:700;margin-bottom:8px;">Required Ports — open these on your router:</div>';
+  html += '<div class="onboarding-port-section-title" style="font-weight:700;margin-bottom:8px;">Required Router Rules</div>';
   html += '<table class="onboarding-port-table">';
-  html += '<thead><tr><th>Port</th><th>Protocol</th><th>Forward&nbsp;to</th><th>Purpose</th></tr></thead>';
+  html += '<thead><tr><th>Port</th><th>Protocol</th><th>Forward&nbsp;To</th><th>Used For</th></tr></thead>';
   html += '<tbody>';
-  html += '<tr><td class="port-req-port">80</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">HTTP</td></tr>';
+  html += '<tr><td class="port-req-port">80</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">HTTP / SSL setup</td></tr>';
   html += '<tr><td class="port-req-port">443</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">HTTPS</td></tr>';
-  html += '<tr><td class="port-req-port">22</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">SSH Remote Access</td></tr>';
+  html += '<tr><td class="port-req-port">22</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">Remote SSH access</td></tr>';
-  html += '<tr><td class="port-req-port">8448</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">Matrix Federation</td></tr>';
   html += '</tbody></table>';
   html += '</div>';
 
   // Optional ports table
   html += '<div class="onboarding-port-section" style="margin-bottom:20px;">';
-  html += '<div class="onboarding-port-section-title" style="font-weight:700;margin-bottom:4px;">Optional — Only needed if you enable Element Calling:</div>';
+  html += '<div class="onboarding-port-section-title" style="font-weight:700;margin-bottom:4px;">Element Call Router Rules</div>';
-  html += '<div style="font-size:0.88em;margin-bottom:8px;color:var(--color-text-muted,#888);">These 5 additional port openings are required on top of the 4 required ports above.</div>';
+  html += '<div style="font-size:0.88em;margin-bottom:8px;color:var(--color-text-muted,#888);">Only add these if you enable Element Call. These ports help video and audio calls connect reliably.</div>';
   html += '<table class="onboarding-port-table">';
-  html += '<thead><tr><th>Port</th><th>Protocol</th><th>Forward&nbsp;to</th><th>Purpose</th></tr></thead>';
+  html += '<thead><tr><th>Port</th><th>Protocol</th><th>Forward&nbsp;To</th><th>Used For</th></tr></thead>';
   html += '<tbody>';
   html += '<tr><td class="port-req-port">7881</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">LiveKit WebRTC signalling</td></tr>';
   html += '<tr><td class="port-req-port">7882</td><td class="port-req-proto">UDP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">LiveKit media (UDP mux)</td></tr>';
   html += '<tr><td class="port-req-port">5349</td><td class="port-req-proto">TCP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">TURN over TLS</td></tr>';
   html += '<tr><td class="port-req-port">3478</td><td class="port-req-proto">UDP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">TURN (STUN/relay)</td></tr>';
-  html += '<tr><td class="port-req-port">30000–40000</td><td class="port-req-proto">TCP/UDP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">TURN relay (WebRTC)</td></tr>';
+  html += '<tr><td class="port-req-port">30000-40000</td><td class="port-req-proto">TCP &amp; UDP</td><td class="port-req-internal-ip">' + ip + '</td><td class="port-req-desc">TURN relay (WebRTC)</td></tr>';
   html += '</tbody></table>';
+  html += '<div style="font-size:0.85em;margin-top:6px;color:var(--color-text-muted,#888);">ℹ The <strong>30000-40000</strong> range is a single forwarding rule — just set its protocol to <strong>both TCP and UDP</strong> (often shown as "Both" or "TCP/UDP" on your router).</div>';
   html += '</div>';
 
   // Totals
   html += '<div class="onboarding-port-totals">';
-  html += '<strong>Total port openings: 4</strong> (without Element Calling)<br>';
+  html += '<strong>Total port openings: 3</strong> (without Element Call)<br>';
-  html += '<strong>Total port openings: 9</strong> (with Element Calling — 4 required + 5 optional)';
+  html += '<strong>Total port openings: 8</strong> (with Element Call — 3 required + 5 optional)';
   html += '</div>';
 
   html += '<div class="onboarding-port-warn" style="margin-bottom:16px;">'
@@ -582,12 +594,16 @@ async function loadStep4() {
     + '<li>Open your router\'s admin panel — usually <code>http://192.168.1.1</code> or <code>http://192.168.0.1</code></li>'
     + '<li>Look for <strong>"Port Forwarding"</strong>, <strong>"NAT"</strong>, or <strong>"Virtual Server"</strong> in the settings</li>'
     + '<li>Create a new rule for each port listed above</li>'
-    + '<li>Set the destination/internal IP to <strong>' + ip + '</strong></li>'
+    + '<li>' + destinationInstruction + '</li>'
     + '<li>Set both internal and external port to the same number</li>'
     + '<li>Save and apply changes</li>'
     + '</ol>'
     + '</details>';
 
+  html += '<div class="onboarding-port-note" style="margin-top:12px;">'
+    + '<strong>Important:</strong> The Hub can show which ports Sovran_SystemsOS needs, but it cannot fully confirm router forwarding from inside your home network. Full public port verification requires an outside internet check.'
+    + '</div>';
+
   body.innerHTML = html;
 }
 

app/sovran_systemsos_web/templates/index.html

@@ -24,6 +24,7 @@
     <span class="title">Sovran_SystemsOS Hub</span>
     <div class="header-buttons">
       <span class="role-badge" id="role-badge">Loading…</span>
+      <button class="btn btn-header-reboot" id="btn-header-reboot" title="Restart the entire computer">Reboot</button>
       <button class="btn btn-logout" id="btn-logout" title="Sign out">Sign Out</button>
     </div>
   </header>
@@ -61,7 +62,7 @@
       <div class="modal-log" id="modal-log" aria-live="polite"></div>
       <div class="modal-footer">
         <button class="btn btn-save" id="btn-save-report" style="display:none">Save Error Report</button>
-        <button class="btn btn-reboot" id="btn-reboot" style="display:none">Reboot</button>
+        <button class="btn btn-reboot" id="btn-reboot" style="display:none">Restart Entire System</button>
         <button class="btn btn-close-modal" id="btn-close-modal" disabled>Close</button>
       </div>
     </div>
@@ -164,7 +165,7 @@
       <div class="modal-log" id="rebuild-log" aria-live="polite"></div>
       <div class="modal-footer">
         <button class="btn btn-save" id="rebuild-save-report" style="display:none">Save Error Report</button>
-        <button class="btn btn-reboot" id="rebuild-reboot-btn" style="display:none">Reboot</button>
+        <button class="btn btn-reboot" id="rebuild-reboot-btn" style="display:none">Restart Entire System</button>
         <button class="btn btn-close-modal" id="rebuild-close-btn" disabled>Close</button>
       </div>
     </div>
@@ -240,26 +241,61 @@
         You will need it to log in to your computer<br />and the Sovran Hub at <em>sovransystemsos.local</em>.
       </p>
       <button class="security-reset-reboot-btn" id="security-reset-reboot-btn" disabled>
-        I have written down my new password — Reboot now
+        I have written down my new password — Restart Entire System
       </button>
     </div>
   </div>
 
   <!-- Reboot overlay -->
   <div class="reboot-overlay" id="reboot-overlay">
-    <div class="reboot-card">
+    <!-- Normal restarting card -->
-      <div class="reboot-icon">↻</div>
+    <div class="reboot-card" id="reboot-main-card">
-      <h2 class="reboot-title">System Rebooting</h2>
+      <div class="reboot-icon" aria-hidden="true">↻</div>
+      <h2 class="reboot-title">Restarting Entire System</h2>
       <p class="reboot-message">
-        Sovran_SystemsOS is now restarting.<br />
+        The entire computer is restarting, including the desktop and all hosted services.<br />
-        This page will automatically reconnect once the system is back online.
+        This page will reconnect automatically when Sovran_SystemsOS is back online.
       </p>
-      <div class="reboot-dots">
+      <div class="reboot-dots" aria-hidden="true">
         <span class="reboot-dot"></span>
         <span class="reboot-dot"></span>
         <span class="reboot-dot"></span>
       </div>
-      <p class="reboot-submessage">Stay tuned…</p>
+      <p class="reboot-submessage" id="reboot-submessage" aria-live="polite">Sending restart request…</p>
+    </div>
+    <!-- Error card (shown if restart request fails definitively) -->
+    <div class="reboot-card" id="reboot-error-card" style="display:none">
+      <div class="reboot-icon" aria-hidden="true">⚠</div>
+      <h2 class="reboot-title">Restart could not be started</h2>
+      <p class="reboot-message">
+        The computer did not begin restarting. No services were intentionally stopped. Please try again.
+      </p>
+      <div class="reboot-error-actions">
+        <button class="btn btn-close-modal" id="reboot-error-close-btn">Close</button>
+        <button class="btn btn-restart-amber" id="reboot-error-retry-btn">Try Again</button>
+      </div>
+    </div>
+  </div>
+
+  <!-- Restart Confirm Dialog -->
+  <div class="modal-overlay" id="restart-confirm-modal" role="dialog" aria-modal="true" aria-labelledby="restart-confirm-title">
+    <div class="creds-dialog domain-narrow-dialog">
+      <div class="creds-header">
+        <span class="creds-title" id="restart-confirm-title">Restart the entire computer?</span>
+      </div>
+      <div class="creds-body">
+        <div id="restart-conflict-box" class="restart-conflict-box" style="display:none">
+          <p class="restart-conflict-title">The system cannot restart right now.</p>
+          <p class="restart-conflict-desc">A system update, rebuild, backup, restore, or security operation is currently running. Wait for it to finish, then try again.</p>
+        </div>
+        <p class="support-desc"><strong>This will reboot the physical machine running Sovran_SystemsOS — not just the Hub.</strong></p>
+        <p class="support-desc">The desktop and all hosted services will stop temporarily and restart with the computer. Anyone currently using these services will be disconnected.</p>
+        <p class="support-desc">The system usually returns within 1–3 minutes. This page will reconnect automatically.</p>
+        <div class="domain-field-actions">
+          <button class="btn btn-close-modal" id="restart-confirm-cancel-btn">Cancel</button>
+          <button class="btn btn-restart-amber" id="restart-confirm-ok-btn">Restart Entire System</button>
+        </div>
+      </div>
     </div>
   </div>
 

