nixpkgs update

Switch LibreOffice from fresh to stable version
fix(hub): self-heal truncated/corrupt Nix downloads and keep failed updates retryable
2026-09-07 10:55:32 -05:00 · 2026-09-03 16:31:12 -05:00 · 2026-09-03 11:54:29 -05:00 · 2026-09-03 09:52:27 -05:00 · 2026-09-02 15:29:20 -05:00 · 2026-09-02 15:13:56 -05:00
20 changed files with 342 additions and 1520 deletions
@@ -7,6 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ---
 ## [1.1.4] - 2026-09-02
 ### Added
 - Element-calling: fix Nix string interpolation of LAN_CIDR echo
 - Docs/hub: update Element Calling port guidance to the new port set
 - Element-calling: fix Wi-Fi calls and tighten media/TURN ports
 - Flake: pin LiveKit to 1.13.6 for rtc.advertise_internal_ip support
 ### Changed
 - Updated nixpkgs
 - Updated sovran-bitcon
 - Dedupe NWC tooling — use Sovran_Bitcoin's sovran-nwc
 - Update sovran-bitcoin flake input
 - Extract bitcoin stack into Sovran_Bitcoin flake input
 ### Fixed
 - Set lnurl domainFile for Hub-managed Lightning Address domain
 - Correct disablewallet casing
 - Fixed typo
 [1.1.4]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.1.4
 ## [Unreleased]
 ### Changed
 - Element Calling: pin LiveKit to 1.13.6 and advertise the LAN interface
  (rtc.advertise_internal_ip) so Wi-Fi callers get a local ICE candidate and
  calls no longer depend on router NAT hairpin
 - Element Calling: use a single UDP media mux (7882); move the TURN relay to
  40000-40099 and remove the unreachable 5349 TURN/TLS listener
 - Hub: update Element Calling router-port guidance to the new port set
 ### Fixed
 - Element Calling: TURN relay could not deliver media to the SFU on routers
  without NAT loopback (turn.allow_restricted_peer_cidrs now permits the LAN
  subnet derived from the primary interface)
 ## [1.1.3] - 2026-08-27
 ### Added
@@ -21,9 +21,9 @@ Lightning infrastructure, private cloud, and communications platform when you
 are ready.
 [Visit the Website](https://sovransystems.com) ·
-[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.3.iso) ·
+[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.4.iso) ·
 [Try it safely in a VM](#try-it-first-in-a-virtual-machine) ·
-[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.3.iso.sha256) ·
+[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.4.iso.sha256) ·
 [Build from Source](#build-from-source)
 <img src="assets/desktop-screenshot.webp" alt="Sovran_SystemsOS private Bitcoin desktop" width="800" />
@@ -345,8 +345,8 @@ with an imaging application such as [Balena Etcher](https://etcher.balena.io).
 ### 1. Download the ISO and checksum
- [Download Sovran_SystemsOS-1.1.3.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.3.iso)
+- [Download Sovran_SystemsOS-1.1.4.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.4.iso)
- [Download Sovran_SystemsOS-1.1.3.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.3.iso.sha256)
+- [Download Sovran_SystemsOS-1.1.4.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.4.iso.sha256)
 The download may take some time. Do not rename or modify the ISO before
 verifying it, and keep both files in the same folder.
@@ -364,16 +364,16 @@ checksum exactly.
 Open a terminal in the download folder and run:
 ```bash
-sha256sum --check Sovran_SystemsOS-1.1.3.iso.sha256
+sha256sum --check Sovran_SystemsOS-1.1.4.iso.sha256
 ```
 A successful comparison reports:
 ```text
-Sovran_SystemsOS-1.1.3.iso: OK
+Sovran_SystemsOS-1.1.4.iso: OK
 ```
-You can also run `sha256sum Sovran_SystemsOS-1.1.3.iso` and compare the output
+You can also run `sha256sum Sovran_SystemsOS-1.1.4.iso` and compare the output
 against the checksum file manually.
 </details>
@@ -384,11 +384,11 @@ against the checksum file manually.
 Open Terminal in the download folder and run:
 ```bash
-shasum -a 256 Sovran_SystemsOS-1.1.3.iso
+shasum -a 256 Sovran_SystemsOS-1.1.4.iso
 ```
 Compare the value shown in Terminal with the value inside
-`Sovran_SystemsOS-1.1.3.iso.sha256`.
+`Sovran_SystemsOS-1.1.4.iso.sha256`.
 </details>
@@ -398,7 +398,7 @@ Compare the value shown in Terminal with the value inside
 Open PowerShell in the download folder and run:
 ```powershell
-Get-FileHash .\Sovran_SystemsOS-1.1.3.iso -Algorithm SHA256
+Get-FileHash .\Sovran_SystemsOS-1.1.4.iso -Algorithm SHA256
 ```
 Compare the value under `Hash` with the published checksum.
@@ -413,7 +413,7 @@ match exactly.
 1. Download and install [Balena Etcher](https://etcher.balena.io), then
   connect the USB drive.
-2. Choose **Flash from file** and select `Sovran_SystemsOS-1.1.3.iso`.
+2. Choose **Flash from file** and select `Sovran_SystemsOS-1.1.4.iso`.
 3. Choose **Select target**, select the USB drive, and review your selection
   carefully.
 4. Choose **Flash** and wait for the writing and verification process to
@@ -856,7 +856,7 @@ primary location for collaboration. Please read our
 ## Privacy. Sovereignty. Bitcoin.
 [Visit Sovran Systems](https://sovransystems.com) ·
-[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.3.iso) ·
+[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.4.iso) ·
 [View the License](LICENSE)
 </div>
@@ -1 +1 @@
-1.1.3
+1.1.4
@@ -1,75 +0,0 @@
 """
 Structured audit logging for NWC wallet operations.
 Writes append-only JSON lines to /var/log/sovran-nwc-audit.log.
 Log file is owned by albyhub:albyhub with mode 0600.
 """
 from __future__ import annotations
 import json
 import logging
 import os
 import threading
 import time
 from typing import Any
 logger = logging.getLogger(__name__)
 AUDIT_LOG_PATH = "/var/log/sovran-nwc-audit.log"
 _AUDIT_LOCK = threading.Lock()
 _initialized = False
 def _ensure_log_file() -> None:
    """Ensure audit log file exists with correct permissions."""
    global _initialized
    if _initialized:
        return
    with _AUDIT_LOCK:
        if _initialized:
            return
        try:
            # Create directory if needed
            os.makedirs(os.path.dirname(AUDIT_LOG_PATH), exist_ok=True)
            # Create file if it doesn't exist
            if not os.path.exists(AUDIT_LOG_PATH):
                with open(AUDIT_LOG_PATH, "w") as f:
                    pass
            # Set restrictive permissions
            os.chmod(AUDIT_LOG_PATH, 0o600)
            # Try to set ownership to albyhub user (best effort)
            try:
                import pwd
                import grp
                albyhub_uid = pwd.getpwnam("albyhub").pw_uid
                albyhub_gid = grp.getgrnam("albyhub").gr_gid
                os.chown(AUDIT_LOG_PATH, albyhub_uid, albyhub_gid)
            except Exception:
                pass  # Best effort; may not have permissions
            _initialized = True
        except Exception as exc:
            logger.warning("Failed to initialize audit log: %s", exc)
 def audit_log(event: str, **fields: Any) -> None:
    """Write a structured audit log entry.
    Args:
        event: Event type identifier (e.g., "wallet_created", "invoice_issued")
        **fields: Additional key-value fields to include in the log entry
    """
    _ensure_log_file()
    entry = {
        "ts": time.time(),
        "event": event,
        **fields,
    }
    try:
        with _AUDIT_LOCK:
            with open(AUDIT_LOG_PATH, "a") as f:
                f.write(json.dumps(entry, separators=(",", ":")) + "\n")
    except Exception as exc:
        logger.error("Failed to write audit log: %s", exc)
@@ -1,881 +0,0 @@
 """
 Alby Hub manager — shared backend for Lightning Wallet Connections API and recovery CLI.
 Interfaces with the local Alby Hub instance at
 http://127.0.0.1:18080 by default (override with NWC_ALBY_HUB_API_BASE).
 All sensitive values (passwords, bearer tokens, pairing URIs, macaroon
 contents, Nostr private keys) are redacted from any exception messages
 or log output.
 """
 from __future__ import annotations
 import json
 import logging
 import os
 import re
 import secrets
 import threading
 import time
 import urllib.error
 import urllib.parse
 import urllib.request
 from typing import Any
 from . import nwc_audit as _audit_mod
 logger = logging.getLogger(__name__)
 # ── Constants ──────────────────────────────────────────────────────
 DEFAULT_API_BASE = os.environ.get(
    "NWC_ALBY_HUB_API_BASE",
    "http://127.0.0.1:18080",
 )
 DEFAULT_UNLOCK_PASSWORD_FILE = "/var/lib/albyhub/unlock-password"
 DEFAULT_MACAROON_FILE = os.environ.get(
    "NWC_LND_MACAROON_FILE", "/run/lnd/albyhub.macaroon"
 )
 DEFAULT_LND_ADDRESS = os.environ.get("NWC_LND_ADDRESS", "127.0.0.1:10009")
 DEFAULT_LND_CERT_FILE = os.environ.get("NWC_LND_CERT_FILE", "/var/lib/lnd/tls.cert")
 DEFAULT_LND_SOCKET = "/run/lnd/lnd.socket"
 LNURL_DESCRIPTION_DEFAULT = "Pay via Lightning"
 NWC_MIN_SENDABLE_MSAT = 1000
 NWC_MAX_SENDABLE_MSAT = 1_000_000_000
 # Metadata key used to mark managed isolated wallets
 _MANAGED_APP_STORE_ID = "uncle-jim"
 _MANAGED_META_KEY = "app_store_app_id"
 RECEIVE_ONLY_SCOPES = [
    "get_info",
    "get_balance",
    "make_invoice",
    "lookup_invoice",
    "list_transactions",
    "notifications",
 ]
 LIMITED_SEND_SCOPES = RECEIVE_ONLY_SCOPES + ["pay_invoice"]
 # ── Exceptions ─────────────────────────────────────────────────────
 class AlbyHubError(Exception):
    """Base error from the Alby Hub manager.
    The message string is safe to surface to the user — it never
    contains raw secret material.
    """
    def __init__(self, code: str, message: str) -> None:
        super().__init__(message)
        self.code = code
    def __str__(self) -> str:
        return f"[{self.code}] {self.args[0]}"
 class AlbyHubHttpError(AlbyHubError):
    def __init__(self, status_code: int, message: str) -> None:
        super().__init__(f"http_{status_code}", message)
        self.status_code = status_code
 # ── Manager class ──────────────────────────────────────────────────
 class AlbyHubManager:
    """Thread-safe manager for Alby Hub API operations."""
    def __init__(
        self,
        api_base: str = DEFAULT_API_BASE,
        unlock_password_file: str = DEFAULT_UNLOCK_PASSWORD_FILE,
        macaroon_file: str = DEFAULT_MACAROON_FILE,
        lnd_address: str = DEFAULT_LND_ADDRESS,
        lnd_cert_file: str = DEFAULT_LND_CERT_FILE,
    ) -> None:
        self.api_base = api_base.rstrip("/")
        self.unlock_password_file = unlock_password_file
        self.macaroon_file = macaroon_file
        self.lnd_address = lnd_address
        self.lnd_cert_file = lnd_cert_file
        self._lock = threading.Lock()
        self._token: str | None = None
    # ── Low-level HTTP ─────────────────────────────────────────────
    def _request(
        self,
        method: str,
        path: str,
        body: dict | None = None,
        token: str | None = None,
        timeout: int = 30,
    ) -> dict:
        """Make a raw HTTP request to the local Alby Hub API.
