fix: retire the port bindings left over from StartOS 0.3.5; 34.0.4:4 → 34.0.4:5

[MattDHill]

Summary

The 0.3.5 manifest (v30.0.11:manifest.yaml) mapped Tor 80 and 443 to container 80 and 443 and LAN 443 to container 8080, so the compat runtime that ran it on 0.4 bound all three on host main (SystemForEmbassy.exportNetwork takes the union of the Tor port-mapping targets and the LAN internal ports). Every 0.4-native version binds 80 alone. setupInterfaces ends its pass by disabling the bindings it did not declare rather than deleting them, so a server migrated from 0.3.5 still carries the 443 and 8080 records: enabled: false, holding their external ports and recomputing bridge addresses nothing listens on. Tor's migration attached the onion to 8080 (the LAN binding writes its onion ports last), so the address keeps resolving a dead target — Start9Labs/tor-startos#36.

up() retires both with retirePort, which returns their ports to the pool and deletes the records. Retiring is the signal Tor acts on: under Start9Labs/tor-startos#39 the onion attached to 8080 becomes unused — out of torrc and off the interface page, key kept — and Add Onion Service on the Web UI interface offers it back, hostname intact. The release note should say that once #39 ships. On an install that never carried the bindings, retirePort resolves false and nothing happens. The host and its domains stay, and port 80's own binding keeps the external ports it already holds, so no Nextcloud address changes.

Draft until the SDK 3.0 sweep lands here

retirePort ships in @start9labs/start-sdk 3.0.0 and its retireBinding effect in StartOS 0.4.0.2. Neither is released, and this repo's 3.0.0 bump belongs to the fleet sweep's PR rather than this one, so against 2.0.9 the type-check fails on exactly those two calls:

startos/versions/current.ts(16,18): error TS2339: Property 'retirePort' does not exist on type 'MultiHost'.
startos/versions/current.ts(17,18): error TS2339: Property 'retirePort' does not exist on type 'MultiHost'.

To finish once the sweep PR is in: rebase onto it, move the version past whatever master carries by then, get the build gate green, and verify on a 0.4.0.2 box against a server migrated from 0.3.5 that the main host has neither a 443 nor an 8080 binding afterwards and Nextcloud's addresses are unchanged. Not exercised on a box.

🤖 Generated with Claude Code