app/sovran_systemsos_web/templates/onboarding.html

@@ -128,9 +128,8 @@
           <h2 class="onboarding-step-title">Domain Configuration</h2>
           <p class="onboarding-step-desc">
             Sovran_SystemsOS uses <strong><a href="https://njal.la" target="_blank" style="color: var(--accent-color);">Njal.la</a></strong> for domains and Dynamic DNS.
-            First, create an account at <strong>Njal.la</strong> and purchase a new domain, or create a subdomain from a domain you already own. Tip: Subdomains are free to create — you only need to purchase one domain, and you can add as many subdomains as you need at no extra cost.
+            Create an account at Njal.la, then for each service below, add a <strong>Dynamic</strong> record — no IP needed, it auto-populates once the DDNS curl command runs.
-            Then, in the Njal.la web interface, create a <strong>Dynamic</strong> record pointing to this machine's external IP address (shown below).
+            Paste the curl command from your Njal.la dashboard for each service.
-            Finally, paste the DDNS curl command from your Njal.la dashboard for each service below.
           </p>
         </div>
         <div class="onboarding-card" id="step-3-body">
@@ -149,14 +148,14 @@
       <div class="onboarding-panel" id="step-4" style="display:none">
         <div class="onboarding-step-header">
           <span class="onboarding-step-icon">🔌</span>
-          <h2 class="onboarding-step-title">Port Forwarding Check</h2>
+          <h2 class="onboarding-step-title">Router Setup</h2>
           <p class="onboarding-step-desc">
-            Forward these ports on your router to this machine. Each port only needs to be opened once — they are shared across all your services.
+            Forward these ports in your router to this Sovran_SystemsOS computer. These rules let people reach your services from outside your home network.
-            <strong>Ports 80 and 443 must be open for SSL certificates to work.</strong>
+            <strong>Ports 80 and 443 are required for HTTPS and SSL certificates.</strong>
           </p>
         </div>
         <div class="onboarding-card" id="step-4-body">
-          <p class="onboarding-loading">Checking ports…</p>
+          <p class="onboarding-loading">Loading router setup…</p>
         </div>
         <div class="onboarding-footer">
           <button class="btn btn-close-modal onboarding-btn-back" data-prev="3">← Back</button>

configuration.nix

@@ -145,12 +145,12 @@
     ranger fastfetch gedit openssl pwgen
     aspell aspellDicts.en lm_sensors
     hunspell hunspellDicts.en_US
-    synadm brave dua bitwarden-desktop
+    synadm brave dua
     gparted pv unzip parted screen zenity
     libargon2 gnome-terminal libreoffice-fresh
-    dig firefox element-desktop wp-cli axel
+    dig firefox wp-cli axel
-    lk-jwt-service livekit-libwebrtc livekit-cli livekit
+    lk-jwt-service livekit-libwebrtc livekit
-    matrix-synapse age
+    matrix-synapse age onlyoffice-desktopeditors
   ];
 
   # ── Shell ──────────────────────────────────────────────────

flake.lock

@@ -1,33 +1,15 @@
 {
   "nodes": {
-    "bip110": {
+    "btc-clients": {
       "inputs": {
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1778967282,
+        "lastModified": 1784932759,
-        "narHash": "sha256-0g9RvVCD6zxY2vy54GhbB1OeeEZdKuxTr9r0whcpRjQ=",
+        "narHash": "sha256-44/iCx+wiYukHGhvPm65ppJZ3FZZbp6f9JE5isz8TsA=",
-        "owner": "emmanuelrosa",
-        "repo": "bitcoin-knots-bip-110-nix",
-        "rev": "8d23ed98940d70e42ee870d719677a073a0a5920",
-        "type": "github"
-      },
-      "original": {
-        "owner": "emmanuelrosa",
-        "repo": "bitcoin-knots-bip-110-nix",
-        "type": "github"
-      }
-    },
-    "btc-clients": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1779889285,
-        "narHash": "sha256-5QOMNn/rxJjsy9n2pAG5+AwUXOAPXSzcr62y1tGHXKA=",
         "owner": "emmanuelrosa",
         "repo": "btc-clients-nix",
-        "rev": "9a3dd86e11ea5fb17ace9043aa3d0d5ed359a3ca",
+        "rev": "8aab86c245ab9a2bea0d72175d6fd663a892af9f",
         "type": "github"
       },
       "original": {
@@ -70,11 +52,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778716662,
+        "lastModified": 1782949081,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -105,7 +87,7 @@
       "inputs": {
         "extra-container": "extra-container",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_2",
         "nixpkgs-25_05": "nixpkgs-25_05",
         "nixpkgs-unstable": "nixpkgs-unstable"
       },
@@ -126,16 +108,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1777728799,
+        "lastModified": 1782911660,
-        "narHash": "sha256-z7jjYQqhkFKab92VQ3duB7QVO7f7Y62qTFrJYXO/lyo=",
+        "narHash": "sha256-PbR+tJ5E/Ux+01UtdFKqblccVA4/FgWbkym4ev3VHHQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4b2287113c2f9a2331c04899b2e2e5ab92dea9c5",
+        "rev": "cf720c15e108d432d29041cc5a185630809acefb",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "master",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -158,16 +139,16 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1751274312,
+        "lastModified": 1784856561,
-        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
+        "narHash": "sha256-J+Bx1Z6Oeoj2FgnBhRMKyUhhtDoOpTgXYaVLZpDjW4A=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
+        "rev": "597283ad8aa0b331c788e97c4c262d58877074ef",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.11",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -189,21 +170,6 @@
       }
     },
     "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1777728799,
-        "narHash": "sha256-z7jjYQqhkFKab92VQ3duB7QVO7f7Y62qTFrJYXO/lyo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "4b2287113c2f9a2331c04899b2e2e5ab92dea9c5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
       "locked": {
         "lastModified": 1778737229,
         "narHash": "sha256-6xWoytx8jFW4PF1GjRm/i/53trbpKGfz6zjzQGBr4cI=",
@@ -219,13 +185,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_3": {
       "locked": {
-        "lastModified": 1779560665,
+        "lastModified": 1784796856,
-        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
         "type": "github"
       },
       "original": {
@@ -235,13 +201,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_4": {
       "locked": {
-        "lastModified": 1779259093,
+        "lastModified": 1784555310,
-        "narHash": "sha256-7DKWmH23hL2eYdkxCKeqj2i+yljTKuU+3Nk1UPHOnxc=",
+        "narHash": "sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl+HHZ+DrtM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d99b013d5d1931ad77fe3912ed218170dec5d9a4",
+        "rev": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
         "type": "github"
       },
       "original": {
@@ -254,15 +220,15 @@
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_4",
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1779816597,
+        "lastModified": 1784814601,
-        "narHash": "sha256-Kgod3gZlhSp6WozZ2pFaclXbWpjs6kQLAtldoxb85Lc=",
+        "narHash": "sha256-T32JXjZ7kIbhBn8/Har171yGg6IBdl97cxAWameqZDE=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "297f9341476ba7f821a42d7a2805e206ef8c6ef8",
+        "rev": "f316e949e0ed9df0e1e0bf645c6dce721d4e230e",
         "type": "github"
       },
       "original": {
@@ -273,10 +239,9 @@
     },
     "root": {
       "inputs": {
-        "bip110": "bip110",
         "btc-clients": "btc-clients",
         "nix-bitcoin": "nix-bitcoin",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-stable": "nixpkgs-stable",
         "nixvim": "nixvim"
       }
@@ -298,15 +263,16 @@
     },
     "systems_2": {
       "locked": {
-        "lastModified": 1681028828,
+        "lastModified": 1774449309,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
+        "ref": "future-26.11",
         "repo": "default",
         "type": "github"
       }

flake.nix

@@ -6,11 +6,10 @@
 		nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release";
 		nixvim.url = "github:nix-community/nixvim";
 		btc-clients.url = "github:emmanuelrosa/btc-clients-nix";
-		nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.11";
+		nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";
-		bip110.url = "github:emmanuelrosa/bitcoin-knots-bip-110-nix";
 	};
 
-	outputs = { self, nixpkgs, nix-bitcoin, nixvim, btc-clients, nixpkgs-stable, bip110, ... }:
+	outputs = { self, nixpkgs, nix-bitcoin, nixvim, btc-clients, nixpkgs-stable, ... }:
 
 	let
 		overlay-stable = final: prev: {
@@ -56,8 +55,16 @@
 					btc-clients.packages.${pkgs.system}.bisq2
 					btc-clients.packages.${pkgs.system}.sparrow
 				];
-				sovran_systemsOS.packages.bip110 = bip110.packages.${pkgs.system}.bitcoind-knots-bip-110;
 			};
 		};
+
+		nixosTests.nwc-wallets-port-collision =
+			import ./nix/tests/nwc-wallets-port-collision.nix {
+				inherit nixpkgs;
+				system = "x86_64-linux";
+			};
+
+		checks.x86_64-linux.nwc-wallets-port-collision =
+			self.nixosTests.nwc-wallets-port-collision;
 	};
 }

iso/common.nix

@@ -16,7 +16,6 @@ in
 {
   imports = [
     "${modulesPath}/installer/cd-dvd/installation-cd-graphical-gnome.nix"
-    ./branding.nix
   ];
 
   image.baseName = lib.mkForce "Sovran_SystemsOS";

iso/installer.py

@@ -1169,7 +1169,7 @@ class InstallerWindow(Adw.ApplicationWindow):
         btn_box = Gtk.Box(orientation=Gtk.Orientation.HORIZONTAL, spacing=0)
         btn_box.set_halign(Gtk.Align.CENTER)
         btn_box.set_margin_bottom(32)
-        reboot_btn = Gtk.Button(label="I Have Written Down My Password — Reboot Now")
+        reboot_btn = Gtk.Button(label="I Have Written Down My Password — Restart Entire System")
         reboot_btn.add_css_class("suggested-action")
         reboot_btn.add_css_class("pill")
         reboot_btn.connect("clicked", lambda b: subprocess.run(["sudo", "reboot"]))

