Pin meta-watch 1.2.2 (MetaWatch, MetaWatchShared): restore hand-picked subtitle per file, auto-arm online result, no-subtitles notice (#819)

github.com/Worph/MetaAppStore answers 404, and with it every jsDelivr
cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/ URL: the icons, thumbnails and
screenshots of all 44 apps were missing from the store listing, and the store
source in the README no longer downloaded.

- Asset URLs in every Apps/*/docker-compose.yml now point at
  https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/{AppName}/
  (103 of the 109 distinct URLs checked: 200 image/png). The other 6, MetaGateway
  and MetaWatch screenshot-1..3, name files that have never been in this repo.
- README: the store source is https://gitea-watch.nsl.sh/metastar/MetaAppStore/archive/main.zip
  (public, checked to download anonymously).
- CLAUDE.md and CONTRIBUTING.md: the asset rule and its grep guard follow, so an
  import cannot bring back a jsDelivr URL unnoticed.

Apps/MetaCore/docker-compose.yml

@@ -5,23 +5,20 @@ services:
   # Public ingress goes through the `metacore` hash-lock proxy below — this
   # service has no public Caddy labels and no exposed host ports.
   metacore-app:
-    image: ghcr.io/worph/meta-core:1.0.23
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.1.0.1
     container_name: metacore-app
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
     # instead of swap. Both values must move together or swap comes back.
     #
-    # Raised 768m -> 1536m (2026-08-26): on watch.nsl.sh the Redis working set
+    # Lowered to 1g (2026-10-19, meta-core 1.2.0). The store is an embedded
-    # ran at 73-97% of 768m, i.e. one indexing burst away from an OOM kill that
+    # SQLite file now (no Redis, no in-memory search copy): on watch.nsl.sh,
-    # takes the record store (and every service reading it) down with it.
+    # 169k records, meta-core idles at ~70-160 MB and peaked at 568 MB during
-    # 1536m puts steady state near 30%.
+    # a full counter rebuild (POST /api/schema/rescan) — the heaviest operation
-    #
+    # it has. Page cache for the database file is charged here too but is
-    # Raised 1536m -> 6g (2026-09-30): the record index costs ~40 KB of RAM per
+    # reclaimable. History: 768m → 1536m (Redis working set) → 6g → 8g (the
-    # record, and watch.nsl.sh's working set reached 4.8 GiB (tens of
+    # Redis-era in-memory index, ~30 KB/record, OOM-killed repeatedly).
-    # thousands of records). A cap is a ceiling, not a reservation — a small
+    mem_limit: 1g
-    # library still uses a few hundred MB — so a generous one costs nothing
+    memswap_limit: 1g
-    # until the library grows into it.
-    mem_limit: 6g
-    memswap_limit: 6g
     hostname: metacore-app
     restart: unless-stopped
     privileged: true
@@ -31,7 +28,10 @@ services:
       - 80
 
     volumes:
-      # Shared infrastructure state (leader election, Redis dump, service discovery).
+      # Shared infrastructure state: the metadata store (db/meta-core.db, SQLite),
+      # the leader lock, identity and mounts. Since meta-core 2.0.0 also
+      # db-cache/cache.db: every index/derived table, rebuilt from db/ on
+      # demand — so it is excluded from backups (see x-compose-app.backup).
       # Lives inside /DATA/AppData/metacore/ so CasaOS archives it on uninstall.
       - ${DATA_ROOT:-/DATA}/AppData/metacore/meta-core:/meta-core:rw
 
@@ -48,7 +48,7 @@ services:
       # `filePath` points into it. This MUST be a bind mount: without it the
       # directory is the container's writable layer, so any `docker compose
       # up -d` that recreates metacore-app silently deletes every poster while
-      # Redis keeps pointing at them. That is exactly what happened on
+      # the records keep pointing at them. That is exactly what happened on
       # watch.nsl.sh on 2026-08-03 (270 files → 0), and it is the reason a
       # fraction of poster CIDs 404 with a healthy-looking record behind them.
       # metacore-app is the only service that mounts /files; the gateway and
@@ -65,7 +65,7 @@ services:
       - BASE_URL=https://metacore-$APP_DOMAIN
       - TZ=$TZ
 
-    # Runs as root for nginx, Redis, rclone mounts
+    # Runs as root for nginx and rclone mounts
     user: 0:0
 
     healthcheck:
@@ -101,7 +101,7 @@ services:
       BACKEND_HOST: "metacore-app"
       BACKEND_PORT: "80"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
 
     depends_on:
       - metacore-app
@@ -120,8 +120,8 @@ services:
       caddy_0.1_handle: ""
       caddy_0.1_handle.reverse_proxy: "{{upstreams 80}}"
 
-      # ---- metacore-IP.nip.io (gateway TLS) ----
+      # ---- metacore-IP.<IP_ZONE> (gateway TLS) ----
-      caddy_1: metacore-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metacore-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.0_handle: "/health"
       caddy_1.0_handle.reverse_proxy: "metacore-app:80"
@@ -155,15 +155,15 @@ x-casaos:
     en_us: |
       **The infrastructure foundation for the MetaMesh media management ecosystem.**
 
-      MetaCore provides the shared services that power all MetaMesh applications: distributed leader election, Redis database, WebDAV file serving, remote mount management, and service discovery.
+      MetaCore provides the shared services that power all MetaMesh applications: distributed leader election, embedded SQLite database, WebDAV file serving, remote mount management, and service discovery.
 
       **Key Features:**
       - **Leader Election** - Automatic flock-based leader election with failover support
-      - **Redis Database** - Centralized metadata storage for all MetaMesh services
+      - **SQLite Database** - Centralized metadata storage for all MetaMesh services: a backed-up truth file plus a rebuildable index cache
       - **WebDAV File Serving** - Cached file access for all services via HTTP
       - **Mount Management** - Add NFS, SMB, and rclone remote mounts from the dashboard
       - **File Watcher** - Monitors folders and notifies services of new files
-      - **Metadata Editor** - Browse and edit file metadata stored in Redis
+      - **Metadata Editor** - Browse and edit file metadata stored in SQLite
       - **Service Discovery** - Automatic registration and discovery of MetaMesh services
       - **OIDC Single Sign-On** - Dashboard protected by Yundera's built-in Authelia (auto-registered, no secrets to configure)
 
@@ -174,33 +174,33 @@ x-casaos:
     fr_fr: |
       **La fondation d'infrastructure pour l'ecosysteme de gestion de medias MetaMesh.**
 
-      MetaCore fournit les services partages qui alimentent toutes les applications MetaMesh : election de leader distribuee, base de donnees Redis, service de fichiers WebDAV, gestion de montages distants et decouverte de services.
+      MetaCore fournit les services partages qui alimentent toutes les applications MetaMesh : election de leader distribuee, base de donnees SQLite embarquee, service de fichiers WebDAV, gestion de montages distants et decouverte de services.
 
       **Fonctionnalites Cles:**
       - **Election de Leader** - Election automatique basee sur flock avec support de basculement
-      - **Base de Donnees Redis** - Stockage centralise des metadonnees pour tous les services
+      - **Base de Donnees SQLite** - Stockage centralise des metadonnees pour tous les services : un fichier de verite sauvegarde et un cache d'index reconstructible
       - **Service de Fichiers WebDAV** - Acces aux fichiers en cache via HTTP
       - **Gestion des Montages** - Ajout de montages NFS, SMB et rclone depuis le tableau de bord
       - **Surveillance de Fichiers** - Surveille les dossiers et notifie les services des nouveaux fichiers
-      - **Editeur de Metadonnees** - Parcourir et editer les metadonnees stockees dans Redis
+      - **Editeur de Metadonnees** - Parcourir et editer les metadonnees stockees dans SQLite
       - **Decouverte de Services** - Enregistrement et decouverte automatiques des services
       - **SSO OIDC** - Tableau de bord protege par l'Authelia integre de Yundera (auto-enregistre, aucun secret a configurer)
 
       **Installez ceci EN PREMIER** avant MetaSort, MetaFuse ou MetaStremio.
 
   tagline:
-    en_us: MetaMesh infrastructure - Leader election, Redis, WebDAV, and service discovery
+    en_us: MetaMesh infrastructure - Leader election, SQLite, WebDAV, and service discovery
-    fr_fr: Infrastructure MetaMesh - Election de leader, Redis, WebDAV et decouverte de services
+    fr_fr: Infrastructure MetaMesh - Election de leader, SQLite, WebDAV et decouverte de services
 
   title:
     en_us: MetaCore
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaCore/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaCore/icon.png
   screenshot_link:
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaCore/screenshot-1.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaCore/screenshot-1.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaCore/screenshot-2.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaCore/screenshot-2.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaCore/screenshot-3.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaCore/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaCore/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaCore/thumbnail.png
 
   index: /
   store_app_id: metacore
@@ -239,6 +239,11 @@ x-compose-app:
     - path: /DATA/AppData/metacore/meta-core
       user: $PUID
       group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (META_CORE_CACHE_PATH default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metacore/meta-core/db-cache
+      user: $PUID
+      group: $PGID
     - path: /DATA/AppData/metacore/cache
       user: $PUID
       group: $PGID
@@ -248,6 +253,12 @@ x-compose-app:
     - path: /DATA/AppData/metacore/plugin/share
       user: $PUID
       group: $PGID
+  # The index cache is derived data: meta-core rebuilds it from db/meta-core.db
+  # (the truth file, which IS backed up) when it is missing or stale. Never
+  # back it up — a restore brings it back empty and it repopulates on boot.
+  backup:
+    exclude:
+      - meta-core/db-cache/
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metacore-${domain}
   webui-path: "/"

Apps/MetaCore/pre-install/configuration.yml

@@ -2,7 +2,7 @@
 # Authelia Configuration for MetaMesh (OIDC provider mode)
 #
 # Template — MetaCore/pre-install-cmd substitutes the placeholders below at
-# install time: APP_DOMAIN, APP_PUBLIC_IP_DASH, HMAC secret, RSA JWKS private
+# install time: APP_DOMAIN, APP_PUBLIC_IP_DASH, APP_IP_ZONE, HMAC secret, RSA JWKS private
 # key, and one argon2id hash per OIDC client.
 #
 # Protected apps reach Authelia via OIDC (not forward_auth) so each app's
@@ -81,7 +81,7 @@ __OIDC_JWKS_KEY__
         require_pkce: false
         redirect_uris:
           - 'https://metacore-__AUTH_DOMAIN__/oauth2/callback'
-          - 'https://metacore-__APP_PUBLIC_IP_DASH__.nip.io/oauth2/callback'
+          - 'https://metacore-__APP_PUBLIC_IP_DASH__.__APP_IP_ZONE__/oauth2/callback'
           - 'https://metacore-__APP_PUBLIC_IP_DASH__.sslip.io/oauth2/callback'
         scopes:
           - 'openid'
@@ -104,7 +104,7 @@ __OIDC_JWKS_KEY__
         require_pkce: false
         redirect_uris:
           - 'https://metasort-__AUTH_DOMAIN__/oauth2/callback'
-          - 'https://metasort-__APP_PUBLIC_IP_DASH__.nip.io/oauth2/callback'
+          - 'https://metasort-__APP_PUBLIC_IP_DASH__.__APP_IP_ZONE__/oauth2/callback'
           - 'https://metasort-__APP_PUBLIC_IP_DASH__.sslip.io/oauth2/callback'
         scopes:
           - 'openid'
@@ -127,7 +127,7 @@ __OIDC_JWKS_KEY__
         require_pkce: false
         redirect_uris:
           - 'https://metafuse-__AUTH_DOMAIN__/oauth2/callback'
-          - 'https://metafuse-__APP_PUBLIC_IP_DASH__.nip.io/oauth2/callback'
+          - 'https://metafuse-__APP_PUBLIC_IP_DASH__.__APP_IP_ZONE__/oauth2/callback'
           - 'https://metafuse-__APP_PUBLIC_IP_DASH__.sslip.io/oauth2/callback'
         scopes:
           - 'openid'

