Running ./install/build_offline_bundle_docker.sh from a checkout on a USB stick
failed with "No Docker socket at /var/run/docker.sock" — advice that cannot be
followed, since Docker Desktop is reached over a named pipe. Three separate
faults sat behind it.
1. Windows was never supported despite the docs claiming otherwise. The socket
test only means something where a socket file is what gets mounted; MSYS also
rewrites the Unix-looking paths in every -v argument. Guard the test, convert
mount sources with cygpath, and set MSYS_NO_PATHCONV so targets, the socket
path and the workdir survive verbatim.
2. Identity mapping broke on Windows. The build starts further containers whose
bind mounts are resolved by the host daemon, so a path must mean the same
thing on both sides. On Linux that is free. On Windows it is not: the daemon
speaks Windows paths and a Linux container cannot have a directory called
C:/Users. Mount inside the container at /run/desktop/mnt/host/<drive>/… —
the form Docker Desktop's VM resolves — and hand the inner script the same.
Without this the APT resolver wrote 106 .debs into a phantom directory and
the build died with "no package index was produced". That check happens to
run host-side; had it run in the container, the result would have been a
bundle that built, self-verified, and was empty.
3. Docker Desktop shares only fixed drives. Removable and exFAT volumes mount as
an EMPTY directory instead of failing. Probe each path with a marker file, and
work around what is found: stage the checkout when the source is unmountable,
and build into staging then copy across when the output is. Writing a bundle
straight to the USB stick it will travel on is the whole point of the tool, and
the host can write there even when the daemon cannot read there.
Verified end to end on Windows/Git Bash from an exFAT checkout: a 978 MB bundle
with 106 .debs and 6 images landed on the removable drive, and
verify_offline_bundle.sh passes against that copy.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`./install/build_offline_bundle_docker.sh` on Windows died with "No Docker
socket at /var/run/docker.sock. Set NOMAD_DOCKER_SOCKET if yours lives
elsewhere." — advice that cannot be followed, because there is no socket path
to point at. Docker Desktop is reached over a named pipe.
The docs claimed "Linux, macOS and Windows build machines all produce the same
bundle", which is not true of Windows' native shells and is what sent the user
down this path.
Relaxing the `-S` guard would not fix it. The build starts further containers
whose bind mounts are resolved by the host daemon, and MSYS rewrites the
Unix-looking paths in every -v argument — so the socket mount, the repo mount
and the output mount each need different treatment. Dropping the check just
moves the failure somewhere less obvious.
So: detect MSYS/MinGW/Cygwin and fail immediately with the actual remedy (build
from WSL2, Linux or macOS), and correct the Windows claim in the docs. Real
Git Bash support would mean reworking mount-path construction and is a separate
piece of work.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
management_compose.yaml pins the published Command Center image and the
builder pulls it unconditionally, so a bundle always carries the *released*
admin application. That makes an admin-side change impossible to test on an
air-gapped target until it ships in an image — including the Easy Setup
offline fixes in this branch.
With --use-local-images, an image already in the daemon is bundled as-is.
Anything not present locally is still pulled, so the flag cannot quietly
produce a bundle with a gap in it. It is opt-in because it deliberately does
not verify that a local image resembles the tag it claims.
Bundles built this way record USED_LOCAL_IMAGES=1 in the manifest and carry a
"not for distribution" note in README.txt. The manifest is read key-by-key by
the installer, so the added key needs no format bump.
The docker wrapper forwards the flag through its existing catch-all, and
`docker image inspect` inside the build container resolves against the host
daemon via the mounted socket, so host-built images are visible.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
An air-gapped host installed from an artifact bundle could not use Easy
Setup at all, which defeated the point: the bundle had already put the app
images on disk.
Two independent faults.