modules/bip110.nix

@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.sovran_systemsOS;
-in
-{
-  options.sovran_systemsOS.packages.bip110 = lib.mkOption {
-    type = lib.types.nullOr lib.types.package;
-    default = null;
-    description = "BIP110 Bitcoin package";
-  };
-
-  config = lib.mkIf (
-    cfg.features.bip110 &&
-    cfg.packages.bip110 != null
-  ) {
-    services.bitcoind.package = lib.mkForce cfg.packages.bip110;
-
-    environment.systemPackages = [
-      cfg.packages.bip110
-    ];
-  };
-}

modules/bitcoinecosystem.nix

@@ -4,7 +4,7 @@ lib.mkIf config.sovran_systemsOS.services.bitcoin {
 
   services.bitcoind = {
     enable = true;
-    package = config.nix-bitcoin.pkgs.bitcoind-knots;
+    package = pkgs.bitcoind-knots;
     dataDir = "/run/media/Second_Drive/BTCEcoandBackup/Bitcoin_Node";
     txindex = true;
     tor.proxy = true;

modules/core/caddy.nix

@@ -12,11 +12,15 @@ let
     || config.sovran_systemsOS.services.nextcloud
     || config.sovran_systemsOS.services.vaultwarden
     || config.sovran_systemsOS.features.haven
+    || config.sovran_systemsOS.features."nwc-wallets"
     || config.sovran_systemsOS.features.element-calling;
 in
 {
   services.caddy = {
-    enable = true;
+    # Only enable Caddy when at least one domain-based service needs it or
+    # the operator has defined custom vhosts.  This prevents Caddy from
+    # running on Desktop Only installs that have no web services configured.
+    enable = needsHttpsPorts || extraVhosts != "";
     user = "caddy";
     group = "root";
   };
@@ -67,6 +71,7 @@ in
       BTCPAY=$(read_domain btcpayserver)
       VAULTWARDEN=$(read_domain vaultwarden)
       HAVEN=$(read_domain haven)
+      LIGHTNING=$(read_domain lightning)
       ACME_EMAIL=$(read_domain sslemail)
 
       # Start with global config — use ACME only when domain-based services are active
@@ -94,10 +99,10 @@ EOF
 $MATRIX {
   reverse_proxy /_matrix/* http://localhost:8008
   reverse_proxy /_synapse/client/* http://localhost:8008
-}
+  handle /.well-known/matrix/server {
-
+    header Content-Type application/json
-$MATRIX:8448 {
+    respond \`{"m.server":"$MATRIX:443"}\` 200
-  reverse_proxy http://localhost:8008
+  }
 }
 EOF
         fi
@@ -183,6 +188,20 @@ $HAVEN {
 EOF
       fi
 
+      # ── Wallet Connections LNURL ──────────────────────
+      if [ -n "$LIGHTNING" ]; then
+        cat >> /run/caddy/Caddyfile <<EOF
+
+$LIGHTNING {
+  # LNURL discovery and callback are served by the dedicated
+  # nwc-lnurl service on loopback port 8181.  Only these paths
+  # are proxied; the Alby Hub management port (18080) is never exposed.
+  reverse_proxy /.well-known/lnurlp/* http://127.0.0.1:8181
+  reverse_proxy /lnurlp/* http://127.0.0.1:8181
+}
+EOF
+      fi
+
       # ── Sovran Hub (LAN access via mDNS) ────────────
       cat >> /run/caddy/Caddyfile <<EOF
 

modules/core/local-domain-loopback.nix

@@ -0,0 +1,171 @@
+{ config, pkgs, lib, ... }:
+
+# ── Server-local domain loopback overrides ────────────────────────────────────
+#
+# Some routers (especially newer ISP-provided devices) do not support NAT
+# loopback (hairpin NAT).  When a request originates on this computer and
+# targets a public domain name that resolves to the router's WAN address, the
+# router may refuse to loop the connection back in — causing Nextcloud, WordPress
+# background jobs, and other server-side callbacks to fail even when the service
+# is fully operational from the internet.
+#
+# This module installs a one-shot systemd service,
+# ``sovran-hosts-update.service``, that reads the configured service domains
+# from ``/var/lib/domains/`` at boot (and whenever triggered by the Hub after a
+# domain is saved) and writes ``127.0.0.1`` entries for them into a dedicated
+# Sovran-managed block in ``/etc/hosts``.
+#
+# With those entries in place:
+#   • Requests originating on this computer resolve the public domain name to
+#     127.0.0.1, reach Caddy directly, and never touch the router.
+#   • Caddy still receives the correct public hostname via TLS SNI so virtual-
+#     host routing and certificate validation continue to work.
+#   • The Sovran Hub can verify Caddy reachability locally without needing NAT
+#     loopback.
+#
+# Limitation: this does not help other devices on your home network (phones,
+# laptops).  Those devices resolve domains via the router's DNS and still depend
+# on NAT loopback (or require manual router DNS overrides).  For now, only
+# server-originated requests benefit from this override.
+#
+# On NixOS, /etc/hosts is normally a symlink into the Nix store and is
+# regenerated by the system activation script.  The ``system.activationScripts``
+# hook below converts it to a writable file each time the system is activated
+# (i.e. after every ``nixos-rebuild switch``) and then injects the Sovran block.
+# The same wrapped Nix-store executable is reused by both the activation hook
+# and the ``sovran-hosts-update.service`` unit, ensuring a deterministic runtime
+# PATH in every execution context.
+
+let
+  # ── Wrapped Nix-store executable ──────────────────────────────────────────
+  # Built with pkgs.writeShellApplication so that all required runtime tools
+  # (awk, grep, coreutils) are declared explicitly and injected into PATH by
+  # Nix.  Both the systemd service and the activation hook reference this same
+  # store-path executable — there is no second raw script body.
+  hostsUpdateScript = pkgs.writeShellApplication {
+    name = "sovran-hosts-update";
+
+    # Declare every external command the script calls.  These packages are
+    # added to the script's runtime PATH by writeShellApplication; nothing from
+    # the system PATH is relied upon.
+    runtimeInputs = [
+      pkgs.coreutils   # readlink, cp, mv, chmod, mktemp, rm, tr, head
+      pkgs.gawk        # awk
+      pkgs.gnugrep     # grep
+    ];
+
+    text = ''
+      # Regenerate the Sovran-managed loopback block in /etc/hosts.
+      # Safe to run multiple times — idempotent.
+
+      DOMAINS_DIR="/var/lib/domains"
+      HOSTS_FILE="/etc/hosts"
+      BEGIN_MARKER="# Sovran managed begin — server-local loopback overrides"
+      END_MARKER="# Sovran managed end"
+
+      # ── Step 1: ensure /etc/hosts is a regular writable file ──────────────
+      # On NixOS /etc/hosts starts as a symlink to the Nix store.  We replace
+      # it with a copy so we can append our block without touching the store.
+      if [ -L "$HOSTS_FILE" ]; then
+        TARGET=$(readlink -f "$HOSTS_FILE")
+        cp --no-preserve=all "$TARGET" "$HOSTS_FILE.sovran-tmp"
+        mv "$HOSTS_FILE.sovran-tmp" "$HOSTS_FILE"
+        chmod 644 "$HOSTS_FILE"
+      fi
+
+      # ── Step 2: remove any existing Sovran block ──────────────────────────
+      # Use a temp file so the operation is atomic.
+      # awk -v passes marker strings safely without shell interpolation.
+      TMP=$(mktemp "$HOSTS_FILE.XXXXXX")
+      trap 'rm -f "$TMP"' EXIT
+      awk -v begin="$BEGIN_MARKER" -v end="$END_MARKER" '
+        $0 == begin { skip=1; next }
+        $0 == end   { skip=0; next }
+        !skip
+      ' "$HOSTS_FILE" > "$TMP"
+
+      # ── Step 3: collect valid configured service domains ──────────────────
+      # NOTE: The hostname validation regex below must stay in sync with
+      # _SAFE_DOMAIN_RE in app/sovran_systemsos_web/server.py.
+      ENTRIES=""
+      for KEY in matrix wordpress nextcloud btcpayserver vaultwarden haven element-calling lightning; do
+        FILE="$DOMAINS_DIR/$KEY"
+        [ -f "$FILE" ] || continue
+        # Read the domain value (strip all whitespace, limit to 253 chars)
+        DOMAIN=$(tr -d '[:space:]' < "$FILE" | head -c 253)
+        [ -z "$DOMAIN" ] && continue
+        # Validate: must match a reasonable hostname pattern (no injection)
+        if ! printf '%s' "$DOMAIN" | grep -qE \
+          '^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+$'; then
+          echo "sovran-hosts-update: skipping invalid domain value for $KEY: $DOMAIN" >&2
+          continue
+        fi
+        ENTRIES="$ENTRIES
+127.0.0.1 $DOMAIN
+::1       $DOMAIN"
+      done
+
+      # ── Step 4: append the Sovran block if there are any entries ──────────
+      if [ -n "$ENTRIES" ]; then
+        {
+          printf '\n%s\n' "$BEGIN_MARKER"
+          printf '%s\n' "# These entries route configured service domains to local Caddy."
+          printf '%s\n' "# They are managed automatically — do not edit this block."
+          printf '%s\n' "$ENTRIES"
+          printf '%s\n' "$END_MARKER"
+        } >> "$TMP"
+      fi
+
+      # ── Step 5: atomically replace /etc/hosts ─────────────────────────────
+      mv "$TMP" "$HOSTS_FILE"
+      chmod 644 "$HOSTS_FILE"
+    '';
+  };
+
+in
+{
+  # ── /etc/sovran-hosts-update.sh — operator discoverability symlink ─────────
+  # Retain the familiar /etc path so administrators can inspect or manually
+  # invoke the helper.  The target is the wrapped Nix-store executable, so
+  # there is no second raw script body to keep in sync.
+  environment.etc."sovran-hosts-update.sh".source = lib.getExe hostsUpdateScript;
+
+  # ── Systemd service ────────────────────────────────────────────────────────
+
+  systemd.services.sovran-hosts-update = {
+    description = "Update /etc/hosts with Sovran server-local loopback overrides";
+    documentation = [ "https://github.com/naturallaw777/sovran-systems" ];
+
+    # Run before Caddy so loopback entries are ready when it starts.
+    before = [
+      "caddy.service"
+      "network-online.target"
+    ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      # Point directly at the wrapped Nix-store executable, not the /etc path.
+      ExecStart = lib.getExe hostsUpdateScript;
+    };
+  };
+
+  # ── Activation script (runs after every nixos-rebuild switch) ─────────────
+  # This ensures the loopback block survives rebuilds that restore the /etc/hosts
+  # symlink.  The "users" and "etc" scripts must complete first.
+  # The same wrapped Nix-store executable used by the systemd service is
+  # referenced here, guaranteeing identical runtime dependencies in both
+  # execution contexts.
+
+  system.activationScripts.sovranDomainLoopback = {
+    text = ''
+      if [ -d /var/lib/domains ]; then
+        if ! ${lib.getExe hostsUpdateScript}; then
+          echo "warning: sovran-hosts-update: failed to update /etc/hosts loopback entries" >&2
+        fi
+      fi
+    '';
+    deps = [ "etc" "users" ];
+  };
+}

modules/core/role-logic.nix

@@ -3,6 +3,13 @@
 {
   config = lib.mkMerge [
 
+    # nix-bitcoin is globally imported by the flake (nixosModules.Sovran_SystemsOS).
+    # This default satisfies nix-bitcoin's generateSecrets assertion so that Desktop
+    # Only systems can evaluate without enabling any Bitcoin services.
+    {
+      nix-bitcoin.generateSecrets = lib.mkDefault true;
+    }
+
     # ── Server+Desktop Role (default) ─────────────────────────
     (lib.mkIf config.sovran_systemsOS.roles.server_plus_desktop {
       sovran_systemsOS.web.btcpayserver = lib.mkDefault true;
@@ -12,19 +19,29 @@
     (lib.mkIf config.sovran_systemsOS.roles.desktop {
       services.desktopManager.gnome.enable = true;
 