Apps/MetaFeederAniList/docker-compose.yml

@@ -24,7 +24,7 @@ services:
   # are its ids, cover, synopsis, reading direction, author." Keyless.
   # ---------------------------------------------------------------------------
   metafeederanilist-feeder:
-    image: ghcr.io/worph/meta-feeder-anilist:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-anilist:1.0.5
     cpu_shares: 30
     container_name: metafeederanilist-feeder
     mem_limit: 256m
@@ -90,8 +90,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · AniList
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederAniList/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederAniList/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederAniList/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederAniList/thumbnail.png
 
   store_app_id: metafeederanilist
   is_uncontrolled: false

Apps/MetaFeederArxiv/docker-compose.yml

@@ -22,7 +22,7 @@ services:
   # metafeederarxiv-feeder — the arxiv feeder. Keyless; no config needed.
   # ---------------------------------------------------------------------------
   metafeederarxiv-feeder:
-    image: ghcr.io/worph/meta-feeder-arxiv:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-arxiv:1.0.4
     cpu_shares: 30
     container_name: metafeederarxiv-feeder
     hostname: metafeederarxiv-feeder
@@ -78,8 +78,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · arXiv
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederArxiv/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederArxiv/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederArxiv/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederArxiv/thumbnail.png
 
   store_app_id: metafeederarxiv
   is_uncontrolled: false

Apps/MetaFeederEuropePMC/docker-compose.yml

@@ -22,7 +22,7 @@ services:
   # metafeedereuropepmc-feeder — the europepmc feeder (upstream `pubmed`). Keyless.
   # ---------------------------------------------------------------------------
   metafeedereuropepmc-feeder:
-    image: ghcr.io/worph/meta-feeder-europepmc:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-europepmc:1.0.3
     cpu_shares: 30
     container_name: metafeedereuropepmc-feeder
     hostname: metafeedereuropepmc-feeder
@@ -79,8 +79,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Europe PMC
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederEuropePMC/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederEuropePMC/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederEuropePMC/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederEuropePMC/thumbnail.png
 
   store_app_id: metafeedereuropepmc
   is_uncontrolled: false

Apps/MetaFeederGiphy/docker-compose.yml

@@ -21,7 +21,7 @@ services:
   # metafeedergiphy-feeder — the giphy feeder. Needs a Giphy API key.
   # ---------------------------------------------------------------------------
   metafeedergiphy-feeder:
-    image: ghcr.io/worph/meta-feeder-giphy:1.0.1
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-giphy:1.0.2
     cpu_shares: 30
     container_name: metafeedergiphy-feeder
     hostname: metafeedergiphy-feeder
@@ -81,8 +81,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Giphy
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederGiphy/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederGiphy/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederGiphy/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederGiphy/thumbnail.png
 
   store_app_id: metafeedergiphy
   is_uncontrolled: false

Apps/MetaFeederGutenberg/docker-compose.yml

@@ -16,7 +16,7 @@ services:
   # for discovery/query; it returns records (no meta-core, no enrichment).
   # ---------------------------------------------------------------------------
   metafeedergutenberg-feeder:
-    image: ghcr.io/worph/meta-feeder-gutenberg:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-gutenberg:1.0.5
     cpu_shares: 30
     container_name: metafeedergutenberg-feeder
     hostname: metafeedergutenberg-feeder
@@ -78,8 +78,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Gutenberg
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederGutenberg/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederGutenberg/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederGutenberg/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederGutenberg/thumbnail.png
 
   store_app_id: metafeedergutenberg
   is_uncontrolled: false

Apps/MetaFeederInternetArchive/docker-compose.yml

@@ -26,7 +26,7 @@ services:
   # from the MetaGateway dashboard (configure panel).
   # ---------------------------------------------------------------------------
   metafeederinternetarchive-feeder:
-    image: ghcr.io/worph/meta-feeder-internetarchive:1.1.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-internetarchive:1.1.4
     cpu_shares: 30
     container_name: metafeederinternetarchive-feeder
         # Bytes tier: a single archive item can list hundreds of files and one
@@ -93,8 +93,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Internet Archive
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederInternetArchive/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederInternetArchive/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederInternetArchive/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederInternetArchive/thumbnail.png
 
   store_app_id: metafeederinternetarchive
   is_uncontrolled: false

Apps/MetaFeederJamendo/docker-compose.yml

@@ -27,7 +27,7 @@ services:
   # from the MetaGateway dashboard (configure panel).
   # ---------------------------------------------------------------------------
   metafeederjamendo-feeder:
-    image: ghcr.io/worph/meta-feeder-jamendo:1.1.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-jamendo:1.1.4
     cpu_shares: 30
     container_name: metafeederjamendo-feeder
         # Bytes tier: one mp32 derivative is buffered whole before hand-off.
@@ -99,8 +99,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Jamendo
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederJamendo/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederJamendo/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederJamendo/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederJamendo/thumbnail.png
 
   store_app_id: metafeederjamendo
   is_uncontrolled: false

Apps/MetaFeederMusicBrainz/docker-compose.yml

@@ -29,7 +29,7 @@ services:
   # from the MetaGateway dashboard (configure panel).
   # ---------------------------------------------------------------------------
   metafeedermusicbrainz-feeder:
-    image: ghcr.io/worph/meta-feeder-musicbrainz:1.1.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-musicbrainz:1.1.4
     cpu_shares: 30
     container_name: metafeedermusicbrainz-feeder
         # Identity tier: JSON in, cards out, nothing buffered. Swap disabled
@@ -100,8 +100,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · MusicBrainz
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederMusicBrainz/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederMusicBrainz/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederMusicBrainz/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederMusicBrainz/thumbnail.png
 
   store_app_id: metafeedermusicbrainz
   is_uncontrolled: false

Apps/MetaFeederOpenSubtitles/docker-compose.yml

@@ -39,7 +39,7 @@ services:
   # for discovery/query; the human configures it from the MetaGateway dashboard (configure panel).
   # ---------------------------------------------------------------------------
   metafeederopensubtitles-feeder:
-    image: ghcr.io/worph/meta-feeder-opensubtitles:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-opensubtitles:1.0.4
     cpu_shares: 30
     container_name: metafeederopensubtitles-feeder
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM instead of
@@ -151,8 +151,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · OpenSubtitles
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederOpenSubtitles/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederOpenSubtitles/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederOpenSubtitles/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederOpenSubtitles/thumbnail.png
 
   store_app_id: metafeederopensubtitles
   is_uncontrolled: false

Apps/MetaFeederProwlarr/docker-compose.yml

@@ -40,7 +40,7 @@ services:
     # package, published as ${{ github.repository }}) was renamed. The old
     # `meta-feeder-indexer` package still exists but is frozen at 1.0.23 and
     # receives no further pushes. The APP keeps the `metafeederprowlarr` name.
-    image: ghcr.io/worph/meta-feeder-torznab:1.0.37
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-torznab:1.1.0
     cpu_shares: 30
     container_name: metafeederprowlarr-feeder
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -76,10 +76,15 @@ services:
       # was dropped — its 500 did match the default.
       META_GATEWAY_PROWLARR_PAGE_SIZE: "20"
       TZ: "$TZ"
+      # Own claim-signing key (self-published records); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederprowlarr-feeder.key"
     volumes:
       # Persist feeder config (config.json saved via the config UI) + redb cache.
       # Transient librqbit downloads go to the container's /tmp (off backup).
       - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/state:/data/meta-feeder:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/keys:/keys:rw
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
       interval: 5s
@@ -102,7 +107,7 @@ services:
   # No healthcheck: these plugin images don't ship one (curl absent).
   # ---------------------------------------------------------------------------
   metafeederprowlarr-filename-parser:
-    image: ghcr.io/worph/metamesh-plugin-filename-parser:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
     cpu_shares: 30
     container_name: metafeederprowlarr-filename-parser
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -118,11 +123,17 @@ services:
       # (meta-sort's Scan card) sees it as bound elsewhere, never addable.
       BEACON_BINDS: "metafeederprowlarr-feeder"
       EMIT_TITLE_TAGS: "true"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederprowlarr-filename-parser.key"
+    volumes:
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/keys:/keys:rw
     networks:
       - metafeederprowlarr
 
   metafeederprowlarr-tmdb:
-    image: ghcr.io/worph/metamesh-plugin-tmdb:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
     cpu_shares: 30
     container_name: metafeederprowlarr-tmdb
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -145,8 +156,13 @@ services:
       # unavailable" and silently writes no posters/backdrops, so every record then
       # fails meta-watch's poster gate. Drop only after re-tagging the plugin.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederprowlarr-tmdb.key"
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/tmdb-cache:/cache
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederprowlarr/keys:/keys:rw
     networks:
       - metafeederprowlarr
       - pcs
@@ -215,8 +231,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Prowlarr
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederProwlarr/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederProwlarr/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederProwlarr/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederProwlarr/thumbnail.png
 
   store_app_id: metafeederprowlarr
   is_uncontrolled: false
@@ -255,3 +271,6 @@ x-compose-app:
     - path: /DATA/AppData/metafeederprowlarr/tmdb-cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metafeederprowlarr/keys
+      user: $PUID
+      group: $PGID

Apps/MetaFeederSciHub/docker-compose.yml

@@ -21,7 +21,7 @@ services:
   # metafeederscihub-feeder — the scihub feeder. Needs SCIHUB_MIRRORS to do anything.
   # ---------------------------------------------------------------------------
   metafeederscihub-feeder:
-    image: ghcr.io/worph/meta-feeder-scihub:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-scihub:1.0.3
     cpu_shares: 30
     container_name: metafeederscihub-feeder
     hostname: metafeederscihub-feeder
@@ -86,8 +86,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Sci-Hub
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederSciHub/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederSciHub/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederSciHub/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederSciHub/thumbnail.png
 
   store_app_id: metafeederscihub
   is_uncontrolled: false

Apps/MetaFeederStremio/docker-compose.yml

@@ -46,7 +46,7 @@ services:
   # (configure panel).
   # ---------------------------------------------------------------------------
   metafeederstremio-feeder:
-    image: ghcr.io/worph/meta-feeder-stremio:1.3.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-stremio:1.3.1
     cpu_shares: 30
     container_name: metafeederstremio-feeder
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM instead of
@@ -154,8 +154,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Stremio
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederStremio/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederStremio/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederStremio/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederStremio/thumbnail.png
 
   store_app_id: metafeederstremio
   is_uncontrolled: false

Apps/MetaFeederSuwayomi/docker-compose.yml

@@ -8,21 +8,24 @@ name: metafeedersuwayomi
 # own. Split out of the former MetaFeeder · Comic app; **MetaFeeder · AniList**
 # is the optional identity tier beside it.
 #
-# ⚠ **Needs meta-gateway ≥ 1.0.28** — chapters arrive unresolved and their page
-# list follows as an EnrichPatch, which an older gateway drops.
-#
 # ⚠ **Suwayomi itself is a SEPARATE app — install it first.** This feeder ships
-# pointed at `suwayomi:4567`, the container the **Suwayomi** store app publishes
+# pointed at `http://suwayomi` (port 80), the container the stock **Suwayomi**
-# on the shared `pcs` network.
+# store app publishes on the shared `pcs` network.
+#
+# ⚠ **Give the feeder Suwayomi's login.** The stock app runs
+# `AUTH_MODE: simple_login`; enter its admin password (Maison → Suwayomi →
+# credentials) on this feeder's config page. Only this feeder talks to
+# Suwayomi — readers get chapters through the gateway — so its login stays on.
 #
 # ⚠ **Querying Suwayomi WRITES.** Its search and chapter calls are GraphQL
 # mutations that cache source results into its library database.
 #
-# ⚠ **Suwayomi must be reachable UNAUTHENTICATED.** An undownloaded chapter is a
+# How a chapter is read: its record carries one portable `tachiyomi` locator
-# list of per-page URLs pointing at the Suwayomi container, redeemed by the
+# (minted from the chapter's address on its SITE, so every box agrees on it).
-# READER's meta-share peer with no credentials. Suwayomi's `simple_login` 401s
+# Opening it makes the gateway redeem it here: the feeder fetches every page
-# those routes — a library that lists every chapter and opens none. The Suwayomi
+# through Suwayomi and answers one CBZ, which the gateway stores once and the
-# store app therefore runs `AUTH_MODE: none` behind an AppShield/OIDC gate.
+# mesh serves from then on. Needs a gateway that redeems `provider-file`
+# locators and MetaTransport · IPFS ≥ 1.3.4 (64 MiB redeem ceiling).
 #
 # It needs, over the shared `pcs` network:
 #   - the **MetaGateway** app — which must list this feeder's URL
@@ -37,11 +40,11 @@ name: metafeedersuwayomi
 services:
   # ---------------------------------------------------------------------------
   # metafeedersuwayomi-feeder — the chapter tier. Resolves a work to titles,
-  # searches every installed source, returns the chapters. Chapters are listed
+  # searches every installed source, returns the chapters. Listing fetches no
-  # lazily: each chapter's page list is fetched only when a reader opens it.
+  # page: a chapter's pages are fetched once, when a reader first opens it.
   # ---------------------------------------------------------------------------
   metafeedersuwayomi-feeder:
-    image: ghcr.io/worph/meta-feeder-suwayomi:1.0.7
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-suwayomi:1.1.0
     cpu_shares: 30
     container_name: metafeedersuwayomi-feeder
     mem_limit: 256m
@@ -54,16 +57,15 @@ services:
     environment:
       RUST_LOG: "info,meta_feeder=info,suwayomi_feeder=info"
       META_FEEDER_STATE_DIR: "/data/meta-feeder"
-      # INFRA-ONLY env, and only a FIRST-BOOT SEED: `base_url` is a field on
+      # FIRST-BOOT SEEDS only: `base_url`, `username` and `password` are fields
-      # this feeder's own config page (the MetaGateway dashboard (configure panel)), and a value saved
+      # on this feeder's own config page (MetaGateway dashboard → this feeder →
-      # there wins. `suwayomi` is the container the Suwayomi store app publishes
+      # configure), and a value saved there wins. `suwayomi` is the container
-      # on `pcs` — change it only to point at a Suwayomi somewhere else, and see
+      # the Suwayomi store app publishes on `pcs`, on port 80.
-      # the reachability warning in the header before you do.
+      SUWAYOMI_URL: "http://suwayomi"
-      SUWAYOMI_URL: "http://suwayomi:4567"
+      # The stock Suwayomi app's login user. Its password is per-install
-      # Listing chapters is cheap (one call returns them all); RESOLVING a
+      # (Maison → Suwayomi → credentials) and no app can read another's
-      # chapter's page list is what costs. 0 = fetch nothing until a reader
+      # secret, so it is entered once on the config page.
-      # clicks. Raise it to pre-warm the first N ordinals per work.
+      SUWAYOMI_USERNAME: "admin"
-      SUWAYOMI_WARM_CHAPTERS: "0"
       # ⚠ SUWAYOMI_MAX_CHAPTERS is deliberately NOT set: it bounds how many
       # chapters are LISTED, and any value can only truncate a long series into
       # looking short.
@@ -101,9 +103,9 @@ x-casaos:
       you installed in the **Suwayomi** app, and mints its own work cards so search
       works on its own. Add **MetaFeeder · AniList** to name works across sources.
 
-      **Install Suwayomi first.** It is a separate app in this store (with a
+      **Install Suwayomi first** (a separate app, with a FlareSolverr sidecar so
-      FlareSolverr sidecar, so Cloudflare-protected sources work). This feeder arrives
+      Cloudflare-protected sources work). This feeder arrives pointed at it; give it
-      pointed at it and needs no wiring.
+      Suwayomi's admin password on its config page.
 
       **You own the sources.** Suwayomi ships exactly one built-in source — *Local
       source*, which reads CBZ/CBR from its own folder. Everything else is an extension
@@ -114,8 +116,9 @@ x-casaos:
       **Multi-source by design.** Every installed source that carries a work
       contributes, and each chapter row offers a chooser across them.
 
-      **Lazy by default.** Listing a series' chapters costs one upstream call however
+      **Fetched once, shared after.** Listing a series' chapters costs one upstream
-      long it is; a chapter's page list is fetched only when someone opens it.
+      call however long it is. A chapter's pages are fetched the first time someone
+      opens it, stored as one CBZ, and served from the mesh from then on.
       **Requires:** **MetaGateway** — its meta-core stores the resolved records and
       announces them to the swarm. The gateway must list this feeder in its config.
       **Pairs with: MetaRead**, the reading client.
@@ -131,8 +134,9 @@ x-casaos:
       **Vous possédez les sources.** Suwayomi n'embarque que *Local source* ; tout le
       reste est une extension que **vous** installez via l'interface Suwayomi.
 
-      **Paresseux par défaut.** Lister les chapitres coûte un appel ; les pages d'un
+      **Récupéré une fois, partagé ensuite.** Lister les chapitres coûte un appel ;
-      chapitre ne sont récupérées qu'à l'ouverture.
+      les pages d'un chapitre sont récupérées à sa première ouverture, stockées en un
+      CBZ, puis servies par le maillage.
 
       **Nécessite :** les apps **MetaGateway** et **Suwayomi**. **Va avec : MetaRead.**
   tagline:
@@ -142,8 +146,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Suwayomi
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederSuwayomi/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederSuwayomi/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederSuwayomi/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederSuwayomi/thumbnail.png
 
   store_app_id: metafeedersuwayomi
   is_uncontrolled: false
@@ -152,8 +156,8 @@ x-casaos:
     before_install:
       en_us: |
         **Install order:** **MetaGateway** first, then **Suwayomi** — the separate
-        store app this feeder reads. This app arrives pointed at `suwayomi:4567`; without
+        store app this feeder reads. This app arrives pointed at `http://suwayomi`;
-        that app installed it stays healthy and simply finds no chapters.
+        without that app installed it stays healthy and simply finds no chapters.
 
         **After installing this app:**
         1. In **MetaGateway**, add this feeder from the dashboard's *Add a feeder* box —
@@ -167,16 +171,17 @@ x-casaos:
         4. Optionally install **MetaFeeder · AniList** so chapters from several sources
            converge on one work page.
 
+        5. **Give the feeder Suwayomi's login:** copy the admin password from Maison →
+           Suwayomi → credentials into this feeder's config page (*Suwayomi password*).
+           Changed it in Maison later? Enter it here again.
+
         This app has no web UI of its own: the **feeder's config page** (Suwayomi URL,
-        chapters per work, chapters pre-loaded) opens from the **MetaGateway**
+        username, password, chapters per work) opens from the **MetaGateway**
         dashboard → this feeder → *configure*. Suwayomi's own UI is the Suwayomi app.
 
         **⚠ Querying Suwayomi writes to it.** Rows will appear in its library that you
         did not add by hand. That is inherent to how the aggregator works.
 
-        **Suwayomi's own login must stay off** — the reader fetches chapter pages from it
-        unauthenticated, so enabling it gives a library that lists every chapter and can
-        open none.
         **No web UI of its own:** configure it from the **MetaGateway** dashboard → this feeder → *configure* (the gateway proxies this feeder's config page, behind the gateway's login).
 
 # Maison (Yundera dashboard) configuration. Read in preference to x-casaos.

Apps/MetaFeederTMDB/docker-compose.yml

@@ -43,7 +43,7 @@ services:
   # from the MetaGateway dashboard (configure panel).
   # ---------------------------------------------------------------------------
   metafeedertmdb-feeder:
-    image: ghcr.io/worph/meta-feeder-tmdb:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-tmdb:1.0.6
     cpu_shares: 30
     container_name: metafeedertmdb-feeder
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM instead of
@@ -162,12 +162,12 @@ x-casaos:
   title:
     en_us: MetaFeeder · TMDB
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederTMDB/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederTMDB/icon.png
   screenshot_link:
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederTMDB/screenshot-1.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederTMDB/screenshot-1.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederTMDB/screenshot-2.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederTMDB/screenshot-2.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederTMDB/screenshot-3.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederTMDB/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederTMDB/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederTMDB/thumbnail.png
 
   store_app_id: metafeedertmdb
   is_uncontrolled: false

Apps/MetaFeederTribler/docker-compose.yml

@@ -71,7 +71,7 @@ services:
   # from the MetaGateway dashboard (configure panel).
   # ---------------------------------------------------------------------------
   metafeedertribler-feeder:
-    image: ghcr.io/worph/meta-feeder-tribler:1.0.8
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-tribler:1.1.0
     cpu_shares: 30
     container_name: metafeedertribler-feeder
     hostname: metafeedertribler-feeder
@@ -93,10 +93,15 @@ services:
       META_FEEDER_CALLBACK_URL: "http://metafeedertribler-feeder:8080/enrich/callback"
       META_FEEDER_STATE_DIR: "/data/meta-feeder"
       TZ: "$TZ"
+      # Own claim-signing key (self-published records); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeedertribler-feeder.key"
     volumes:
       # Persist feeder config (config.json pre-seeded + editable via UI) + redb
       # cache. config.json lives at gateway/tribler/config.json under this dir.
       - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/state:/data/meta-feeder:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/keys:/keys:rw
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
       interval: 5s
@@ -123,7 +128,7 @@ services:
   # images don't ship one (curl absent).
   # ---------------------------------------------------------------------------
   metafeedertribler-filename-parser:
-    image: ghcr.io/worph/metamesh-plugin-filename-parser:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
     cpu_shares: 30
     container_name: metafeedertribler-filename-parser
     hostname: metafeedertribler-filename-parser
@@ -136,11 +141,17 @@ services:
       BEACON_BINDS: "metafeedertribler-feeder"
       PORT: "8080"
       EMIT_TITLE_TAGS: "true"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeedertribler-filename-parser.key"
+    volumes:
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/keys:/keys:rw
     networks:
       - metafeedertribler
 
   metafeedertribler-tmdb:
-    image: ghcr.io/worph/metamesh-plugin-tmdb:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
     cpu_shares: 30
     container_name: metafeedertribler-tmdb
     hostname: metafeedertribler-tmdb
@@ -155,8 +166,13 @@ services:
       CACHE_DIR: "/cache"
       # Posters land in the shared meta-core (over pcs) so the ingester seeds them.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeedertribler-tmdb.key"
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/tmdb-cache:/cache
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedertribler/keys:/keys:rw
     networks:
       - metafeedertribler
       - pcs
@@ -214,8 +230,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Tribler
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederTribler/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederTribler/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederTribler/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederTribler/thumbnail.png
 
   store_app_id: metafeedertribler
   is_uncontrolled: false
@@ -275,3 +291,6 @@ x-compose-app:
     - path: /DATA/AppData/metafeedertribler/tribler-seed
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metafeedertribler/keys
+      user: $PUID
+      group: $PGID

Apps/MetaFeederUsenet/docker-compose.yml

@@ -38,7 +38,7 @@ services:
   # the MetaGateway dashboard (configure panel).
   # ---------------------------------------------------------------------------
   metafeederusenet-feeder:
-    image: ghcr.io/worph/meta-feeder-usenet:1.2.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-usenet:1.2.1
     cpu_shares: 30
     container_name: metafeederusenet-feeder
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM instead
@@ -101,7 +101,7 @@ services:
   # images don't ship one (curl absent).
   # ---------------------------------------------------------------------------
   metafeederusenet-filename-parser:
-    image: ghcr.io/worph/metamesh-plugin-filename-parser:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
     cpu_shares: 30
     container_name: metafeederusenet-filename-parser
     mem_limit: 256m
@@ -115,11 +115,17 @@ services:
       # (meta-sort's Scan card) sees it as bound elsewhere, never addable.
       BEACON_BINDS: "metafeederusenet-feeder"
       EMIT_TITLE_TAGS: "true"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederusenet-filename-parser.key"
+    volumes:
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederusenet/keys:/keys:rw
     networks:
       - metafeederusenet
 
   metafeederusenet-tmdb:
-    image: ghcr.io/worph/metamesh-plugin-tmdb:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
     cpu_shares: 30
     container_name: metafeederusenet-tmdb
     mem_limit: 384m
@@ -137,8 +143,13 @@ services:
       # the sibling feeder apps' identical note: the published image needs
       # this, unlike the source build the dev stack runs).
       WEBDAV_URL: "http://metacore-app:9000/webdav"
+      # Own claim-signing key (enrichment claims); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metafeederusenet-tmdb.key"
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metafeederusenet/tmdb-cache:/cache
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeederusenet/keys:/keys:rw
     networks:
       - metafeederusenet
       - pcs
@@ -198,12 +209,12 @@ x-casaos:
   title:
     en_us: MetaFeeder · Usenet
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederUsenet/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederUsenet/icon.png
   screenshot_link:
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederUsenet/screenshot-1.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederUsenet/screenshot-1.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederUsenet/screenshot-2.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederUsenet/screenshot-2.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederUsenet/screenshot-3.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederUsenet/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederUsenet/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederUsenet/thumbnail.png
 
   store_app_id: metafeederusenet
   is_uncontrolled: false
@@ -252,6 +263,9 @@ x-compose-app:
     - path: /DATA/AppData/metafeederusenet/tmdb-cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metafeederusenet/keys
+      user: $PUID
+      group: $PGID
   # No web UI: Maison files it under Services. Configured from MetaGateway.
   # Shown from the tile menu.
   tips:

Apps/MetaFeederWikiCommons/docker-compose.yml

@@ -22,7 +22,7 @@ services:
   # metafeederwikicommons-feeder — the wikicommons feeder. Keyless; no config needed.
   # ---------------------------------------------------------------------------
   metafeederwikicommons-feeder:
-    image: ghcr.io/worph/meta-feeder-wikicommons:1.0.1
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-wikicommons:1.0.2
     cpu_shares: 30
     container_name: metafeederwikicommons-feeder
     hostname: metafeederwikicommons-feeder
@@ -79,8 +79,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · Wikimedia Commons
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederWikiCommons/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederWikiCommons/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederWikiCommons/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederWikiCommons/thumbnail.png
 
   store_app_id: metafeederwikicommons
   is_uncontrolled: false

Apps/MetaFeederYouTube/docker-compose.yml

@@ -30,7 +30,7 @@ services:
   # from the MetaGateway dashboard (configure panel).
   # ---------------------------------------------------------------------------
   metafeederyoutube-feeder:
-    image: ghcr.io/worph/meta-feeder-youtube:1.1.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-youtube:1.1.3
     cpu_shares: 30
     container_name: metafeederyoutube-feeder
         # Delegated tier: it moves an 11-character video id, never bytes.
@@ -100,8 +100,8 @@ x-casaos:
   title:
     en_us: MetaFeeder · YouTube
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederYouTube/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederYouTube/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederYouTube/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFeederYouTube/thumbnail.png
 
   store_app_id: metafeederyoutube
   is_uncontrolled: false

Apps/MetaFuse/docker-compose.yml

@@ -4,7 +4,7 @@ services:
   # Backend service. Reachable on the pcs network as `metafuse-app`.
   # Public ingress goes through the `metafuse` hash-lock proxy below.
   metafuse-app:
-    image: ghcr.io/worph/meta-fuse:1.1.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-fuse:1.1.6
     cpu_shares: 50
     container_name: metafuse-app
     hostname: metafuse-app
@@ -77,7 +77,7 @@ services:
       BACKEND_HOST: "metafuse-app"
       BACKEND_PORT: "80"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
 
     depends_on:
       - metafuse-app
@@ -94,8 +94,8 @@ services:
       caddy_0.2_handle: ""
       caddy_0.2_handle.reverse_proxy: "{{upstreams 80}}"
 
-      # ---- metafuse-IP.nip.io (gateway TLS) ----
+      # ---- metafuse-IP.<IP_ZONE> (gateway TLS) ----
-      caddy_1: metafuse-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metafuse-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.0_handle: "/health"
       caddy_1.0_handle.reverse_proxy: "metafuse-app:80"
@@ -168,12 +168,12 @@ x-casaos:
   title:
     en_us: MetaFuse
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFuse/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFuse/icon.png
   screenshot_link:
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFuse/screenshot-1.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFuse/screenshot-1.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFuse/screenshot-2.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFuse/screenshot-2.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFuse/screenshot-3.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFuse/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFuse/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaFuse/thumbnail.png
 
   index: /
   store_app_id: metafuse

Apps/MetaGateway/README.md

@@ -77,9 +77,9 @@ over mDNS on `pcs` regardless.
 
 | Image | Tag |
 |-------|-----|
-| `ghcr.io/worph/meta-gateway` | `1.0.25` |
+| `ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway` | `1.0.43` |
-| `ghcr.io/worph/meta-share` | `1.0.26` |
+| `ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share` | `2.6.2` |
-| `ghcr.io/worph/meta-core` | `1.0.12` |
+| `ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core` | `1.0.24` |
 | `ghcr.io/yundera/appshield` | `2.0.9` |
 
 No feeder images are listed here any more: every content source is a **separate

Apps/MetaGateway/docker-compose.yml

@@ -35,7 +35,7 @@ services:
   # ===========================================================================
   metagateway-core:
     # 1.0.1 carries the new meta-core API (records cids/ set, identity).
-    image: ghcr.io/worph/meta-core:1.0.23
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.1.0.1
     container_name: metagateway-core
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
     # instead of swap. Mirrors the dev sub-stack limits.
@@ -50,6 +50,8 @@ services:
       - 9000
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metagateway/metacore:/meta-core:rw
+      # (meta-core 2.0.0 keeps its rebuildable index cache at
+      # /meta-core/db-cache/cache.db inside this bind — excluded from backups.)
       - ${DATA_ROOT:-/DATA}/AppData/metagateway/files:/files:rw
     environment:
       - BASE_URL=http://metagateway-core:9000
@@ -81,7 +83,7 @@ services:
     # MetaShare app's `metashare-<tier>` hostnames, which on a shared `pcs`
     # would be ANOTHER hull's plugins writing to another /data).
     #  - 3000  HTTP API   - 3001  plugin callback API (internal only)
-    image: ghcr.io/worph/meta-share:2.4.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
     container_name: metagateway-share
     # The swarm and blockstore moved to the ipfs plugin, so the hull needs far
     # less than the monolith did.
@@ -103,6 +105,9 @@ services:
       # hull's; ipfs/blocks.redb is the ipfs plugin's corner of the SAME folder
       # (layout unchanged from 1.0.x, so an existing cache carries over).
       - ${DATA_ROOT:-/DATA}/AppData/metagateway/share-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metagateway/keys:/keys:rw
     environment:
       META_CORE_URL: "http://metagateway-core:9000"
       BASE_URL: "http://metagateway-share:3000"
@@ -110,6 +115,8 @@ services:
       META_SHARE_PLUGIN_IPFS_URL: "http://metagateway-share-ipfs:3000"
       META_SHARE_PLUGIN_TORRENT_URL: "off"
       META_SHARE_PLUGIN_NZB_URL: "off"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metagateway-share.key"
       TZ: "$TZ"
     depends_on:
       metagateway-core:
@@ -129,7 +136,7 @@ services:
     # mDNS, bitswap), the blockstore, gateway discovery and the peer directory
     # the hull uses to forward Usenet cids. Waits up to 60 s for the hull's
     # internal /health before opening blocks.redb, so no depends_on.
-    image: ghcr.io/worph/meta-transport-ipfs:1.3.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-transport-ipfs:1.3.4
     container_name: metagateway-share-ipfs
     hostname: metagateway-share-ipfs
     restart: unless-stopped
@@ -184,8 +191,12 @@ services:
     # P2P listen/announce so it's discoverable + dialable off-host + the
     # 2026-07 discovery/filters fixes that make the meta-search fan-out
     # actually route `fileType:video` queries here.
-    image: ghcr.io/worph/meta-gateway:1.0.42
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway:1.1.1
     container_name: metagateway-app
+    # Run as the PUID that Maison creates the app folders with (as the Shared
+    # variant does). The image default user (uid 10001) cannot write them on a
+    # fresh install: "create ipfs dir … Permission denied".
+    user: "1000:1000"
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
     # instead of swap. Mirrors the dev sub-stack limits.
     # 1g -> 2g (2026-09-30): the DHT-joined dispatcher runs at ~1.2 GiB on
@@ -207,6 +218,9 @@ services:
       # gateway-config.json (feeders map) + gateway-enabled.json, written by
       # pre-install-cmd. Runtime redb caches also live here.
       - ${DATA_ROOT:-/DATA}/AppData/metagateway/state:/data/meta-gateway:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metagateway/keys:/keys:rw
     environment:
       # NOTE: `meta_core_url` (and `meta_share_url`) live in gateway-config.json
       # since v1.0.12 — no longer read from env. The pre-install-cmd below seeds
@@ -215,6 +229,9 @@ services:
       # libp2p identify agent_version) — without it meta-search can't HTTP-fetch
       # /api/gateway/plugins on this gateway to populate its routing table.
       META_GATEWAY_PEER_ID: "metagateway"
+      # Own claim-signing key for the records it auto-stores in its meta-core;
+      # generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metagateway-app.key"
       # MUST be resolvable BY A REMOTE PEER — it is advertised verbatim in the
       # identify `baseUrl=` token and used for nothing else in-process. A
       # docker-internal name here (the old `http://metagateway-app:3000`) makes
@@ -306,7 +323,7 @@ services:
       BACKEND_HOST: "metagateway-app"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
     depends_on:
       - metagateway-app
     labels:
@@ -331,8 +348,8 @@ services:
       caddy_0.3_handle: ""
       caddy_0.3_handle.reverse_proxy: "{{upstreams 80}}"
 
-      # ---- metagateway-IP.nip.io (gateway TLS) ----
+      # ---- metagateway-IP.<IP_ZONE> (gateway TLS) ----
-      caddy_1: metagateway-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metagateway-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.0_handle: "/health"
       caddy_1.0_handle.reverse_proxy: "metagateway-app:3000"
@@ -385,7 +402,7 @@ services:
     expose: ["80"]
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metagateway-core"
       BACKEND_PORT: "80"
       LISTEN_PORT: "80"
@@ -393,7 +410,7 @@ services:
       caddy_0: metagatewaycore-${APP_DOMAIN}
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metagatewaycore-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metagatewaycore-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 80}}"
       caddy_2: metagatewaycore-${APP_PUBLIC_IP_DASH}.sslip.io
@@ -414,7 +431,7 @@ services:
     expose: ["80"]
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metagateway-share"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -422,7 +439,7 @@ services:
       caddy_0: metagatewayshare-${APP_DOMAIN}
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metagatewayshare-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metagatewayshare-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 80}}"
       caddy_2: metagatewayshare-${APP_PUBLIC_IP_DASH}.sslip.io
@@ -512,12 +529,12 @@ x-casaos:
   title:
     en_us: MetaGateway
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaGateway/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaGateway/icon.png
   screenshot_link:
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaGateway/screenshot-1.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaGateway/screenshot-1.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaGateway/screenshot-2.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaGateway/screenshot-2.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaGateway/screenshot-3.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaGateway/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaGateway/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaGateway/thumbnail.png
 
   index: /
   store_app_id: metagateway
@@ -609,6 +626,11 @@ x-compose-app:
     - path: /DATA/AppData/metagateway/metacore
       user: $PUID
       group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metagateway/metacore/db-cache
+      user: $PUID
+      group: $PGID
     - path: /DATA/AppData/metagateway/files
       user: $PUID
       group: $PGID
@@ -624,6 +646,14 @@ x-compose-app:
     - path: /DATA/AppData/metagateway/share-ipfs-state
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metagateway/keys
+      user: $PUID
+      group: $PGID
+  # Derived data only: meta-core rebuilds its index cache from the truth file
+  # (metacore/db/meta-core.db, which IS backed up). keys/ stays backed up.
+  backup:
+    exclude:
+      - metacore/db-cache/
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metagateway-${domain}
   webui-path: "/"

Apps/MetaGatewayShared/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # co-located metashare-app then seeds the resolved CIDs.
   # ---------------------------------------------------------------------------
   metagateway-app:
-    image: ghcr.io/worph/meta-gateway:1.0.42
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-gateway:1.1.1
     container_name: metagateway-app
     hostname: metagateway-app
     restart: unless-stopped
@@ -55,6 +55,9 @@ services:
     volumes:
       # gateway-config.json (source definitions, feeder URLs) + dispatcher state.
       - ${DATA_ROOT:-/DATA}/AppData/metagateway/state:/data/meta-gateway:rw
+      # Claim-signing key (meta-core 2.0.0 claims model) for the records the
+      # dispatcher writes to metacore-app. Config — backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metagateway/keys:/keys:rw
     environment:
       # Advertised verbatim in this peer's libp2p identify `agent_version`
       # (`baseUrl=...`) and used for NOTHING else in-process — see
@@ -72,6 +75,8 @@ services:
       # carve-out in the Caddy labels below is what makes this URL answerable.
       META_GATEWAY_BASE_URL: "https://metagateway-${APP_DOMAIN}"
       META_GATEWAY_PEER_ID: "metagateway"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metagateway-app.key"
       # --- cross-node discoverability (added 2026-08-26) ---------------------
       # WITHOUT META_GATEWAY_PUBLIC_ADDR meta-gateway starts in local/mDNS-only
       # mode: it loads NO kad bootstraps, sets kad_provide_enabled=false, and so
@@ -130,7 +135,7 @@ services:
       retries: 10
       start_period: 5s
     labels:
-      icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaGateway/icon.png
+      icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaGateway/icon.png
     networks:
       - metagateway
       - pcs
@@ -144,7 +149,7 @@ services:
   # Runs as 10001:999 — the uid/gid baked into the meta-feeder-tmdb image.
   # ---------------------------------------------------------------------------
   metagateway-card:
-    image: ghcr.io/worph/meta-feeder-tmdb:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-feeder-tmdb:1.0.6
     container_name: metagateway-card
     hostname: metagateway-card
     restart: unless-stopped
@@ -166,7 +171,7 @@ services:
       retries: 10
       start_period: 5s
     labels:
-      icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaGateway/icon.png
+      icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaGateway/icon.png
     networks:
       - metagateway
 
@@ -193,7 +198,7 @@ services:
       BACKEND_HOST: "metagateway-app"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
     depends_on:
       - metagateway-app
     labels:
@@ -221,8 +226,8 @@ services:
       caddy_0.3_handle: ""
       caddy_0.3_handle.reverse_proxy: "{{upstreams 80}}"
 
-      # ---- metagateway-IP.nip.io (gateway TLS) ----
+      # ---- metagateway-IP.<IP_ZONE> (gateway TLS) ----
-      caddy_1: metagateway-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metagateway-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.0_handle: "/health"
       caddy_1.0_handle.reverse_proxy: "metagateway-app:3000"
@@ -256,7 +261,7 @@ services:
       caddy_2.3_handle: ""
       caddy_2.3_handle.reverse_proxy: "{{upstreams 80}}"
 
-      icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaGateway/icon.png
+      icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaGateway/icon.png
     networks:
       - metagateway
       - pcs
@@ -277,7 +282,7 @@ x-casaos:
   category: Media
   developer: Aptero Team
   hostname: metagateway-${APP_DOMAIN}
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaGateway/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaGateway/icon.png
   index: /
   is_uncontrolled: false
   main: metagateway
@@ -356,6 +361,9 @@ x-compose-app:
     - path: /DATA/AppData/metagateway/state
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metagateway/keys
+      user: $PUID
+      group: $PGID
     - path: /DATA/AppData/metagateway/card
       user: 10001
       group: 999

Apps/MetaPluginAnimeDetector/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginanimedetector-plugin:
-    image: ghcr.io/worph/metamesh-plugin-anime-detector:1.0.1
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-anime-detector:1.1.0
     cpu_shares: 30
     container_name: metapluginanimedetector-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -49,6 +49,13 @@ services:
       # Nothing to configure: this plugin takes its work from the /process
       # payload and writes back through the caller. No key, no WebDAV.
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginanimedetector-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginanimedetector/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -100,8 +107,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · Anime Detector
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginAnimeDetector/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginAnimeDetector/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginAnimeDetector/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginAnimeDetector/thumbnail.png
 
   store_app_id: metapluginanimedetector
   is_uncontrolled: false
@@ -124,3 +131,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginanimedetector/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginFFmpeg/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginffmpeg-plugin:
-    image: ghcr.io/worph/metamesh-plugin-ffmpeg:1.0.1
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-ffmpeg:1.1.0
     cpu_shares: 30
     container_name: metapluginffmpeg-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginffmpeg-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metapluginffmpeg/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginffmpeg/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -110,8 +116,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · FFmpeg
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginFFmpeg/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginFFmpeg/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginFFmpeg/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginFFmpeg/thumbnail.png
 
   store_app_id: metapluginffmpeg
   is_uncontrolled: false
@@ -144,3 +150,6 @@ x-compose-app:
     - path: /DATA/AppData/metapluginffmpeg/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metapluginffmpeg/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginFileInfo/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginfileinfo-plugin:
-    image: ghcr.io/worph/metamesh-plugin-file-info:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-file-info:1.1.0
     cpu_shares: 30
     container_name: metapluginfileinfo-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginfileinfo-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metapluginfileinfo/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginfileinfo/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -108,8 +114,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · File Info
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginFileInfo/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginFileInfo/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginFileInfo/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginFileInfo/thumbnail.png
 
   store_app_id: metapluginfileinfo
   is_uncontrolled: false
@@ -142,3 +148,6 @@ x-compose-app:
     - path: /DATA/AppData/metapluginfileinfo/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metapluginfileinfo/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginFilenameParser/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginfilenameparser-plugin:
-    image: ghcr.io/worph/metamesh-plugin-filename-parser:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-filename-parser:1.1.0
     cpu_shares: 30
     container_name: metapluginfilenameparser-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -54,6 +54,13 @@ services:
       # Blank = off = the plugin's own default, which is MetaSort's semantics.
       EMIT_TITLE_TAGS: "${EMIT_TITLE_TAGS:-}"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginfilenameparser-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginfilenameparser/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -108,8 +115,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · Filename Parser
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginFilenameParser/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginFilenameParser/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginFilenameParser/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginFilenameParser/thumbnail.png
 
   store_app_id: metapluginfilenameparser
   is_uncontrolled: false
@@ -136,3 +143,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginfilenameparser/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginFullHash/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginfullhash-plugin:
-    image: ghcr.io/worph/metamesh-plugin-fullhash:1.0.1
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-fullhash:1.1.0
     cpu_shares: 30
     container_name: metapluginfullhash-plugin
     # 2 GB, swap disabled (memswap_limit == mem_limit) → OOM instead of
@@ -50,10 +50,16 @@ services:
       # Nothing to configure: this plugin takes its work from the /process
       # payload and writes back through the caller. No key, no WebDAV.
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginfullhash-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metapluginfullhash/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginfullhash/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -108,8 +114,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · Full Hash
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginFullHash/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginFullHash/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginFullHash/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginFullHash/thumbnail.png
 
   store_app_id: metapluginfullhash
   is_uncontrolled: false
@@ -139,3 +145,6 @@ x-compose-app:
     - path: /DATA/AppData/metapluginfullhash/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metapluginfullhash/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginJellyfinNFO/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginjellyfinnfo-plugin:
-    image: ghcr.io/worph/metamesh-plugin-jellyfin-nfo:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-jellyfin-nfo:1.1.0
     cpu_shares: 30
     container_name: metapluginjellyfinnfo-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginjellyfinnfo-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginjellyfinnfo/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -106,8 +113,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · Jellyfin NFO
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginJellyfinNFO/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginJellyfinNFO/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginJellyfinNFO/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginJellyfinNFO/thumbnail.png
 
   store_app_id: metapluginjellyfinnfo
   is_uncontrolled: false
@@ -133,3 +140,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginjellyfinnfo/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginLanguage/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginlanguage-plugin:
-    image: ghcr.io/worph/metamesh-plugin-language:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-language:1.1.0
     cpu_shares: 30
     container_name: metapluginlanguage-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -49,6 +49,13 @@ services:
       # Nothing to configure: this plugin takes its work from the /process
       # payload and writes back through the caller. No key, no WebDAV.
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginlanguage-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginlanguage/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -102,8 +109,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · Language
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginLanguage/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginLanguage/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginLanguage/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginLanguage/thumbnail.png
 
   store_app_id: metapluginlanguage
   is_uncontrolled: false
@@ -126,3 +133,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginlanguage/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginOpenSubtitles/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginopensubtitles-plugin:
-    image: ghcr.io/worph/metamesh-plugin-opensubtitle:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-opensubtitle:1.1.0
     cpu_shares: 30
     container_name: metapluginopensubtitles-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginopensubtitles-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginopensubtitles/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -106,8 +113,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · OpenSubtitles
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginOpenSubtitles/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginOpenSubtitles/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginOpenSubtitles/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginOpenSubtitles/thumbnail.png
 
   store_app_id: metapluginopensubtitles
   is_uncontrolled: false
@@ -137,3 +144,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginopensubtitles/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginStillExtractor/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginstillextractor-plugin:
-    image: ghcr.io/worph/metamesh-plugin-still-extractor:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-still-extractor:1.1.0
     cpu_shares: 30
     container_name: metapluginstillextractor-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginstillextractor-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginstillextractor/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -106,8 +113,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · Still Extractor
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginStillExtractor/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginStillExtractor/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginStillExtractor/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginStillExtractor/thumbnail.png
 
   store_app_id: metapluginstillextractor
   is_uncontrolled: false
@@ -133,3 +140,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginstillextractor/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginSubtitle/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: fast.
   # ---------------------------------------------------------------------------
   metapluginsubtitle-plugin:
-    image: ghcr.io/worph/metamesh-plugin-subtitle:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle:1.1.0
     cpu_shares: 30
     container_name: metapluginsubtitle-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginsubtitle-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitle/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -107,8 +114,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · Subtitle
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginSubtitle/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginSubtitle/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginSubtitle/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginSubtitle/thumbnail.png
 
   store_app_id: metapluginsubtitle
   is_uncontrolled: false
@@ -134,3 +141,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginsubtitle/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginSubtitleExtractor/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginsubtitleextractor-plugin:
-    image: ghcr.io/worph/metamesh-plugin-subtitle-extractor:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.1.0
     cpu_shares: 30
     container_name: metapluginsubtitleextractor-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginsubtitleextractor-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitleextractor/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitleextractor/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -111,8 +117,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · Subtitle Extractor
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginSubtitleExtractor/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginSubtitleExtractor/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginSubtitleExtractor/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginSubtitleExtractor/thumbnail.png
 
   store_app_id: metapluginsubtitleextractor
   is_uncontrolled: false
@@ -145,3 +151,6 @@ x-compose-app:
     - path: /DATA/AppData/metapluginsubtitleextractor/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metapluginsubtitleextractor/keys
+      user: $PUID
+      group: $PGID

Apps/MetaPluginTMDB/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metaplugintmdb-plugin:
-    image: ghcr.io/worph/metamesh-plugin-tmdb:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-tmdb:1.1.0
     cpu_shares: 30
     container_name: metaplugintmdb-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaplugintmdb-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metaplugintmdb/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metaplugintmdb/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -111,8 +117,8 @@ x-casaos:
   title:
     en_us: MetaPlugin · TMDB
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginTMDB/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginTMDB/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaPluginTMDB/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaPluginTMDB/thumbnail.png
 
   store_app_id: metaplugintmdb
   is_uncontrolled: false
@@ -149,3 +155,6 @@ x-compose-app:
     - path: /DATA/AppData/metaplugintmdb/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metaplugintmdb/keys
+      user: $PUID
+      group: $PGID

