meta-core claims model: pin meta-core 2.0.1, meta-read 1.4.1, meta-watch 1.1.0, meta-search 1.3.2, meta-share 2.7.0, gateway 1.1.1, meta-sort 1.1.1, plugins 1.1.0; signing keys + db-cache backup exclude

Apps/MetaReadShared/docker-compose.yml

@@ -60,7 +60,7 @@ services:
   # peer count before suspecting the feeders.
   # ---------------------------------------------------------------------------
   metaread-search:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.2.10
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
     container_name: metaread-search
     # 2g, not the self-contained listing's 1g: on the shared core it indexes the
     # gateway box's whole catalogue (~830 MiB steady state on watch.nsl.sh).
@@ -79,6 +79,9 @@ services:
       # (beacon v2) instead of reading kv-leader.info off a shared
       # volume. See docs/project-architecture/beacon-v2.md.
       - ${DATA_ROOT:-/DATA}/AppData/metaread/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metaread/keys:/keys:rw
     environment:
       # Distinct from metawatch-search on the same core, so the two discovery
       # peers do not register under one name.
@@ -111,6 +114,8 @@ services:
       META_CORE_URL: "http://metacore-app:80"
       BASE_URL: "http://metaread-search:3000"
       INTERNAL_BASE_URL: "http://metaread-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaread-search.key"
       TZ: "$TZ"
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://localhost:3000/health"]
@@ -132,7 +137,7 @@ services:
   # User Data Layer.
   # ---------------------------------------------------------------------------
   metaread-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.3.9.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.4.1
     container_name: metaread-app
     hostname: metaread-app
     restart: unless-stopped
@@ -208,7 +213,7 @@ services:
       - 80
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metaread-search"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -361,6 +366,9 @@ x-compose-app:
     - path: /DATA/AppData/metaread/search-data
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metaread/keys
+      user: $PUID
+      group: $PGID
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metaread-${domain}
   webui-path: "/"