        Returns the parsed JSON response body.
        Raises AlbyHubHttpError on non-2xx responses.
        Secrets in response bodies are never included in raised exceptions.
        """
        url = f"{self.api_base}{path}"
        data = json.dumps(body).encode("utf-8") if body is not None else None
        headers: dict[str, str] = {
            "Content-Type": "application/json",
            "Accept": "application/json",
        }
        if token:
            headers["Authorization"] = "Bearer " + token
        req = urllib.request.Request(url, data=data, headers=headers, method=method)
        try:
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                raw = resp.read()
                if not raw:
                    return {}
                return json.loads(raw)
        except urllib.error.HTTPError as exc:
            code = exc.code
            # Read and discard the body — we do NOT include it in the exception
            try:
                exc.read()
            except Exception:
                pass
            raise AlbyHubHttpError(code, f"Hub API {method} {path} returned HTTP {code}") from None
        except (urllib.error.URLError, TimeoutError, OSError):
            raise AlbyHubError(
                "hub_unreachable",
                f"Hub API {method} {path} is unreachable",
            ) from None
    def _authenticated_request(
        self,
        method: str,
        path: str,
        body: dict | None = None,
        timeout: int = 30,
    ) -> dict:
        """Make an authenticated request; retry once with a fresh token on 401/403."""
        token = self.ensure_ready()
        try:
            return self._request(method, path, body=body, token=token, timeout=timeout)
        except AlbyHubHttpError as exc:
            if exc.status_code in (401, 403):
                with self._lock:
                    self._token = None
                token = self.ensure_ready()
                return self._request(method, path, body=body, token=token, timeout=timeout)
            raise
    def _paginate(self, path_template: str, page_size: int = 100) -> list[dict]:
        """Paginate a list API completely, collecting all items.
        ``path_template`` must contain ``{limit}`` and ``{offset}`` placeholders.
        """
        token = self.ensure_ready()
        offset = 0
        results: list[dict] = []
        while True:
            path = path_template.format(limit=page_size, offset=offset)
            page = self._request("GET", path, token=token)
            # Alby Hub returns apps at the top level or under "apps"/"transactions"
            total_count: int | None = None
            if isinstance(page, list):
                items = page
            elif isinstance(page, dict):
                items = page.get("apps") or page.get("transactions") or []
                if page.get("totalCount") is not None:
                    total_count = int(page.get("totalCount"))
            else:
                items = []
            if not isinstance(items, list):
                break
            results.extend(items)
            if total_count is not None:
                if len(results) >= total_count:
                    break
            elif len(items) < page_size:
                break
            offset += page_size
        return results
    # ── Audit log helper ───────────────────────────────────────────
    def _audit(self, event: str, **fields: Any) -> None:
        """Emit structured audit log entry."""
        _audit_mod.audit_log(event, **fields)
    # ── Startup / Auth ─────────────────────────────────────────────
    def _read_unlock_password(self) -> str:
        try:
            with open(self.unlock_password_file, "r") as fh:
                return fh.read().strip()
        except OSError as exc:
            raise AlbyHubError(
                "unlock_password_unavailable",
                "Cannot read Alby Hub unlock password",
            ) from exc
    def _wait_for_file(self, path: str, timeout: int = 120) -> None:
        deadline = time.monotonic() + timeout
        while time.monotonic() < deadline:
            if os.path.exists(path):
                return
            time.sleep(2)
        raise AlbyHubError(
            "dependency_unavailable",
            f"Timed out waiting for required file: {path}",
        )
    def _wait_for_hub_api(self, timeout: int = 120) -> None:
        deadline = time.monotonic() + timeout
        while time.monotonic() < deadline:
            try:
                self._request("GET", "/api/info", timeout=5)
                return
            except AlbyHubError:
                pass
            time.sleep(3)
        raise AlbyHubError("hub_unavailable", "Timed out waiting for Alby Hub API")
    def _hub_setup(self, password: str) -> None:
        """Perform /api/setup idempotently."""
        try:
            info = self._request("GET", "/api/info", timeout=10)
            if info.get("setupCompleted"):
                return
        except AlbyHubError:
            pass
        setup_body = {
            "backendType": "LND",
            "unlockPassword": password,
            "lndAddress": self.lnd_address,
            "lndCertFile": self.lnd_cert_file,
            "lndMacaroonFile": self.macaroon_file,
        }
        try:
            self._request("POST", "/api/setup", body=setup_body, timeout=30)
        except AlbyHubHttpError as exc:
            if exc.status_code == 409:
                return  # already setup
            raise
    def _obtain_token(self, password: str) -> str:
        info = self._request("GET", "/api/info", timeout=10)
        if info.get("running"):
            resp = self._request(
                "POST",
                "/api/unlock",
                body={
                    "unlockPassword": password,
                    "permission": "full",
                },
                timeout=30,
            )
        else:
            resp = self._request(
                "POST",
                "/api/start",
                body={"unlockPassword": password},
                timeout=30,
            )
        token = (
            resp.get("token")
            or resp.get("accessToken")
            or resp.get("access_token")
        )
        if not token or not isinstance(token, str):
            raise AlbyHubError("auth_failed", "Alby Hub auth response missing token")
        return token
    def _wait_for_node_ready(self, token: str, timeout: int = 120) -> None:
        deadline = time.monotonic() + timeout
        while time.monotonic() < deadline:
            try:
                status = self._request(
                    "GET", "/api/node/status", token=token, timeout=10
                )
                if status.get("isReady") or status.get("running") or status.get("online"):
                    return
            except AlbyHubError:
                pass
            time.sleep(3)
        raise AlbyHubError("node_not_ready", "Timed out waiting for Alby Hub node to be ready")
    def ensure_ready(self) -> str:
        """Ensure Alby Hub is set up, unlocked, and authenticated.
        Returns a valid bearer token.  Caches it and uses a lock to
        prevent concurrent setup races.
        """
        with self._lock:
            if self._token:
                return self._token
            password = self._read_unlock_password()
            self._wait_for_file(self.macaroon_file, timeout=120)
            self._wait_for_hub_api(timeout=120)
            self._hub_setup(password)
            token = self._obtain_token(password)
            self._wait_for_node_ready(token, timeout=120)
            self._token = token
            return token
    # ── App isolation helpers ──────────────────────────────────────
    @staticmethod
    def _parse_metadata(raw: Any) -> dict:
        if isinstance(raw, dict):
            return raw
        if isinstance(raw, str):
            try:
                result = json.loads(raw)
                if isinstance(result, dict):
                    return result
            except Exception:
                pass
        return {}
    def _is_managed_app(self, app: dict) -> bool:
        meta = self._parse_metadata(app.get("metadata"))
        alias = str(meta.get("lnurl_alias", "")).strip().lower()
        return (
            meta.get(_MANAGED_META_KEY) == _MANAGED_APP_STORE_ID
            and bool(alias)
        )
    def _app_to_wallet_meta(self, app: dict, domain: str | None) -> dict:
        meta = self._parse_metadata(app.get("metadata"))
        alias = meta.get("lnurl_alias", "")
        address = f"{alias}@{domain}" if alias and domain else None
        scopes = app.get("scopes") or []
        access_preset = (
            "send_receive_limited" if "pay_invoice" in scopes else "receive_only"
        )
        balance_msat = int(app.get("balanceMsat", 0) or 0)
        balance_sats = balance_msat // 1000
        dust_msat = balance_msat % 1000
        spending_limit_sats: int | None = None
        max_amount = app.get("maxAmountSat") or 0
        if max_amount:
            spending_limit_sats = int(max_amount)
        # Count pending transactions from the budget or transactions list
        pending_txs = int(app.get("pendingTransactionsCount", 0) or 0)
        return {
            "id": str(app.get("id", "")),
            "pubkey": app.get("appPubkey") or app.get("nostrPubkey") or app.get("pubkey") or "",
            "name": app.get("name", ""),
            "alias": alias,
            "lightning_address": address,
            "access_preset": access_preset,
            "spending_limit_sats": spending_limit_sats,
            "balance_sats": balance_sats,
            "dust_msat": dust_msat,
            "pending_transactions": pending_txs,
            "created_at": app.get("createdAt") or app.get("created_at"),
            "min_sendable_msat": int(
                meta.get("lnurl_min_sendable_msat", NWC_MIN_SENDABLE_MSAT)
            ),
            "max_sendable_msat": int(
                meta.get("lnurl_max_sendable_msat", NWC_MAX_SENDABLE_MSAT)
            ),
        }
    def _all_managed_apps(self) -> list[dict]:
        apps = self._paginate("/api/apps?limit={limit}&offset={offset}&order_by=created_at")
        return [a for a in apps if a.get("isolated") and self._is_managed_app(a)]
    def _find_managed_app(self, identifier: str) -> dict | None:
        needle = identifier.strip().lower()
        for app in self._all_managed_apps():
            if str(app.get("id", "")).lower() == needle:
                return app
            pubkey = (
                app.get("appPubkey") or app.get("nostrPubkey") or app.get("pubkey") or ""
            ).lower()
            if pubkey == needle:
                return app
        return None
    # ── Public API ─────────────────────────────────────────────────
    def list_wallets(self, domain: str | None = None) -> list[dict]:
        """Return all managed isolated app wallets (no secrets)."""
        wallets = []
        for app in self._all_managed_apps():
            app_copy = dict(app)
            app_copy["pendingTransactionsCount"] = len(self._get_app_pending_txs(int(app["id"])))
            wallets.append(self._app_to_wallet_meta(app_copy, domain))
        return wallets
    def create_wallet(
        self,
        name: str,
        alias: str,
        access_preset: str,
        spending_limit_sats: int | None,
        domain: str | None = None,
    ) -> dict:
        """Create a new isolated Alby Hub app (wallet connection).
        Returns a dict containing:
          ``wallet``      — safe metadata (no secrets)
          ``pairing_uri`` — real Alby Hub pairingUri (returned ONCE)
          ``result``      — creation status report
        """
        # Validate uniqueness
        managed = self._all_managed_apps()
        for a in managed:
            meta = self._parse_metadata(a.get("metadata"))
            if meta.get("lnurl_alias", "").lower() == alias.lower():
                raise AlbyHubError(
                    "alias_exists", "That Lightning Address alias is already in use."
                )
            if (a.get("name") or "").lower() == name.lower():
                raise AlbyHubError(
                    "wallet_name_exists",
                    "That Wallet Connection name already exists.",
                )
        scopes = (
            LIMITED_SEND_SCOPES
            if access_preset == "send_receive_limited"
            else RECEIVE_ONLY_SCOPES
        )
        max_amount = (
            spending_limit_sats
            if access_preset == "send_receive_limited" and spending_limit_sats
            else 0
        )
        create_body: dict = {
            "name": name,
            "scopes": scopes,
            "isolated": True,
            "budgetRenewal": "never",
            "maxAmountSat": max_amount,
            "metadata": {
                _MANAGED_META_KEY: _MANAGED_APP_STORE_ID,
                "lnurl_alias": alias,
                "lnurl_description": LNURL_DESCRIPTION_DEFAULT,
                "lnurl_min_sendable_msat": NWC_MIN_SENDABLE_MSAT,
                "lnurl_max_sendable_msat": NWC_MAX_SENDABLE_MSAT,
            },
        }
        resp = self._authenticated_request("POST", "/api/apps", body=create_body)
        pairing_uri: str = resp.get("pairingUri") or resp.get("pairing_uri") or ""
        app_id = resp.get("id")
        # Fetch full app details for accurate metadata
        app_detail: dict | None = None
        if app_id is not None:
            try:
                app_detail = self._authenticated_request(
                    "GET", f"/api/v2/apps/{app_id}"
                )
            except AlbyHubError:
                pass
        if app_detail is None:
            # Fallback: search recent apps for the one we just created
            updated = self._all_managed_apps()
            for a in updated:
                if str(a.get("id", "")) == str(app_id):
                    app_detail = a
                    break
        wallet_meta = self._app_to_wallet_meta(app_detail or resp, domain)
        # Initial internal transfer for limited wallets
        funding_result: dict = {"attempted": False, "success": False}
        if (
            access_preset == "send_receive_limited"
            and spending_limit_sats
            and app_id is not None
        ):
            funding_result["attempted"] = True
            try:
                self._authenticated_request(
                    "POST",
                    "/api/transfers",
                    body={
                        "toAppId": int(app_id),
                        "amountSat": spending_limit_sats,
                        "description": f"Initial funding for {name}",
                    },
                )
                funding_result["success"] = True
            except AlbyHubError as exc:
                funding_result["error"] = exc.code
                funding_result["message"] = (
                    "The wallet was created successfully and the NWC connection secret is shown "
                    "above, but initial funding failed. Save the NWC secret now. "
                    "Do not recreate this wallet."
