From caba6067f04ef582166c9408664e49ee60289aad Mon Sep 17 00:00:00 2001 From: Baris Aydek Date: Fri, 28 Aug 2026 17:16:23 +0300 Subject: [PATCH 1/3] feat(catalog): add AppWeaver managed app --- catalog/appweaver.yaml | 15 +++++++++++++++ docs/managed-app-examples.md | 21 +++++++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 catalog/appweaver.yaml diff --git a/catalog/appweaver.yaml b/catalog/appweaver.yaml new file mode 100644 index 00000000..80eab93b --- /dev/null +++ b/catalog/appweaver.yaml @@ -0,0 +1,15 @@ +services: + appweaver: + image: ghcr.io/getappweaver/core:alpine + user: "1000" + resources: { cpu: 1, memory: 2Gi } + ports: + - { name: http, container: 5551, protocol: http, expose: ingress } + env: + BOT_SETUP_UI_ORIGIN: "https://${HOSTNAME}" + volumes: + - { name: workspace, path: /workspace/appweaver, size: 20Gi, label: files } + scratch: + - { path: /tmp, size: 256Mi } + backup: + volume: workspace diff --git a/docs/managed-app-examples.md b/docs/managed-app-examples.md index 33408de8..f1d39eed 100644 --- a/docs/managed-app-examples.md +++ b/docs/managed-app-examples.md @@ -646,6 +646,27 @@ where the image allows it. --- +## AppWeaver — AI-powered app hub + +- **Image:** `ghcr.io/getappweaver/core:alpine` — published from + . The Alpine runtime includes Bun, + OpenCode, ngit and Piper, but deliberately excludes Chromium, Playwright + browsers, Cursor Agent and VNC. +- **Repo:** — the entrypoint clones the + core repository into the persistent workspace on first boot, installs its + locked dependencies and starts the setup web UI on port `5551`. The workspace + volume retains configuration, credentials, installed apps and app data across + image upgrades. +- **Authentication:** API-key and device-code OpenCode providers work through + the setup web UI. A provider that requires a callback to the user's localhost + cannot be authenticated without a separate tunnel and should not be selected + for a managed deployment. + +**Document:** [`catalog/appweaver.yaml`](../catalog/appweaver.yaml) — +`scripts/app-catalog-test.sh catalog/appweaver.yaml` starts it locally. + +--- + ## Notes on other apps - **zap-stream-core** — needs raw TCP/UDP ingest (RTMP `1935/tcp`, SRT), i.e. From 59219841a55c6e2ee899325509f8869988797aca Mon Sep 17 00:00:00 2001 From: Baris Aydek Date: Sun, 30 Aug 2026 01:23:11 +0300 Subject: [PATCH 2/3] feat(catalog): secure AppWeaver setup with Nostr --- catalog/appweaver.yaml | 4 ++++ docs/managed-app-examples.md | 4 ++++ scripts/app-catalog-test.sh | 1 + 3 files changed, 9 insertions(+) diff --git a/catalog/appweaver.yaml b/catalog/appweaver.yaml index 80eab93b..528aa9ef 100644 --- a/catalog/appweaver.yaml +++ b/catalog/appweaver.yaml @@ -7,9 +7,13 @@ services: - { name: http, container: 5551, protocol: http, expose: ingress } env: BOT_SETUP_UI_ORIGIN: "https://${HOSTNAME}" + BOT_MASTER_PUBKEY: "${master_pubkey}" volumes: - { name: workspace, path: /workspace/appweaver, size: 20Gi, label: files } scratch: - { path: /tmp, size: 256Mi } backup: volume: workspace +config: + - { name: master_pubkey, label: "Master pubkey (64-character lowercase hex)", type: string, + required: true, pattern: "[0-9a-f]{64}" } diff --git a/docs/managed-app-examples.md b/docs/managed-app-examples.md index f1d39eed..c748a59d 100644 --- a/docs/managed-app-examples.md +++ b/docs/managed-app-examples.md @@ -661,6 +661,10 @@ where the image allows it. the setup web UI. A provider that requires a callback to the user's localhost cannot be authenticated without a separate tunnel and should not be selected for a managed deployment. +- **Setup access:** the order form requires the owner's 64-character lowercase + hex Nostr pubkey. AppWeaver receives it as `BOT_MASTER_PUBKEY`; `/setup` + requires a matching NIP-98 signature before issuing an in-memory setup + session, so the customer does not need access to container logs. **Document:** [`catalog/appweaver.yaml`](../catalog/appweaver.yaml) — `scripts/app-catalog-test.sh catalog/appweaver.yaml` starts it locally. diff --git a/scripts/app-catalog-test.sh b/scripts/app-catalog-test.sh index 12831e50..4e1b6df2 100755 --- a/scripts/app-catalog-test.sh +++ b/scripts/app-catalog-test.sh @@ -40,6 +40,7 @@ app_config() { # merely pattern-shaped string would crashloop the container. haven) echo "--config owner_npub=npub1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqshp52w2" ;; buzz) echo "--config owner_pubkey=0000000000000000000000000000000000000000000000000000000000000001" ;; + appweaver) echo "--config master_pubkey=79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798" ;; *) echo "" ;; esac } From 34f360159db901964330a75f57d5c3087778bb2a Mon Sep 17 00:00:00 2001 From: Baris Aydek Date: Tue, 15 Sep 2026 00:41:19 +0300 Subject: [PATCH 3/3] fix(catalog): pin AppWeaver image to reviewed artifact --- catalog/appweaver.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/catalog/appweaver.yaml b/catalog/appweaver.yaml index 528aa9ef..25014ada 100644 --- a/catalog/appweaver.yaml +++ b/catalog/appweaver.yaml @@ -1,6 +1,6 @@ services: appweaver: - image: ghcr.io/getappweaver/core:alpine + image: ghcr.io/getappweaver/core:alpine-3e4b413@sha256:de1d200aba4cfc908eb1466fe3a1fea750f07ee9c79edb793b6174212a36613a user: "1000" resources: { cpu: 1, memory: 2Gi } ports: