@le-space/rootfs 0.6.35 → 0.6.37

package/index.d.ts

@@ -115,6 +115,8 @@ interface RootfsManifest {
     version: string;
     rootfsInstallStrategy: string;
     requiresBootstrapNetwork: boolean;
+    /** Guest fetches its bootstrap config from the Aleph aggregate itself. */
+    supportsBootstrapConfigAggregate?: boolean;
     bootstrapSummary: string;
     rootfsSourceSizeBytes?: number;
     requiredPortForwards: RootfsContract["ports"];

package/index.js

@@ -351,6 +351,9 @@ function createRootfsManifest(plan, contract, options = {}) {
   if (contract.rootfs.profile === "playwright-runner") {
     manifest.playwrightVersion = "1.61.1";
   }
+  if (contract.rootfs.profile === "uc-go-peer" || contract.rootfs.profile === "orbitdb-relay") {
+    manifest.supportsBootstrapConfigAggregate = true;
+  }
   if (typeof options.rootfsSourceSizeBytes === "number" && Number.isFinite(options.rootfsSourceSizeBytes) && options.rootfsSourceSizeBytes > 0) {
     manifest.rootfsSourceSizeBytes = options.rootfsSourceSizeBytes;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.35",
+  "version": "0.6.37",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/orbitdb-relay/rootfs/orbitdb-relay-autotls-refresh.py

@@ -129,6 +129,13 @@ def build_secure_addrs(env_values: dict[str, str], zone: str) -> list[str]:
     if not ws_port:
         raise RuntimeError("missing EXTERNAL_RELAY_WS_PORT in environment file")
 
+    # IPv4 is NAT/port-mapped, so it is advertised on the externally assigned
+    # host port. IPv6 is globally routed with no NAT on the Aleph VM — reachable
+    # directly on the internal listen port, while the mapped host port is closed
+    # over IPv6. Advertise the IPv6 libp2p.direct AutoTLS addresses on the
+    # internal WS port so AutoNAT/AutoTLS dial-backs actually reach the relay.
+    ws_port_ipv6 = env_values.get("RELAY_WS_PORT", "").strip() or ws_port
+
     addrs: list[str] = []
 
     public_ipv4 = env_values.get("PUBLIC_IPV4", "").strip()
@@ -140,8 +147,8 @@ def build_secure_addrs(env_values: dict[str, str], zone: str) -> list[str]:
     public_ipv6 = env_values.get("PUBLIC_IPV6", "").strip()
     if public_ipv6:
         host6 = ipv6_domain(public_ipv6, zone)
-        addrs.append(f"/ip6/{public_ipv6}/tcp/{ws_port}/tls/sni/{host6}/ws")
-        addrs.append(f"/dns6/{host6}/tcp/{ws_port}/tls/ws")
+        addrs.append(f"/ip6/{public_ipv6}/tcp/{ws_port_ipv6}/tls/sni/{host6}/ws")
+        addrs.append(f"/dns6/{host6}/tcp/{ws_port_ipv6}/tls/ws")
 
     if not addrs:
         raise RuntimeError("missing PUBLIC_IPV4/PUBLIC_IPV6 in environment file")