                )
        # Audit log: wallet created
        self._audit(
            "wallet_created",
            wallet_id=str(app_id) if app_id else "unknown",
            name=name,
            alias=alias,
            access_preset=access_preset,
            spending_limit_sats=spending_limit_sats,
            lightning_address=wallet_meta.get("lightning_address"),
            funding_attempted=funding_result["attempted"],
            funding_success=funding_result["success"],
        )
        return {
            "wallet": wallet_meta,
            "pairing_uri": pairing_uri,  # returned once on create only
            "result": {
                "wallet_created": True,
                "secret_created": bool(pairing_uri),
                "lightning_address_registered": bool(alias and domain),
                "funding": funding_result,
            },
        }
    def _get_app_balance_msat(self, app: dict) -> int:
        return int(app.get("balanceMsat", 0) or 0)
    def _get_app_pending_txs(self, app_id: int) -> list[dict]:
        txs = self._paginate(
            f"/api/transactions?appId={app_id}&limit={{limit}}&offset={{offset}}"
        )
        return [
            t for t in txs if str(t.get("state", "")).lower() == "pending"
        ]
    def drain_wallet(self, identifier: str) -> dict:
        """Drain all whole-satoshi funds from an isolated app to the primary wallet.
        Returns ``{"ok": True, "drained_sats": N, "dust_msat": M}``.
        Raises AlbyHubError on rejection or failure.
        """
        app = self._find_managed_app(identifier)
        if app is None:
            raise AlbyHubError("wallet_not_found", "Wallet connection not found.")
        app_id = int(app["id"])
        balance_msat = self._get_app_balance_msat(app)
        if balance_msat < 0:
            raise AlbyHubError("negative_balance", "Wallet has a negative balance.")
        pending = self._get_app_pending_txs(app_id)
        if pending:
            raise AlbyHubError(
                "pending_transactions",
                "Wallet has pending transactions and cannot be drained.",
            )
        transferable_msat = (balance_msat // 1000) * 1000
        expected_dust_msat = balance_msat - transferable_msat
        if transferable_msat == 0:
            return {"ok": True, "drained_sats": 0, "dust_msat": expected_dust_msat}
        # Save original permissions
        original_scopes = list(app.get("scopes") or [])
        original_max = app.get("maxAmountSat") or 0
        original_renewal = app.get("budgetRenewal") or "never"
        # Temporarily grant pay_invoice scope with sufficient budget
        app_pubkey = app.get("appPubkey") or app.get("nostrPubkey") or app.get("pubkey") or ""
        if not app_pubkey:
            raise AlbyHubError(
                "app_pubkey_missing",
                "Cannot drain app: app public key not available.",
            )
        patch_body = {
            "scopes": sorted(set(original_scopes) | {"pay_invoice"}),
            "maxAmountSat": 0,
            "budgetRenewal": "never",
        }
        self._authenticated_request("PATCH", f"/api/apps/{app_pubkey}", body=patch_body)
        drain_error: AlbyHubError | None = None
        drained_sats = 0
        try:
            self._authenticated_request(
                "POST",
                "/api/transfers",
                body={
                    "fromAppId": app_id,
                    "amountMsat": transferable_msat,
                    "description": f"Drain isolated subwallet {app.get('name', '')}",
                },
            )
            drained_sats = transferable_msat // 1000
        except AlbyHubError as exc:
            drain_error = exc
        finally:
            # Restore original permissions whether drain succeeded or not
            restore_body = {
                "scopes": original_scopes,
                "maxAmountSat": original_max,
                "budgetRenewal": original_renewal,
            }
            try:
                self._authenticated_request(
                    "PATCH", f"/api/apps/{app_pubkey}", body=restore_body
                )
            except AlbyHubError:
                pass  # best-effort restore; don't mask the original error
        if drain_error is not None:
            raise drain_error
        # Verify remaining balance equals expected dust
        refreshed = self._authenticated_request("GET", f"/api/v2/apps/{app_id}")
        remaining_msat = self._get_app_balance_msat(refreshed)
        if remaining_msat != expected_dust_msat:
            raise AlbyHubError(
                "drain_incomplete",
                "Drain verification failed: final balance does not match expected dust.",
            )
        # Audit log: wallet drained
        self._audit(
            "wallet_drained",
            wallet_id=str(app_id),
            name=app.get("name", ""),
            alias=app.get("alias", ""),
            drained_sats=drained_sats,
            dust_msat=expected_dust_msat,
        )
        return {
            "ok": True,
            "drained_sats": drained_sats,
            "dust_msat": expected_dust_msat,
            "remaining_msat": remaining_msat,
        }
    def delete_wallet(self, identifier: str) -> dict:
        """Safely drain and delete an isolated app.
        Returns ``{"ok": True, "drained_sats": N}``.
        """
        app = self._find_managed_app(identifier)
        if app is None:
            raise AlbyHubError("wallet_not_found", "Wallet connection not found.")
        app_id = int(app["id"])
        pending = self._get_app_pending_txs(app_id)
        if pending:
            raise AlbyHubError(
                "pending_transactions",
                "Wallet has pending transactions and cannot be deleted.",
            )
        drain_result = self.drain_wallet(identifier)
        # Verify no transferable balance remains
        refreshed = self._authenticated_request("GET", f"/api/v2/apps/{app_id}")
        remaining_msat = self._get_app_balance_msat(refreshed)
        if remaining_msat < 0:
            raise AlbyHubError(
                "negative_balance",
                "Wallet has a negative final balance and cannot be deleted.",
            )
        if remaining_msat >= 1000:
            raise AlbyHubError(
                "drain_incomplete",
                f"Drain verification failed: funds still remain.",
            )
        # Delete by app pubkey
        pubkey = app.get("appPubkey") or app.get("nostrPubkey") or app.get("pubkey") or ""
        if not pubkey:
            raise AlbyHubError(
                "app_pubkey_missing",
                "Cannot delete app: nostr pubkey not available.",
            )
        self._authenticated_request(
            "DELETE",
            f"/api/apps/{urllib.parse.quote(pubkey, safe='')}",
        )
        # Audit log: wallet deleted
        self._audit(
            "wallet_deleted",
            wallet_id=str(app_id),
            name=app.get("name", ""),
            alias=app.get("alias", ""),
            drained_sats=drain_result.get("drained_sats", 0),
            dust_msat=remaining_msat,
        )
        return {
            "ok": True,
            "drained_sats": drain_result.get("drained_sats", 0),
            "dust_msat": remaining_msat,
        }
    def issue_invoice(
        self, app_id: int, amount_msat: int, description: str = ""
    ) -> str:
        """Create an LND invoice attributed to a specific isolated app.
        Returns a valid BOLT11 invoice string.
        Raises AlbyHubError if the Hub returns an invalid or misattributed invoice.
        """
        resp = self._authenticated_request(
            "POST",
            "/api/invoices",
            body={
                "amountMsat": amount_msat,
                "description": description or LNURL_DESCRIPTION_DEFAULT,
                "appId": app_id,
            },
        )
        invoice: str = resp.get("invoice") or ""
        returned_app_id = resp.get("appId")
        if not invoice:
            raise AlbyHubError("invoice_creation_failed", "Hub returned empty invoice.")
        # Require a valid BOLT11 prefix (mainnet, testnet, signet, regtest)
        if not re.match(r"^ln", invoice, re.IGNORECASE):
            raise AlbyHubError(
                "invalid_invoice", "Hub returned a non-BOLT11 invoice string."
            )
        if returned_app_id is None or int(returned_app_id) != app_id:
            raise AlbyHubError(
                "invoice_attribution_failed",
                "Invoice attribution mismatch: returned appId does not match.",
            )
        # Audit log: invoice issued via API
        self._audit(
            "invoice_issued",
            app_id=app_id,
            amount_msat=amount_msat,
            amount_sat=amount_msat // 1000,
            invoice_prefix=invoice[:50] + "..." if len(invoice) > 50 else invoice,
        )
        return invoice
    def find_app_by_alias(self, alias: str) -> dict | None:
        """Find a managed isolated app by its ``lnurl_alias`` metadata field."""
        alias_lower = alias.strip().lower()
        for a in self._all_managed_apps():
            meta = self._parse_metadata(a.get("metadata"))
            if meta.get("lnurl_alias", "").lower() == alias_lower:
                return a
        return None
    def rotate_wallet_secret(self, identifier: str) -> dict:
        """Rotate the NWC pairing secret for a wallet connection.
        Revokes the old Nostr key and generates a new pairing URI.
        Returns the new pairing URI (shown ONCE).
        """
        app = self._find_managed_app(identifier)
        if app is None:
            raise AlbyHubError("wallet_not_found", "Wallet connection not found.")
        app_id = int(app["id"])
        app_pubkey = app.get("appPubkey") or app.get("nostrPubkey") or app.get("pubkey") or ""
        if not app_pubkey:
            raise AlbyHubError(
                "app_pubkey_missing",
                "Cannot rotate secret: app public key not available.",
            )
        # Call Alby Hub's rotate secret endpoint (if available)
        # Alby Hub may not have this endpoint yet; fall back to re-creating the app
        # For now, we'll delete and re-create with same metadata
        # This is a safe operation since we drain first
        name = app.get("name", "")
        alias = app.get("alias", "")
        scopes = app.get("scopes") or []
        max_amount = app.get("maxAmountSat") or 0
        metadata = app.get("metadata") or {}
        # Drain first
        self.drain_wallet(identifier)
        # Delete old app
        self._authenticated_request(
            "DELETE",
            f"/api/apps/{urllib.parse.quote(app_pubkey, safe='')}",
        )
        # Create new app with same parameters
        create_body: dict = {
            "name": name,
            "scopes": scopes,
            "isolated": True,
            "budgetRenewal": "never",
            "maxAmountSat": max_amount,
            "metadata": metadata,
        }
        resp = self._authenticated_request("POST", "/api/apps", body=create_body)
        new_pairing_uri: str = resp.get("pairingUri") or resp.get("pairing_uri") or ""
        new_app_id = resp.get("id")
        # Audit log: secret rotated
        self._audit(
            "wallet_secret_rotated",
            old_wallet_id=str(app_id),
            new_wallet_id=str(new_app_id) if new_app_id else "unknown",
            name=name,
            alias=alias,
        )
        return {
            "wallet_id": str(new_app_id) if new_app_id else "",
            "pairing_uri": new_pairing_uri,
            "message": "New NWC connection secret generated. Save it now — it will not be shown again.",
        }
    def health(self) -> dict:
        """Return a basic health summary."""
        try:
            token = self.ensure_ready()
            status = self._request(
                "GET", "/api/node/status", token=token, timeout=10
            )
            return {
                "ok": True,
                "hub_ready": bool(
                    status.get("isReady") or status.get("running")
                ),
            }
        except AlbyHubError as exc:
            return {"ok": False, "error": exc.code, "message": str(exc)}
 # ── Module-level singleton ──────────────────────────────────────────
 _manager: AlbyHubManager | None = None
 _manager_lock = threading.Lock()
 def get_manager() -> AlbyHubManager:
    """Return the module-level singleton AlbyHubManager."""
    global _manager
    if _manager is None:
        with _manager_lock:
            if _manager is None:
                _manager = AlbyHubManager()
    return _manager
@@ -1,307 +0,0 @@
 """
 Dedicated LNURL service for Lightning Wallet Connections.
