- Rewrite telemetry-synology.sh: canonical GL format (modem_0001/wan keys),
self-contained metrics (no aiwanbal), Eyeride GPS with IP geo fallback
- Add /api/fleet-telemetry to hub: joins tunnel status with fleet Postgres
- Update dashboard.html: per-device WAN health bars, GPS, signal strength
- Fix hub/ingest.sh normalisation: remap old wan1/wan2 → modem_0001/wan
- Bump SPK version: 0.1-0001 → 0.5.0-0001 for GL parity
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Uses sed instead of grep -P for BusyBox ash compatibility.
Writes JSON to temp file to avoid shell escaping issues.
Posts to fleet hub ingest at 167.172.237.162:8080.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- docs/incident-log: mark x4078 recovered remotely via Tailscale (no
physical access needed); document the recovery steps and root cause
- connect-daemon.sh: remove bare `wait` that wedged the retry loop
forever on the setsid'd tailscaled child — once the tunnel failed the
daemon could not self-heal until the package was restarted; now the
main loop falls through start_tunnel (already blocking+retrying) and
restarts the whole cycle cleanly
- SPK rebuilt (32839680 bytes) with the daemon fix included
- Also documents the two latent lessons: (1) a field router is only
inaccessible when ALL three paths fail; (2) always check Tailscale +
QuickConnect before assuming a truck roll is required
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- wizard.sh + connect.conf: TUNNEL_LOCAL_SSH_PORT back to 2223 (Synology SSH port)
- port-registry: renamed x6340 → x4662 (matches QuickConnect ID)
- port-registry: added MR2200ac mesh satellite note for x4662
- deployment checklist: added kit-connect section, post-deployment rules,
incident log, and complete fleet port registry table
- memory: added fleet-router-inventory.md with full fleet state
- hub README: updated with current status and locations
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Includes fixes: which-vs-command-v for SRM busybox compat,
TUNNEL_LOCAL_SSH_PORT default 22, merged authorized_keys.
32MB SPK for Synology RT2600ac/RT6600ax (ipq806x).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
server.py:
- GET / serves dashboard.html (dark-themed fleet console)
- GET /api/fleet returns all registered devices with tunnel status,
SSH commands, and web dashboard access instructions
- Static file serving via serve_file()
dashboard.html:
- Shows all registered devices from port-registry.json
- Live tunnel status (port-open check on VPS)
- Platform badges (Synology vs GL-XE3000)
- Copy-to-clipboard SSH commands per device
- Web dashboard access via SSH port-forwarding instructions
- Auto-refreshes every 15s
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SRM default PATH is /usr/bin:/bin:/usr/sbin:/sbin:/usr/syno/bin — /usr/local/bin
is NOT included. 'command -v /usr/local/bin/tailscaled' fails on busybox ash
even when the file exists and is executable. Replaced with '[ ! -x "$BIN" ]'
which is always reliable for absolute paths.
Found during x5925 deployment testing. Daemon logged 'binary not found' despite
the files being present at /usr/local/bin/tailscale[d].
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- GL connect-wizard.sh: fixed key authorization block indentation (was at 3 tabs instead of 2)
- GL kit-busrouter Makefile: added +kit-connect to DEPENDS so installing the balancer auto-pulls connectivity
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
GL daemon: removed remaining 'local ts_ip' (busybox ash compat)
Synology wizard: auto-authorizes tunnel key via POST /api/authorize-key
GL wizard: same key authorization flow added
Synology: added connect-register.sh for parity with GL
syno-balance build.sh: removed deprecated checksum file (same lesson as kit-connect)
All four curl hubs (wizards + register scripts) now have --max-time 15.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)
Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management
GL daemon: same --max-time fix applied for curl timeout
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Bundled tailscale 1.98.9 + tailscaled ARMv7 (ELF 32-bit, statically linked)
- Fixed connect-daemon.sh 644 → 755 (was preventing daemon from starting)
- Postinst now chmod +x all bin/*.sh and bundled binaries
- Postinst copies tailscale/tailscaled to /usr/local/bin if not present
- Hub firewall: opened ports 8080 (API) and 2230-2299 (SSH tunnels)
- Hub systemd service restarted after firewall fix
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds sections 2b (Safe Access) and 2c (Traffic Control):
- Disable WPS, login page title = DEVICE_ID
- Synology Account sign-in for QuickConnect relay
- Google Safe Browsing via API key, Threat Intelligence DB
- DoS protection enabled, NO DoH servers
- Traffic Control: per-client 80% cap, auto-speedtest on new WAN
- Update preflight memory with all security requirements
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- scripts/backup-config.sh: weekly router config backup to hub (SRM + OpenWrt)
Runs via cron, exports platform-specific config, POSTs to /api/backup
Keeps last 10 backups per device on hub
- hub/ingest.sh: fleet hub telemetry normalizer + backup receiver
Normalises GL (openwrt) and Synology telemetry into single schema
Adds platform field to GL telemetry for unified dashboard
- hub/dashboard.html: single-pane fleet console
Shows all routers (GL + Synology) with scores, WAN state, GPS, uptime
Auto-refreshes every 10s from /api/status endpoint
- 62-point checklist updated with weekly backup section 9b
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kitadmin
allen