package/reference/orbitdb-relay/rootfs/orbitdb-relay-bootstrap.sh

@@ -117,6 +117,25 @@ write_env_var "RELAY_WS_PORT" "9092"
 write_env_var "RELAY_WEBRTC_PORT" "9093"
 write_env_var "RELAY_QUIC_PORT" "9094"
 write_env_var "RELAY_DISABLE_WEBRTC" "1"
-write_env_var "RELAY_DISABLE_BOOTSTRAP" "1"
+# Bootstrap MUST stay enabled. The relay needs public IPFS/DHT peers so libp2p
+# AutoNAT can confirm a public address — the precondition for AutoTLS to fetch
+# the `*.libp2p.direct` certificate. With bootstrap disabled the relay comes up
+# isolated (0 peers, empty DHT routing table), AutoNAT never confirms, and
+# AutoTLS silently stops serving certs ("no public addresses"), so browsers can
+# only reach it through the Caddy `2n6.me` proxy. RELAY_DISABLE_BOOTSTRAP=1 is
+# for tests / deliberately isolated deployments only.
+write_env_var "RELAY_DISABLE_BOOTSTRAP" "0"
+# The kad-DHT must stay OFF on these 2 GB Aleph VMs. With it enabled the relay
+# announces itself into the public DHT and is then flooded with inbound
+# WebSocket connections: sockets pile up in CLOSE-WAIT (hundreds within
+# minutes), the single-threaded Node event loop saturates, and the process
+# hangs — /health, metrics and every libp2p transport stop responding while the
+# VM, Caddy and the TCP listeners still look healthy. `connectionManager
+# .maxConnections` does not prevent this: it bounds established connections,
+# not the inbound churn. Bootstrap above stays enabled, which gives AutoNAT the
+# handful of public peers it needs to confirm an address so AutoTLS can still
+# fetch its `*.libp2p.direct` certificate. Set RELAY_DISABLE_DHT=0 only on a
+# host that can absorb full DHT server load.
+write_env_var "RELAY_DISABLE_DHT" "1"
 write_env_var "ENABLE_GENERAL_LOGS" "1"
 write_env_var "DEBUG" "'libp2p:websockets:listener'"

package/reference/orbitdb-relay/rootfs/orbitdb-relay-configure.sh

@@ -13,6 +13,17 @@ CADDYFILE="${CADDYFILE:-/etc/caddy/Caddyfile}"
 CADDY_UPSTREAM_WSS_PORT="${CADDY_UPSTREAM_WSS_PORT:-9092}"
 CADDY_UPSTREAM_HOST="${CADDY_UPSTREAM_HOST:-127.0.0.1}"
 CADDY_UPSTREAM_METRICS_PORT="${CADDY_UPSTREAM_METRICS_PORT:-9090}"
+# Internal libp2p listen ports. On the Aleph VM, IPv4 is NAT/port-mapped (so it
+# is announced on the externally assigned host ports), but IPv6 is globally
+# routed with NO NAT — the VM is reachable directly on the real listen ports,
+# and the mapped host ports are closed over IPv6. IPv6 must therefore be
+# announced on these internal ports, otherwise AutoNAT/AutoTLS dial-backs to the
+# IPv6 address hit a closed mapped port, the address is never confirmed, and
+# `*.libp2p.direct` AutoTLS never provisions a certificate over IPv6.
+RELAY_TCP_LISTEN_PORT="${RELAY_TCP_LISTEN_PORT:-9091}"
+RELAY_WS_LISTEN_PORT="${RELAY_WS_LISTEN_PORT:-${CADDY_UPSTREAM_WSS_PORT}}"
+RELAY_WEBRTC_LISTEN_PORT="${RELAY_WEBRTC_LISTEN_PORT:-9093}"
+RELAY_QUIC_LISTEN_PORT="${RELAY_QUIC_LISTEN_PORT:-9094}"
 AUTOTLS_REFRESH_SERVICE="${AUTOTLS_REFRESH_SERVICE:-orbitdb-relay-autotls-refresh.service}"
 BOOTSTRAP_REFRESH_TIMER="${BOOTSTRAP_REFRESH_TIMER:-orbitdb-relay-bootstrap-refresh.timer}"
 BOOTSTRAP_REFRESH_SERVICE="${BOOTSTRAP_REFRESH_SERVICE:-orbitdb-relay-bootstrap-refresh.service}"
@@ -29,6 +40,7 @@ QUIC_PORT=""
 BOOTSTRAP_PUBLISHER_PRIVATE_KEY=""
 BOOTSTRAP_PUBLISHER_LIBP2P_IDENTITY_HEX=""
 BOOTSTRAP_OWNER_PRIVATE_KEY=""
+BOOTSTRAP_OWNER_ADDRESS=""
 BOOTSTRAP_OWNER_AUTHORIZATION_B64=""
 BOOTSTRAP_REGISTRATION_ID=""
 START_SERVICE=1
@@ -49,6 +61,7 @@ Usage:
     [--bootstrap-publisher-private-key <hex>] \
     [--bootstrap-publisher-libp2p-identity-hex <hex>] \
     [--bootstrap-owner-private-key <hex>] \
+    [--bootstrap-owner-address <0x…>] \
     [--bootstrap-owner-authorization-b64 <base64>] \
     [--bootstrap-registration-id <id>] \
     [--no-start]
@@ -58,6 +71,33 @@ marks the relay as ready, and optionally starts the relay plus Caddy services.
 EOF
 }
 