 Runs as ``nwc-lnurl.service`` on 127.0.0.1:8181 (loopback only).
 Caddy proxies the public Lightning Address domain's LNURL routes to this port.
 Routes:
  GET /.well-known/lnurlp/{alias}
  GET /lnurlp/{alias}/callback?amount=<msat>
 All error responses are safe for public consumption — raw Alby Hub bodies
 and internal credentials are never returned to callers.
 """
 from __future__ import annotations
 import json
 import logging
 import os
 import re
 import time
 import urllib.parse
 from collections import defaultdict
 from http.server import BaseHTTPRequestHandler, HTTPServer
 from typing import TYPE_CHECKING
 from . import nwc_hub_manager as _mgr_mod
 from . import nwc_audit as _audit_mod
 if TYPE_CHECKING:
    from .nwc_hub_manager import AlbyHubManager
 logger = logging.getLogger(__name__)
 # ── Configuration ─────────────────────────────────────────────────
 LNURL_BIND_HOST = "127.0.0.1"
 LNURL_PORT = int(os.environ.get("NWC_LNURL_PORT", "8181"))
 DOMAIN_FILE = "/var/lib/domains/lightning"
 NWC_ALIAS_RE = re.compile(r"^[a-z0-9][a-z0-9_-]{0,31}$")
 # Rate limiting configuration
 RATE_LIMIT_WINDOW_SEC = 60
 RATE_LIMIT_MAX_REQUESTS = 30
 _rate_limit_buckets: dict[str, list[float]] = defaultdict(list)
 # ── Helpers ───────────────────────────────────────────────────────
 def _read_domain() -> str | None:
    try:
        with open(DOMAIN_FILE, "r") as fh:
            raw = fh.read(256).strip().lower()
        # Strict FQDN validation: must be a valid hostname with at least one dot
        # Reject localhost, IP addresses, and single-label names
        if not re.match(r"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$", raw):
            return None
        # Explicitly reject local/reserved names
        if raw in {"localhost", "localhost.localdomain", "local"}:
            return None
        return raw
    except OSError:
        pass
    return None
 def _check_rate_limit(client_ip: str) -> bool:
    """Check and update rate limit bucket for client IP. Returns True if allowed."""
    now = time.monotonic()
    bucket = _rate_limit_buckets[client_ip]
    # Prune old entries
    cutoff = now - RATE_LIMIT_WINDOW_SEC
    while bucket and bucket[0] < cutoff:
        bucket.pop(0)
    if len(bucket) >= RATE_LIMIT_MAX_REQUESTS:
        return False
    bucket.append(now)
    return True
 def _lnurl_discovery(alias: str, manager: "AlbyHubManager", client_ip: str = "") -> tuple[dict, int]:
    alias = alias.strip().lower()
    if not NWC_ALIAS_RE.match(alias):
        return {"status": "ERROR", "reason": "Unknown Lightning Address alias"}, 404
    domain = _read_domain()
    if not domain:
        return {"status": "ERROR", "reason": "Lightning domain is not configured"}, 503
    try:
        app = manager.find_app_by_alias(alias)
    except _mgr_mod.AlbyHubError:
        return {"status": "ERROR", "reason": "Service temporarily unavailable"}, 503
    if app is None:
        return {"status": "ERROR", "reason": "Unknown Lightning Address alias"}, 404
    meta = _mgr_mod.AlbyHubManager._parse_metadata(app.get("metadata"))
    min_sendable = int(
        meta.get("lnurl_min_sendable_msat", _mgr_mod.NWC_MIN_SENDABLE_MSAT)
    )
    max_sendable = int(
        meta.get("lnurl_max_sendable_msat", _mgr_mod.NWC_MAX_SENDABLE_MSAT)
    )
    callback_alias = urllib.parse.quote(alias, safe="")
    callback = f"https://{domain}/lnurlp/{callback_alias}/callback"
    description = meta.get("lnurl_description") or f"Pay {alias}"
    metadata = json.dumps([["text/plain", description]], separators=(",", ":"))
    # Audit log: LNURL discovery
    _audit_mod.audit_log(
        "lnurl_discovery",
        alias=alias,
        domain=domain,
        client_ip=client_ip,
        min_sendable_msat=min_sendable,
        max_sendable_msat=max_sendable,
    )
    return {
        "tag": "payRequest",
        "callback": callback,
        "minSendable": min_sendable,
        "maxSendable": max_sendable,
        "metadata": metadata,
        "commentAllowed": 0,
    }, 200
 def _lnurl_callback(
    alias: str, amount_str: str | None, manager: "AlbyHubManager", client_ip: str = ""
 ) -> tuple[dict, int]:
    payload, status_code = _lnurl_discovery(alias, manager, client_ip)
    if status_code != 200:
        return payload, status_code
    if amount_str is None:
        return {"status": "ERROR", "reason": "Missing amount parameter"}, 400
    if not re.match(r"^\d+$", amount_str):
        return {
            "status": "ERROR",
            "reason": "Amount must be an integer millisatoshi value",
        }, 400
    amount_msat = int(amount_str)
    min_sendable = int(payload["minSendable"])
    max_sendable = int(payload["maxSendable"])
    if amount_msat < min_sendable:
        return {
            "status": "ERROR",
            "reason": "Amount is below the minimum sendable value",
        }, 400
    if amount_msat > max_sendable:
        return {
            "status": "ERROR",
            "reason": "Amount is above the maximum sendable value",
        }, 400
    if amount_msat % 1000 != 0:
        return {
            "status": "ERROR",
            "reason": "Amount must be a whole-satoshi value",
        }, 400
    try:
        app = manager.find_app_by_alias(alias)
    except _mgr_mod.AlbyHubError:
        return {"status": "ERROR", "reason": "Service temporarily unavailable"}, 503
    if app is None:
        return {"status": "ERROR", "reason": "Unknown Lightning Address alias"}, 404
    meta = _mgr_mod.AlbyHubManager._parse_metadata(app.get("metadata"))
    description = meta.get("lnurl_description") or f"Pay {alias}"
    try:
        app_id = int(app["id"])
        invoice = manager.issue_invoice(app_id, amount_msat, description)
    except _mgr_mod.AlbyHubError:
        return {"status": "ERROR", "reason": "Invoice creation failed"}, 502
    # Audit log: Invoice generated via LNURL
    _audit_mod.audit_log(
        "lnurl_invoice_created",
        alias=alias,
        amount_msat=amount_msat,
        amount_sat=amount_msat // 1000,
        client_ip=client_ip,
        invoice_prefix=invoice[:50] + "..." if len(invoice) > 50 else invoice,
    )
    return {"pr": invoice, "routes": []}, 200
 # ── HTTP server ───────────────────────────────────────────────────
 def _make_handler(manager: "AlbyHubManager") -> type:
    """Return a handler class bound to the given manager."""
    class LnurlHandler(BaseHTTPRequestHandler):
        _manager = manager
        def log_message(self, fmt: str, *args: object) -> None:
            logger.debug(f"LNURL {self.address_string()} {fmt % args}")
        def _send_json(self, status: int, body: dict) -> None:
            raw = json.dumps(body, separators=(",", ":")).encode("utf-8")
            self.send_response(status)
            self.send_header("Content-Type", "application/json")
            self.send_header("Content-Length", str(len(raw)))
            self.end_headers()
            self.wfile.write(raw)
        def _get_client_ip(self) -> str:
            # Check X-Forwarded-For header (set by Caddy)
            forwarded = self.headers.get("X-Forwarded-For")
            if forwarded:
                # Take the first IP in the chain
                return forwarded.split(",")[0].strip()
            # Fallback to direct connection IP
            return self.client_address[0]
        def _check_rate_limit(self) -> bool:
            client_ip = self._get_client_ip()
            if not _check_rate_limit(client_ip):
                self._send_json(429, {
                    "status": "ERROR",
                    "reason": "Rate limit exceeded. Please slow down."
                })
                _audit_mod.audit_log(
                    "rate_limit_exceeded",
                    client_ip=client_ip,
                    path=self.path,
                )
                return False
            return True
        def do_GET(self) -> None:  # noqa: N802
            if not self._check_rate_limit():
                return
            parsed = urllib.parse.urlparse(self.path)
            path = parsed.path
            qs = urllib.parse.parse_qs(parsed.query)
            client_ip = self._get_client_ip()
            # /.well-known/lnurlp/{alias}
            m = re.fullmatch(
                r"/.well-known/lnurlp/([^/]+)", path
            )
            if m:
                alias = urllib.parse.unquote(m.group(1))
                payload, code = _lnurl_discovery(alias, self._manager, client_ip)
                self._send_json(code, payload)
                return
            # /lnurlp/{alias}/callback
            m = re.fullmatch(r"/lnurlp/([^/]+)/callback", path)
            if m:
                alias = urllib.parse.unquote(m.group(1))
                amount_values = qs.get("amount")
                if not amount_values:
                    amount_str = None
                elif len(amount_values) != 1:
                    self._send_json(
                        400,
                        {
                            "status": "ERROR",
                            "reason": "A single amount parameter is required",
                        },
                    )
                    return
                else:
                    amount_str = amount_values[0]
                payload, code = _lnurl_callback(alias, amount_str, self._manager, client_ip)
                self._send_json(code, payload)
                return
            self._send_json(404, {"status": "ERROR", "reason": "Not found"})
    return LnurlHandler
 def run(
    host: str = LNURL_BIND_HOST,
    port: int = LNURL_PORT,
    manager: "AlbyHubManager | None" = None,
 ) -> None:
    """Start the blocking LNURL HTTP server."""