+      # Force all server/node services and features off so they cannot be
+      # accidentally enabled via custom.nix or option defaults on Desktop Only.
       sovran_systemsOS.services = {
-        synapse = lib.mkDefault false;
+        synapse = lib.mkForce false;
-        bitcoin = lib.mkDefault false;
+        bitcoin = lib.mkForce false;
-        vaultwarden = lib.mkDefault false;
+        vaultwarden = lib.mkForce false;
-        wordpress = lib.mkDefault false;
+        wordpress = lib.mkForce false;
-        nextcloud = lib.mkDefault false;
+        nextcloud = lib.mkForce false;
       };
 
-      sovran_systemsOS.web.btcpayserver = lib.mkDefault false;
+      sovran_systemsOS.features = {
+        haven = lib.mkForce false;
+        mempool = lib.mkForce false;
+        element-calling = lib.mkForce false;
+        bitcoin-core = lib.mkForce false;
+        "nwc-wallets" = lib.mkForce false;
+      };
+
+      sovran_systemsOS.web.btcpayserver = lib.mkForce false;
     })
 
     # ── Bitcoin Node Only Role ────────────────────────────────
-    # Bitcoin ecosystem + mempool + bip110, BTCPay runs but not exposed via Caddy
+    # Bitcoin ecosystem + mempool, BTCPay runs but not exposed via Caddy
     (lib.mkIf config.sovran_systemsOS.roles.node {
       sovran_systemsOS.services = {
         bitcoin = lib.mkDefault true;
@@ -36,7 +53,6 @@
 
       sovran_systemsOS.features = {
         mempool = lib.mkDefault true;
-        bip110 = lib.mkDefault true;
       };
 
       sovran_systemsOS.web.btcpayserver = lib.mkDefault false;

modules/core/roles.nix

@@ -43,12 +43,25 @@
     # ── Features (default OFF — user can enable in custom.nix) ──
     features = {
       haven = lib.mkEnableOption "Haven NOSTR relay";
-      bip110 = lib.mkEnableOption "BIP-110 Bitcoin Better Money";
       mempool = lib.mkEnableOption "Bitcoin Mempool Explorer";
       element-calling = lib.mkEnableOption "Element Video and Audio Calling";
       bitcoin-core = lib.mkEnableOption "Bitcoin Core";
+      "nwc-wallets" = lib.mkEnableOption "Wallet Connections";
       rdp = lib.mkEnableOption "Gnome Remote Desktop";
       sshd = lib.mkEnableOption "SSH remote access";
+
+      # Deprecated: BIP-110 is now built into mainline Bitcoin Knots and is the
+      # default node. This option is retained ONLY so that existing machines with
+      # `sovran_systemsOS.features.bip110 = lib.mkForce true;` left in their local
+      # custom.nix continue to evaluate. It has no effect and will be removed in a
+      # future release once the Hub has cleaned up old custom.nix files.
+      bip110 = lib.mkOption {
+        type = lib.types.nullOr lib.types.bool;
+        default = null;
+        internal = true;
+        visible = false;
+        description = "(Deprecated, no-op) BIP-110 is now built into Bitcoin Knots.";
+      };
     };
 
     # ── Web exposure (controls Caddy vhosts) ──────────────────
@@ -89,4 +102,15 @@
       description = "Nostr public key (npub1...) for Haven relay";
     };
   };
+
+  config = lib.mkIf (config.sovran_systemsOS.features.bip110 != null) {
+    warnings = [
+      ''
+        sovran_systemsOS.features.bip110 is deprecated and has no effect:
+        BIP-110 is now built into mainline Bitcoin Knots, which is the default node.
+        You can safely remove the `sovran_systemsOS.features.bip110` line from
+        /etc/nixos/custom.nix. The Sovran Hub will also remove it automatically.
+      ''
+    ];
+  };
 }

modules/core/sovran-hub.nix

@@ -29,10 +29,7 @@ let
     ]
     # ── Bitcoin Base (node implementations) ────────────────────
     ++ lib.optionals cfg.services.bitcoin [
-      { name = "Bitcoin Knots + BIP110"; unit = "bitcoind.service"; type = "system"; icon = "bip110";        enabled = cfg.features.bip110;        category = "bitcoin-base"; credentials = [
+      { name = "Bitcoin Knots + BIP110"; unit = "bitcoind.service"; type = "system"; icon = "bip110";        enabled = cfg.services.bitcoin && !cfg.features.bitcoin-core; category = "bitcoin-base"; credentials = [
-        { label = "Tor Address — Access from anywhere via Tor Browser"; file = "/var/lib/tor/onion/bitcoind/hostname"; prefix = "http://"; }
-      ]; }
-      { name = "Bitcoin Knots";          unit = "bitcoind.service"; type = "system"; icon = "bitcoind";      enabled = cfg.services.bitcoin && !cfg.features.bitcoin-core && !cfg.features.bip110; category = "bitcoin-base"; credentials = [
         { label = "Tor Address — Access from anywhere via Tor Browser"; file = "/var/lib/tor/onion/bitcoind/hostname"; prefix = "http://"; }
       ]; }
       { name = "Bitcoin Core";           unit = "bitcoind.service"; type = "system"; icon = "bitcoin-core";  enabled = cfg.features.bitcoin-core;  category = "bitcoin-base"; credentials = [
@@ -64,6 +61,9 @@ let
         { label = "Server"; value = "tcp://127.0.0.1:50001 (Electrs)"; }
         { label = "Status"; value = "Auto-configured on first boot"; }
       ]; }
+      { name = "Wallet Connections"; unit = "albyhub.service"; type = "system"; icon = "nwc"; enabled = cfg.features."nwc-wallets"; category = "bitcoin-apps"; credentials = [
+        { label = "Lightning Address Domain"; file = "/var/lib/domains/lightning"; }
+      ]; }
       { name = "Mempool";            unit = "mempool.service";      type = "system"; icon = "mempool";      enabled = cfg.features.mempool;  category = "bitcoin-apps"; credentials = [
         { label = "Tor Address — Access from anywhere via Tor Browser"; file = "/var/lib/tor/onion/mempool-frontend/hostname"; prefix = "http://"; }
         { label = "Local Network — Access on your home network only"; file = "/var/lib/secrets/internal-ip"; prefix = "http://"; suffix = ":60847"; }
@@ -149,33 +149,16 @@ let
     echo ""
 
     if [ "$RC" -eq 0 ]; then
-      echo "── Step 2/3: nixos-rebuild ──────────────────────────"
+      echo "── Step 2/3: nixos-rebuild boot (stage next reboot) ──"
-      SWITCH_OUT=$(nixos-rebuild switch --flake /etc/nixos --print-build-logs \
+      BOOT_OUT=$(nixos-rebuild boot --flake /etc/nixos --print-build-logs \
         --option connect-timeout 10 \
         --option stalled-download-timeout 90 \
         --option download-attempts 7 \
         --option fallback true 2>&1)
-      SWITCH_RC=$?
+      BOOT_RC=$?
-      echo "$SWITCH_OUT"
+      echo "$BOOT_OUT"
-      if [ "$SWITCH_RC" -eq 0 ]; then
+      if [ "$BOOT_RC" -ne 0 ]; then
-        echo "[OK] switch succeeded"
+        echo "[ERROR] nixos-rebuild boot failed"
-      elif echo "$SWITCH_OUT" | grep -q "switchInhibitors\|Pre-switch checks failed"; then
-        echo ""
-        echo "  ✓ Build succeeded — a reboot is required to apply this update"
-        echo "  (Critical system components changed; running nixos-rebuild boot instead)"
-        if nixos-rebuild boot --flake /etc/nixos --print-build-logs \
-             --option connect-timeout 10 \
-             --option stalled-download-timeout 90 \
-             --option download-attempts 7 \
-             --option fallback true 2>&1; then
-          echo "REBOOT_REQUIRED" > "$STATUS"
-          exit 0
-        else
-          echo "[ERROR] nixos-rebuild boot also failed"
-          RC=1
-        fi
-      else
-        echo "[ERROR] nixos-rebuild switch failed"
         RC=1
       fi
       echo ""
@@ -191,9 +174,10 @@ let
 
     if [ "$RC" -eq 0 ]; then
       echo "══════════════════════════════════════════════════"
-      echo "  ✓ Update completed successfully"
+      echo "  ✓ Update staged successfully"
+      echo "  Reboot required to activate the new system"
       echo "══════════════════════════════════════════════════"
-      echo "SUCCESS" > "$STATUS"
+      echo "REBOOT_REQUIRED" > "$STATUS"
     else
       echo "══════════════════════════════════════════════════"
       echo "  ✗ Update failed — see errors above"
@@ -372,6 +356,26 @@ uvicorn.run(
 LAUNCHER
       chmod +x $out/bin/sovran-hub-web
 