+current_bootstrap_publisher_private_key() {
+  local existing
+  existing="$(grep -E '^[#[:space:]]*ALEPH_BOOTSTRAP_PUBLISHER_PRIVATE_KEY=' "${ENV_FILE}" 2>/dev/null | tail -n1 | cut -d= -f2- || true)"
+  if [ -n "${existing}" ]; then
+    printf '%s\n' "${existing}"
+    return
+  fi
+  printf '\n'
+}
+
+# The bootstrap publisher key signs this relay's own Aleph registrations, so
+# it never has to leave the guest. Generating it here means the deployer does
+# not have to send a secret to the plain-HTTP setup endpoint, which runs
+# before Caddy/TLS exists and would otherwise put the key on the wire in the
+# clear. An already-provisioned key is reused so the relay keeps its identity
+# across reconfigurations.
+generate_bootstrap_publisher_private_key() {
+  while true; do
+    local candidate
+    candidate="$(openssl rand -hex 32)"
+    if [ -n "${candidate}" ] && [ "${candidate}" != "0000000000000000000000000000000000000000000000000000000000000000" ]; then
+      printf '0x%s\n' "${candidate}"
+      return
+    fi
+  done
+}
+
 write_env_var() {
   local key="$1"
   local value="$2"
@@ -165,6 +205,10 @@ while [ "$#" -gt 0 ]; do
       BOOTSTRAP_OWNER_PRIVATE_KEY="${2:-}"
       shift 2
       ;;
+    --bootstrap-owner-address)
+      BOOTSTRAP_OWNER_ADDRESS="${2:-}"
+      shift 2
+      ;;
     --bootstrap-owner-authorization-b64)
       BOOTSTRAP_OWNER_AUTHORIZATION_B64="${2:-}"
       shift 2
@@ -203,7 +247,7 @@ announce=(
 
 if [ -n "${PUBLIC_IPV6}" ]; then
   announce+=(
-    "/ip6/${PUBLIC_IPV6}/tcp/${TCP_PORT}"
+    "/ip6/${PUBLIC_IPV6}/tcp/${RELAY_TCP_LISTEN_PORT}"
   )
 fi
 
@@ -214,20 +258,20 @@ fi
 
 announce+=("/ip4/${PUBLIC_IPV4}/tcp/${WS_PORT}/ws")
 if [ -n "${PUBLIC_IPV6}" ]; then
-  announce+=("/ip6/${PUBLIC_IPV6}/tcp/${WS_PORT}/ws")
+  announce+=("/ip6/${PUBLIC_IPV6}/tcp/${RELAY_WS_LISTEN_PORT}/ws")
 fi
 
 if [ -n "${WEBRTC_PORT}" ]; then
   announce+=("/ip4/${PUBLIC_IPV4}/udp/${WEBRTC_PORT}/webrtc-direct")
   if [ -n "${PUBLIC_IPV6}" ]; then
-    announce+=("/ip6/${PUBLIC_IPV6}/udp/${WEBRTC_PORT}/webrtc-direct")
+    announce+=("/ip6/${PUBLIC_IPV6}/udp/${RELAY_WEBRTC_LISTEN_PORT}/webrtc-direct")
   fi
 fi
 
 if [ -n "${QUIC_PORT}" ]; then
   announce+=("/ip4/${PUBLIC_IPV4}/udp/${QUIC_PORT}/quic-v1")
   if [ -n "${PUBLIC_IPV6}" ]; then
-    announce+=("/ip6/${PUBLIC_IPV6}/udp/${QUIC_PORT}/quic-v1")
+    announce+=("/ip6/${PUBLIC_IPV6}/udp/${RELAY_QUIC_LISTEN_PORT}/quic-v1")
   fi
 fi
 
@@ -256,6 +300,12 @@ fi
 if [ -n "${QUIC_PORT}" ]; then
   write_env_var "EXTERNAL_RELAY_QUIC_PORT" "${QUIC_PORT}"
 fi
+if [ -z "${BOOTSTRAP_PUBLISHER_PRIVATE_KEY}" ]; then
+  BOOTSTRAP_PUBLISHER_PRIVATE_KEY="$(current_bootstrap_publisher_private_key)"
+fi
+if [ -z "${BOOTSTRAP_PUBLISHER_PRIVATE_KEY}" ]; then
+  BOOTSTRAP_PUBLISHER_PRIVATE_KEY="$(generate_bootstrap_publisher_private_key)"
+fi
 if [ -n "${BOOTSTRAP_PUBLISHER_PRIVATE_KEY}" ]; then
   write_env_var "ALEPH_BOOTSTRAP_PUBLISHER_PRIVATE_KEY" "${BOOTSTRAP_PUBLISHER_PRIVATE_KEY}"
 fi
@@ -265,6 +315,9 @@ fi
 if [ -n "${BOOTSTRAP_OWNER_PRIVATE_KEY}" ]; then
   write_env_var "ALEPH_BOOTSTRAP_OWNER_PRIVATE_KEY" "${BOOTSTRAP_OWNER_PRIVATE_KEY}"
 fi
+if [ -n "${BOOTSTRAP_OWNER_ADDRESS}" ]; then
+  write_env_var "ALEPH_BOOTSTRAP_OWNER_ADDRESS" "${BOOTSTRAP_OWNER_ADDRESS}"
+fi
 if [ -n "${BOOTSTRAP_OWNER_AUTHORIZATION_B64}" ]; then
   write_env_var "ALEPH_BOOTSTRAP_OWNER_AUTHORIZATION_B64" "${BOOTSTRAP_OWNER_AUTHORIZATION_B64}"
 fi

package/reference/orbitdb-relay/rootfs/orbitdb-relay-describe.py

@@ -51,6 +51,29 @@ def normalize_multiaddrs(payload: dict) -> list[str]:
     return [entry for entry in values if isinstance(entry, str) and entry.strip()]
 
 
+def bootstrap_publisher_address(env_values: dict[str, str]) -> str | None:
+    """Address of the key this relay signs its own Aleph registrations with.
+
+    The guest generates that key itself, so the deployer cannot know the
+    address up front. Reporting it here lets the deployer bind an owner
+    authorization to the relay's real publisher identity instead of having to
+    send the key to the guest over the plain-HTTP setup endpoint.
+    """
+    private_key = env_values.get("ALEPH_BOOTSTRAP_PUBLISHER_PRIVATE_KEY", "").strip()
+    if not private_key:
+        return None
+
+    try:
+        from eth_account import Account
+    except ImportError:
+        return None
+
+    try:
+        return Account.from_key(private_key).address
+    except (ValueError, TypeError):
+        return None
+
+
 def build_grouped_multiaddrs(env_values: dict[str, str], all_multiaddrs: list[str], peer_id: str) -> dict[str, list[str]]:
     proxy_hostname = env_values.get("PROXY_HOSTNAME", "").strip().lower()
     direct_tcp_multiaddrs = [addr for addr in all_multiaddrs if "/tcp/" in addr and "/ws" not in addr]
@@ -148,6 +171,7 @@ def main() -> None:
     env_values = parse_env_file(ENV_FILE)
     payload = {
         "peer_id": peer_id,
+        "bootstrap_publisher_address": bootstrap_publisher_address(env_values),
         "announce_addrs": [
             entry.strip()
             for entry in env_values.get("VITE_APPEND_ANNOUNCE", "").split(",")

package/reference/orbitdb-relay/rootfs/orbitdb-relay-setup-server.py

@@ -1,4 +1,6 @@
 #!/usr/bin/env python3
+import base64
+import hashlib
 import ipaddress
 import json
 import os
@@ -6,7 +8,9 @@ import subprocess
 import threading
 import time
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from urllib.parse import urlsplit
+from urllib.error import HTTPError, URLError
+from urllib.parse import urlencode, urlsplit
+from urllib.request import Request, urlopen
 
 
 ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/orbitdb-relay")
@@ -18,6 +22,26 @@ DESCRIBE_SCRIPT = "/usr/local/sbin/orbitdb-relay-describe.py"
 METADATA_FILE = os.environ.get("METADATA_FILE", "/run/orbitdb-relay-setup-metadata.json")
 METADATA_ERROR_FILE = os.environ.get("METADATA_ERROR_FILE", "/run/orbitdb-relay-setup-metadata.error")
 