    if manager is None:
        manager = _mgr_mod.get_manager()
    handler_class = _make_handler(manager)
    server = HTTPServer((host, port), handler_class)
    logger.info("nwc-lnurl service listening on %s:%d", host, port)
    server.serve_forever()
 def main() -> None:
    logging.basicConfig(level=logging.INFO)
    run()
 if __name__ == "__main__":
    main()
@@ -1,131 +0,0 @@
 from __future__ import annotations
 import argparse
 import json
 import sys
 from . import nwc_hub_manager as _mgr_mod
 from .server import _nwc_domain, _nwc_validate_alias, _nwc_test_address
 def _print(data) -> None:
    print(json.dumps(data, indent=2, sort_keys=True))
 def main(argv: list[str] | None = None) -> int:
    parser = argparse.ArgumentParser(prog="nwc-wallet")
    sub = parser.add_subparsers(dest="cmd", required=True)
    create = sub.add_parser("create")
    create.add_argument("name")
    create.add_argument("alias")
    preset_group = create.add_mutually_exclusive_group()
    preset_group.add_argument("--receive-only", action="store_true")
    preset_group.add_argument("--limit-sats", type=int)
    sub.add_parser("list")
    drain = sub.add_parser("drain")
    drain.add_argument("wallet")
    delete = sub.add_parser("delete")
    delete.add_argument("wallet")
    addr = sub.add_parser("address")
    addr_sub = addr.add_subparsers(dest="address_cmd", required=True)
    addr_show = addr_sub.add_parser("show")
    addr_show.add_argument("alias")
    rotate = sub.add_parser("rotate")
    rotate.add_argument("wallet")
    sub.add_parser("health")
    args = parser.parse_args(argv)
    manager = _mgr_mod.get_manager()
    domain = _nwc_domain()
    if args.cmd == "list":
        try:
            wallets = manager.list_wallets(domain)
        except _mgr_mod.AlbyHubError as exc:
            print(f"Error: {exc.code} - {exc}", file=sys.stderr)
            return 1
        _print({"wallets": wallets})
        return 0
    if args.cmd == "health":
        result = manager.health()
        _print(result)
        return 0 if result.get("ok") else 1
    if args.cmd == "address" and args.address_cmd == "show":
        alias = args.alias.strip().lower()
        test = _nwc_test_address(alias)
        _print(test)
        return 0 if test.get("ok") else 1
    if args.cmd == "drain":
        try:
            result = manager.drain_wallet(args.wallet)
        except _mgr_mod.AlbyHubError as exc:
            print(f"Error: {exc.code} - {exc}", file=sys.stderr)
            return 1
        _print(result)
        return 0
    if args.cmd == "delete":
        try:
            result = manager.delete_wallet(args.wallet)
        except _mgr_mod.AlbyHubError as exc:
            print(f"Error: {exc.code} - {exc}", file=sys.stderr)
            return 1
        _print(result)
        return 0
    if args.cmd == "rotate":
        try:
            result = manager.rotate_wallet_secret(args.wallet)
        except _mgr_mod.AlbyHubError as exc:
            print(f"Error: {exc.code} - {exc}", file=sys.stderr)
            return 1
        _print({
            "wallet_id": result.get("wallet_id", ""),
            "pairing_uri": result.get("pairing_uri", ""),
            "message": result.get("message", "New NWC connection secret generated. Save it now — it will not be shown again."),
        })
        return 0
    if args.cmd == "create":
        alias = args.alias.strip().lower()
        if not _nwc_validate_alias(alias):
            print("Error: alias_invalid - Alias must be lowercase letters, digits, '_' or '-'.", file=sys.stderr)
            return 1
        access_preset = "send_receive_limited" if args.limit_sats is not None else "receive_only"
        try:
            result = manager.create_wallet(
                args.name.strip(),
                alias,
                access_preset,
                args.limit_sats if access_preset == "send_receive_limited" else None,
                domain,
            )
        except _mgr_mod.AlbyHubError as exc:
            print(f"Error: {exc.code} - {exc}", file=sys.stderr)
            return 1
        # Print the pairing URI once — this is the only time it is shown
        _print(
            {
                "wallet": result["wallet"],
                "pairing_uri": result.get("pairing_uri", ""),
                "message": "Keep the NWC connection secret private. It cannot be displayed again.",
                "result": result.get("result", {}),
            }
        )
        return 0
    return 1
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -39,7 +39,7 @@ from starlette.middleware.base import BaseHTTPMiddleware
 from .config import load_config, load_versions
 from . import systemctl as sysctl
-from . import nwc_hub_manager as _nwc_mgr
+from sovran_nwc import nwc_hub_manager as _nwc_mgr
 from . import support_ops as _support_ops
 from .security_helpers import (
    _nix_escape,
@@ -291,11 +291,10 @@ FEATURE_REGISTRY = [
        "port_requirements": [
            {"port": "80",          "protocol": "TCP",     "description": "HTTP (redirect to HTTPS)"},
            {"port": "443",         "protocol": "TCP",     "description": "HTTPS (domain)"},
-            {"port": "7881",        "protocol": "TCP",     "description": "LiveKit WebRTC signalling"},
+            {"port": "7881",        "protocol": "TCP",     "description": "WebRTC media (TCP fallback)"},
-            {"port": "7882",        "protocol": "UDP",     "description": "LiveKit media (UDP mux)"},
+            {"port": "7882",        "protocol": "UDP",     "description": "WebRTC media (UDP)"},
-            {"port": "5349",        "protocol": "TCP",     "description": "TURN over TLS"},
+            {"port": "3478",        "protocol": "UDP",     "description": "TURN relay + STUN"},
-            {"port": "3478",        "protocol": "UDP",     "description": "TURN (STUN/relay)"},
+            {"port": "40000-40099", "protocol": "UDP",     "description": "TURN relay (WebRTC media)"},
            {"port": "30000-40000", "protocol": "TCP/UDP", "description": "TURN relay (WebRTC)"},
        ],
    },
    {
@@ -395,11 +394,10 @@ FEATURE_SERVICE_MAP = {
 # Port requirements for service tiles (keyed by unit name or icon)
 _PORTS_ELEMENT_CALLING = [
-    {"port": "7881",        "protocol": "TCP",     "description": "LiveKit WebRTC signalling"},
+    {"port": "7881",        "protocol": "TCP",     "description": "WebRTC media (TCP fallback)"},
-    {"port": "7882",        "protocol": "UDP",     "description": "LiveKit media (UDP mux)"},
+    {"port": "7882",        "protocol": "UDP",     "description": "WebRTC media (UDP)"},
-    {"port": "5349",        "protocol": "TCP",     "description": "TURN over TLS"},
+    {"port": "3478",        "protocol": "UDP",     "description": "TURN relay + STUN"},
-    {"port": "3478",        "protocol": "UDP",     "description": "TURN (STUN/relay)"},
+    {"port": "40000-40099", "protocol": "UDP",     "description": "TURN relay (WebRTC media)"},
    {"port": "30000-40000", "protocol": "TCP/UDP", "description": "TURN relay (WebRTC)"},
 ]
 # Units whose port requirements exist purely so the user can forward them in
@@ -910,11 +908,68 @@ def _get_remote_rev(branch=None):
    return None
 def _parse_version(text):
    """Return a (major, minor, patch) tuple from a VERSION string, or None."""
    try:
        match = re.search(r"(\d+)\.(\d+)\.(\d+)", str(text))
        if match:
            return tuple(int(g) for g in match.groups())
    except Exception:
        pass
    return None
 def _get_remote_version(branch=None):
    """Read VERSION on the tracked branch, e.g. the stable release version."""
    try:
        ref = branch or "stable"
        url = (
            "https://git.sovransystems.com/api/v1/repos/"
            "Sovran_Systems/Sovran_SystemsOS/raw/VERSION?ref="
            + urllib.parse.quote(ref)
        )
        req = urllib.request.Request(url, method="GET")
        with urllib.request.urlopen(req, timeout=15) as resp:
            return _parse_version(resp.read().decode())
    except Exception:
        pass
    return None
 def check_for_updates() -> bool | None:
    """Whether an update is available.
    Primary signal: the flake lock's pinned Sovran_Systems rev differs from
    the remote branch head.  BUT a failed update rewrites ``flake.lock`` (the
    ``nix flake update`` step) without staging a generation (the
    ``nixos-rebuild boot`` step failed), so after a failure the lock and the
    remote agree while the *running* system is still on the old version.  In
    that case the rev comparison alone reports a false "up to date" and hides
    the failed update from the dashboard.
    Backstop: compare the running Hub version against the branch VERSION.
    A newer released version while running an older one means the update did
    not apply (build failed, reboot skipped, generation rolled back) and must
    be offered again.
    """
    locked_rev, branch = _get_locked_info()
    remote_rev = _get_remote_rev(branch)
    if locked_rev and remote_rev:
-        return locked_rev != remote_rev
+        rev_differs = locked_rev != remote_rev
        if rev_differs:
            return True
        # Revs match — make sure the pinned (failed) rev isn't masking an
        # older *running* system.
        running_ver = _parse_version(_get_sovran_version())
        remote_ver = _get_remote_version(branch)
        if running_ver and remote_ver and remote_ver > running_ver:
            return True
        return False
    # Couldn't compare revs — fall back to the version backstop.
    running_ver = _parse_version(_get_sovran_version())
    remote_ver = _get_remote_version(branch)
    if running_ver and remote_ver:
        return remote_ver > running_ver
    return None  # inconclusive — couldn't read lock or reach remote
@@ -1114,7 +1169,7 @@ def _get_firewall_allowed_ports() -> dict[str, set[int]]:
        )
        if proc.returncode == 0:
            for line in proc.stdout.splitlines():
-                # e.g. ACCEPT tcp  -- ... dpt:443  or  dpts:7882:7894
+                # e.g. ACCEPT tcp  -- ... dpt:443  or  dpts:40000:40099
                m = re.search(r'(tcp|udp).*dpts?:(\d+)(?::(\d+))?', line)
                if m:
                    proto_match = m.group(1)
@@ -1172,7 +1227,7 @@ def _resolve_all_addresses_cached(domain: str) -> list[str]:
 def _port_range_to_ints(port_str: str) -> list[int]:
-    """Convert a port string like ``"443"``, ``"30000-40000"`` to a list of ints."""
+    """Convert a port string like ``"443"``, ``"40000-40099"`` to a list of ints."""
    port_str = port_str.strip()
    if re.match(r'^\d+$', port_str):
        return [int(port_str)]
@@ -3887,6 +3942,11 @@ async def api_updates_check():
        # Avoid a slow remote update check when there is already an operation
        # the dashboard needs to surface.
        return {"available": True, "status": status.lower()}
    if status == "FAILED":
        # The last update did not complete (build failed).  Keep offering the
        # update so the user can re-run it rather than silently landing on a
        # false "up to date".
        return {"available": True, "status": "failed"}
    available = await loop.run_in_executor(None, check_for_updates)
    # None means inconclusive (check failed) — report as available so the UI doesn't block
@@ -3964,8 +4024,15 @@ async def api_updates_run():
        except OSError:
            pass
    # Re-read status: a prior failed update leaves flake.lock advanced even
    # though no generation was staged, so the rev-based check below can say
    # "no updates" even though the system is still old.  A failed update must
    # always be re-runnable to recover.
    persisted_status = await loop.run_in_executor(None, _read_update_status)
    last_failed = persisted_status == "FAILED"
    available = await loop.run_in_executor(None, check_for_updates)
-    if available is False:  # only block when positively confirmed no updates
+    if available is False and not last_failed:  # only block when positively confirmed no updates
