feat: fleet hub dashboard + /api/fleet endpoint with direct access links

server.py:
- GET / serves dashboard.html (dark-themed fleet console)
- GET /api/fleet returns all registered devices with tunnel status,
  SSH commands, and web dashboard access instructions
- Static file serving via serve_file()

dashboard.html:
- Shows all registered devices from port-registry.json
- Live tunnel status (port-open check on VPS)
- Platform badges (Synology vs GL-XE3000)
- Copy-to-clipboard SSH commands per device
- Web dashboard access via SSH port-forwarding instructions
- Auto-refreshes every 15s

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,12 @@
+# SSH keys
+*_id_ed25519
+*_id_ed25519.pub
+*.pem
+
+# Build artifacts
+*.spk
+build/
+
+# IDE
+.idea/
+.vscode/

docs/deployment/synology-rt2600ac-checklist.md

@@ -1,6 +1,6 @@
 # Synology RT2600ac — Fleet Deployment Checklist
 
-**Version:** 1.1 · **Last updated:** 2026-07-21 · **Audited against:** x4078 DSS config backup
+**Version:** 1.2 · **Last updated:** 2026-07-22 · **Audited against:** x4078 DSS config backup
 
 Every Synology RT2600ac bus router MUST pass ALL sections before departing the yard. Items flagged 🔴 were missed on x4078 and caused remote-access emergencies.
 
@@ -50,6 +50,45 @@ Every Synology RT2600ac bus router MUST pass ALL sections before departing the y
   - Email: configure SMTP or use SRM notification relay
 - [ ] **2.5** **SSH:** Control Panel → Terminal & SNMP → Enable SSH on port 2223
 - [ ] **2.6** **Regional Options:** Verify language, time format, and date format
+- [ ] **2.7** 🔴 **Disable WPS:** Wi-Fi Connect → WPS → **Disabled** on both bands
+- [ ] **2.8** 🔴 **Login page title:** Control Panel → System → Login Portal → Title = `<DEVICE_ID>` (e.g. `x5925`)
+- [ ] **2.9** 🔴 **Sign in to Synology Account:** Control Panel → QuickConnect → Sign in with Synology Account
+  - Required for QuickConnect relay to work. Use `pioneercoach@keylinkit.net` or create if needed.
+- [ ] **2.10** 🔴 **Do NOT use DoH:** Network Center → Internet → DNS → Do NOT use DNS over HTTPS
+  - Standard DNS only: `1.1.1.2`, `9.9.9.9`, `8.8.8.8`
+
+---
+
+## 2b. Security — Safe Access
+
+- [ ] **2b.1** 🔴 **Install Safe Access:** Package Center → Install "Safe Access" (Synology SRM package)
+- [ ] **2b.2** 🔴 **Enable malware blocking on Primary network:**
+  - Safe Access → Primary Network → Web Filter → Block malicious websites
+  - Enable **Google Safe Browsing**
+- [ ] **2b.3** 🔴 **Enable malware blocking on Guest network:**
+  - Safe Access → Guest Network → Web Filter → Block malicious websites
+  - Enable Google Safe Browsing
+- [ ] **2b.4** 🔴 **Google Safe Browsing API key:** Use `AIzaSyBqjLxf1BpD-gPgMqOV1whr6KtomP_D3MM`
+- [ ] **2b.5** 🔴 **Enable Threat Intelligence database:** Safe Access → Settings → Threat Intelligence → ON
+  - Auto-update definitions
+- [ ] **2b.6** 🔴 **DoS Protection:** Network Center → Security → DoS Protection → **Enabled**
+- [ ] **2b.7** **Safe Access profiles:** Create a profile for fleet devices with appropriate filtering
+
+---
+
+## 2c. Traffic Control — Bandwidth Management
+
+- [ ] **2c.1** 🔴 **Enable Traffic Control:** Network Center → Traffic Control → Enable
+- [ ] **2c.2** 🔴 **Per-device throttle:** Set maximum bandwidth per client to **80% of total WAN capacity**
+  - Dynamic: adjust based on measured WAN speed
+  - Guest network: stricter cap (50% of total)
+- [ ] **2c.3** 🔴 **Run speed test on new WAN detection:**
+  - When a WAN interface comes up for the first time, run a speed test to measure capacity
+  - Set traffic control caps based on measured throughput
+  - Re-test if WAN IP changes (new ISP/tower)
+- [ ] **2c.4** **QoS priority:** Primary network gets higher priority than Guest
+  - Primary: 70% guaranteed minimum
+  - Guest: 30% maximum (burst to 50% when idle)
 