Apps/MetaRead/docker-compose.yml

@@ -47,7 +47,7 @@ services:
   # consumer, not a library indexer.
   # ---------------------------------------------------------------------------
   metaread-core:
-    image: ghcr.io/worph/meta-core:1.0.23
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.1.0.1
     container_name: metaread-core
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM instead of
     # swap.
@@ -62,6 +62,8 @@ services:
       - 9000
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metaread/metacore:/meta-core:rw
+      # (meta-core 2.0.0 keeps its rebuildable index cache at
+      # /meta-core/db-cache/cache.db inside this bind — excluded from backups.)
     environment:
       - BASE_URL=http://metaread-core:9000
       - ENABLE_FILE_WATCHER=false
@@ -86,7 +88,7 @@ services:
   # peer count before suspecting the feeders.
   # ---------------------------------------------------------------------------
   metaread-search:
-    image: ghcr.io/worph/meta-search:1.2.9
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
     container_name: metaread-search
     mem_limit: 1g
     memswap_limit: 1g
@@ -103,6 +105,9 @@ services:
       # (beacon v2) instead of reading kv-leader.info off a shared
       # volume. See docs/project-architecture/beacon-v2.md.
       - ${DATA_ROOT:-/DATA}/AppData/metaread/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metaread/keys:/keys:rw
     environment:
       P2P_LISTEN: "/ip4/0.0.0.0/tcp/4001"
       # ⚠ The IPV4 spelling, never the bare APP_PUBLIC_IP: on an IPv6-primary
@@ -121,6 +126,8 @@ services:
       META_CORE_URL: "http://metaread-core:9000"
       BASE_URL: "http://metaread-search:3000"
       INTERNAL_BASE_URL: "http://metaread-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaread-search.key"
       TZ: "$TZ"
     depends_on:
       metaread-core:
@@ -154,7 +161,7 @@ services:
     # MetaShare app's `metashare-<tier>` hostnames, which on a shared `pcs`
     # would be ANOTHER hull's plugins writing to another /data).
     #  - 3000  HTTP API   - 3001  plugin callback API (internal only)
-    image: ghcr.io/worph/meta-share:2.4.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
     container_name: metaread-share
     # The swarm and blockstore moved to the ipfs plugin, so the hull needs far
     # less than the monolith did.
@@ -176,6 +183,9 @@ services:
       # hull's; ipfs/blocks.redb is the ipfs plugin's corner of the SAME folder
       # (layout unchanged from 1.0.x, so an existing cache carries over).
       - ${DATA_ROOT:-/DATA}/AppData/metaread/share-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metaread/keys:/keys:rw
     environment:
       META_CORE_URL: "http://metaread-core:9000"
       BASE_URL: "http://metaread-share:3000"
@@ -183,6 +193,8 @@ services:
       META_SHARE_PLUGIN_IPFS_URL: "http://metaread-share-ipfs:3000"
       META_SHARE_PLUGIN_TORRENT_URL: "off"
       META_SHARE_PLUGIN_NZB_URL: "off"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaread-share.key"
       TZ: "$TZ"
     depends_on:
       metaread-core:
@@ -202,7 +214,7 @@ services:
     # mDNS, bitswap), the blockstore, gateway discovery and the peer directory
     # the hull uses to forward Usenet cids. Waits up to 60 s for the hull's
     # internal /health before opening blocks.redb, so no depends_on.
-    image: ghcr.io/worph/meta-transport-ipfs:1.3.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-transport-ipfs:1.3.4
     container_name: metaread-share-ipfs
     hostname: metaread-share-ipfs
     restart: unless-stopped
@@ -247,7 +259,7 @@ services:
   # My List, Continue Reading and reading positions live in the User Data Layer.
   # ---------------------------------------------------------------------------
   metaread-app:
-    image: ghcr.io/worph/meta-read:1.0.9
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.5.1
     container_name: metaread-app
     hostname: metaread-app
     restart: unless-stopped
@@ -266,10 +278,16 @@ services:
     environment:
       META_SHARE_URL: "http://metaread-share:3000"
       META_SEARCH_URL: "http://metaread-search:3000"
+      # This stack's own meta-core, used ONLY to forward 🐛 bug reports to its
+      # inbox (/api/reports). Unset hides the button.
+      META_CORE_URL: "http://metaread-core:9000"
       # Browser-reachable topbar chips — the AppShield gates below expose the
       # co-located transport and discovery peers behind Yundera OIDC.
       META_SHARE_PUBLIC_URL: "https://metareadshare-${APP_DOMAIN}"
       META_SEARCH_PUBLIC_URL: "https://metareadsearch-${APP_DOMAIN}"
+      # Standalone: this app brings its own meta-core and there is no MetaWatch to
+      # create profiles in, so profile creation stays invite-gated here.
+      META_READ_PROFILE_CREATION: "local"
       TZ: "$TZ"
     depends_on:
       metaread-search:
@@ -300,7 +318,7 @@ services:
       - 80
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metaread-app"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -308,7 +326,7 @@ services:
       caddy_0: metaread-${APP_DOMAIN}
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metaread-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metaread-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 80}}"
       caddy_2: metaread-${APP_PUBLIC_IP_DASH}.sslip.io
@@ -334,7 +352,7 @@ services:
       - 80
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metaread-share"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -342,7 +360,7 @@ services:
       caddy_0: metareadshare-${APP_DOMAIN}
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metareadshare-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metareadshare-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 80}}"
       caddy_2: metareadshare-${APP_PUBLIC_IP_DASH}.sslip.io
@@ -364,7 +382,7 @@ services:
       - 80
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metaread-search"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -372,7 +390,7 @@ services:
       caddy_0: metareadsearch-${APP_DOMAIN}
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metareadsearch-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metareadsearch-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 80}}"
       caddy_2: metareadsearch-${APP_PUBLIC_IP_DASH}.sslip.io
@@ -480,8 +498,8 @@ x-casaos:
   title:
     en_us: MetaRead
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaRead/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaRead/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaRead/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaRead/thumbnail.png
 
   store_app_id: metaread
   is_uncontrolled: false
@@ -521,6 +539,11 @@ x-compose-app:
     - path: /DATA/AppData/metaread/metacore
       user: $PUID
       group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metaread/metacore/db-cache
+      user: $PUID
+      group: $PGID
     - path: /DATA/AppData/metaread/data
       user: $PUID
       group: $PGID
@@ -536,5 +559,13 @@ x-compose-app:
     - path: /DATA/AppData/metaread/metashare-config
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metaread/keys
+      user: $PUID
+      group: $PGID
+  # Derived data only: meta-core rebuilds its index cache from the truth file
+  # (metacore/db/meta-core.db, which IS backed up). keys/ stays backed up.
+  backup:
+    exclude:
+      - metacore/db-cache/
   webui-host: metaread-${domain}
   webui-path: "/"

Apps/MetaReadShared/docker-compose.yml

@@ -60,7 +60,7 @@ services:
   # peer count before suspecting the feeders.
   # ---------------------------------------------------------------------------
   metaread-search:
-    image: ghcr.io/worph/meta-search:1.2.9
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
     container_name: metaread-search
     # 2g, not the self-contained listing's 1g: on the shared core it indexes the
     # gateway box's whole catalogue (~830 MiB steady state on watch.nsl.sh).
@@ -79,11 +79,19 @@ services:
       # (beacon v2) instead of reading kv-leader.info off a shared
       # volume. See docs/project-architecture/beacon-v2.md.
       - ${DATA_ROOT:-/DATA}/AppData/metaread/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metaread/keys:/keys:rw
     environment:
       # Distinct from metawatch-search on the same core, so the two discovery
       # peers do not register under one name.
       SERVICE_NAME: "metaread-search"
       META_SEARCH_PUBLIC_URL: "https://metareadsearch-${APP_DOMAIN}"
+      # Profiles are created in MetaWatch (it shares this box's meta-core), so MetaRead
+      # only signs in with an existing secret key. See META_READ_PROFILE_CREATION in
+      # the meta-read README.
+      META_READ_PROFILE_CREATION: "watch"
+      META_READ_WATCH_URL: "https://metawatch-${APP_DOMAIN}"
       # glibc malloc: cap the per-thread arenas and hand freed memory back to
       # the OS, so RSS comes down after a fan-out burst.
       MALLOC_ARENA_MAX: "2"
@@ -106,6 +114,8 @@ services:
       META_CORE_URL: "http://metacore-app:80"
       BASE_URL: "http://metaread-search:3000"
       INTERNAL_BASE_URL: "http://metaread-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metaread-search.key"
       TZ: "$TZ"
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://localhost:3000/health"]
@@ -127,7 +137,7 @@ services:
   # User Data Layer.
   # ---------------------------------------------------------------------------
   metaread-app:
-    image: ghcr.io/worph/meta-read:1.0.9
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-read:1.5.1
     container_name: metaread-app
     hostname: metaread-app
     restart: unless-stopped
@@ -149,6 +159,10 @@ services:
       SERVICE_NAME: "meta-read"
       META_SHARE_URL: "http://metashare-app:3000"
       META_SEARCH_URL: "http://metaread-search:3000"
+      # The shared MetaCore, used ONLY to forward 🐛 bug reports to its inbox
+      # (/api/reports, read on MetaCore's dashboard → Reports). Unset hides the
+      # button. Reached over `pcs`, like metaread-search.
+      META_CORE_URL: "http://metacore-app:80"
       # Browser-reachable topbar chips. Transport is the shared MetaShare app
       # (its own AppShield gate); discovery is this stack's gate below.
       META_SHARE_PUBLIC_URL: "https://metashare-${APP_DOMAIN}"
@@ -174,14 +188,14 @@ services:
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 3000}}"
 
-      caddy_1: metaread-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metaread-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 3000}}"
 
       caddy_2: metaread-${APP_PUBLIC_IP_DASH}.sslip.io
       caddy_2.reverse_proxy: "{{upstreams 3000}}"
 
-      icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaRead/icon.png
+      icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaRead/icon.png
     networks:
       - metaread
       - pcs
@@ -203,7 +217,7 @@ services:
       - 80
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metaread-search"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -211,7 +225,7 @@ services:
       caddy_0: metareadsearch-${APP_DOMAIN}
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metareadsearch-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metareadsearch-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 80}}"
       caddy_2: metareadsearch-${APP_PUBLIC_IP_DASH}.sslip.io
@@ -304,8 +318,8 @@ x-casaos:
   title:
     en_us: MetaRead (shared backend)
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaRead/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaRead/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaRead/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaRead/thumbnail.png
 
   store_app_id: metareadshared
   is_uncontrolled: false
@@ -356,6 +370,9 @@ x-compose-app:
     - path: /DATA/AppData/metaread/search-data
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metaread/keys
+      user: $PUID
+      group: $PGID
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metaread-${domain}
   webui-path: "/"

Apps/MetaShare/docker-compose.yml

@@ -13,7 +13,7 @@ services:
   #  - 3000  HTTP API + dashboard (proxied through the hash-lock + Caddy)
   #  - 3001  plugin callback API — internal only, never published
   metashare-app:
-    image: ghcr.io/worph/meta-share:2.6.1
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
     container_name: metashare-app
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM instead of
     # swap. The swarm, blockstore and torrent session moved to the plugins, so
@@ -42,6 +42,10 @@ services:
       # host folder, which they mount too — so the tmp/ → cache/ rename(2) stays
       # atomic. Layout unchanged from the monolith: existing caches carry over.
       - ${DATA_ROOT:-/DATA}/AppData/metashare/data:/data:rw
+      # Claim-signing key (meta-core 2.0.0 claims model): the hull's identity on
+      # the claims it writes (content links, archive marks, pointer resolves).
+      # Config — backed up, deliberately NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metashare/keys:/keys:rw
 
     environment:
       # Service registration / neighbour announce.
@@ -51,6 +55,8 @@ services:
       # Inter-peer fetch URL, announced in identify by the ipfs plugin. Same as
       # BASE_URL in prod (other peers fetch via the public Caddy URL).
       - INTERNAL_BASE_URL=https://metashare-$APP_DOMAIN
+      # Own claim-signing key; generated on first boot if missing.
+      - METAMESH_SIGNING_KEY_FILE=/keys/metashare-app.key
       - TZ=$TZ
 
     user: 0:0
@@ -86,7 +92,7 @@ services:
       BACKEND_HOST: "metashare-app"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
 
     depends_on:
       - metashare-app
@@ -115,8 +121,8 @@ services:
       caddy_0.6_handle: ""
       caddy_0.6_handle.reverse_proxy: "{{upstreams 80}}"
 
-      # ---- metashare-IP.nip.io (gateway TLS) ----
+      # ---- metashare-IP.<IP_ZONE> (gateway TLS) ----
-      caddy_1: metashare-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metashare-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.0_handle: "/health"
       caddy_1.0_handle.reverse_proxy: "metashare-app:3000"
@@ -218,12 +224,12 @@ x-casaos:
   title:
     en_us: MetaShare
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaShare/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaShare/icon.png
   screenshot_link:
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaShare/screenshot-1.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaShare/screenshot-1.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaShare/screenshot-2.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaShare/screenshot-2.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaShare/screenshot-3.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaShare/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaShare/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaShare/thumbnail.png
 
   index: /
   store_app_id: metashare
@@ -276,6 +282,9 @@ x-compose-app:
     - path: /DATA/AppData/metashare/data
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metashare/keys
+      user: $PUID
+      group: $PGID
   # Fetched content only: everything under these can be pulled again off the
   # swarm/NNTP/HTTP (meta-share reclaim.rs, "cache means cache"). They are ~94G
   # on a busy peer, so without this every backup — and Maison's pre-update

Apps/MetaSort/docker-compose.yml

@@ -4,7 +4,7 @@ services:
   # Backend service. Reachable on the pcs network as `metasort-app`.
   # Public ingress goes through the `metasort` hash-lock proxy below.
   metasort-app:
-    image: ghcr.io/worph/meta-sort:1.0.12
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-sort:1.1.1
     container_name: metasort-app
     hostname: metasort-app
     restart: unless-stopped
@@ -39,6 +39,11 @@ services:
       - ${DATA_ROOT:-/DATA}/AppData/metasort/config/supervisord-metasort.conf:/etc/supervisor/conf.d/supervisord.conf:ro
       - ${DATA_ROOT:-/DATA}/AppData/metasort/config/nginx-metasort.conf:/etc/nginx/nginx.conf:ro
 
+      # Signing keys (meta-core 2.0.0 claims model): metasort-app.key is
+      # meta-sort's own identity; plugins/<pluginId>.key are minted per plugin
+      # and injected into the plugin containers it spawns. Config — backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metasort/keys:/keys:rw
+
     # Note: no /files mounts — files are accessed via WebDAV from MetaCore
     # (Architecture V3). MetaCore is the single source of truth for media files.
 
