server.py:
- GET / serves dashboard.html (dark-themed fleet console)
- GET /api/fleet returns all registered devices with tunnel status,
SSH commands, and web dashboard access instructions
- Static file serving via serve_file()
dashboard.html:
- Shows all registered devices from port-registry.json
- Live tunnel status (port-open check on VPS)
- Platform badges (Synology vs GL-XE3000)
- Copy-to-clipboard SSH commands per device
- Web dashboard access via SSH port-forwarding instructions
- Auto-refreshes every 15s
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)
Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management
GL daemon: same --max-time fix applied for curl timeout
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kitadmin