allen/kit-busrouter
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: revert TUNNEL_LOCAL_SSH_PORT to 2223, fix registry, add incident docs

Browse Source 
- wizard.sh + connect.conf: TUNNEL_LOCAL_SSH_PORT back to 2223 (Synology SSH port)
- port-registry: renamed x6340 → x4662 (matches QuickConnect ID)
- port-registry: added MR2200ac mesh satellite note for x4662
- deployment checklist: added kit-connect section, post-deployment rules,
  incident log, and complete fleet port registry table
- memory: added fleet-router-inventory.md with full fleet state
- hub README: updated with current status and locations

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
kitadmin
2026-07-22 21:20:08 +00:00
parent 44566d9563
commit 24d8fbd366
178 changed files with 874 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment/synology-rt2600ac-checklist.md
+39 -6
View File
@@ -153,6 +153,20 @@ Every Synology RT2600ac bus router MUST pass ALL sections before departing the y
---
## 6a. Kit-Connect (Replaces kittunnel + Tailscale — single SPK)
Kit-connect is the unified replacement for Sections 6 and 7. One SPK installs both the reverse SSH tunnel and Tailscale.
- [ ] **6a.1** Download SPK from Gitea: `https://git.keylinkit.net/allen/kit-busrouter/raw/branch/main/kit-connect/kit-connect-0.1-0001.spk`
- [ ] **6a.2** SCP to router: `scp -O -P 2223 kit-connect-0.1-0001.spk kitadmin@192.168.1.1:/tmp/`
- [ ] **6a.3** Install: `echo "kitPLANE1!!" | sudo -S /usr/syno/bin/synopkg install /tmp/kit-connect-0.1-0001.spk`
- [ ] **6a.4** Verify config: `grep TUNNEL_LOCAL_SSH_PORT /etc/kit-connect/connect.conf` must show `2223` (NOT 22)
- [ ] **6a.5** ONLY after confirming two alternative access paths (QuickConnect + Tailscale), stop old tunnel: `sudo synopkg stop kittunnel`
- [ ] **6a.6** Start kit-connect: `sudo synopkg start kit-connect`
- [ ] **6a.7** Verify port is LISTENING on VPS (162.243.83.36) for this device
**⚠️ DO NOT attempt switchover remotely.** The old tunnel is the only management path. Switch only when physically present or when QuickConnect + Tailscale are both confirmed working.
## 7. Tailscale Install (Management Tailnet)
- [ ] **7.1** Download Tailscale static `linux_arm` binary
@@ -265,15 +279,34 @@ Every Synology RT2600ac bus router MUST pass ALL sections before departing the y
## Fleet Port Registry
| Device | VPS Port | Tailscale IP | QuickConnect URL |
|--------|----------|-------------|-------------------|
| x4078 | 2226 | `100.116.71.43` | `https://x4078.us2.quickconnect.to` |
| x5925 | 2230 | TBD | `https://x5925.us2.quickconnect.to` |
| *(next)* | 2231 | TBD | TBD |
| *(next)* | 2231 | TBD | TBD |
| Device | VPS Port | Tailscale IP | QuickConnect URL | Location | Notes |
|--------|----------|-------------|-------------------|----------|-------|
| x4078 | 2226 | `100.116.71.43` | `https://x4078.us2.quickconnect.to` | Bus (field) | Eyeride + Starlink |
| x4324 | 2225 | `100.91.204.32` | `https://x4324.us2.quickconnect.to` | Bus (field) | kit-connect |
| x4662 | 2229 | TBD | `https://x4662.us2.quickconnect.to` | Bus (field) | MR2200ac mesh satellite |
| x5925 | 2230 | TBD | `https://x5925.us2.quickconnect.to` | Office bench | |
| x9002 | 2231 | `100.82.60.8` | N/A (GL-XE3000) | Office bench | |
---
## Post-Deployment Rules 🔴
1. **Never tear down a working tunnel without two confirmed alternative access paths** (QuickConnect + Tailscale, or QuickConnect + LAN). The reverse SSH tunnel is the primary management channel — once it's gone, you are dead in the water.
2. **TUNNEL_LOCAL_SSH_PORT must be 2223 for Synology.** Synology SRM SSH listens on port 2223, not 22. The kit-connect wizard default was corrected to 2223 on 2026-07-22 after this mistake took down x4078.
3. **Don't restart sshd on the VPS** while tunnels are active. It kills established forwarding sessions and authorized_keys changes don't require a restart.
4. **If quickconnect.to is the only backup**, confirm it's actually working before touching anything. The relay can be slow or locked out by DoS protection.
5. **The old kittunnel is stable.** If it's working, leave it alone until a planned maintenance window with physical access.
## Incident Log — 2026-07-22
**Root cause**: The kit-connect wizard.sh used `command -v` (not available on SRM busybox) and defaulted `TUNNEL_LOCAL_SSH_PORT=22` instead of 2223. Combined with attempting remote switchover from old tunnel to kit-connect without confirmed backup paths, this took x4078 and x6340 offline.
**Resolution for x4662**: Kittunnel restarted via Package Center through QuickConnect. Tunnel stable on port 2229.
**Resolution for x4324**: Kit-connect daemon reconnected after authorized_keys fix on VPS. Tunnel stable on port 2225.
**Pending**: x4078 needs physical access — kit-connect daemon is installed and connecting but fails because it forwards to port 22 instead of 2223.
**SPK fixed**: Rebuilt with `which` instead of `command -v` and `TUNNEL_LOCAL_SSH_PORT=2223`. Available at `https://git.keylinkit.net/allen/kit-busrouter/raw/branch/main/kit-connect/kit-connect-0.1-0001.spk`.
---
## x4078 Audit (2026-07-21) — Findings from DSS backup
🔴 **Critical — must fix remotely or on next physical access:**