The Wikipedia catalog was the only one of the page's four catalogs that
threw on a failed fetch rather than degrading, so GET /api/zim/wikipedia
returned 500 offline and the UI showed "An internal error occurred". It now
reads the manifest through CollectionManifestService like the curated
categories, maps and creator packs already do — refresh when reachable,
cached copy when not, empty list when neither. The second, laxer schema for
the same remote file is deleted; having two is what let the offline path
diverge in the first place.
Navigation and completion were gated on a blanket !isOnline check. Stepping
through the wizard needs nothing from the network, and installing an app
whose image is already in the local Docker daemon works air-gapped because
the install path skips the registry pull. The gate is now per-selection:
- The page reports which services have a local image, so offline the
capability cards offer exactly those and badge the rest "Needs internet"
rather than queuing an install that would fail mid-pull.
- Map regions, content tiers, creator packs, AI models and Wikipedia are
genuinely remote, so those steps stay unselectable — but they now say why
instead of leaving dead cards.
- Complete Setup is blocked offline only when a selection actually needs a
download, and names which ones.
The offline decision logic is a pure module with unit tests.
Two gaps found and documented rather than changed here: an AMD host still
can't install Ollama offline (the install swaps to ollama/ollama:rocm, which
--with-apps doesn't bundle), and remote Ollama can't be configured from the
wizard offline since its checkbox lives behind the AI capability card.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Add admin/docs/offline-install.md covering the build-and-carry workflow,
bundle layout and manifest, how artifact mode stays offline, GPU support,
bundling Supply Depot apps, updating an air-gapped install, troubleshooting,
and an explicit statement of what is and is not covered.
Link it from the README and soften the two "stable internet connection
required during install" lines to point at it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The MeshCore Web app doc listed meshcore.co.uk as the official site. The
canonical MeshCore project (github.com/meshcore-dev/MeshCore, the firmware +
protocol) declares its homepage as meshcore.io, so update the two references
in the MeshCore Web section to point there.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Validated Project NOMAD on Ubuntu 26.04 LTS across two builds (an AMD/CPU
box and an NVIDIA RTX 5060 box), so recommend 26.04 as the default going
forward. 24.04 LTS and Debian 12 remain supported.
- bug_report.yml: add Ubuntu 26.04 (Resolute Raccoon) to the OS dropdown
- README / CONTRIBUTING / FAQ: name Ubuntu 26.04 LTS as the recommended version
- getting-started.md: correct the GPU note. NOMAD's installer sets up the
NVIDIA Container Toolkit and Docker runtime automatically; the user only
needs the NVIDIA driver (via "Install third-party drivers" at OS setup)
Retire the dotted "N.O.M.A.D." styling everywhere in favor of
"Project NOMAD" (no periods) ahead of the trademark filing, and
remove the "Node for Offline Media, Archives, and Data" backronym
from all copy except a single origin-story line in the About page
(corrected to "Maps" rather than "Media").
Scope is display strings only: docs, admin UI labels/titles, install
script output, Dockerfile labels, package.json description, and issue
templates. Code identifiers, container/service names, env vars, CSS
tokens, URLs, and the project-nomad slug are unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: replace legacy Kolibri image default with latest v19 image
* feat(supply-depot): add content migration instructions for Edu Platform Gen 1 to 2
Adds the MeshCore web client to the Supply Depot catalog (host port 8500),
alongside the existing Meshtastic apps. Uses aXistem's prebuilt image of Liam
Cottle's MeshCore client (MeshCore is a sibling LoRa mesh project to Meshtastic).
The image is stock nginx serving a static Flutter build over HTTP, but the
client reaches radios via Web Bluetooth / Web Serial, which browsers only allow
from a secure (HTTPS) context. So we serve it over HTTPS: a new preinstall hook
generates a self-signed cert + a small SSL nginx config into storage/meshcore-web,
both bind-mounted into the container (the config over the image's default.conf),
publishing 443. Same one-time browser-warning approach as Vaultwarden, whose
openssl cert generation is refactored into a shared _ensureSelfSignedCert helper.