 ---
 
@@ -167,14 +206,25 @@ Every Synology RT2600ac bus router MUST pass ALL sections before departing the y
 - [ ] **9.1** SCP `telemetry-synology.sh` to `/usr/lib/busrouter/telemetry-synology.sh`
 - [ ] **9.2** Configure `TELEMETRY_HUB` to fleet hub endpoint:
   ```sh
-  # In the script or via environment: http://167.172.237.162:8080/api/telemetry
+  # Default: http://167.172.237.162:8080/api/telemetry
   ```
-- [ ] **9.3** 🔴 Add cron job (every 60s):
+- [ ] **9.3** Add cron job (every 60s):
   ```sh
   echo '* * * * * root TELEMETRY_HUB=http://167.172.237.162:8080/api/telemetry /usr/lib/busrouter/telemetry-synology.sh 2>/dev/null' | sudo tee -a /etc/crontab
   ```
 - [ ] **9.4** Dry-run test: `sudo /usr/lib/busrouter/telemetry-synology.sh`
 
+## 9b. Weekly Config Backup
+
+- [ ] **9b.1** SCP `scripts/backup-config.sh` to `/usr/lib/busrouter/backup-config.sh`
+- [ ] **9b.2** Add weekly cron (Sunday 03:00):
+  ```sh
+  echo '0 3 * * 0 root BACKUP_HUB=http://167.172.237.162:8080 /usr/lib/busrouter/backup-config.sh 2>/dev/null' | sudo tee -a /etc/crontab
+  ```
+- [ ] **9b.3** Dry-run test: `sudo /usr/lib/busrouter/backup-config.sh`
+- [ ] **9b.4** Verify backup appears on hub at `/opt/busfleet-hub/backups/<DEVICE_ID>/`
+- [ ] **9b.5** 🔴 If a router dies, the most recent backup is the replacement config — never more than 7 days stale
+
 ---
 
 ## 10. Reboot & Final Verification
@@ -198,8 +248,14 @@ Every Synology RT2600ac bus router MUST pass ALL sections before departing the y
 | WAN1 carrier | aiwanbal UI | Shows ISP |
 | WAN2 carrier | aiwanbal UI | Shows Starlink |
 | Telemetry cron | `grep telemetry /etc/crontab` | present |
+| Backup cron | `grep backup /etc/crontab` | present |
 | Auto-update | SRM UI → Update & Restore | Auto-check ON |
 | Notifications | SRM UI → Notification | Enabled |
+| WPS | Wi-Fi Connect → WPS | Disabled both bands |
+| Safe Access | Package Center → Safe Access | Installed, malware ON |
+| DoS Protection | Network Center → Security | Enabled |
+| Traffic Control | Network Center → Traffic Control | Enabled, 80% cap |
+| DoH | Network Center → Internet → DNS | OFF |
 
 - [ ] **10.3** 🔴 **Run the reboot test before the bus leaves the yard.** There is no second chance.
 - [ ] **10.4** Store credentials in vault under `busrouter/<DEVICE_ID>`