+      cat > $out/bin/nwc-wallet <<LAUNCHER
+#!${pkgs.python3}/bin/python3
+import os, sys
+base = os.path.join("$out", "lib", "sovran-hub-web")
+sys.path.insert(0, base)
+from sovran_systemsos_web.nwc_wallet_cli import main
+sys.exit(main())
+LAUNCHER
+      chmod +x $out/bin/nwc-wallet
+
+      cat > $out/bin/nwc-lnurl <<LAUNCHER
+#!${pkgs.python3}/bin/python3
+import os, sys
+base = os.path.join("$out", "lib", "sovran-hub-web")
+sys.path.insert(0, base)
+from sovran_systemsos_web.nwc_lnurl_service import main
+main()
+LAUNCHER
+      chmod +x $out/bin/nwc-lnurl
+
       runHook postInstall
     '';
 
@@ -383,6 +387,12 @@ LAUNCHER
 
 in
 {
+  options.services.sovranHub.webPackage = lib.mkOption {
+    type        = lib.types.package;
+    default     = sovran-hub-web;
+    description = "The sovran-hub-web Python application package. Other modules use this to reference Hub-installed scripts without duplicating the Python path setup.";
+  };
+
   config = {
     systemd.services.sovran-hub-web = {
       description = "Sovran_SystemsOS Hub Web Interface";
@@ -401,13 +411,25 @@ in
       };
 
       path = [
+        pkgs.bash
+        pkgs.gawk
         pkgs.qrencode
         pkgs.curl
         pkgs.iproute2
         pkgs.nftables
         pkgs.iptables
         pkgs.hostname
-      ] ++ lib.optional cfg.services.bitcoin config.services.bitcoind.package;
+        pkgs.coreutils
+        pkgs.findutils
+        pkgs.gnugrep
+        pkgs.rsync
+        pkgs.acl
+        pkgs.util-linux
+      ]
+      ++ lib.optional cfg.services.bitcoin config.services.bitcoind.package
+      ++ lib.optionals cfg.services.bitcoin [ pkgs.lnd ]
+      ++ lib.optionals (cfg.services.nextcloud || cfg.services.synapse) [ config.services.postgresql.package ]
+      ++ lib.optionals config.services.mysql.enable [ config.services.mysql.package ];
     };
 
     systemd.services.sovran-hub-update = {

modules/core/ssh-bootstrap.nix

@@ -31,7 +31,7 @@ lib.mkIf userExists {
   };
 
   systemd.services.factory-ssh-keygen = {
-    description = "Generate factory SSH key for ${userName} if missing";
+    description = "Generate or repair factory SSH key for ${userName}";
     wantedBy = [ "multi-user.target" ];
     after = [ "ssh-passphrase-setup.service" ];
     requires = [ "ssh-passphrase-setup.service" ];
@@ -39,14 +39,47 @@ lib.mkIf userExists {
       Type = "oneshot";
       RemainAfterExit = true;
     };
-    path = [ pkgs.openssh pkgs.coreutils ];
+    path = [ pkgs.openssh pkgs.coreutils pkgs.util-linux ];
     script = ''
-      if [ ! -f "${keyPath}" ]; then
+      set -eu
+
       PASSPHRASE=$(cat /var/lib/secrets/ssh-passphrase)
+      lock_file="${keyPath}.lock"
+
+      exec 9>"$lock_file"
+
+      if ! flock -n 9; then
+        echo "Factory SSH key setup is already running." >&2
+        exit 1
+      fi
+
+      generate_factory_key() {
         ssh-keygen -q -N "$PASSPHRASE" -t ed25519 -f "${keyPath}"
         chown ${userName}:users "${keyPath}" "${keyPath}.pub"
         chmod 600 "${keyPath}"
         chmod 644 "${keyPath}.pub"
+      }
+
+      if [ ! -f "${keyPath}" ]; then
+        generate_factory_key
+      elif ! ssh-keygen -y -P "$PASSPHRASE" -f "${keyPath}" >/dev/null 2>&1; then
+        backup_suffix="$(date -u +%Y%m%d_%H%M%S)-$$"
+        backup_path="${keyPath}.bak-$backup_suffix"
+        backup_index=0
+
+        while [ -e "$backup_path" ] || [ -e "$backup_path.pub" ]; do
+          backup_index=$((backup_index + 1))
+          backup_path="${keyPath}.bak-$backup_suffix-$backup_index"
+        done
+
+        echo "Existing factory SSH key does not match current passphrase; backing it up to $backup_path and generating a replacement."
+        mv "${keyPath}" "$backup_path"
+
+        if [ -f "${keyPath}.pub" ]; then
+          mv "${keyPath}.pub" "$backup_path.pub"
+        fi
+
+        generate_factory_key
       fi
     '';
   };

modules/element-calling.nix

@@ -34,8 +34,8 @@ lib.mkIf config.sovran_systemsOS.features.element-calling {
   };
 
   ####### ENSURE SERVICES START AFTER KEY EXISTS #######
-  systemd.services.livekit.after = [ "livekit-key-setup.service" ];
+  systemd.services.livekit.after = [ "livekit-key-setup.service" "livekit-turn-setup.service" ];
-  systemd.services.livekit.wants = [ "livekit-key-setup.service" ];
+  systemd.services.livekit.wants = [ "livekit-key-setup.service" "livekit-turn-setup.service" ];
   systemd.services.lk-jwt-service.after = [ "livekit-key-setup.service" ];
   systemd.services.lk-jwt-service.wants = [ "livekit-key-setup.service" ];
 
@@ -68,35 +68,54 @@ $MATRIX {
   header /.well-known/matrix/* Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
   header /.well-known/matrix/* Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
   respond /.well-known/matrix/client \`{ "m.homeserver": {"base_url": "https://$MATRIX" }, "org.matrix.msc4143.rtc_foci": [{ "type":"livekit", "livekit_service_url":"https://$ELEMENT_CALLING/livekit/jwt" }] }\`
-}
+  respond /.well-known/matrix/server \`{"m.server":"$MATRIX:443"}\`
-
-$MATRIX:8448 {
-  reverse_proxy http://localhost:8008
 }
 
 $ELEMENT_CALLING {
-  handle /livekit/jwt/sfu/get {
+  # Route all current lk-jwt-service authorization endpoints to port 8073,
+  # stripping the /livekit/jwt prefix that Caddy adds on the public URL.
+  @lk_jwt path /livekit/jwt/sfu/get* /livekit/jwt/get_token* /livekit/jwt/healthz* /livekit/jwt/sfu_webhook* /livekit/jwt/delegate_delayed_leave*
+  handle @lk_jwt {
     uri strip_prefix /livekit/jwt
     reverse_proxy [::1]:8073 {
       header_up Host {host}
       header_up X-Forwarded-Server {host}
       header_up X-Real-IP {remote_host}
       header_up X-Forwarded-For {remote_host}
+      header_up X-Forwarded-Proto {scheme}
     }
   }
   handle {
-    reverse_proxy localhost:7880
+    reverse_proxy localhost:7880 {
+      header_up Host {host}
+      header_up X-Forwarded-Proto {scheme}
+      header_up X-Forwarded-For {remote_host}
+      header_up X-Real-IP {remote_host}
+      transport http {
+        read_timeout 300s
+        write_timeout 300s
+      }
+    }
   }
 }
 EOF
     '';
   };
 
-  ####### LIVEKIT RUNTIME CONFIG #######
+  ####### LIVEKIT TURN SETUP (runtime cert + config) #######
-  systemd.services.livekit-runtime-config = {
+  # Replaces the old dead livekit-runtime-config.service. At runtime this:
-    description = "Generate LiveKit runtime config from domain files";
+  #   * reads the matrix domain from /var/lib/domains/matrix (never hardcoded)
+  #   * copies Caddy's already-issued matrix cert/key into /var/lib/livekit
+  #     so LoadCredential can stage them for the (DynamicUser) livekit unit
+  #   * detects the primary network interface from the IPv4 default route so
+  #     LiveKit only advertises real ICE candidates — not VPN/container/private
+  #     addresses from interfaces like Tailscale or Docker bridges
+  #   * writes a complete LiveKit config (with turn.domain and interface
+  #     substituted) that the overridden ExecStart loads.
+  systemd.services.livekit-turn-setup = {
+    description = "Stage TURN cert and generate LiveKit runtime config from domain files";
+    after = [ "caddy.service" "livekit-key-setup.service" ];
     before = [ "livekit.service" ];
-    after = [ "livekit-key-setup.service" ];
     requiredBy = [ "livekit.service" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
@@ -106,20 +125,63 @@ EOF
     unitConfig = {
       ConditionPathExists = "/var/lib/domains/element-calling";
     };
-    path = [ pkgs.coreutils ];
+    path = [ pkgs.coreutils pkgs.findutils pkgs.iproute2 pkgs.gawk ];
     script = ''
       MATRIX=$(cat /var/lib/domains/matrix)
 
       mkdir -p /run/livekit
 
-      cat > /run/livekit/runtime-config.yaml <<EOF
+      # Copy Caddy's already-issued matrix cert/key into LiveKit's state dir.
+      # The ACME CA hostname directory can vary, so glob for the domain dir.
+      CRT=$(find /var/lib/caddy -path "*/$MATRIX/$MATRIX.crt" | head -n1)
+      KEY=$(find /var/lib/caddy -path "*/$MATRIX/$MATRIX.key" | head -n1)
+      cp "$CRT" /var/lib/livekit/turn.crt
+      cp "$KEY" /var/lib/livekit/turn.key
+      chmod 640 /var/lib/livekit/turn.crt /var/lib/livekit/turn.key
+
+      # Detect the primary network interface from the IPv4 default route.
+      # Restricting LiveKit to this single interface prevents it from
+      # advertising VPN/container/private ICE candidates (e.g. Tailscale,
+      # Docker bridges) that remote peers cannot reach, which causes all
+      # ICE negotiation attempts to fail with responsesReceived: 0.
+      IFACE=$(ip -4 route show default | awk '/^default/ { for(i=1;i<=NF;i++) if($i=="dev" && (i+1)<=NF) { print $(i+1); exit } }')
+      if [ -z "$IFACE" ]; then
+        echo "ERROR: Could not detect a default-route network interface from 'ip -4 route show default'." >&2
+        echo "ERROR: Cannot generate a valid LiveKit config without a real interface to bind ICE candidates to." >&2
+        echo "ERROR: Ensure a default IPv4 route is configured, e.g.: ip route add default via <gateway> dev <interface>" >&2
+        echo "ERROR: Inspect the current routing table with: ip -4 route show" >&2
+        exit 1
+      fi
+      echo "Detected primary network interface: $IFACE"
+
+      # Generate the full LiveKit config the daemon will load. turn.domain and
+      # rtc.interfaces.includes are only known at runtime, so they are
+      # substituted here. The cert/key paths point at the LoadCredential-staged
+      # copies under /run/credentials.
+      cat > /run/livekit/livekit.yaml <<EOF
+port: 7880
+rtc:
+  use_external_ip: true
+  skip_external_ip_validation: true
+  tcp_port: 7881
+  udp_port: 7882
+  port_range_start: 30000
+  port_range_end: 40000
+  interfaces:
+    includes:
+      - $IFACE
+room:
+  auto_create: false
 turn:
+  enabled: true
   domain: $MATRIX
-  cert_file: /var/lib/livekit/$MATRIX.crt
+  tls_port: 5349
-  key_file: /var/lib/livekit/$MATRIX.key
+  udp_port: 3478
+  cert_file: /run/credentials/livekit.service/turn-cert
+  key_file: /run/credentials/livekit.service/turn-key
 EOF
 