+# Guest-side bootstrap config handoff.
+#
+# A browser served over HTTPS cannot POST to this server: it listens on plain
+# HTTP (it has to exist before Caddy/TLS does), so the request is blocked as
+# mixed content. Instead the deployer publishes the configuration into a
+# public Aleph aggregate and puts a locator into the VM's SSH key; the guest
+# reads that locator, fetches its own configuration over HTTPS, applies it,
+# and publishes a signed acknowledgement the deployer waits for.
+AUTHORIZED_KEYS_FILE = os.environ.get("AUTHORIZED_KEYS_FILE", "/root/.ssh/authorized_keys")
+ALEPH_API_HOST = os.environ.get("ALEPH_API_HOST", "https://api.aleph.im")
+BOOTSTRAP_CONFIG_KEY = os.environ.get("BOOTSTRAP_CONFIG_KEY", "vm-bootstrap-config")
+BOOTSTRAP_CONFIG_POLL_SECONDS = float(os.environ.get("BOOTSTRAP_CONFIG_POLL_SECONDS", "5"))
+BOOTSTRAP_CONFIG_SIGNAL_REF = os.environ.get("BOOTSTRAP_CONFIG_SIGNAL_REF", "vm-bootstrap-config")
+BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE = os.environ.get(
+    "BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE", "vm-bootstrap-config-signal"
+)
+BOOTSTRAP_CHANNEL = os.environ.get("ALEPH_BOOTSTRAP_CHANNEL", "simple-todo")
+
+CONFIGURE_LOCK = threading.Lock()
+
 
 def _cors_headers(handler: BaseHTTPRequestHandler) -> None:
     handler.send_header("Access-Control-Allow-Origin", "*")
@@ -49,6 +73,323 @@ def _validate_proxy_hostname(value: object) -> str | None:
     return parsed.hostname
 
