meta-core claims model: pin meta-core 2.0.1, meta-read 1.4.1, meta-watch 1.1.0, meta-search 1.3.2, meta-share 2.7.0, gateway 1.1.1, meta-sort 1.1.1, plugins 1.1.0; signing keys + db-cache backup exclude

Apps/MetaSort/docker-compose.yml

@@ -4,7 +4,7 @@ services:
   # Backend service. Reachable on the pcs network as `metasort-app`.
   # Public ingress goes through the `metasort` hash-lock proxy below.
   metasort-app:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-sort:1.0.13
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-sort:1.1.1
     container_name: metasort-app
     hostname: metasort-app
     restart: unless-stopped
@@ -39,6 +39,11 @@ services:
       - ${DATA_ROOT:-/DATA}/AppData/metasort/config/supervisord-metasort.conf:/etc/supervisor/conf.d/supervisord.conf:ro
       - ${DATA_ROOT:-/DATA}/AppData/metasort/config/nginx-metasort.conf:/etc/nginx/nginx.conf:ro
 
+      # Signing keys (meta-core 2.0.0 claims model): metasort-app.key is
+      # meta-sort's own identity; plugins/<pluginId>.key are minted per plugin
+      # and injected into the plugin containers it spawns. Config — backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metasort/keys:/keys:rw
+
     # Note: no /files mounts — files are accessed via WebDAV from MetaCore
     # (Architecture V3). MetaCore is the single source of truth for media files.
 
@@ -61,6 +66,8 @@ services:
       # Compose project label stamped on the plugin containers meta-sort spawns,
       # so they group under one stack instead of floating loose.
       - PLUGIN_STACK_NAME=metasort-plugins
+      # meta-sort's own claim-signing key; generated on first boot if missing.
+      - METAMESH_SIGNING_KEY_FILE=/keys/metasort-app.key
 
     # Note: Runs as root for nginx, Redis, and file management
     user: 0:0
@@ -89,7 +96,7 @@ services:
       BACKEND_HOST: "metasort-app"
       BACKEND_PORT: "80"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
 
     depends_on:
       - metasort-app
@@ -217,6 +224,9 @@ x-compose-app:
     - path: /DATA/AppData/metasort/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metasort/keys
+      user: $PUID
+      group: $PGID
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metasort-${domain}
   webui-path: "/"