@@ -61,6 +66,8 @@ services:
       # Compose project label stamped on the plugin containers meta-sort spawns,
       # so they group under one stack instead of floating loose.
       - PLUGIN_STACK_NAME=metasort-plugins
+      # meta-sort's own claim-signing key; generated on first boot if missing.
+      - METAMESH_SIGNING_KEY_FILE=/keys/metasort-app.key
 
     # Note: Runs as root for nginx, Redis, and file management
     user: 0:0
@@ -89,7 +96,7 @@ services:
       BACKEND_HOST: "metasort-app"
       BACKEND_PORT: "80"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
 
     depends_on:
       - metasort-app
@@ -108,8 +115,8 @@ services:
       caddy_0.1_handle: ""
       caddy_0.1_handle.reverse_proxy: "{{upstreams 80}}"
 
-      # ---- metasort-IP.nip.io (gateway TLS) ----
+      # ---- metasort-IP.<IP_ZONE> (gateway TLS) ----
-      caddy_1: metasort-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metasort-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.0_handle: "/health"
       caddy_1.0_handle.reverse_proxy: "metasort-app:80"
@@ -182,12 +189,12 @@ x-casaos:
   title:
     en_us: MetaSort
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaSort/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaSort/icon.png
   screenshot_link:
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaSort/screenshot-1.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaSort/screenshot-1.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaSort/screenshot-2.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaSort/screenshot-2.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaSort/screenshot-3.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaSort/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaSort/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaSort/thumbnail.png
 
   index: /
   store_app_id: metasort
@@ -217,6 +224,9 @@ x-compose-app:
     - path: /DATA/AppData/metasort/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metasort/keys
+      user: $PUID
+      group: $PGID
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metasort-${domain}
   webui-path: "/"

Apps/MetaSort/seed/config/plugins.yml

@@ -15,7 +15,7 @@ defaults:
 plugins:
   file-info:
     enabled: true
-    image: ghcr.io/worph/metamesh-plugin-file-info:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-file-info:1.1.0
     instances: 1
     resources:
       memory: 128m
@@ -23,7 +23,7 @@ plugins:
 
   ffmpeg:
     enabled: true
-    image: ghcr.io/worph/metamesh-plugin-ffmpeg:1.0.1
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-ffmpeg:1.1.0
     instances: 1
     resources:
       memory: 512m
@@ -31,7 +31,7 @@ plugins:
 
   subtitle:
     enabled: true
-    image: ghcr.io/worph/metamesh-plugin-subtitle:1.0.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle:1.1.0
     instances: 1
     resources:
       memory: 128m
@@ -39,7 +39,7 @@ plugins:
 
   subtitle-extractor:
     enabled: true
-    image: ghcr.io/worph/metamesh-plugin-subtitle-extractor:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.1.0
     instances: 1
     resources:
       memory: 512m
@@ -48,7 +48,7 @@ plugins:
 
   still-extractor:
     enabled: true
-    image: ghcr.io/worph/metamesh-plugin-still-extractor:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-still-extractor:1.1.0
     instances: 1
     resources:
       memory: 512m

Apps/MetaStremio/docker-compose.yml

@@ -2,7 +2,7 @@ name: metastremio
 
 services:
   metastremio:
-    image: ghcr.io/worph/meta-stremio:1.1.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-stremio:1.1.4
     cpu_shares: 50
     container_name: metastremio
     restart: unless-stopped
@@ -45,7 +45,7 @@ services:
       caddy_0: metastremio-${APP_DOMAIN}
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 7000}}"
-      caddy_1: metastremio-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metastremio-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 7000}}"
       caddy_2: metastremio-${APP_PUBLIC_IP_DASH}.sslip.io
@@ -107,12 +107,12 @@ x-casaos:
   title:
     en_us: MetaStremio
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaStremio/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaStremio/icon.png
   screenshot_link:
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaStremio/screenshot-1.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaStremio/screenshot-1.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaStremio/screenshot-2.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaStremio/screenshot-2.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaStremio/screenshot-3.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaStremio/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaStremio/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaStremio/thumbnail.png
 
   index: /
   store_app_id: metastremio

Apps/MetaTransportIpfs/docker-compose.yml

@@ -16,7 +16,7 @@ name: metatransportipfs
 
 services:
   metashare-ipfs:
-    image: ghcr.io/worph/meta-transport-ipfs:1.3.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-transport-ipfs:1.3.4
     container_name: metashare-ipfs
     hostname: metashare-ipfs
     restart: unless-stopped
@@ -121,8 +121,8 @@ x-casaos:
   title:
     en_us: MetaTransport · IPFS
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaTransportIpfs/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaTransportIpfs/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaTransportIpfs/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaTransportIpfs/thumbnail.png
 
   store_app_id: metatransportipfs
   is_uncontrolled: false

Apps/MetaTransportNzb/docker-compose.yml

@@ -16,7 +16,7 @@ name: metatransportnzb
 
 services:
   metashare-nzb:
-    image: ghcr.io/worph/meta-transport-nzb:1.4.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-transport-nzb:1.4.1
     container_name: metashare-nzb
     hostname: metashare-nzb
     restart: unless-stopped
@@ -98,8 +98,8 @@ x-casaos:
   title:
     en_us: MetaTransport · Usenet
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaTransportNzb/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaTransportNzb/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaTransportNzb/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaTransportNzb/thumbnail.png
 
   store_app_id: metatransportnzb
   is_uncontrolled: false

Apps/MetaTransportTorrent/docker-compose.yml

@@ -16,7 +16,7 @@ name: metatransporttorrent
 
 services:
   metashare-torrent:
-    image: ghcr.io/worph/meta-transport-torrent:1.2.2
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-transport-torrent:1.2.3
     container_name: metashare-torrent
     hostname: metashare-torrent
     restart: unless-stopped
@@ -107,8 +107,8 @@ x-casaos:
   title:
     en_us: MetaTransport · BitTorrent
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaTransportTorrent/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaTransportTorrent/icon.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaTransportTorrent/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaTransportTorrent/thumbnail.png
 
   store_app_id: metatransporttorrent
   is_uncontrolled: false

Apps/MetaWatch/README.md

@@ -50,10 +50,10 @@ another MetaShare archivist) must be reachable on the swarm. Install
 
 | Image | Tag |
 |-------|-----|
-| `ghcr.io/worph/meta-watch` | `1.0.34` |
+| `ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch` | `1.0.89` |
-| `ghcr.io/worph/meta-search` | `1.1.0` |
+| `ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search` | `1.2.10` |
-| `ghcr.io/worph/meta-share` | `1.0.26` |
+| `ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share` | `2.6.2` |
-| `ghcr.io/worph/meta-core` | `1.0.12` |
+| `ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core` | `1.0.24` |
 | `ghcr.io/yundera/appshield` | `2.0.9` |
 
 Publish the `worph/*` tags before listing the app — `:latest` tracks the newest

Apps/MetaWatch/docker-compose.yml

@@ -29,7 +29,7 @@ services:
   metawatch-core:
     # 1.0.1 carries the identity API (commit 52f5b5c) required for MetaWatch
     # sign-in / keypair generation; 1.0.0 predates it.
-    image: ghcr.io/worph/meta-core:1.0.23
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.1.0.1
     container_name: metawatch-core
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
     # instead of swap. Mirrors the dev sub-stack limits.
@@ -44,6 +44,8 @@ services:
       - 9000
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/metacore:/meta-core:rw
+      # (meta-core 2.0.0 keeps its rebuildable index cache at
+      # /meta-core/db-cache/cache.db inside this bind — excluded from backups.)
       # Subtitle store: player-uploaded subtitles land in /files/plugin/subtitles
       # (WebDAV PUT + POST /api/files/register, needs meta-core with that route).
       # Plugin output only — no /files/watch mount, watcher stays off.
@@ -72,7 +74,7 @@ services:
     # RSA-keyed bootstrap.libp2p.io nodes) and therefore to DISCOVER remote
     # gateways via the kad `metamesh-gateway` provider namespace. Without it
     # this peer only ever sees same-host mDNS peers.
-    image: ghcr.io/worph/meta-search:1.2.9
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
     container_name: metawatch-search
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
     # instead of swap. Mirrors the dev sub-stack limits.
@@ -96,6 +98,9 @@ services:
       # swarm. Without this mount both are on the container's writable layer and
       # every image bump loses the prefs and re-fetches every poster.
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
     environment:
       P2P_LISTEN: "/ip4/0.0.0.0/tcp/4001"
       # Public IPFS DHT bootstraps by explicit /dns4/.../tcp/4001 (the nested
@@ -121,6 +126,8 @@ services:
       SEARCH_TIMEOUT_SECS: "300"
       META_CORE_URL: "http://metawatch-core:9000"
       BASE_URL: "http://metawatch-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-search.key"
       # Renamed at the 1.1.0 bump (2026-08-26), as the old note here said to do:
       # META_SHARE_PEER_API_URL was the pre-1.0.8 spelling and now only logs a
       # deprecation warning. Do NOT set both.
@@ -157,7 +164,7 @@ services:
     # MetaShare app's `metashare-<tier>` hostnames, which on a shared `pcs`
     # would be ANOTHER hull's plugins writing to another /data).
     #  - 3000  HTTP API   - 3001  plugin callback API (internal only)
-    image: ghcr.io/worph/meta-share:2.4.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
     container_name: metawatch-share
     # The swarm and blockstore moved to the ipfs plugin, so the hull needs far
     # less than the monolith did.
@@ -179,6 +186,9 @@ services:
       # hull's; ipfs/blocks.redb is the ipfs plugin's corner of the SAME folder
       # (layout unchanged from 1.0.x, so an existing cache carries over).
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/share-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
     environment:
       META_CORE_URL: "http://metawatch-core:9000"
       BASE_URL: "http://metawatch-share:3000"
@@ -186,6 +196,8 @@ services:
       META_SHARE_PLUGIN_IPFS_URL: "http://metawatch-share-ipfs:3000"
       META_SHARE_PLUGIN_TORRENT_URL: "off"
       META_SHARE_PLUGIN_NZB_URL: "off"
+      # Own claim-signing key; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-share.key"
       TZ: "$TZ"
     depends_on:
       metawatch-core:
@@ -205,7 +217,7 @@ services:
     # mDNS, bitswap), the blockstore, gateway discovery and the peer directory
     # the hull uses to forward Usenet cids. Waits up to 60 s for the hull's
     # internal /health before opening blocks.redb, so no depends_on.
-    image: ghcr.io/worph/meta-transport-ipfs:1.3.0
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-transport-ipfs:1.3.4
     container_name: metawatch-share-ipfs
     hostname: metawatch-share-ipfs
     restart: unless-stopped
@@ -250,8 +262,12 @@ services:
   # My List + Continue Watching persist in /DATA/AppData/metawatch/data.
   # ---------------------------------------------------------------------------
   metawatch-app:
-    image: ghcr.io/worph/meta-watch:1.0.85
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.2.2
     container_name: metawatch-app
+    # Run as the PUID that Maison creates the app folders with (as the Shared
+    # variant does). The image default user (uid 10001) cannot write them on a
+    # fresh install: "create ipfs dir … Permission denied".
+    user: "1000:1000"
     hostname: metawatch-app
     restart: unless-stopped
     cpu_shares: 30
@@ -264,6 +280,9 @@ services:
       - 3000
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/data:/app/data
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
     environment:
       META_SHARE_URL: "http://metawatch-share:3000"
       META_SEARCH_URL: "http://metawatch-search:3000"
@@ -275,6 +294,8 @@ services:
       META_WATCH_SYNC_PEERS: "http://metawatch-search:3000"
       # This box's own core — subtitle store only (uploads + curated matches).
       META_CORE_URL: "http://metawatch-core:9000"
+      # Own claim-signing key for the subtitle-store claims it writes; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-app.key"
       TZ: "$TZ"
     depends_on:
       metawatch-search:
@@ -310,7 +331,7 @@ services:
       BACKEND_HOST: "metawatch-app"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
     depends_on:
       - metawatch-app
     labels:
@@ -322,8 +343,8 @@ services:
       caddy_0.1_handle: ""
       caddy_0.1_handle.reverse_proxy: "{{upstreams 80}}"
 