 
+def _json_dumps(payload: object) -> str:
+    return json.dumps(payload, separators=(",", ":"))
+
+
+def _parse_env_file(path: str) -> dict[str, str]:
+    values: dict[str, str] = {}
+    if not os.path.exists(path):
+        return values
+
+    with open(path, encoding="utf-8") as handle:
+        for line in handle:
+            stripped = line.strip()
+            if not stripped or stripped.startswith("#") or "=" not in stripped:
+                continue
+            key, value = stripped.split("=", 1)
+            values[key.strip()] = value.strip()
+    return values
+
+
+def _extract_guest_bootstrap_locator() -> tuple[str | None, str | None]:
+    """Read the deployment locator the deployer left in our SSH key.
+
+    The Aleph INSTANCE message carries an SSH public key with an extra
+    `aleph-bootstrap-config:<owner>:<token>` part, so it lands in the guest's
+    authorized_keys and gives us everything needed to find our own record.
+    """
+    try:
+        with open(AUTHORIZED_KEYS_FILE, encoding="utf-8") as handle:
+            for raw_line in handle:
+                line = raw_line.strip()
+                if not line or line.startswith("#"):
+                    continue
+                for part in line.split():
+                    if part.startswith("aleph-bootstrap-config:"):
+                        _, owner_address, deployment_token = part.split(":", 2)
+                        owner_address = owner_address.strip()
+                        deployment_token = deployment_token.strip()
+                        if owner_address and deployment_token:
+                            return owner_address, deployment_token
+    except (FileNotFoundError, ValueError):
+        return None, None
+
+    return None, None
+
+
+def _address_from_private_key(private_key: str) -> str:
+    from eth_account import Account
+
+    return Account.from_key(private_key).address
+
+
+def _sign_personal_message(private_key: str, payload: str) -> str:
+    from eth_account import Account
+    from eth_account.messages import encode_defunct
+
+    signed = Account.sign_message(encode_defunct(text=payload), private_key=private_key)
+    signature = signed.signature.hex()
+    return signature if signature.startswith("0x") else f"0x{signature}"
+
+
+def _signature_payload(chain: str, sender: str, message_type: str, item_hash: str) -> str:
+    return "\n".join([chain, sender, message_type, item_hash])
+
+
+def _broadcast_aleph_message(api_host: str, message: dict[str, object]) -> None:
+    body = json.dumps({"message": message, "sync": True}).encode("utf-8")
+    request = Request(
+        f"{api_host.rstrip('/')}/api/v0/messages",
+        data=body,
+        headers={"content-type": "application/json"},
+        method="POST",
+    )
+    with urlopen(request, timeout=30) as response:
+        response.read()
+
+
+def _fresh_metadata_payload() -> tuple[dict | None, str | None]:
+    if os.path.exists(METADATA_FILE):
+        try:
+            with open(METADATA_FILE, encoding="utf-8") as handle:
+                return json.load(handle), None
+        except (OSError, json.JSONDecodeError) as error:
+            return None, str(error)
+    if os.path.exists(METADATA_ERROR_FILE):
+        with open(METADATA_ERROR_FILE, encoding="utf-8") as handle:
+            return None, handle.read().strip() or "metadata generation failed"
+    return None, None
+
+
+def _build_configure_args_from_record(record: dict) -> list[str]:
+    """Map an Aleph bootstrap config record onto configure.sh arguments.
+
+    Deliberately mirrors the /configure payload mapping, minus every secret:
+    the record lives in a *public* aggregate, so it may only carry network
+    facts, the registration id, the owner address and a signed authorization.
+    """
+    runtime = record.get("runtime") if isinstance(record.get("runtime"), dict) else {}
+    bootstrap = record.get("bootstrap") if isinstance(record.get("bootstrap"), dict) else {}
+
+    public_ipv4 = str(runtime.get("publicIpv4") or "").strip()
+    if not public_ipv4:
+        raise ValueError("bootstrap config is missing runtime.publicIpv4")
+
+    mapped = runtime.get("mappedPorts") if isinstance(runtime.get("mappedPorts"), dict) else {}
+
+    def host_port(*container_ports: str) -> int | None:
+        for container_port in container_ports:
+            entry = mapped.get(container_port)
+            if isinstance(entry, dict):
+                host = entry.get("host")
+                if isinstance(host, int) and host > 0:
+                    return host
+        return None
+
+    tcp_port = host_port("9091")
+    ws_port = host_port("9092", "443")
+    if not tcp_port or not ws_port:
+        raise ValueError("bootstrap config is missing the mapped TCP/WS ports")
+
+    args = [
+        CONFIGURE_SCRIPT,
+        "--public-ipv4",
+        public_ipv4,
+        "--tcp-port",
+        str(tcp_port),
+        "--ws-port",
+        str(ws_port),
+    ]
+
+    public_ipv6 = str(runtime.get("publicIpv6") or "").strip()
+    if public_ipv6:
+        args.extend(["--public-ipv6", public_ipv6])
+
+    proxy_hostname = _validate_proxy_hostname(runtime.get("proxyUrl"))
+    if proxy_hostname:
+        args.extend(["--proxy-hostname", proxy_hostname])
+
+    for flag, container_ports in (
+        ("--metrics-port", ("9090",)),
+        ("--metrics-https-port", ("443",)),
+        ("--webrtc-port", ("9093",)),
+        ("--quic-port", ("9094",)),
+    ):
+        value = host_port(*container_ports)
+        if value:
+            args.extend([flag, str(value)])
+
+    registration_id = str(bootstrap.get("registrationId") or "").strip()
+    if registration_id:
+        args.extend(["--bootstrap-registration-id", registration_id])
+
+    owner_address = str(record.get("ownerAddress") or "").strip()
+    if owner_address:
+        args.extend(["--bootstrap-owner-address", owner_address])
+
+    owner_authorization = str(bootstrap.get("ownerAuthorizationBase64") or "").strip()
+    if owner_authorization:
+        args.extend(["--bootstrap-owner-authorization-b64", owner_authorization])
+
+    return args
+
+
+def _run_configure_process(args: list[str], bootstrap_record: dict | None = None) -> tuple[bool, str]:
+    with CONFIGURE_LOCK:
+        if os.path.exists(READY_FILE):
+            return True, "ready"
+        try:
+            result = subprocess.run(args, check=True, capture_output=True, text=True)
