SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)
Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management
GL daemon: same --max-time fix applied for curl timeout
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Bundled tailscale 1.98.9 + tailscaled ARMv7 (ELF 32-bit, statically linked)
- Fixed connect-daemon.sh 644 → 755 (was preventing daemon from starting)
- Postinst now chmod +x all bin/*.sh and bundled binaries
- Postinst copies tailscale/tailscaled to /usr/local/bin if not present
- Hub firewall: opened ports 8080 (API) and 2230-2299 (SSH tunnels)
- Hub systemd service restarted after firewall fix
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds sections 2b (Safe Access) and 2c (Traffic Control):
- Disable WPS, login page title = DEVICE_ID
- Synology Account sign-in for QuickConnect relay
- Google Safe Browsing via API key, Threat Intelligence DB
- DoS protection enabled, NO DoH servers
- Traffic Control: per-client 80% cap, auto-speedtest on new WAN
- Update preflight memory with all security requirements
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- scripts/backup-config.sh: weekly router config backup to hub (SRM + OpenWrt)
Runs via cron, exports platform-specific config, POSTs to /api/backup
Keeps last 10 backups per device on hub
- hub/ingest.sh: fleet hub telemetry normalizer + backup receiver
Normalises GL (openwrt) and Synology telemetry into single schema
Adds platform field to GL telemetry for unified dashboard
- hub/dashboard.html: single-pane fleet console
Shows all routers (GL + Synology) with scores, WAN state, GPS, uptime
Auto-refreshes every 10s from /api/status endpoint
- 62-point checklist updated with weekly backup section 9b
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kitadmin
allen