        # Clear stale status/log so they don't contaminate future modal opens.
        _write_update_status("IDLE")
        try:
@@ -7,6 +7,7 @@ if ($btnCloseModal) $btnCloseModal.addEventListener("click", closeUpdateModal);
 if ($btnReboot) $btnReboot.addEventListener("click", doReboot);
 if ($btnSave) $btnSave.addEventListener("click", saveErrorReport);
 if ($btnRetryUpdate) $btnRetryUpdate.addEventListener("click", retryUpdateStatus);
 if ($btnRetryRun) $btnRetryRun.addEventListener("click", retryUpdateRun);
 // Browser timers and requests may be suspended while an RDP session/tab is in
 // the background. Reconcile immediately when the user returns instead of
@@ -67,7 +67,7 @@ function renderPortForwardGuideHtml(ports, opts) {
  var noteClass  = opts.noteClass  || "port-req-hint";
  var ipHtml = opts.internalIp
    ? '<code class="port-req-internal-ip">' + escHtml(opts.internalIp) + '</code>'
-    : 'this computer&rsquo;s <strong>internal IP</strong> (shown as &ldquo;Internal IP&rdquo; at the top of the Hub dashboard)';
+    : 'this computer&rsquo;s <strong>internal IP</strong>';
  var rows = (ports || []).map(function(p) {
    return '<tr>' +
@@ -78,26 +78,17 @@ function renderPortForwardGuideHtml(ports, opts) {
  }).join("");
  var forWhat = opts.serviceName
-    ? 'For <strong>' + escHtml(opts.serviceName) + '</strong> to be reachable from outside your home network, open'
+    ? 'To make <strong>' + escHtml(opts.serviceName) + '</strong> reachable from outside your home, forward these ports to ' + ipHtml + ':'
-    : 'Open';
+    : 'Forward these ports to ' + ipHtml + ':';
-  return '<p class="' + introClass + '">' +
+  return '<p class="' + introClass + '">' + forWhat + '</p>' +
-      forWhat + ' the ports below in your router&rsquo;s <strong>port forwarding</strong> settings ' +
+    '<p class="port-req-steps" style="margin-top:6px;margin-bottom:10px;font-size:0.92em;color:#555;">' +
-      'and point them at ' + ipHtml + '.' +
+      'Set the internal and external port to the <strong>same number</strong>. Match <strong>TCP</strong> or <strong>UDP</strong> exactly. For ranges like <strong>40000-40099</strong>, use your router&rsquo;s range fields (start 40000, end 40099).' +
    '</p>' +
    '<ul class="port-req-steps">' +
      '<li>Set the <strong>internal (private) port</strong> and the <strong>external (public) port</strong> to the <strong>same number</strong>.</li>' +
      '<li>Match the <strong>protocol</strong> exactly — a rule set to TCP will not pass UDP traffic. Where the table says <strong>TCP + UDP</strong>, create both rules (or pick &ldquo;Both&rdquo;/&ldquo;TCP/UDP&rdquo; if your router offers it).</li>' +
      '<li>For a range such as <strong>30000-40000</strong>, use your router&rsquo;s port-range fields — start 30000, end 40000 — rather than one rule per port.</li>' +
    '</ul>' +
    '<table class="' + tableClass + '">' +
      '<thead><tr><th>Port(s)</th><th>Protocol</th><th>Used for</th></tr></thead>' +
      '<tbody>' + rows + '</tbody>' +
-    '</table>' +
+    '</table>';
    '<p class="' + noteClass + '">' +
      '📱 <strong>How to confirm it worked:</strong> forwarding happens on your router, so it can only be verified from outside your network. ' +
      'Turn Wi-Fi off on your phone and open the service over mobile data — if it loads, your ports are open.' +
    '</p>';
 }
 function formatDuration(seconds) {
@@ -53,6 +53,7 @@ const $modalLog       = document.getElementById("modal-log");
 const $btnReboot      = document.getElementById("btn-reboot");
 const $btnSave        = document.getElementById("btn-save-report");
 const $btnRetryUpdate = document.getElementById("btn-retry-update-status");
 const $btnRetryRun    = document.getElementById("btn-retry-update");
 const $btnCloseModal  = document.getElementById("btn-close-modal");
 const $rebootOverlay  = document.getElementById("reboot-overlay");
@@ -275,7 +275,13 @@ async function checkUpdates() {
    var sidebarUpdateBtn = document.getElementById("sidebar-btn-update");
    var sidebarUpdateHint = document.getElementById("sidebar-update-hint");
    if (sidebarUpdateBtn) {
-      if (updateStatus === "reboot_required") {
+      if (updateStatus === "failed") {
        // Last update errored and did not apply — surface it as a persistent
        // red banner that re-opens the failed run with a "Retry Update" action.
        sidebarUpdateBtn.style.borderColor = "#e01b24";
        sidebarUpdateBtn.style.backgroundColor = "rgba(224, 27, 36, 0.10)";
        if (sidebarUpdateHint) sidebarUpdateHint.textContent = "Update failed — click to retry";
      } else if (updateStatus === "reboot_required") {
        sidebarUpdateBtn.style.borderColor = "#e5a50a";
        sidebarUpdateBtn.style.backgroundColor = "rgba(229, 165, 10, 0.10)";
        if (sidebarUpdateHint) sidebarUpdateHint.textContent = "Restart required";
@@ -14,7 +14,10 @@ async function openUpdateModal() {
      { cache: "no-store" },
      STATUS_POLL_FETCH_TIMEOUT
    );
-    if (current.running || current.result === "reboot_required") {
+    if (current.running || current.result === "reboot_required" || current.result === "failed") {
      // An in-progress update, a staged update awaiting reboot, or a prior
      // failed update — reattach to the persisted systemd/log state instead of
      // starting over or wrongly reporting "up to date".
      showExistingUpdate(current);
      return;
    }
@@ -41,6 +44,7 @@ async function openUpdateModal() {
        if ($btnReboot) $btnReboot.style.display = "none";
        if ($btnSave) $btnSave.style.display = "none";
        if ($btnRetryUpdate) $btnRetryUpdate.style.display = "none";
        if ($btnRetryRun) $btnRetryRun.style.display = "none";
        if ($btnCloseModal) $btnCloseModal.disabled = false;
        $modal.classList.add("open");
        return;
@@ -69,6 +73,7 @@ function prepareUpdateModal() {
  if ($btnReboot) $btnReboot.style.display = "none";
  if ($btnSave) $btnSave.style.display = "none";
  if ($btnRetryUpdate) $btnRetryUpdate.style.display = "none";
  if ($btnRetryRun) $btnRetryRun.style.display = "none";
  if ($btnCloseModal) $btnCloseModal.disabled = true;
  $modal.classList.add("open");
 }
@@ -154,6 +159,7 @@ function startUpdate() {
        if ($btnReboot) $btnReboot.style.display = "none";
        if ($btnSave) $btnSave.style.display = "none";
        if ($btnRetryUpdate) $btnRetryUpdate.style.display = "none";
        if ($btnRetryRun) $btnRetryRun.style.display = "none";
        if ($btnCloseModal) $btnCloseModal.disabled = false;
        _updateFinished = true;
        return;
@@ -283,6 +289,16 @@ function retryUpdateStatus() {
  startUpdatePoll();
 }
 // Re-run a failed (or never-applied) update from scratch.  The backend always
 // allows this after a FAILED attempt even though flake.lock may already be
 // advanced (the previous build never staged a bootable generation).
 function retryUpdateRun() {
  if ($btnRetryRun) $btnRetryRun.style.display = "none";
  if ($btnSave) $btnSave.style.display = "none";
  if ($btnReboot) $btnReboot.style.display = "none";
  _doOpenUpdateModal();
 }
 function resumeUpdateStatusAfterInterruption() {
  if (!$modal || !$modal.classList.contains("open")) return;
  if (_updateStatusUnavailable) {
@@ -304,9 +320,10 @@ function onUpdateDone(result) {
    if ($modalStatus) $modalStatus.textContent = "✓ Update complete — restart required";
    if ($btnReboot) $btnReboot.style.display = "inline-flex";
  } else {
-    if ($modalStatus) $modalStatus.textContent = "✗ Update failed";
+    if ($modalStatus) $modalStatus.textContent = "✗ Update failed — your system was not changed. Run the update again or save the error report for support.";
    if ($btnRetryRun) $btnRetryRun.style.display = "inline-flex";
    if ($btnSave) $btnSave.style.display = "inline-flex";
-    if ($btnReboot) $btnReboot.style.display = "inline-flex";
+    if ($btnReboot) $btnReboot.style.display = "none";
  }
 }
@@ -75,6 +75,7 @@
      <div class="modal-footer">
        <button class="btn btn-save" id="btn-save-report" style="display:none">Save Error Report</button>
        <button class="btn btn-save" id="btn-retry-update-status" style="display:none">Retry Status</button>
        <button class="btn btn-reboot" id="btn-retry-update" style="display:none">Retry Update</button>
        <button class="btn btn-reboot" id="btn-reboot" style="display:none">Restart Entire System</button>
        <button class="btn btn-close-modal" id="btn-close-modal" disabled>Close</button>
      </div>
@@ -10,7 +10,7 @@
  "albyhub.service": "1.24.0",
  "mempool.service": "3.2.1",
  "matrix-synapse.service": "1.115.0",
-  "livekit.service": "1.5.2",
+  "livekit.service": "1.13.6",
  "vaultwarden.service": "1.32.0",
  "haven-relay.service": "0.1.0"
 }
@@ -147,7 +147,7 @@
    hunspell hunspellDicts.en_US
    synadm brave-origin dua
    gparted pv unzip parted screen zenity
-    libargon2 gnome-terminal libreoffice-fresh
+    libargon2 gnome-terminal libreoffice-stable
    dig firefox wp-cli axel
    lk-jwt-service livekit-libwebrtc livekit
    matrix-synapse age onlyoffice-desktopeditors
@@ -5,11 +5,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1787839684,
+        "lastModified": 1788527183,
-        "narHash": "sha256-xTafqsVs2/zyGsaCel41QT5Lpbs/rG56Kp+YsmLXL8I=",
+        "narHash": "sha256-Jvuh4VWR8Ep+UlX1siyiMWJAn9fPNZKN5IxzVOnGAec=",
        "owner": "emmanuelrosa",
        "repo": "btc-clients-nix",
-        "rev": "ef81159876930802ef9861aa5c039cec6886a30f",
+        "rev": "761b147fd7038b210251b16cb2b4e3fe5e9b603b",
        "type": "github"
      },
      "original": {
@@ -26,11 +26,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1785627969,
+        "lastModified": 1787559586,
-        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
        "type": "github"
      },
      "original": {
@@ -41,11 +41,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1785590095,
+        "lastModified": 1788179970,
-        "narHash": "sha256-CNO2szJbdLjVN/Hi1BML9MSALz1GM2fIdwnzs404QO8=",
+        "narHash": "sha256-r5LmxzIhsu5+oDybatN/HJ8roYOKjb2Apa5xI6v46VU=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e568f3b19d54b08f48bfae9b12b3e124d1a28002",
+        "rev": "1db62ab7d2ccf1916bbf7deb61fc9d16f1c4ab49",
        "type": "github"
      },
      "original": {
@@ -56,11 +56,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1787753485,
+        "lastModified": 1788690626,
-        "narHash": "sha256-BZWCi9ZRJiARTuKTbbtvFTj7t1TK4G3UEckT3HyNfRg=",
+        "narHash": "sha256-+v4I4LawmRD/mVxO7QIAerRrCkElp3YImzWkkUnvOTg=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "062346a6d85bc4b49dfaa61c986e9c5be21217d1",
+        "rev": "c25784012c9982bca5b3e0de87e90bbdac8927d3",
        "type": "github"
      },
      "original": {
@@ -72,11 +72,11 @@
    },
    "nixpkgs-stable_2": {
      "locked": {
-        "lastModified": 1787753485,
+        "lastModified": 1788297115,
-        "narHash": "sha256-BZWCi9ZRJiARTuKTbbtvFTj7t1TK4G3UEckT3HyNfRg=",
+        "narHash": "sha256-Z+vUNbfd2FIKkWOTkcT7RYlh3oFCnig/d2eXD1SWf2E=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "062346a6d85bc4b49dfaa61c986e9c5be21217d1",
+        "rev": "a3116115851d68b8952a2a4221cc25a84e56b532",
        "type": "github"
      },
      "original": {
@@ -88,11 +88,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1787498568,
+        "lastModified": 1788614874,
-        "narHash": "sha256-9i/VTdusq/+NM/tz+J1Re+ojkMB8MBf0QshnYfzHz30=",
+        "narHash": "sha256-7QYjT2vHLuX9Z1pdxHXDKCbh1CR3D/2rywB9Tx0MPRg=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "56c02bc00adcf003215cc4bd996d6efaf4cff188",
+        "rev": "c043004d1c6985732bcc1cbc5a9c9aecbbb4e0f0",
        "type": "github"
      },
      "original": {
@@ -104,11 +104,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1787364730,
+        "lastModified": 1787631388,
-        "narHash": "sha256-NcYt9QJfpJiF1lAyN8BDPB4EeScbPU+EwQqPiBElrpU=",
+        "narHash": "sha256-vMiXptXarfSdJb1Gkc+FYVOAibuBRj7qxGa8z68q1Uw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "a831408e6378bc02ebf8cc09b52c96ca86f6bab4",
+        "rev": "ac6b2166e7a9375683b8e98f860f273222337b16",
        "type": "github"
      },
      "original": {
@@ -120,11 +120,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1787736819,
+        "lastModified": 1788179007,
-        "narHash": "sha256-cV5xEJJK3BvhU8rEd4mC9UsmDi5qscv/kzGPhBRC5WA=",
+        "narHash": "sha256-hn1oU2rue2SYK8dAr8+WNZWtbsz1S2W5mnHlSEuh3bo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9fbb54b33e91ee4ca368e35a78e0613c720600b3",
+        "rev": "34ab99075ac4f7e40cf037eef32cb1c360bb85e9",
        "type": "github"
      },
      "original": {
@@ -141,11 +141,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1787691219,
+        "lastModified": 1788190018,
-        "narHash": "sha256-CjeJTOjrluiDuL0W/YBFkSBOQjBYmdKwj7hWAJ4PIh0=",
+        "narHash": "sha256-59BAfH0txPAZrPBF4QJqwvUWppD+ICrcjA1LZAmPnrQ=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "ebec1ae277a50b16e7d6682edd009ef585d68261",
+        "rev": "41844750e55f17b1385d5b09ca7ade5f11f49506",
        "type": "github"
      },
      "original": {
@@ -169,11 +169,11 @@
        "nixpkgs-stable": "nixpkgs-stable_2"
      },
      "locked": {
-        "lastModified": 1788191399,
+        "lastModified": 1788796120,
-        "narHash": "sha256-2m3eeQvPGPjcegG1+C1LnfjQ5DGJTra9Aw2RFThzT1A=",
+        "narHash": "sha256-SLxKMbMPf0MN4tVLAURr6p5mNsieXH8dzmMZisqljmM=",
        "owner": "naturallaw777",
        "repo": "Sovran_Bitcoin",
-        "rev": "f4e86564418bee335fd230387f07abb9c6632f65",
+        "rev": "17cc04f5229563cb06f7e1843ccb8994af1df7f9",
        "type": "github"
      },
      "original": {
@@ -19,6 +19,24 @@
 				system = prev.stdenv.hostPlatform.system;
 				config.allowUnfree = true;
 			};