gl-kit-connect/Makefile

@@ -0,0 +1,69 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=kit-connect
+PKG_VERSION:=0.1.0
+PKG_RELEASE:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/kit-connect
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=Pioneer Bus Fleet — Connectivity Agent
+  DEPENDS:=+curl +openssh-client +tailscale
+  PKGARCH:=all
+endef
+
+define Package/kit-connect/description
+  Unified management connectivity for Pioneer bus fleet routers.
+  Deploys Tailscale + reverse SSH tunnel. Hub auto-assigns ports.
+  Includes one-button setup wizard and local status dashboard.
+
+  Compatible: GL-XE3000, GL-MT3000, and all OpenWrt-based fleet routers.
+endef
+
+define Build/Compile
+endef
+
+define Package/kit-connect/install
+	$(INSTALL_DIR) $(1)/etc/init.d $(1)/etc/config $(1)/etc/kitconnect
+	$(INSTALL_DIR) $(1)/usr/sbin $(1)/www/kitconnect
+
+	# Init + config
+	$(INSTALL_BIN) ./files/etc/init.d/kitconnect $(1)/etc/init.d/kitconnect
+	$(INSTALL_CONF) ./files/etc/config/kitconnect $(1)/etc/config/kitconnect
+
+	# Binaries
+	$(INSTALL_BIN) ./files/usr/sbin/connect-daemon.sh $(1)/usr/sbin/connect-daemon.sh
+	$(INSTALL_BIN) ./files/usr/sbin/connect-register.sh $(1)/usr/sbin/connect-register.sh
+	$(INSTALL_BIN) ./files/usr/sbin/connect-wizard.sh $(1)/usr/sbin/connect-wizard.sh
+
+	# SSH key (private — must be 600)
+	$(INSTALL_DATA) ./files/etc/kitconnect/connect_id_ed25519 $(1)/etc/kitconnect/connect_id_ed25519
+	chmod 600 $(1)/etc/kitconnect/connect_id_ed25519
+
+	# Web UI
+	$(INSTALL_DATA) ./files/www/kitconnect/index.html $(1)/www/kitconnect/index.html
+	$(INSTALL_BIN)  ./files/www/kitconnect/wizard.cgi $(1)/www/kitconnect/wizard.cgi
+endef
+
+define Package/kit-connect/postinst
+#!/bin/sh
+# Run the setup wizard on first install
+if [ -z "$${IPKG_INSTROOT}" ]; then
+	/etc/init.d/kitconnect enable 2>/dev/null || true
+	/usr/sbin/connect-wizard.sh --auto 2>/dev/null || true
+	/etc/init.d/kitconnect start 2>/dev/null || true
+fi
+endef
+
+define Package/kit-connect/prerm
+#!/bin/sh
+# Stop service before removal
+if [ -z "$${IPKG_INSTROOT}" ]; then
+	/etc/init.d/kitconnect stop 2>/dev/null || true
+	/etc/init.d/kitconnect disable 2>/dev/null || true
+fi
+endef
+
+$(eval $(call BuildPackage,kit-connect))

gl-kit-connect/files/etc/config/kitconnect

@@ -0,0 +1,26 @@
+config kitconnect 'main'
+	# ── Device Identity ────────────────────────────────────
+	option device_id ''
+	# Auto-detected from /etc/busrouter/device-id or hostname
+
+	# ── Hub Registration ────────────────────────────────────
+	option hub_host '162.243.83.36'
+	option hub_port '8080'
+
+	# ── Reverse SSH Tunnel ──────────────────────────────────
+	option tunnel_enable '1'
+	option tunnel_remote_host '162.243.83.36'
+	option tunnel_remote_user 'node'
+	option tunnel_remote_ssh_port '22'
+	option tunnel_remote_port '0'        # 0 = auto-assign via hub
+	option tunnel_local_port '2223'
+	option tunnel_retry_delay '30'
+
+	# ── Tailscale ──────────────────────────────────────────
+	option tailscale_enable '1'
+	option tailscale_auth_key 'tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV'
+	option tailscale_hostname ''
+
+	# ── Behaviour ──────────────────────────────────────────
+	option watchdog_interval '60'
+	option forward_fail_limit '2'

gl-kit-connect/files/etc/init.d/kitconnect

@@ -0,0 +1,43 @@
+#!/bin/sh /etc/rc.common
+# kit-connect — Pioneer Bus Fleet connectivity agent
+# Manages Tailscale + reverse SSH tunnel to the fleet hub.
+# One package, all GL routers. Hub assigns ports and keys.
+
+USE_PROCD=1
+START=90
+
+EXTRA_COMMANDS="wizard status"
+EXTRA_HELP="  wizard  Run the Keylink IT setup wizard
+  status  Show connectivity status"
+
+start_service() {
+	procd_open_instance
+	procd_set_param command /usr/sbin/connect-daemon.sh
+	procd_set_param respawn 3600 5 0   # max 1 respawn/hr, 5s delay, unlimited
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}
+
+wizard() {
+	/usr/sbin/connect-wizard.sh
+}
+
+status() {
+	echo "=== kit-connect Status ==="
+	echo "Device: $(cat /etc/busrouter/device-id 2>/dev/null || hostname)"
+	if [ -f /var/run/kitconnect.pid ] && kill -0 "$(cat /var/run/kitconnect.pid)" 2>/dev/null; then
+		echo "Daemon: running (PID $(cat /var/run/kitconnect.pid))"
+	else
+		echo "Daemon: stopped"
+	fi
+	uci -q show kitconnect 2>/dev/null | while IFS='=' read -r key val; do
+		echo "Config: ${key##*.}=${val//\'/}"
+	done
+	echo "Tunnel PID: $(cat /var/run/kitconnect-tunnel.pid 2>/dev/null || echo 'none')"
+	if command -v tailscale >/dev/null 2>&1; then
+		tailscale status 2>/dev/null | head -3
+	else
+		echo "Tailscale: not installed"
+	fi
+}

