81 lines
4.2 KiB
Markdown
81 lines
4.2 KiB
Markdown
|
# UmbrelApps
|
||
|
|
|
||
|
|
A community app store for [Umbrel](https://umbrel.com), store id `whatsnext`. Add it in umbrelOS under
|
||
|
|
**App Store → Community App Stores**, using the clone URL of this repository.
|
||
|
|
|
||
|
|
## Apps
|
||
|
|
|
||
|
|
### Electrum Gate
|
||
|
|
|
||
|
|
Reach your own Electrum server from outside your network, over TLS. An Electrum server speaks plain TCP;
|
||
|
|
a wallet on the road wants TLS. This app puts a proxy in between, using the certificate a reverse proxy on
|
||
|
|
the same Umbrel already manages.
|
||
|
|
|
||
|
|
Two containers, both on an off-the-shelf image, both configured from a `*.template`.
|
||
|
|
|
||
|
|
| Container | What it does |
|
||
|
|
|-|-|
|
||
|
|
| `server` (`nginx:alpine`) | terminates TLS on 50022 and forwards plain to the Electrum server; serves the dashboard on port 80 behind the umbrelOS app proxy |
|
||
|
|
| `agent` (`python:3-alpine`) | writes `status.json` every minute, reads the certificates from the mounted folders, queries the Electrum server, and accepts the certificate choice |
|
||
|
|
|
||
|
|
The agent cannot reload nginx itself, as that would need the Docker socket and it is deliberately absent.
|
||
|
|
It writes `cert.conf` with the chosen paths and drops a flag file; the nginx container reloads itself. A
|
||
|
|
reload keeps existing wallet connections alive.
|
||
|
|
|
||
|
|
| Port | For |
|
||
|
|
|-|-|
|
||
|
|
| 50022 | TLS for Electrum wallets. **Not** the conventional 50002: Fulcrum occupies that on the host, and with Fulcrum as the backend the container would not start |
|
||
|
|
| 3850 | the web UI, through the umbrelOS app proxy |
|
||
|
|
|
||
|
|
Electrs, Fulcrum and ElectrumX all work, switchable in the umbrelOS settings: the app declares the
|
||
|
|
dependency and uses the address it is handed. Details, with sources, in
|
||
|
|
[Docs/Referenties/Umbrel-appstore-spec.md](Docs/Referenties/Umbrel-appstore-spec.md) §4.
|
||
|
|
|
||
|
|
**Tor or TLS.** The privacy win is in running your own server, and you have that the moment you do. Tor
|
||
|
|
remains the better choice for privacy; TLS wins on speed, on mobile, and on networks that block Tor. The
|
||
|
|
trade-off is written out in [Docs/Referenties/Clients.md](Docs/Referenties/Clients.md) §1.
|
||
|
|
|
||
|
|
### Evolu Relay
|
||
|
|
|
||
|
|
> **Not packaged yet.** Plans only, no manifest and no compose.
|
||
|
|
|
||
|
|
Trezor Suite syncs labels and account names between devices, and by default that runs through a server
|
||
|
|
operated by Trezor. That server is open source and called Evolu Relay. The plan is to package it here so
|
||
|
|
the sync runs through your own machine. Trezor states the data is end to end encrypted client-side, so
|
||
|
|
self-hosting does not change that guarantee, it only takes Trezor out of the picture.
|
||
|
|
|
||
|
|
Two questions decide the shape of the package, and both are open: whether Trezor Suite can point at a
|
||
|
|
custom sync server at all, and whether the quota manager (part of Trezor's own paid hosting) is required.
|
||
|
|
See [Docs/Referenties/Upstream-evolu-relay.md](Docs/Referenties/Upstream-evolu-relay.md).
|
||
|
|
|
||
|
|
## Documentatie
|
||
|
|
|
||
|
|
Alles staat in **[Docs/](Docs/README.md)**. Begin bij
|
||
|
|
**[Docs/CONTINUE_HERE.md](Docs/CONTINUE_HERE.md)**; dat is de index die naar de volgende stap wijst.
|
||
|
|
|
||
|
|
| Waar je heen wilt | Waar het staat |
|
||
|
|
|-|-|
|
||
|
|
| Wat er nu speelt en wat de volgende stap is | [Docs/CONTINUE_HERE.md](Docs/CONTINUE_HERE.md) |
|
||
|
|
| Wat umbrelOS van een app store verwacht | [Docs/Referenties/Umbrel-appstore-spec.md](Docs/Referenties/Umbrel-appstore-spec.md) |
|
||
|
|
| Hoe Electrum Gate vandaag in elkaar zit | [Docs/Referenties/Architectuur-huidig.md](Docs/Referenties/Architectuur-huidig.md) |
|
||
|
|
| Welke wallets hierheen kunnen wijzen, en wanneer Tor beter is | [Docs/Referenties/Clients.md](Docs/Referenties/Clients.md) |
|
||
|
|
| Wat er over de sync-server van Trezor bekend is | [Docs/Referenties/Upstream-evolu-relay.md](Docs/Referenties/Upstream-evolu-relay.md) |
|
||
|
|
| Versiegeschiedenis van Electrum Gate | [Docs/CHANGELOG-electrum-gate.md](Docs/CHANGELOG-electrum-gate.md) |
|
||
|
|
| Waar documentatie hoort | [Docs/README.md](Docs/README.md) |
|
||
|
|
|
||
|
|
## Tests
|
||
|
|
|
||
|
|
```
|
||
|
|
python tests/test_agent_certificates.py
|
||
|
|
```
|
||
|
|
|
||
|
|
Losse scripts, geen afhankelijkheden. Let op de regels met `OVERGESLAGEN`: die toetsen hebben de
|
||
|
|
certificaatwinkel van het besturingssysteem of netwerk nodig, en zijn dan niet bewezen. Ze dekken Electrum
|
||
|
|
Gate; voor Evolu Relay is er nog geen bron.
|
||
|
|
|
||
|
|
## Licentie
|
||
|
|
|
||
|
|
De apps zijn dunne lagen om bestaande onderdelen: nginx en Alpine Linux (BSD/MIT) voor Electrum Gate, en
|
||
|
|
straks de relay van Trezor, die zijn eigen licentie houdt. Voor de verpakking zelf is nog geen licentie
|
||
|
|
gekozen.
|