 			# Pin LiveKit to 1.13.6: element-calling.nix sets
 			# rtc.advertise_internal_ip, which gives LAN callers a host candidate
 			# so calls work on Wi-Fi without the router needing NAT-hairpin. That
 			# flag is only honoured when node_ip is set manually from LiveKit
 			# v1.13.6 (mediatransportutil f234b53); nixpkgs-unstable currently
 			# ships 1.13.5. Remove this override once nixpkgs-unstable reaches
 			# >= 1.13.6.
 			livekit = prev.livekit.overrideAttrs (old: {
 				version = "1.13.6";
 				src = prev.fetchFromGitHub {
 					owner = "livekit";
 					repo = "livekit";
 					rev = "v1.13.6";
 					hash = "sha256-sUAx6ooeEUUqot5xuZv7xiQa3DdRFVULteTwYgFUzCI=";
 				};
 				vendorHash = "sha256-nOGSmoNuQQm/sIVI1HojsiS4GkbhA68uYMQ6X7d4a5Q=";
 			});
 		};
 	in
 	{
@@ -37,7 +55,6 @@
 				{ nixpkgs.hostPlatform = "x86_64-linux"; nixpkgs.overlays = [ overlay-stable ]; }
 				./iso/common.nix
 				sovran-bitcoin.nixosModules.default
 				./modules/sovran-bitcoin-integration.nix
 				nixvim.nixosModules.nixvim
 			];
 		};
@@ -150,6 +150,61 @@ let
    "haven-relay.service" = if pkgs ? haven-relay then pkgs.haven-relay.version else (if pkgs ? haven then pkgs.haven.version else "0.1.0");
  });
  # Shared shell prelude used by both the update and rebuild wrapper scripts.
  # A flake/package fetch that is interrupted (network blip, reboot
  # mid-download, disk filled, hiccup on the remote) can leave a truncated
  # tarball or partial git clone in Nix's download caches. Nix then reuses the
  # corrupt archive on every retry and dies with "cannot read file from
  # tarball: Truncated tar archive detected" — a failure that is NOT fixed by
  # simply re-running, but IS fixed by clearing the fetch caches. run_step runs
  # a command and, on the first failure that matches a download/cache
  # signature, clears the caches and retries once. Real config errors never
  # match, so they still fail loudly. Each sourcing script must define $LOG.
  nix-self-heal-prelude = ''
    transient_failure() {
      grep -Eqi 'truncated tar|unexpected end of (file|archive)|unexpected eof|corrupt(ed)? (archive|nar|download|file)|could not (fetch|download)|download.*(failed|interrupted)|timed out|timeout|connection (reset|refused|timed out)|network is unreachable|temporary failure in name resolution|checksum mismatch|hash mismatch|nar hash|unable to download|store path.*is not valid|cannot read file from tarball|into the git cache' "$LOG"
    }
    clear_fetch_caches() {
      echo "[SELF-HEAL] Clearing stale Nix download caches and verifying the Nix store…"
      # Re-fetchable caches only; /nix/store generations and the running system
      # are never touched here.
      rm -rf /root/.cache/nix/tarballs /root/.cache/nix/vcs-cache /root/.cache/nix/git* /root/.cache/nix/flakes 2>/dev/null || true
      # Fast closure-level repair only. A full --check-contents scan hashes
      # every store path and can take tens of minutes on a big node; the cache
      # clear above is the actual fix for truncated/corrupt downloads.
      nix-store --verify --repair >/dev/null 2>&1 || true
      echo "[SELF-HEAL] Caches cleared; retrying…"
      echo ""
    }
    # run_step LABEL CMD [ARGS...] — run a build step; on a transient
    # fetch/cache failure, heal once and retry. Returns the command exit code
    # but leaves error messaging to the caller.
    run_step() {
      label="$1"; shift
      rc=1
      for try in 1 2; do
        if [ "$try" -eq 2 ]; then
          echo "── $label — retry after cache repair ──"
        fi
        "$@"
        rc=$?
        if [ "$rc" -eq 0 ]; then
          return 0
        fi
        if [ "$try" -eq 1 ] && transient_failure; then
          echo ""
          echo "[SELF-HEAL] $label failed on a download/cache error (see above)."
          clear_fetch_caches
          continue
        fi
        return "$rc"
      done
      return "$rc"
    }
  '';
  # ── Update wrapper script ──────────────────────────────────────
  update-script = pkgs.writeShellScript "sovran-hub-update.sh" ''
    set -uo pipefail
@@ -171,12 +226,14 @@ let
    RC=0
    ${nix-self-heal-prelude}
    echo "── Step 1/3: nix flake update ────────────────────"
-    if ! nix flake update --flake /etc/nixos --print-build-logs \
+    if ! run_step "nix flake update" nix flake update --flake /etc/nixos --print-build-logs \
          --option connect-timeout 10 \
          --option stalled-download-timeout 90 \
          --option download-attempts 7 \
-          --option fallback true 2>&1; then
+          --option fallback true; then
      echo "[ERROR] nix flake update failed"
      RC=1
    fi
@@ -186,22 +243,22 @@ let
      echo "── Step 2/3: nixos-rebuild boot (stage next reboot) ──"
      # Stream output straight into $LOG (see rebuild-script) so the Hub UI
      # shows live progress instead of an empty log during long builds.
-      nixos-rebuild boot --flake /etc/nixos --print-build-logs \
+      if run_step "nixos-rebuild boot" nixos-rebuild boot --flake /etc/nixos --print-build-logs \
          --option connect-timeout 10 \
          --option stalled-download-timeout 90 \
          --option download-attempts 7 \
-        --option fallback true
+          --option fallback true; then
-      BOOT_RC=$?
+        if ! readlink -f /nix/var/nix/profiles/system > "$GENERATION"; then
      if [ "$BOOT_RC" -ne 0 ]; then
        echo "[ERROR] nixos-rebuild boot failed"
        RC=1
      elif ! readlink -f /nix/var/nix/profiles/system > "$GENERATION"; then
          # The marker is informational only.  The Hub derives pending-reboot
          # state from the NixOS system profile itself, so failing to record
          # the marker must not fail an otherwise successful update.
          echo "[WARNING] update succeeded but its staged generation could not be recorded"
          rm -f "$GENERATION"
        fi
      else
        echo "[ERROR] nixos-rebuild boot failed"
        RC=1
      fi
      echo ""
    fi
@@ -245,12 +302,15 @@ let
    echo "  Sovran_SystemsOS Rebuild — $(date)"
    echo "══════════════════════════════════════════════════"
    echo ""
    ${nix-self-heal-prelude}
    echo "── Rebuilding system configuration ──────────────"
    # Stream output straight into $LOG (tee'd by the exec redirect above) so
    # the Hub UI shows live progress.  Capturing the output in a variable
    # kept the log empty for the entire build+activation, which made long
    # rebuilds can otherwise look like a hang.
-    nixos-rebuild switch --flake /etc/nixos --print-build-logs \
+    run_step "nixos-rebuild switch" nixos-rebuild switch --flake /etc/nixos --print-build-logs \
      --option connect-timeout 10 \
      --option stalled-download-timeout 90 \
      --option download-attempts 7 \
@@ -266,11 +326,11 @@ let
      echo ""
      echo "  ✓ Build succeeded — a reboot is required to apply this rebuild"
      echo "  (Critical system components changed; running nixos-rebuild boot instead)"
-      if nixos-rebuild boot --flake /etc/nixos --print-build-logs \
+      if run_step "nixos-rebuild boot" nixos-rebuild boot --flake /etc/nixos --print-build-logs \
           --option connect-timeout 10 \
           --option stalled-download-timeout 90 \
           --option download-attempts 7 \
-           --option fallback true 2>&1; then
+           --option fallback true; then
        echo "REBOOT_REQUIRED" > "$STATUS"
      else
        echo "[ERROR] nixos-rebuild boot also failed"
@@ -278,6 +338,7 @@ let
        exit 1
      fi
    else
      echo "[ERROR] nixos-rebuild switch failed"
      echo ""
      echo "══════════════════════════════════════════════════"
      echo "  ✗ Rebuild failed — see errors above"
@@ -405,6 +466,9 @@ DESKTOP
 import os, sys
 base = os.path.join("$out", "lib", "sovran-hub-web")
 sys.path.insert(0, base)
 # Canonical NWC implementation — single source of truth from the
 # Sovran_Bitcoin flake (imported directly by server.py).
 sys.path.insert(0, os.path.join("${pkgs.sovran-bitcoin.nwc}", "lib", "sovran-nwc"))
 os.environ["SOVRAN_HUB_CONFIG"] = os.path.join(base, "config.json")
 os.environ["SOVRAN_HUB_VERSIONS"] = os.path.join(base, "versions.json")
 os.environ["SOVRAN_HUB_ICONS"]  = os.path.join("$out", "share", "sovran-hub", "icons")
@@ -418,26 +482,9 @@ uvicorn.run(
 LAUNCHER
      chmod +x $out/bin/sovran-hub-web
-      cat > $out/bin/nwc-wallet <<LAUNCHER
+      # nwc-wallet / nwc-lnurl binaries are no longer shipped here: the
-#!${pkgs.python3}/bin/python3
+      # Sovran_Bitcoin flake provides them (env-wrapped nwc-wallet via
-import os, sys
+      # albyhub.nix, nwc-lnurl.service via lnurl.nix) — single source of truth.