gl-kit-connect/files/usr/sbin/connect-daemon.sh

@@ -0,0 +1,187 @@
+#!/bin/sh
+# kit-connect daemon — manages Tailscale + reverse SSH tunnel.
+# Runs under procd supervision (auto-respawn on crash).
+# Config: /etc/config/kitconnect (UCI) + hub-assigned settings.
+# One package, all GL routers. Hub assigns ports and keys.
+
+PKG="kit-connect"
+STATE_DIR="/var/run/kitconnect"
+CONF="/etc/config/kitconnect"
+KEY="/etc/kitconnect/connect_id_ed25519"
+PID_FILE="$STATE_DIR/daemon.pid"
+TUNNEL_PID="$STATE_DIR/tunnel.pid"
+LOG_TAG="kit-connect"
+
+log() {
+	logger -t "$LOG_TAG" -p daemon.info "$*"
+}
+
+warn() {
+	logger -t "$LOG_TAG" -p daemon.warn "WARN: $*"
+}
+
+mkdir -p "$STATE_DIR"
+chmod 600 "$KEY" 2>/dev/null
+echo "$$" > "$PID_FILE"
+
+# ── Config loader (UCI → shell vars) ──────────────────────────
+load_config() {
+	_uci() { uci -q get "kitconnect.main.${1}" 2>/dev/null || echo "${2}"; }
+
+	DEVICE_ID=$(_uci device_id "")
+	[ -z "$DEVICE_ID" ] && DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || hostname | sed 's/[^a-zA-Z0-9_-]//g')
+
+	HUB_HOST=$(_uci hub_host "162.243.83.36")
+	HUB_PORT=$(_uci hub_port "8080")
+
+	TUNNEL_ENABLE=$(_uci tunnel_enable "1")
+	TUNNEL_REMOTE_HOST=$(_uci tunnel_remote_host "162.243.83.36")
+	TUNNEL_REMOTE_USER=$(_uci tunnel_remote_user "node")
+	TUNNEL_REMOTE_SSH_PORT=$(_uci tunnel_remote_ssh_port "22")
+	TUNNEL_REMOTE_PORT=$(_uci tunnel_remote_port "0")
+	TUNNEL_LOCAL_PORT=$(_uci tunnel_local_port "2223")
+	TUNNEL_RETRY_DELAY=$(_uci tunnel_retry_delay "30")
+
+	TAILSCALE_ENABLE=$(_uci tailscale_enable "1")
+	TAILSCALE_AUTH_KEY=$(_uci tailscale_auth_key "")
+	TAILSCALE_HOSTNAME=$(_uci tailscale_hostname "")
+	[ -z "$TAILSCALE_HOSTNAME" ] && TAILSCALE_HOSTNAME="$DEVICE_ID"
+
+	WATCHDOG_INTERVAL=$(_uci watchdog_interval "60")
+	FORWARD_FAIL_LIMIT=$(_uci forward_fail_limit "2")
+
+	# Binary detection
+	TAILSCALE_BIN=$(command -v tailscale 2>/dev/null || echo "/usr/sbin/tailscale")
+	TAILSCALED_BIN=$(command -v tailscaled 2>/dev/null || echo "/usr/sbin/tailscaled")
+}
+
+# ── Start Tailscale ────────────────────────────────────────────
+start_tailscale() {
+	[ "$TAILSCALE_ENABLE" != "1" ] && { log "tailscale: disabled in config"; return 0; }
+	[ -z "$TAILSCALE_AUTH_KEY" ] && { log "tailscale: no auth key — skipping"; return 0; }
+	! command -v "$TAILSCALE_BIN" >/dev/null 2>&1 && { log "tailscale: binary not found"; return 1; }
+
+	# Already connected?
+	if "$TAILSCALE_BIN" status >/dev/null 2>&1; then
+		log "tailscale: already connected ($($TAILSCALE_BIN ip -4 2>/dev/null || echo no-ip))"
+		return 0
+	fi
+
+	log "tailscale: starting daemon..."