-      chmod 640 /run/livekit/runtime-config.yaml
+      chmod 644 /run/livekit/livekit.yaml
     '';
   };
 
@@ -130,7 +192,11 @@ EOF
     keyFile = livekitKeyFile;
     settings = {
       rtc.use_external_ip = true;
+      rtc.skip_external_ip_validation = true;
+      rtc.tcp_port = 7881;
       rtc.udp_port = 7882;
+      rtc.port_range_start = 30000;
+      rtc.port_range_end = 40000;
       room.auto_create = false;
       turn = {
         enabled = true;
@@ -140,13 +206,27 @@ EOF
     };
   };
 
+  # Override ExecStart to load the runtime-generated config (which carries the
+  # runtime-only turn.domain), mirroring the Caddy ExecStart override pattern in
+  # modules/core/caddy.nix. Deliver the TURN cert/key via LoadCredential so they
+  # are readable under the upstream unit's DynamicUser=true sandbox without
+  # weakening it. Everything else about the standard unit is left intact.
+  systemd.services.livekit.serviceConfig.ExecStart = lib.mkForce [
+    ""
+    "${pkgs.livekit}/bin/livekit-server --config /run/credentials/livekit.service/livekit-config --key-file /run/credentials/livekit.service/livekit-secrets"
+  ];
+
+  systemd.services.livekit.serviceConfig.LoadCredential = [
+    "livekit-config:/run/livekit/livekit.yaml"
+    "livekit-secrets:${livekitKeyFile}"
+    "turn-cert:/var/lib/livekit/turn.crt"
+    "turn-key:/var/lib/livekit/turn.key"
+  ];
+
   networking.firewall.allowedTCPPorts = [ 5349 7881 ];
   networking.firewall.allowedUDPPorts = [ 3478 7882 ];
   networking.firewall.allowedUDPPortRanges = [
-    { from = 30000; to = 40000; }
+    { from = 30000; to = 40000; } # LiveKit internal TURN relay range
-  ];
-  networking.firewall.allowedTCPPortRanges = [
-    { from = 30000; to = 40000; }
   ];
 
   ####### JWT SERVICE RUNTIME CONFIG #######
@@ -166,11 +246,13 @@ EOF
     path = [ pkgs.coreutils ];
     script = ''
       ELEMENT_CALLING=$(cat /var/lib/domains/element-calling)
+      MATRIX=$(cat /var/lib/domains/matrix)
 
       mkdir -p /run/lk-jwt-service
 
       cat > /run/lk-jwt-service/env <<EOF
 LIVEKIT_URL=wss://$ELEMENT_CALLING
+LIVEKIT_FULL_ACCESS_HOMESERVERS=$MATRIX
 EOF
 
       chmod 640 /run/lk-jwt-service/env

modules/modules.nix

@@ -16,6 +16,7 @@
     ./core/remote-deploy.nix
     ./core/no-sleep.nix
     ./core/cpu-performance.nix
+    ./core/local-domain-loopback.nix
 
     # ── Always on (no flag) ───────────────────────────────────
     ./php.nix
@@ -31,7 +32,7 @@
 
     # ── Features (default OFF — enable in custom.nix) ─────────
     ./haven.nix
-    ./bip110.nix
+    ./nwc-wallets.nix
     ./element-calling.nix
     ./mempool.nix
     ./bitcoin-core.nix

modules/nwc-wallets.nix

@@ -0,0 +1,173 @@
+{ config, pkgs, lib, ... }:
+
+let
+  albyHubPort = 18080;
+  albyHubApiBase = "http://127.0.0.1:${toString albyHubPort}";
+  patchedAlbyHub = pkgs.albyhub.overrideAttrs (old: {
+    patches = (old.patches or []) ++ [
+      ../packages/albyhub/0001-private-route-hints.patch
+      ../packages/albyhub/0002-isolated-invoice-app-id.patch
+      ../packages/albyhub/0003-loopback-bind-host.patch
+    ];
+  });
+
+  lndRpcAddress = lib.attrByPath [ "services" "lnd" "rpcAddress" ] "127.0.0.1" config;
+  lndRpcPort = toString (lib.attrByPath [ "services" "lnd" "rpcPort" ] 10009 config);
+  lndCertPath = config.services.lnd.certPath;
+  pythonManagerEnvironment = {
+    NWC_ALBY_HUB_API_BASE = albyHubApiBase;
+    NWC_LND_ADDRESS = "${lndRpcAddress}:${lndRpcPort}";
+    NWC_LND_CERT_FILE = lndCertPath;
+    NWC_LND_MACAROON_FILE = "/run/lnd/albyhub.macaroon";
+  };
+  wrappedNwcWallet = lib.hiPrio (pkgs.writeShellScriptBin "nwc-wallet" ''
+    export NWC_ALBY_HUB_API_BASE='${pythonManagerEnvironment.NWC_ALBY_HUB_API_BASE}'
+    export NWC_LND_ADDRESS='${pythonManagerEnvironment.NWC_LND_ADDRESS}'
+    export NWC_LND_CERT_FILE='${pythonManagerEnvironment.NWC_LND_CERT_FILE}'
+    export NWC_LND_MACAROON_FILE='${pythonManagerEnvironment.NWC_LND_MACAROON_FILE}'
+    exec ${config.services.sovranHub.webPackage}/bin/nwc-wallet "$@"
+  '');
+
+  albyhubWrapper = pkgs.writeShellScript "albyhub-wrapper" ''
+    set -euo pipefail
+    password_file="/var/lib/albyhub/unlock-password"
+    if [ ! -s "$password_file" ]; then
+      umask 077
+      ${pkgs.openssl}/bin/openssl rand -hex 32 > "$password_file"
+    fi
+    export AUTO_UNLOCK_PASSWORD="$(cat "$password_file")"
+    exec ${lib.getExe patchedAlbyHub}
+  '';
+in
+lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
+  assertions = [
+    {
+      assertion = config.services.lnd.enable;
+      message = "Wallet Connections requires services.lnd.enable = true.";
+    }
+    {
+      assertion = !(lib.attrByPath [ "nix-bitcoin" "netns-isolation" "enable" ] false config);
+      message = "Wallet Connections requires nix-bitcoin.netns-isolation.enable = false.";
+    }
+    {
+      assertion = albyHubPort != config.services.lnd.restPort;
+      message = "Alby Hub and LND REST must use different ports.";
+    }
+    {
+      assertion = albyHubPort != 8181;
+      message = "Alby Hub and the public LNURL service must use different ports.";
+    }
+    {
+      assertion = !(lib.elem albyHubPort config.networking.firewall.allowedTCPPorts);
+      message = "Alby Hub management port must not be opened on the public TCP firewall.";
+    }
+  ];
+
+  users.groups.albyhub = { };
+  users.users.albyhub = {
+    isSystemUser = true;
+    group = "albyhub";
+    home = "/var/lib/albyhub";
+    createHome = false;
+    extraGroups = [ ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/albyhub       0700 albyhub albyhub -"
+  ];
+
+  services.lnd.macaroons.albyhub = {
+    user = "albyhub";
+    permissions = lib.concatStringsSep "," [
+      ''{"entity":"info","action":"read"}''
+      ''{"entity":"offchain","action":"read"}''
+      ''{"entity":"offchain","action":"write"}''
+      ''{"entity":"invoices","action":"read"}''
+      ''{"entity":"invoices","action":"write"}''
+      ''{"entity":"onchain","action":"read"}''
+      ''{"entity":"address","action":"read"}''
+      ''{"entity":"message","action":"read"}''
+      ''{"entity":"message","action":"write"}''
+    ];
+  };
+
+  systemd.services.albyhub = {
+    description = "Alby Hub — NWC wallet server";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" "lnd.service" ];
+    requires = [ "lnd.service" ];
+
+    environment = {
+      HOME = "/var/lib/albyhub";
+      HOST = "127.0.0.1";
+      LN_BACKEND_TYPE = "LND";
+      ENABLE_ADVANCED_SETUP = "false";
+      LND_ADDRESS = "${lndRpcAddress}:${lndRpcPort}";
+      LND_CERT_FILE = lndCertPath;
+      LND_MACAROON_FILE = "/run/lnd/albyhub.macaroon";
+      WORK_DIR = "/var/lib/albyhub";
+      DATABASE_URI = "/var/lib/albyhub/nwc.db";
+      PORT = toString albyHubPort;
+      RELAY = "wss://relay.getalby.com,wss://relay2.getalby.com";
+      AUTO_LINK_ALBY_ACCOUNT = "false";
+      SEND_EVENTS_TO_ALBY = "false";
+      LOG_TO_FILE = "false";
+      HIDE_UPDATE_BANNER = "true";
+    };
+
+    serviceConfig = {
+      Type = "simple";
+      User = "albyhub";
+      Group = "albyhub";
+      WorkingDirectory = "/var/lib/albyhub";
+      ExecStart = albyhubWrapper;
+      Restart = "on-failure";
+      RestartSec = "10s";
+      UMask = "0077";
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+      ProtectHome = true;
+      ProtectSystem = "strict";
+      ReadWritePaths = [ "/var/lib/albyhub" ];
+      ReadOnlyPaths = [ lndCertPath "/run/lnd" ];
+    };
+  };
+
+  systemd.services.nwc-lnurl = {
+    description = "Wallet Connections public LNURL service";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "albyhub.service" "sovran-hub-web.service" ];
+    wants = [ "albyhub.service" ];
+    environment = pythonManagerEnvironment;
+
+    serviceConfig = {
+      Type = "simple";
+      User = "albyhub";
+      Group = "albyhub";
+      ExecStart = "${config.services.sovranHub.webPackage}/bin/nwc-lnurl";
+      Restart = "on-failure";
+      RestartSec = "10s";
+      UMask = "0027";
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+      ProtectHome = true;
+      ProtectSystem = "strict";
+      ReadOnlyPaths = [
+        "/var/lib/domains/lightning"
+        "/var/lib/albyhub/unlock-password"
+      ];
+    };
+  };
+
+  systemd.services.sovran-hub-web.environment = pythonManagerEnvironment;
+  environment.systemPackages = lib.mkBefore [ wrappedNwcWallet ];
+
+  sovran_systemsOS.domainRequirements = [
+    {
+      name = "lightning";
+      label = "Lightning Address Domain";
+      example = "pay.yourdomain.com";
+      needsDDNS = true;
+    }
+  ];
+}

