- wizard.sh + connect.conf: TUNNEL_LOCAL_SSH_PORT back to 2223 (Synology SSH port)
- port-registry: renamed x6340 → x4662 (matches QuickConnect ID)
- port-registry: added MR2200ac mesh satellite note for x4662
- deployment checklist: added kit-connect section, post-deployment rules,
incident log, and complete fleet port registry table
- memory: added fleet-router-inventory.md with full fleet state
- hub README: updated with current status and locations
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SRM default PATH is /usr/bin:/bin:/usr/sbin:/sbin:/usr/syno/bin — /usr/local/bin
is NOT included. 'command -v /usr/local/bin/tailscaled' fails on busybox ash
even when the file exists and is executable. Replaced with '[ ! -x "$BIN" ]'
which is always reliable for absolute paths.
Found during x5925 deployment testing. Daemon logged 'binary not found' despite
the files being present at /usr/local/bin/tailscale[d].
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)
Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management
GL daemon: same --max-time fix applied for curl timeout
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kitadmin
allen