+        except subprocess.CalledProcessError as error:
+            return False, error.stderr.strip() or error.stdout.strip() or str(error)
+
+        _clear_metadata_state()
+        _generate_metadata_files()
+
+        if isinstance(bootstrap_record, dict):
+            try:
+                _publish_vm_bootstrap_config_signal(bootstrap_record)
+            except Exception as error:  # pragma: no cover - runtime error path
+                return False, f"configured relay but failed to publish bootstrap signal: {error}"
+        return True, result.stdout.strip()
+
+
+def _publish_vm_bootstrap_config_signal(record: dict) -> None:
+    """Tell the deployer we applied the config; it blocks until this appears."""
+    env_values = _parse_env_file(ENV_FILE)
+    publisher_private_key = env_values.get("ALEPH_BOOTSTRAP_PUBLISHER_PRIVATE_KEY", "").strip()
+    if not publisher_private_key:
+        raise RuntimeError("missing ALEPH_BOOTSTRAP_PUBLISHER_PRIVATE_KEY")
+
+    owner_authorization = None
+    owner_authorization_b64 = env_values.get("ALEPH_BOOTSTRAP_OWNER_AUTHORIZATION_B64", "").strip()
+    if owner_authorization_b64:
+        try:
+            parsed = json.loads(base64.b64decode(owner_authorization_b64).decode("utf-8"))
+            if isinstance(parsed, dict):
+                owner_authorization = parsed
+        except (ValueError, json.JSONDecodeError):
+            owner_authorization = None
+
+    owner_address = str(record.get("ownerAddress") or "").strip()
+    deployment_token = str(record.get("deploymentToken") or "").strip()
+    profile = str(record.get("profile") or "").strip()
+    instance_item_hash = str(record.get("instanceItemHash") or "").strip()
+    if not deployment_token or not profile or not instance_item_hash:
+        raise RuntimeError("bootstrap config signal is missing deployment metadata")
+
+    metadata, metadata_error = _fresh_metadata_payload()
+    if not metadata:
+        raise RuntimeError(
+            f"bootstrap config signal metadata is not ready: {metadata_error or 'unavailable'}"
+        )
+
+    peer_id = metadata.get("peer_id")
+    probe_multiaddrs = metadata.get("probe_multiaddrs")
+    browser_bootstrap_multiaddrs = metadata.get("browser_bootstrap_multiaddrs")
+    if not isinstance(peer_id, str) or not peer_id.strip():
+        raise RuntimeError("bootstrap config signal is missing peer_id")
+    if not isinstance(probe_multiaddrs, list) or not any(
+        isinstance(entry, str) and entry.strip() for entry in probe_multiaddrs
+    ):
+        raise RuntimeError("bootstrap config signal is missing probe_multiaddrs")
+    if not isinstance(browser_bootstrap_multiaddrs, list):
+        browser_bootstrap_multiaddrs = []
+
+    publisher_address = _address_from_private_key(publisher_private_key)
+    now_ms = int(time.time() * 1000)
+    content = {
+        "type": BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE,
+        "address": publisher_address,
+        "ref": BOOTSTRAP_CONFIG_SIGNAL_REF,
+        "content": {
+            "deploymentToken": deployment_token,
+            "status": "applied",
+            "profile": profile,
+            "ownerAddress": owner_address,
+            "instanceItemHash": instance_item_hash,
+            "updatedAt": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(now_ms / 1000)),
+            "publisherAddress": publisher_address,
+            "authorization": owner_authorization,
+            "peerId": peer_id.strip(),
+            "probeMultiaddrs": [
+                entry.strip()
+                for entry in probe_multiaddrs
+                if isinstance(entry, str) and entry.strip()
+            ],
+            "browserBootstrapMultiaddrs": [
+                entry.strip()
+                for entry in browser_bootstrap_multiaddrs
+                if isinstance(entry, str) and entry.strip()
+            ],
+        },
+        "time": now_ms,
+    }
+    item_content = _json_dumps(content)
+    message = {
+        "channel": BOOTSTRAP_CHANNEL,
+        "sender": publisher_address,
+        "chain": "ETH",
+        "type": "POST",
+        "time": now_ms / 1000,
+        "item_type": "inline",
+        "item_content": item_content,
+        "item_hash": hashlib.sha256(item_content.encode("utf-8")).hexdigest(),
+    }
+    message["signature"] = _sign_personal_message(
+        publisher_private_key,
+        _signature_payload(
+            str(message["chain"]),
+            str(message["sender"]),
+            str(message["type"]),
+            str(message["item_hash"]),
+        ),
+    )
+    _broadcast_aleph_message(ALEPH_API_HOST, message)
+
+
+def _load_vm_bootstrap_record() -> tuple[str | None, str | None, dict | None]:
+    owner_address, deployment_token = _extract_guest_bootstrap_locator()
+    if not owner_address or not deployment_token:
+        return owner_address, deployment_token, None
+
+    request_url = (
+        f"{ALEPH_API_HOST.rstrip('/')}/api/v0/aggregates/{owner_address}.json?"
+        f"{urlencode({'keys': BOOTSTRAP_CONFIG_KEY})}"
+    )
+
+    try:
+        with urlopen(request_url, timeout=10) as response:
+            payload = json.loads(response.read().decode("utf-8") or "{}")
+    except (HTTPError, URLError, json.JSONDecodeError, TimeoutError):
+        return owner_address, deployment_token, None
+
+    aggregate = payload.get("data", {}).get(BOOTSTRAP_CONFIG_KEY, {})
+    if not isinstance(aggregate, dict):
+        return owner_address, deployment_token, None
+
+    record = aggregate.get(deployment_token)
+    return owner_address, deployment_token, record if isinstance(record, dict) else None
+
+
+def _poll_bootstrap_config_loop() -> None:
+    while not os.path.exists(READY_FILE):
+        _, deployment_token, record = _load_vm_bootstrap_record()
+        if deployment_token and isinstance(record, dict):
+            status = str(record.get("status") or "").strip().lower()
+            if status == "pending":
+                try:
+                    args = _build_configure_args_from_record(record)
+                except ValueError:
+                    time.sleep(BOOTSTRAP_CONFIG_POLL_SECONDS)
+                    continue
+                ok, _ = _run_configure_process(args, record)
+                if ok:
+                    return
+        time.sleep(BOOTSTRAP_CONFIG_POLL_SECONDS)
+
+
 class Handler(BaseHTTPRequestHandler):
     server_version = "OrbitdbRelaySetup/1.0"
 