modules/rdp.nix

@@ -2,70 +2,104 @@
 
 lib.mkIf config.sovran_systemsOS.features.rdp {
 
-  users.users.gnome-remote-desktop = {
-    isSystemUser = true;
-    group = "gnome-remote-desktop";
-    home = "/var/lib/gnome-remote-desktop";
-    createHome = true;
-  };
-  users.groups.gnome-remote-desktop = {};
-
   # Enable the GNOME Remote Desktop service at the system level
   services.gnome.gnome-remote-desktop.enable = true;
 
   # Open RDP port in the firewall
   networking.firewall.allowedTCPPorts = [ 3389 ];
 
-  # Ensure the service actually starts and waits for setup to complete
+  # Ensure the service only starts after setup succeeds
   systemd.services.gnome-remote-desktop = {
     wantedBy = [ "graphical.target" ];
     after = [ "gnome-remote-desktop-setup.service" ];
-    wants = [ "gnome-remote-desktop-setup.service" ];
+    requires = [ "gnome-remote-desktop-setup.service" ];
   };
 
   systemd.tmpfiles.rules = [
-    "d /var/lib/gnome-remote-desktop 0750 gnome-remote-desktop gnome-remote-desktop -"
+    "d /var/lib/gnome-remote-desktop/.local 0700 gnome-remote-desktop gnome-remote-desktop -"
-    "d /var/lib/gnome-remote-desktop/.local 0750 gnome-remote-desktop gnome-remote-desktop -"
+    "d /var/lib/gnome-remote-desktop/.local/share 0700 gnome-remote-desktop gnome-remote-desktop -"
-    "d /var/lib/gnome-remote-desktop/.local/share 0750 gnome-remote-desktop gnome-remote-desktop -"
+    "d /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop 0700 gnome-remote-desktop gnome-remote-desktop -"
-    "d /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop 0750 gnome-remote-desktop gnome-remote-desktop -"
+    "d /var/lib/gnome-remote-desktop/tls 0700 gnome-remote-desktop gnome-remote-desktop -"
   ];
 
   systemd.services.gnome-remote-desktop-setup = {
     description = "Configure GNOME Remote Desktop RDP";
-    wantedBy = [ "multi-user.target" ];
+    wantedBy = [ "graphical.target" ];
     before = [ "gnome-remote-desktop.service" ];
-    after = [ "systemd-tmpfiles-setup.service" "network-online.target" ];
+    after = [
-    wants = [ "network-online.target" ];
+      "dbus.service"
+      "systemd-tmpfiles-setup.service"
+      "network-online.target"
+      "gnome-remote-desktop-configuration.service"
+    ];
+    wants = [
+      "network-online.target"
+      "gnome-remote-desktop-configuration.service"
+    ];
     serviceConfig = {
       Type = "oneshot";
-      RemainAfterExit = true;
+      TimeoutStartSec = "2min";
     };
     path = [
-      pkgs.gnome-remote-desktop
+      pkgs.coreutils
-      pkgs.polkit
-      pkgs.openssl
-      pkgs.hostname
       pkgs.gawk
+      pkgs.gnome-remote-desktop
+      pkgs.hostname
+      pkgs.openssl
+      pkgs.systemd
     ];
     script = ''
-      # Ensure directory structure exists
+      set -euo pipefail
-      mkdir -p /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop
-      chown -R gnome-remote-desktop:gnome-remote-desktop /var/lib/gnome-remote-desktop
 
-      TLS_DIR="/var/lib/gnome-remote-desktop/tls"
+      # GRD 50.x invokes pkexec internally for every grdctl --system call, even
-      CRED_FILE="/var/lib/gnome-remote-desktop/rdp-credentials"
+      # when the caller is root.  NixOS exposes the required setuid wrapper at
+      # /run/wrappers/bin/pkexec; the Nix-store polkit binary is not setuid and
+      # must not shadow it.  Prepend the wrapper directory so every subsequent
+      # grdctl --system resolves the correct binary.
+      export PATH="/run/wrappers/bin:$PATH"
+
+      STATE_DIR="/var/lib/gnome-remote-desktop"
+      TLS_DIR="$STATE_DIR/tls"
+      USERNAME_FILE="$STATE_DIR/rdp-username"
+      PASSWORD_FILE="$STATE_DIR/rdp-password"
+      CRED_FILE="$STATE_DIR/rdp-credentials"
+      DEFAULT_USERNAME="sovran"
+
+      grdctl_system() {
+        local rc=0
+
+        if timeout --kill-after=5s 10s \
+          grdctl --system "$@"; then
+          return 0
+        else
+          rc=$?
+        fi
+
+        if [ "$rc" -eq 124 ] || [ "$rc" -eq 137 ]; then
+          echo "grdctl command timed out: $*" >&2
+        fi
+        echo "grdctl command failed (exit $rc): $*" >&2
+
+        return "$rc"
+      }
+
+      mkdir -p "$STATE_DIR/.local/share/gnome-remote-desktop" "$TLS_DIR"
+      chown -R gnome-remote-desktop:gnome-remote-desktop "$STATE_DIR"
+      chmod 700 \
+        "$STATE_DIR" \
+        "$STATE_DIR/.local" \
+        "$STATE_DIR/.local/share" \
+        "$STATE_DIR/.local/share/gnome-remote-desktop" \
+        "$TLS_DIR"
 
-      # Regenerate TLS certificate if missing OR if ownership is wrong
-      # (disable/re-enable cycle can break ownership or grdctl state)
       NEED_REGEN=0
       if [ ! -f "$TLS_DIR/rdp-tls.crt" ] || [ ! -f "$TLS_DIR/rdp-tls.key" ]; then
         NEED_REGEN=1
-      elif [ "$(stat -c '%U' "$TLS_DIR/rdp-tls.key" 2>/dev/null)" != "gnome-remote-desktop" ]; then
+      elif [ "$(stat -c '%U:%G' "$TLS_DIR/rdp-tls.key" 2>/dev/null)" != "gnome-remote-desktop:gnome-remote-desktop" ]; then
         NEED_REGEN=1
       fi
 
       if [ "$NEED_REGEN" = "1" ]; then
-        mkdir -p "$TLS_DIR"
         rm -f "$TLS_DIR/rdp-tls.key" "$TLS_DIR/rdp-tls.crt"
         openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
           -sha256 -nodes -days 3650 \
@@ -75,39 +109,59 @@ lib.mkIf config.sovran_systemsOS.features.rdp {
         echo "Generated new RDP TLS certificate"
       fi
 
-      # Always fix ownership and permissions (handles re-enable after disable)
+      chown gnome-remote-desktop:gnome-remote-desktop "$TLS_DIR/rdp-tls.key" "$TLS_DIR/rdp-tls.crt"
-      chown -R gnome-remote-desktop:gnome-remote-desktop "$TLS_DIR"
       chmod 600 "$TLS_DIR/rdp-tls.key"
       chmod 644 "$TLS_DIR/rdp-tls.crt"
 
-      # Configure TLS certificate
+      if [ ! -f "$USERNAME_FILE" ]; then
-      grdctl --system rdp set-tls-cert "$TLS_DIR/rdp-tls.crt"
+        printf '%s\n' "$DEFAULT_USERNAME" > "$USERNAME_FILE"
-      grdctl --system rdp set-tls-key "$TLS_DIR/rdp-tls.key"
+      fi
+      USERNAME="$(tr -d '\n' < "$USERNAME_FILE")"
+      if [ -z "$USERNAME" ]; then
+        USERNAME="$DEFAULT_USERNAME"
+        printf '%s\n' "$USERNAME" > "$USERNAME_FILE"
+      fi
+      if [ "''${#USERNAME}" -gt 32 ]; then
+        echo "RDP username is too long (''${#USERNAME} characters, maximum 32): $USERNAME from $USERNAME_FILE" >&2
+        exit 1
+      fi
+      case "$USERNAME" in
+        [A-Za-z_][A-Za-z0-9_-]*)
+          ;;
+        *)
+          echo "RDP username must start with a letter or underscore and contain only letters, numbers, underscores, and hyphens: $USERNAME from $USERNAME_FILE" >&2
+          exit 1
+          ;;
+      esac
+      chown gnome-remote-desktop:gnome-remote-desktop "$USERNAME_FILE"
+      chmod 600 "$USERNAME_FILE"
 