Also adds a NOMAD-specific docs section + Manage>Docs anchor, and registers the
IconAntenna icon. Meshtastic Web left unchanged.
Validated on NOMAD3 (v1.33.0-rc.1): the image + SSL config + self-signed cert
serves the MeshCore Flutter app over HTTPS 200 with working SPA fallback.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Refresh the in-app Markdoc docs for the v1.33 feature set:
- Repoint dead /settings/apps links to the Supply Depot (/supply-depot)
across home, getting-started, and faq; reword "Apps page" / "Settings
-> Apps" to "Supply Depot". The old /apps route now redirects to the
Supply Depot.
- Expand supply-depot-apps.md with a "Managing your apps" section (Docs/
Edit/Logs/Stats/Update/Remove, version + update-available visibility,
custom launch URLs, per-app auto-update toggle) and a "Bringing your
own app" section for custom Docker containers.
- Add a new "Updates" doc (updates.md) covering the auto-update trilogy
(core/apps/content), manual updates, and the Early Access channel;
wire it into DOC_ORDER and cross-link from home, getting-started, faq.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add NOMAD-specific getting-started docs for all 9 curated Supply Depot apps,
the catalog/install fixes each one surfaced, and a way to reach the docs from
each app card.
Docs:
- New in-app Markdoc page admin/docs/supply-depot-apps.md covering all 9 apps
(Stirling PDF, File Browser, Calibre-Web, IT Tools, Excalidraw, Homebox,
Vaultwarden, Jellyfin, Meshtastic Web): first run/login, where data lives,
and offline behaviour. Registered in docs_service DOC_ORDER.
- Manage > Docs dropdown item linking each app to its section
(/docs/supply-depot-apps#<anchor>): anchor map in constants/supply_depot_docs.ts,
heading anchors via Markdoc {% #id %}, and hash-scroll on the docs page.
Install / catalog fixes:
- Stirling PDF: open straight to the tools (SECURITY_ENABLELOGIN=false; the old
v1 DOCKER_ENABLE_SECURITY flag was dead).
- File Browser: seed a known admin/nomad login (bcrypt) instead of a random
log-only password; scope visibility to content folders via mount selection and
move the DB out of the browsable root.
- Calibre-Web: bundle an empty Calibre library and seed it on install so setup
doesn't dead-end at db config (_runPreinstallActions__CalibreWeb).
- Homebox: swap the archived hay-kot image for the maintained sysadminsmedia fork.
- Vaultwarden: generate a self-signed cert on install and serve HTTPS by default
(_runPreinstallActions__Vaultwarden + ROCKET_TLS + ui_location https:8480), so
the web vault has the secure context it requires.
- Jellyfin: pre-create storage/media/{Movies,TV Shows,Music,Photos} so each
library points at its own subfolder, avoiding the overlapping-path issue that
silently hides content (_runPreinstallActions__Jellyfin).
- Seeder run() now also syncs ui_location for non-modified curated services, so a
catalog link/scheme/port change reaches existing installs on update.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace literal string matching with ipaddr.js parsing
so equivalent encodings of 169.254.169.254
(::ffff:169.254.169.254, ::ffff:a9fe:a9fe,fully-expanded forms)
and fd00:ec2::254 are all rejected.
Introduces a dedicated page listing third-party ZIM content packs built
by the community. Launches with the two current add-ons (jrsphoto field
manuals, kennethbrewer W3Schools) and explains how to install a ZIM pack
and where to submit a new one for inclusion.
- New doc at admin/docs/community-add-ons.md
- Wired into DocsService DOC_ORDER (slot 4) and TITLE_OVERRIDES so the
hyphen in "Add-Ons" is preserved in the sidebar
- README gets a link under Community & Resources
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ken Eucker
cosmistack-bot
jakeaturner
chriscrosstalk
Jake Turner
Chris Sherwood
Kenneth Brewer
gujishh
Henry Estela