App Submission: Tunnelsats v3.0.0

[TrezorHannes]

PR: [feat]: Add Tunnelsats VPN App v3.0.0

Summary of Changes

• Added the Tunnelsats VPN app to the Umbrel App Store (v3.0.0).
• Users can now seamlessly connect their Lightning Nodes to the Tunnelsats VPN via an easy-to-use dedicated UI instead of legacy bash scripts.
• The app utilizes Umbrel's Dockerized environment to natively apply routing logic instead of relying on heavy host-level nftables adjustments.

Detailed Changes

• tunnelsats: Created the new app directory.
• umbrel-app.yml & docker-compose.yml: Defined the app's metadata, dependencies, and network bindings (network_mode: host) to allow cap_add: [NET_ADMIN, NET_RAW].
• server/app.py: Implemented a lightweight Python backend wrapper to proxy Tunnelsats public API calls and manage local /data configurations. Added /api/local/restore-node to safely revert LND/CLN configs upon uninstall.
• web/: Implemented a responsive frontend for users to generate Lightning Invoices for new/renewed subscriptions, import existing configs, and check tunnel status, styled to mirror standard Umbrel UI experiences.
• scripts/entrypoint.sh: Replaced the hardcoded wait-loop to an indefinite backoff for Lightning container IP resolution.

Testing Strategy

• Unit/Integration Tests: Validated the multi-arch (linux/arm64, linux/amd64) image build and pushing process.
• Manual Verification:
  • Validated frontend rendering and functionality.
  • Verified container startup behavior against slow-booting Tor/LND instances.
  • Ensured uninstallation does not leave the Umbrel device with unreachable static routes.
• Verification Result: All UI logic and internal API proxies passing ✅

What's Left for Later

• Phase 8: Updating the legacy tunnelsats.sh script to reject installation on Umbrel OS >= 1.6 and redirect users to the App Store.

Checklist

• Code follows project conventions
• All tests passing locally
• Documentation updated (Wiki/README)
• Sensitive data removed (Secrets/Logs)

[github-actions]

❌   Linting failed with 5 errors and 5 warnings   ❌

Thank you for your submission! This is an automated linter that checks for common issues in pull requests to the Umbrel App Store.

Please review the linting results below and make any necessary changes to your submission.

Linting Results

Severity	File	Description
❌	tunnelsats/docker-compose.yml	Invalid image name "tunnelsats/umbrel-app:latest": Images should be named like "<name>:<version-tag>@<sha256>"
⚠️	tunnelsats/docker-compose.yml	Volume "${APP_DATA_DIR:-./data}:/data": Volumes should not be mounted directly into the "${APP_DATA_DIR}" directory! Please use a subdirectory like "${APP_DATA_DIR}/data-./data}" instead.
⚠️	tunnelsats/docker-compose.yml	Volume "${APP_DATA_DIR:-./data}/../lightning/data/lnd:/lightning-data/lnd": Volumes should not be mounted directly into the "${APP_DATA_DIR}" directory! Please use a subdirectory like "${APP_DATA_DIR}/data-./data}/../lightning/data/lnd" instead.
⚠️	tunnelsats/docker-compose.yml	Volume "${APP_DATA_DIR:-./data}/../core-lightning/data/lightningd/bitcoin:/lightning-data/cln": Volumes should not be mounted directly into the "${APP_DATA_DIR}" directory! Please use a subdirectory like "${APP_DATA_DIR}/data-./data}/../core-lightning/data/lightningd/bitcoin" instead.
⚠️	tunnelsats/docker-compose.yml	Docker socket is mounted in "tunnelsats": The volume "/var/run/docker.sock:/var/run/docker.sock:ro" mounts the Docker socket, which can be a security risk. Consider using docker-in-docker instead (see portainer as an example).
ℹ️	tunnelsats/docker-compose.yml	Potentially using unsafe user in service "tunnelsats": The default container user "root" can lead to security vulnerabilities. If you are using the root user, please try to specify a different user (e.g. "1000:1000") in the compose file or try to set the UID/PUID and GID/PGID environment variables to 1000.
ℹ️	tunnelsats/docker-compose.yml	Service "tunnelsats" uses host network mode: The host network mode can lead to security vulnerabilities. If possible please use the default bridge network mode and expose the necessary ports.
❌	tunnelsats/umbrel-app.yml	submitter: The "submitter" key is required
❌	tunnelsats/umbrel-app.yml	submission: The "submission" key is required
❌	tunnelsats/umbrel-app.yml	Invalid submission field "undefined": The submission field must be set to the URL of this pull request: https://github\.com/getumbrel/umbrel\-apps/pull/4919
❌	tunnelsats/umbrel-app.yml	"releaseNotes" needs to be empty for new app submissions: The "releaseNotes" field must be empty for new app submissions as it is being displayed to the user only in case of an update.
⚠️	tunnelsats/umbrel-app.yml	"icon" and "gallery" needs to be empty for new app submissions: The "icon" and "gallery" fields must be empty for new app submissions as it is being created by the Umbrel team.

Legend

Symbol	Description
❌	Error: This must be resolved before this PR can be merged.
⚠️	Warning: This is highly encouraged to be resolved, but is not strictly mandatory.
ℹ️	Info: This is just for your information.