-      # Generate password on first boot only
+      if [ ! -f "$PASSWORD_FILE" ]; then
-      PASSWORD=""
+        openssl rand -base64 16 > "$PASSWORD_FILE"
-      if [ ! -f /var/lib/gnome-remote-desktop/rdp-password ]; then
+      fi
-        PASSWORD=$(openssl rand -base64 16)
+      PASSWORD="$(tr -d '\n' < "$PASSWORD_FILE")"
-        echo "$PASSWORD" > /var/lib/gnome-remote-desktop/rdp-password
+      if [ -z "$PASSWORD" ]; then
-        chmod 600 /var/lib/gnome-remote-desktop/rdp-password
+        echo "RDP password file is empty: $PASSWORD_FILE" >&2
-      else
+        exit 1
-        PASSWORD=$(cat /var/lib/gnome-remote-desktop/rdp-password)
+      fi
+      if [ "''${#PASSWORD}" -lt 8 ]; then
+        echo "RDP password is too short (''${#PASSWORD} characters, minimum 8): $PASSWORD_FILE" >&2
+        exit 1
+      fi
+      chown gnome-remote-desktop:gnome-remote-desktop "$PASSWORD_FILE"
+      chmod 600 "$PASSWORD_FILE"
+
+      LOCAL_IP="$(hostname -I | awk '{print $1}')"
+      if [ -z "$LOCAL_IP" ]; then
+        LOCAL_IP="127.0.0.1"
       fi
 
-      # Write username to a separate file for the hub
-      echo "sovran" > /var/lib/gnome-remote-desktop/rdp-username
-      chmod 600 /var/lib/gnome-remote-desktop/rdp-username
-
-      # Get current IP address
-      LOCAL_IP=$(hostname -I | awk '{print $1}')
-
-      # Always rewrite the credentials file with the current IP
       cat > "$CRED_FILE" <<EOF
       ========================================
        GNOME Remote Desktop (RDP) Credentials
       ========================================
 
-       Username: sovran
+       Username: $USERNAME
        Password: $PASSWORD
 
        Connect from any RDP client to:
@@ -116,11 +170,22 @@ lib.mkIf config.sovran_systemsOS.features.rdp {
       ========================================
       EOF
 
+      chown gnome-remote-desktop:gnome-remote-desktop "$CRED_FILE"
       chmod 600 "$CRED_FILE"
 
-      # Enable RDP backend and set credentials
+      # Preflight: the NixOS setuid pkexec wrapper must be present and executable
-      grdctl --system rdp enable
+      # before any grdctl --system call.  Absence means the system was booted
-      grdctl --system rdp set-credentials sovran "$PASSWORD"
+      # without security.wrappers or the wrapper directory is not mounted yet.
+      if ! test -x /run/wrappers/bin/pkexec; then
+        echo "Preflight check failed: /run/wrappers/bin/pkexec is absent or not executable." >&2
+        echo "GNOME Remote Desktop system configuration requires the NixOS setuid pkexec wrapper at /run/wrappers/bin/pkexec." >&2
+        exit 1
+      fi
+
+      grdctl_system rdp enable
+      grdctl_system rdp set-tls-cert "$TLS_DIR/rdp-tls.crt"
+      grdctl_system rdp set-tls-key "$TLS_DIR/rdp-tls.key"
+      grdctl_system rdp set-credentials "$USERNAME" "$PASSWORD"
 
       echo "GNOME Remote Desktop RDP configured successfully"
     '';

modules/synapse.nix

@@ -250,9 +250,6 @@ CREDS
     '';
   };
 
-  networking.firewall.allowedTCPPorts = [ 8448 ];
-  networking.firewall.allowedUDPPorts = [ 8448 ];
-
   sovran_systemsOS.domainRequirements = [
     { name = "matrix"; label = "Matrix Synapse"; example = "matrix.yourdomain.com"; }
   ];

packages/albyhub/0001-private-route-hints.patch

@@ -0,0 +1,13 @@
+diff --git a/lnclient/lnd/lnd.go b/lnclient/lnd/lnd.go
+index bad532f..ba35b7b 100644
+--- a/lnclient/lnd/lnd.go
++++ b/lnclient/lnd/lnd.go
+@@ -708,7 +708,7 @@ func (svc *LNDService) MakeInvoice(ctx context.Context, amountMsat int64, descri
+ 		DescriptionHash: descriptionHashBytes,
+ 		Expiry:          expiry,
+ 		RouteHints:      hints,
+-		Private:         !hasPublicChannels, // use private channel hints in the invoice
++		Private:         true, // always include private channel hints in the invoice
+ 	}
+ 
+ 	resp, err := svc.client.AddInvoice(ctx, addInvoiceRequest)

packages/albyhub/0002-isolated-invoice-app-id.patch

@@ -0,0 +1,71 @@
+diff --git a/api/models.go b/api/models.go
+index 28bd117..dceb79a 100644
+--- a/api/models.go
++++ b/api/models.go
+@@ -46,7 +46,7 @@ type API interface {
+ 	ListTransactions(ctx context.Context, appId *uint, limit uint64, offset uint64) (*ListTransactionsResponse, error)
+ 	ListOnchainTransactions(ctx context.Context) ([]OnchainTransaction, error)
+ 	SendPayment(ctx context.Context, invoice string, amountMsat *uint64, metadata map[string]interface{}, fromAppId *uint) (*SendPaymentResponse, error)
+-	CreateInvoice(ctx context.Context, amountMsat uint64, description string) (*MakeInvoiceResponse, error)
++	CreateInvoice(ctx context.Context, amountMsat uint64, description string, appId *uint) (*MakeInvoiceResponse, error)
+ 	LookupInvoice(ctx context.Context, paymentHash string) (*LookupInvoiceResponse, error)
+ 	SetTransactionUserLabels(ctx context.Context, id uint, labels map[string]string) error
+ 	RequestMempoolApi(ctx context.Context, endpoint string) (interface{}, error)
+@@ -586,6 +586,7 @@ type MakeInvoiceRequest struct {
+ 	AmountSat   *uint64 `json:"amountSat"`
+ 	AmountMsat  *uint64 `json:"amountMsat"`
+ 	Description string  `json:"description"`
++	AppId       *uint   `json:"appId"`
+ }
+ 
+ type ResetRouterRequest struct {
+diff --git a/api/transactions.go b/api/transactions.go
+index aaf9380..3f9850a 100644
+--- a/api/transactions.go
++++ b/api/transactions.go
+@@ -12,12 +12,12 @@ import (
+ 	"github.com/sirupsen/logrus"
+ )
+ 
+-func (api *api) CreateInvoice(ctx context.Context, amountMsat uint64, description string) (*MakeInvoiceResponse, error) {
++func (api *api) CreateInvoice(ctx context.Context, amountMsat uint64, description string, appId *uint) (*MakeInvoiceResponse, error) {
+ 	lnClient := api.svc.GetLNClient()
+ 	if lnClient == nil {
+ 		return nil, ErrLNClientNotStarted
+ 	}
+-	transaction, err := api.svc.GetTransactionsService().MakeInvoice(ctx, amountMsat, description, "", 0, nil, lnClient, nil, nil, nil)
++	transaction, err := api.svc.GetTransactionsService().MakeInvoice(ctx, amountMsat, description, "", 0, nil, lnClient, appId, nil, nil)
+ 	if err != nil {
+ 		return nil, err
+ 	}
+diff --git a/http/http_service.go b/http/http_service.go
+index bf650b9..cf61250 100644
+--- a/http/http_service.go
++++ b/http/http_service.go
+@@ -687,7 +687,12 @@ func (httpSvc *HttpService) makeInvoiceHandler(c echo.Context) error {
+ 		amountMsat = *resolvedAmountMsat
+ 	}
+ 
+-	invoice, err := httpSvc.api.CreateInvoice(c.Request().Context(), amountMsat, makeInvoiceRequest.Description)
++	invoice, err := httpSvc.api.CreateInvoice(
++		c.Request().Context(),
++		amountMsat,
++		makeInvoiceRequest.Description,
++		makeInvoiceRequest.AppId,
++	)
+ 
+ 	if err != nil {
+ 		return c.JSON(http.StatusInternalServerError, ErrorResponse{
+diff --git a/wails/wails_handlers.go b/wails/wails_handlers.go
+index d25259b..c9fe4e8 100644
+--- a/wails/wails_handlers.go
++++ b/wails/wails_handlers.go
+@@ -600,7 +600,7 @@ func (app *WailsApp) WailsRequestRouter(route string, method string, body string
+ 		if resolvedAmountMsat != nil {
+ 			amountMsat = *resolvedAmountMsat
+ 		}
+-		invoice, err := app.api.CreateInvoice(ctx, amountMsat, makeInvoiceRequest.Description)
++		invoice, err := app.api.CreateInvoice(ctx, amountMsat, makeInvoiceRequest.Description, nil)
+ 		if err != nil {
+ 			return WailsRequestRouterResponse{Body: nil, Error: err.Error()}
+ 		}

packages/albyhub/0003-loopback-bind-host.patch

@@ -0,0 +1,37 @@
+diff --git a/cmd/http/main.go b/cmd/http/main.go
+index ed31f96..4d31212 100644
+--- a/cmd/http/main.go
++++ b/cmd/http/main.go
+@@ -2,8 +2,8 @@ package main
+ 
+ import (
+ 	"context"
+-	"fmt"
+ 	nethttp "net/http"
++	"net"
+ 	"os"
+ 	"os/signal"
+ 	"syscall"
+@@ -51,8 +51,9 @@ func main() {
+ 	httpSvc := http.NewHttpService(svc, svc.GetEventPublisher())
+ 	httpSvc.RegisterSharedRoutes(e)
+ 	//start Echo server
++	bindAddress := net.JoinHostPort(svc.GetConfig().GetEnv().Host, svc.GetConfig().GetEnv().Port)
+ 	go func() {
+-		if err := e.Start(fmt.Sprintf(":%v", svc.GetConfig().GetEnv().Port)); err != nil && err != nethttp.ErrServerClosed {
++		if err := e.Start(bindAddress); err != nil && err != nethttp.ErrServerClosed {
+ 			logger.Logger.WithError(err).Error("echo server failed to start")
+ 			cancel()
+ 		}
+diff --git a/config/models.go b/config/models.go
+index 0fb8870..dc11afd 100644
+--- a/config/models.go
++++ b/config/models.go
+@@ -24,6 +24,7 @@ type AppConfig struct {
+ 	LNDAddress                         string `envconfig:"LND_ADDRESS"`
+ 	LNDCertFile                        string `envconfig:"LND_CERT_FILE"`
+ 	LNDMacaroonFile                    string `envconfig:"LND_MACAROON_FILE"`
++	Host                               string `envconfig:"HOST" default:"127.0.0.1"`
+ 	Workdir                            string `envconfig:"WORK_DIR"`
+ 	Port                               string `envconfig:"PORT" default:"8080"`
+ 	DatabaseUri                        string `envconfig:"DATABASE_URI" default:"nwc.db"`