-      # ---- metawatch-IP.nip.io (gateway TLS) ----
+      # ---- metawatch-IP.<IP_ZONE> (gateway TLS) ----
-      caddy_1: metawatch-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metawatch-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.0_handle: "/health"
       caddy_1.0_handle.reverse_proxy: "metawatch-app:3000"
@@ -359,7 +380,7 @@ services:
     expose: ["80"]
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metawatch-share"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -367,7 +388,7 @@ services:
       caddy_0: metawatchshare-${APP_DOMAIN}
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metawatchshare-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metawatchshare-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 80}}"
       caddy_2: metawatchshare-${APP_PUBLIC_IP_DASH}.sslip.io
@@ -388,7 +409,7 @@ services:
     expose: ["80"]
     environment:
       OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
       BACKEND_HOST: "metawatch-search"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
@@ -396,7 +417,7 @@ services:
       caddy_0: metawatchsearch-${APP_DOMAIN}
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: metawatchsearch-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metawatchsearch-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 80}}"
       caddy_2: metawatchsearch-${APP_PUBLIC_IP_DASH}.sslip.io
@@ -478,12 +499,12 @@ x-casaos:
   title:
     en_us: MetaWatch
 
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/icon.png
   screenshot_link:
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/screenshot-1.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/screenshot-1.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/screenshot-2.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/screenshot-2.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/screenshot-3.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/thumbnail.png
 
   index: /
   store_app_id: metawatch
@@ -526,6 +547,11 @@ x-compose-app:
     - path: /DATA/AppData/metawatch/metacore
       user: $PUID
       group: $PGID
+    # meta-core 2.0.0 rebuildable index cache (default
+    # /meta-core/db-cache/cache.db). Excluded from backups below.
+    - path: /DATA/AppData/metawatch/metacore/db-cache
+      user: $PUID
+      group: $PGID
     - path: /DATA/AppData/metawatch/search-data
       user: $PUID
       group: $PGID
@@ -541,6 +567,14 @@ x-compose-app:
     - path: /DATA/AppData/metawatch/data
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metawatch/keys
+      user: $PUID
+      group: $PGID
+  # Derived data only: meta-core rebuilds its index cache from the truth file
+  # (metacore/db/meta-core.db, which IS backed up). keys/ stays backed up.
+  backup:
+    exclude:
+      - metacore/db-cache/
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metawatch-${domain}
   webui-path: "/"

Apps/MetaWatchShared/docker-compose.yml

@@ -45,7 +45,7 @@ services:
   # core of its own.
   # ---------------------------------------------------------------------------
   metawatch-search:
-    image: ghcr.io/worph/meta-search:1.2.9
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
     container_name: metawatch-search
     hostname: metawatch-search
     restart: unless-stopped
@@ -71,6 +71,9 @@ services:
       # swarm. Without this mount both are on the container's writable layer and
       # every image bump loses the prefs and re-fetches every poster.
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/search-data:/data:rw
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
     environment:
       P2P_LISTEN: "/ip4/0.0.0.0/tcp/4001"
       # Public IPFS DHT bootstraps by explicit /dns4/.../tcp/4001 (the nested
@@ -93,6 +96,8 @@ services:
       META_CORE_URL: "http://metacore-app:80"
       BASE_URL: "http://metawatch-search:3000"
       INTERNAL_BASE_URL: "http://metawatch-search:3000"
+      # Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-search.key"
       TZ: "$TZ"
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://localhost:3000/health"]
@@ -115,7 +120,7 @@ services:
   # owns the caddy_* labels directly and Caddy proxies straight to :3000.
   # ---------------------------------------------------------------------------
   metawatch-app:
-    image: ghcr.io/worph/meta-watch:1.0.85
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.2.2
     container_name: metawatch-app
     hostname: metawatch-app
     restart: unless-stopped
@@ -130,6 +135,9 @@ services:
       - 3000
     volumes:
       - ${DATA_ROOT:-/DATA}/AppData/metawatch/data:/app/data
+      # Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
+      # service in this stack. Config — backed up, NOT in backup.exclude.
+      - ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
     environment:
       # The STANDALONE MetaShare app — this variant ships no transport peer.
       META_SHARE_URL: "http://metashare-app:3000"
@@ -143,6 +151,8 @@ services:
       # variant has no private core: it writes to the standalone MetaCore app,
       # which already mounts /files and runs the watcher.
       META_CORE_URL: "http://metacore-app:80"
+      # Own claim-signing key for the subtitle-store claims it writes; generated on first boot if missing.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-app.key"
       TZ: "$TZ"
     depends_on:
       metawatch-search:
@@ -159,8 +169,8 @@ services:
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 3000}}"
 
-      # ---- metawatch-IP.nip.io (gateway TLS) ----
+      # ---- metawatch-IP.<IP_ZONE> (gateway TLS) ----
-      caddy_1: metawatch-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metawatch-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 3000}}"
 
@@ -168,7 +178,7 @@ services:
       caddy_2: metawatch-${APP_PUBLIC_IP_DASH}.sslip.io
       caddy_2.reverse_proxy: "{{upstreams 3000}}"
 
-      icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/icon.png
+      icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/icon.png
     networks:
       - metawatch
       - pcs
@@ -197,7 +207,7 @@ services:
       BACKEND_HOST: "metawatch-search"
       BACKEND_PORT: "3000"
       LISTEN_PORT: "80"
-      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
     depends_on:
       - metawatch-search
     labels:
@@ -205,14 +215,14 @@ services:
       caddy_0.import: gateway_tls
       caddy_0.reverse_proxy: "{{upstreams 80}}"
 
-      caddy_1: metawatchsearch-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1: metawatchsearch-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}
       caddy_1.import: gateway_tls
       caddy_1.reverse_proxy: "{{upstreams 80}}"
 
       caddy_2: metawatchsearch-${APP_PUBLIC_IP_DASH}.sslip.io
       caddy_2.reverse_proxy: "{{upstreams 80}}"
 
-      icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/icon.png
+      icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/icon.png
     networks:
       - metawatch
       - pcs
@@ -237,7 +247,7 @@ x-casaos:
   tags: ["media", "needs-public-ip"]
   developer: Aptero Team
   hostname: metawatch-${APP_DOMAIN}
-  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/icon.png
+  icon: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/icon.png
   index: /
   is_uncontrolled: false
   main: metawatch-app
@@ -245,10 +255,10 @@ x-casaos:
   scheme: https
   store_app_id: metawatchshared
   screenshot_link:
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/screenshot-1.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/screenshot-1.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/screenshot-2.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/screenshot-2.png
-    - https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/screenshot-3.png
+    - https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/screenshot-3.png
-  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaWatch/thumbnail.png
+  thumbnail: https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/MetaWatch/thumbnail.png
   title:
     en_us: MetaWatch (shared backend)
   tagline:
@@ -346,6 +356,9 @@ x-compose-app:
     - path: /DATA/AppData/metawatch/data
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metawatch/keys
+      user: $PUID
+      group: $PGID
   # Same string as the caddy_0 label, so the tile link and the route agree.
   webui-host: metawatch-${domain}
   webui-path: "/"

CLAUDE.md

@@ -11,14 +11,15 @@ that are *not* MetaMesh (Jellyfin, Nextcloud, MetaMCP — third-party
 `metatool-ai` software despite the name, …) stay in `Worph/AppStore` and must
 not be added here.
 
-⚠ **Asset URLs are repo-scoped.** Everything in this repo must reference
+⚠ **Asset URLs point at this repo on Gitea.** Everything in this repo must reference
-`https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/{AppName}/`. A file
+`https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/{AppName}/`.
-copied over from `Worph/AppStore` will carry the old
+The GitHub repos are gone, so every jsDelivr `cdn.jsdelivr.net/gh/Worph/...` URL
-`.../gh/Worph/AppStore@main/...` URL and its icon will silently 404 in the store
+(this repo's old ones, or `.../gh/Worph/AppStore@main/...` in a file copied over
+from `Worph/AppStore`) 404s and the icon silently disappears from the store
 listing. Grep after any import:
 
 ```bash
-grep -rn 'gh/Worph/AppStore@main' Apps/   # must be empty
+grep -rn 'cdn.jsdelivr.net/gh/Worph' Apps/   # must be empty
 ```
 
 ## Structure
@@ -39,10 +40,11 @@ grep -rn 'gh/Worph/AppStore@main' Apps/   # must be empty
 - **Networking**: `expose`, not `ports`; main services join the external `pcs`
   network for Caddy routing. Three caddy labels per public service:
   `caddy_0` gateway domain (`appname-${APP_DOMAIN}`, `gateway_tls` import),
-  `caddy_1` nip.io, `caddy_2` sslip.io (Let's Encrypt, no import)
+  `caddy_1` `<app>-${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE}` (the IP zone, `gateway_tls` import), `caddy_2` sslip.io (Let's Encrypt, no import)
 - **`store_app_id`** is the lowercased app name (`MetaFeederTMDB` → `metafeedertmdb`)
-- **Images**: `ghcr.io/worph/meta*` pinned to `:latest` on purpose; the Yundera
+- **Images**: pulled from IPCR on watch.nsl.sh, `ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/<image>:<version>`,
-  perimeter images (`nginx-hash-lock`, `appshield`) stay version-pinned
+  pinned to explicit versions (built by each repo's `.gitea/workflows/` on gitea-watch.nsl.sh/metastar on `v*` tags;
+  ghcr.io/worph is no longer published). The Yundera perimeter images (`nginx-hash-lock`, `appshield`) stay on ghcr.io/yundera
 - **Install order**: `MetaCore` first — every other app depends on it
 - **Multi-language**: descriptions/taglines carry `en_us`, `fr_fr`, `es_es`, `zh_cn`, `ko_kr`, `de_de`
 
@@ -103,5 +105,5 @@ shared MetaPlugin app requires setting the variable explicitly.
 ```bash
 docker compose -f Apps/{AppName}/docker-compose.yml config   # compose validity
 jq . category-list.json recommend-list.json featured-apps.json
-grep -rn 'gh/Worph/AppStore@main' Apps/                       # must be empty
+grep -rn 'cdn.jsdelivr.net/gh/Worph' Apps/                     # must be empty
 ```

CONTRIBUTING.md

@@ -2,4 +2,4 @@
 Refer to https://raw.githubusercontent.com/Yundera/AppStore/refs/heads/main/CONTRIBUTING.md
 
 only difference is in this repos the links for assets and appstore are different
-use https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/
+use https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/

README.md

@@ -11,7 +11,7 @@ collection.
 In Yundera / CasaOS → App Store → *Add source*:
 
 ```
-https://github.com/Worph/MetaAppStore/archive/refs/heads/main.zip
+https://gitea-watch.nsl.sh/metastar/MetaAppStore/archive/main.zip
 ```
 
 ## What's in here
@@ -40,10 +40,11 @@ tier `MetaFeederSuwayomi` reads) and **SegmentPlayer**.
 
 ## Assets
 
-Icons and screenshots are served from jsDelivr:
+Icons and screenshots are served by Gitea, as raw files of this repo (the GitHub
+repo, and with it the jsDelivr `gh/Worph/...` URLs, is gone):
 
 ```
-https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/{AppName}/
+https://gitea-watch.nsl.sh/metastar/MetaAppStore/raw/branch/main/Apps/{AppName}/
 ```
 
 `psd-source/meta-icons-v2/` holds the procedural icon generator for the family —