@@ -143,7 +484,11 @@ class Handler(BaseHTTPRequestHandler):
             bootstrap_publisher_libp2p_identity_hex = payload.get(
                 "bootstrap_publisher_libp2p_identity_hex"
             )
-            bootstrap_owner_private_key = payload.get("bootstrap_owner_private_key")
+            # NOTE: `bootstrap_owner_private_key` is deliberately NOT accepted
+            # here. This endpoint is plain HTTP (it runs before Caddy/TLS
+            # exists), so anything sent to it crosses the network in the
+            # clear. The owner only ever needs to hand the guest a *signed
+            # authorization*, never the key itself.
             bootstrap_owner_authorization_b64 = payload.get("bootstrap_owner_authorization_b64")
             bootstrap_registration_id = payload.get("bootstrap_registration_id")
             no_start = bool(payload.get("no_start"))
@@ -182,8 +527,6 @@ class Handler(BaseHTTPRequestHandler):
                         str(bootstrap_publisher_libp2p_identity_hex),
                     ]
                 )
-            if bootstrap_owner_private_key is not None:
-                args.extend(["--bootstrap-owner-private-key", str(bootstrap_owner_private_key)])
             if bootstrap_owner_authorization_b64 is not None:
                 args.extend(
                     ["--bootstrap-owner-authorization-b64", str(bootstrap_owner_authorization_b64)]
@@ -256,6 +599,13 @@ def _generate_metadata_files() -> None:
 
 
 def main() -> None:
+    # Poll for our own Aleph bootstrap config alongside the HTTP listener, so
+    # a deployer that cannot reach this plain-HTTP endpoint (any page served
+    # over HTTPS) can hand the configuration over through Aleph instead. The
+    # first path to succeed wins; the other becomes a no-op once READY_FILE
+    # exists and CONFIGURE_LOCK serialises them.
+    threading.Thread(target=_poll_bootstrap_config_loop, daemon=True).start()
+
     server = ThreadingHTTPServer(("0.0.0.0", 80), Handler)
     server.serve_forever()