 base = os.path.join("$out", "lib", "sovran-hub-web")
 sys.path.insert(0, base)
 from sovran_systemsos_web.nwc_wallet_cli import main
 sys.exit(main())
 LAUNCHER
      chmod +x $out/bin/nwc-wallet
      cat > $out/bin/nwc-lnurl <<LAUNCHER
 #!${pkgs.python3}/bin/python3
 import os, sys
 base = os.path.join("$out", "lib", "sovran-hub-web")
 sys.path.insert(0, base)
 from sovran_systemsos_web.nwc_lnurl_service import main
 main()
 LAUNCHER
      chmod +x $out/bin/nwc-lnurl
      runHook postInstall
    '';
@@ -185,6 +185,14 @@ EOF
      fi
      echo "Detected primary network interface: $IFACE"
      # Derive the LAN subnet this box sits on so the embedded TURN relay
      # is allowed to hand media to LiveKit's LAN host candidate (see the
      # allow_restricted_peer_cidrs block below). Computed from the primary
      # interface's own address, so it always matches the subnet the LAN
      # clients (phones on Wi-Fi) actually live on.
      LAN_CIDR=$(ip -4 -o addr show dev "$IFACE" | awk '{print $4}' | grep -vE '^(127\.|169\.254\.)' | head -n1 | python3 -c 'import sys, ipaddress; s = sys.stdin.read().strip(); print(str(ipaddress.ip_network(s, strict=False)) if s else "")' 2>/dev/null)
      if [ -n "$LAN_CIDR" ]; then echo "Derived LAN CIDR for TURN relay: $LAN_CIDR"; else echo "Derived LAN CIDR for TURN relay: <none>"; fi
      # Generate the full LiveKit config the daemon will load. turn.domain and
      # rtc.interfaces.includes are only known at runtime, so they are
      # substituted here. The cert/key paths point at the LoadCredential-staged
@@ -229,10 +237,9 @@ port: 7880
 rtc:
  use_external_ip: false
  node_ip: $PUBLIC_IP
  advertise_internal_ip: true
  tcp_port: 7881
  udp_port: 7882
  port_range_start: 30000
  port_range_end: 40000
  interfaces:
    includes:
      - $IFACE
@@ -244,10 +251,9 @@ port: 7880
 rtc:
  use_external_ip: true
  skip_external_ip_validation: true
  advertise_internal_ip: true
  tcp_port: 7881
  udp_port: 7882
  port_range_start: 30000
  port_range_end: 40000
  interfaces:
    includes:
      - $IFACE
@@ -264,16 +270,37 @@ EOF
      # vhost (/livekit/jwt/sfu_webhook → 8073).
      LK_KEY=$(cut -d: -f1 < ${livekitKeyFile} | tr -d '[:space:]')
      # TURN/TLS is intentionally not configured (no tls_port): LiveKit
      # advertises turns:<domain>:443 to clients regardless of tls_port, so
      # a 5349 TURN/TLS listener would be unreachable and only adds attack
      # surface. The staged cert/key stay for a future TURN/TLS-on-443
      # (Caddy layer4 SNI) setup.
      cat >> /run/livekit/livekit.yaml <<EOF
 room:
  auto_create: false
 turn:
  enabled: true
  domain: $MATRIX
  tls_port: 5349
  udp_port: 3478
  relay_range_start: 40000
  relay_range_end: 40099
  cert_file: /run/credentials/livekit.service/turn-cert
  key_file: /run/credentials/livekit.service/turn-key
 EOF
      # By default the embedded TURN relay refuses to send media to
      # private/loopback peers. That would force its final hop to the
      # public/WAN IP (hairpin NAT) — exactly what breaks calls on routers
      # without NAT loopback. Allow the LAN subnet so the relay can deliver
      # directly to LiveKit's LAN host candidate instead.
      if [ -n "$LAN_CIDR" ]; then
        cat >> /run/livekit/livekit.yaml <<EOF
  allow_restricted_peer_cidrs:
    - $LAN_CIDR
 EOF
      fi
      cat >> /run/livekit/livekit.yaml <<EOF
 webhook:
  api_key: $LK_KEY
  urls:
@@ -315,10 +342,14 @@ EOF
    "turn-key:/var/lib/livekit/turn.key"
  ];
-  networking.firewall.allowedTCPPorts = [ 5349 7881 ];
+  # 5349/TCP (TURN/TLS) is deliberately absent — see livekit-turn-setup. RTC
  # media uses the single UDP mux (7882); the 30000-40000 range is gone so
  # media is no longer spread across 10000 ports. The TURN relay allocation
  # range (40000-40099) is kept separate from the media mux.
  networking.firewall.allowedTCPPorts = [ 7881 ];
  networking.firewall.allowedUDPPorts = [ 3478 7882 ];
  networking.firewall.allowedUDPPortRanges = [
-    { from = 30000; to = 40000; } # LiveKit internal TURN relay range
+    { from = 40000; to = 40099; } # LiveKit embedded TURN relay allocation range
  ];
  ####### JWT SERVICE RUNTIME CONFIG #######
Author	SHA1	Message	Date
naturallaw777	1d46d036c0	nixpkgs update	2026-09-07 10:55:32 -05:00
Sovran Systems	9ae4e34fe0	Switch LibreOffice from fresh to stable version	2026-09-03 16:31:12 -05:00
Sovran Systems	d1e226a687	fix(hub): self-heal truncated/corrupt Nix downloads and keep failed updates retryable Updater/rebuild self-heal: - Add a shared run_step wrapper used by both the update and rebuild scripts. On the first failure matching a transient fetch/cache signature (truncated tarball, corrupt NAR, hash mismatch, network timeout, interrupted download), clear Nix's fetch caches and repair the store, then retry once. Real config errors do not match and still fail loudly. - The kernel-change boot fallback in the rebuild path is also wrapped. - Fixes the reported 'cannot read file from tarball: Truncated tar archive detected' failure, which a plain re-run cannot clear because Nix reuses the corrupt cached archive. Failed-update recovery / reporting: - check_for_updates() now compares the running Hub version against the branch VERSION, so a failed 'nix flake update' (lock advanced but no generation staged) can no longer masquerade as 'up to date' and block retries. - /api/updates/check surfaces a persistent 'failed' state; /api/updates/run never blocks a retry after a failure. - Dashboard shows a red 'Update failed - click to retry' tile; the modal offers a Retry Update button and stops offering a reboot on failure.	2026-09-03 11:54:29 -05:00
Patch Bot	49e41eeea9	ui: simplify element-calling port modal — trim verbose steps and remove extra verification task - Replace 3 long instruction bullets with 1 plaintext line - Shorten intro (drop long parenthetical on IP location) - Remove 'how to confirm it worked' note — if router applies rules, ports are open - Keep port table intact (40000-40099 current set)	2026-09-03 09:52:27 -05:00
naturallaw777	88be5b99dd	updated flake to build through the new sovran-bitcoin input	2026-09-02 15:29:20 -05:00
naturallaw777	93492e88fb	chore(release): prepare v1.1.4	2026-09-02 15:13:56 -05:00
naturallaw777	7da37cdb34	updated nixpkgs	2026-09-02 14:52:15 -05:00
Sovran_SystemsOS	f34d1533c3	element-calling: fix Nix string interpolation of LAN_CIDR echo The debug echo used bash ${LAN_CIDR:-<none>} syntax, but inside a Nix indented string ${...} is Nix interpolation, not bash. Nix parsed 'LAN_CIDR:-<none>' as a lambda and failed the build with 'cannot coerce a function to a string'. Rewrite the echo without brace expansion.	2026-09-01 12:29:47 -05:00
Sovran_SystemsOS	220d6dff2c	docs/hub: update Element Calling port guidance to the new port set User-facing polish to match the element-calling port changes: - helpers.js: port-forward guide example now shows the 40000-40099 range instead of the removed 30000-40000. - versions.json: livekit dev fallback 1.5.2 -> 1.13.6 (the Nix-generated version in sovran-hub.nix already derives from pkgs.livekit.version). - server.py: docstring/comment examples reference 40000-40099. - CHANGELOG.md: record the calling changes under [Unreleased]. The tile/modal port tables themselves are data-driven from server.py's port_requirements / _PORTS_ELEMENT_CALLING (updated in the previous commit), so no further UI changes are needed.	2026-09-01 12:15:16 -05:00
Sovran_SystemsOS	81ab3b2280	element-calling: fix Wi-Fi calls and tighten media/TURN ports Root cause of 'calls fail on Wi-Fi but work on mobile data': LiveKit only advertised the public/WAN IP (rtc.node_ip), so LAN clients had to hairpin through the router for media. Fixes and cleanup: - rtc.advertise_internal_ip: true — also advertise the primary interface's LAN host candidate, so Wi-Fi callers connect directly (no hairpin). - Drop rtc.port_range_start/end (30000-40000) and keep the single UDP mux (udp_port: 7882). In LiveKit 1.13.x the range takes precedence over udp_port, so media was actually spread over 10000 ports. - Drop turn.tls_port: 5349 — LiveKit advertises turns:<domain>:443 to clients regardless of tls_port, so a 5349 TURN/TLS listener was unreachable dead config (and needless attack surface). - Pin TURN relay allocation to 40000-40099 (disjoint from the media mux) and open/forward that range; the old default overlapped RTC media. - turn.allow_restricted_peer_cidrs with the LAN subnet derived from the primary interface: without it the relay refuses to deliver to the private LAN host candidate and its final hop would fall back to WAN hairpin. - Update Hub port guidance (server.py) to the new list.	2026-09-01 12:15:16 -05:00
Sovran_SystemsOS	d5d40a1697	flake: pin LiveKit to 1.13.6 for rtc.advertise_internal_ip support rtc.advertise_internal_ip (which lets LAN callers reach the SFU via a LAN host candidate, avoiding NAT-hairpin on the router) is only honoured when node_ip is set manually from LiveKit v1.13.6 (mediatransportutil f234b53). nixpkgs-unstable currently ships 1.13.5, so pin 1.13.6 with the hashes from nixpkgs master. Remove this override once nixpkgs-unstable reaches >= 1.13.6.	2026-09-01 12:15:16 -05:00
naturallaw777	3756a0058d	updated sovran-bitcon	2026-08-31 20:37:46 -05:00
naturallaw777	be5d47cb9c	updated sovran-bitcon	2026-08-31 20:31:48 -05:00
naturallaw777	ddf87a1c1c	refactor(nwc): dedupe NWC tooling — use Sovran_Bitcoin's sovran-nwc The Hub vendored a second copy of the NWC stack (app/sovran_systemsos_web/nwc_hub_manager.py, nwc_audit.py, nwc_lnurl_service.py, nwc_wallet_cli.py) and built its own nwc-wallet / nwc-lnurl binaries from it. That copy drifted from the pinned Alby Hub API contract (appId vs toAppId) and duplicated code that Sovran_Bitcoin already ships and fixes. Changes: - Delete the four vendored modules; server.py now imports the canonical implementation directly (from sovran_nwc import nwc_hub_manager) from the sovran-nwc package (pkgs.sovran-bitcoin.nwc). API fixes in Sovran_Bitcoin now propagate to the Hub web app automatically. - sovran-hub-web launcher: add <sovran-nwc>/lib/sovran-nwc to sys.path so the import resolves. - Stop shipping nwc-wallet / nwc-lnurl binaries from sovran-hub-web: the flake already provides them (env-wrapped nwc-wallet with NWC_* vars via albyhub.nix, and nwc-lnurl.service via lnurl.nix). Requires a Sovran_Bitcoin rev containing the toAppId fix (and the LNURL module audit-log fix); bump the flake input afterwards: nix flake update sovran-bitcoin Test: - nixos-rebuild switch - Hub Wallet Connections tab still lists/creates wallets - nwc-wallet list works from the operator shell - journalctl -u nwc-lnurl shows no import/contract errors	2026-08-31 20:28:10 -05:00