+	"$TAILSCALED_BIN" --tun=userspace-networking >/dev/null 2>&1 &
+	sleep 3
+
+	log "tailscale: authenticating..."
+	"$TAILSCALE_BIN" up \
+		--auth-key "$TAILSCALE_AUTH_KEY" \
+		--hostname "${TAILSCALE_HOSTNAME}" \
+		--accept-routes=false \
+		--accept-dns=false 2>&1 | while read -r line; do log "tailscale: $line"; done
+
+	ts_ip=$("$TAILSCALE_BIN" ip -4 2>/dev/null || echo "unknown")
+	log "tailscale: connected — IP=${ts_ip}"
+}
+
+# ── Start reverse SSH tunnel ───────────────────────────────────
+start_tunnel() {
+	[ "$TUNNEL_ENABLE" != "1" ] && { log "tunnel: disabled"; return 0; }
+	[ "$TUNNEL_REMOTE_PORT" = "0" ] && { register_with_hub; load_config; }
+	[ "$TUNNEL_REMOTE_PORT" = "0" ] && { log "tunnel: no port assigned — skipping"; return 0; }
+
+	log "tunnel: opening R:0.0.0.0:${TUNNEL_REMOTE_PORT} → 127.0.0.1:${TUNNEL_LOCAL_PORT}"
+
+	ssh \
+		-o StrictHostKeyChecking=no \
+		-o UserKnownHostsFile=/dev/null \
+		-o ServerAliveInterval=15 \
+		-o ServerAliveCountMax=3 \
+		-o ExitOnForwardFailure=yes \
+		-o BatchMode=yes \
+		-p "${TUNNEL_REMOTE_SSH_PORT}" \
+		-N \
+		-R "0.0.0.0:${TUNNEL_REMOTE_PORT}:127.0.0.1:${TUNNEL_LOCAL_PORT}" \
+		-i "$KEY" \
+		"${TUNNEL_REMOTE_USER}@${TUNNEL_REMOTE_HOST}" \
+		2>"$STATE_DIR/ssh_err" &
+
+	SSH_PID=$!
+	echo "$SSH_PID" > "$TUNNEL_PID"
+	log "tunnel: SSH PID=${SSH_PID} port=${TUNNEL_REMOTE_PORT}"
+
+	# Watchdog loop — monitors tunnel health
+	_fail_count=0
+	while kill -0 "$SSH_PID" 2>/dev/null; do
+		sleep "$WATCHDOG_INTERVAL"
+		kill -0 "$SSH_PID" 2>/dev/null || break
+
+		if timeout 10 ssh \
+			-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+			-o ConnectTimeout=5 -o BatchMode=yes \
+			-p "${TUNNEL_REMOTE_SSH_PORT}" -i "$KEY" \
+			"${TUNNEL_REMOTE_USER}@${TUNNEL_REMOTE_HOST}" \
+			"timeout 3 bash -c 'echo >/dev/tcp/127.0.0.1/${TUNNEL_REMOTE_PORT}' 2>/dev/null" \
+			2>/dev/null; then
+			[ "$_fail_count" -gt 0 ] && log "tunnel: forward recovered after ${_fail_count} checks"
+			_fail_count=0
+		else
+			_fail_count=$((_fail_count + 1))
+			warn "tunnel: forward check failed (${_fail_count}/${FORWARD_FAIL_LIMIT})"
+			[ "$_fail_count" -ge "$FORWARD_FAIL_LIMIT" ] && break
+		fi
+	done
+
+	kill "$SSH_PID" 2>/dev/null
+	rm -f "$TUNNEL_PID"
+	log "tunnel: exited — will retry in ${TUNNEL_RETRY_DELAY}s"
+	sleep "$TUNNEL_RETRY_DELAY"
+	return 1
+}
+
+# ── Hub registration — get assigned port ───────────────────────
+register_with_hub() {
+	[ "$TUNNEL_REMOTE_PORT" != "0" ] && { return 0; }
+
+	log "hub: registering device ${DEVICE_ID}..."
+
+	resp=$(curl -s --connect-timeout 10 --max-time 15 \
+		"http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
+
+	[ -z "$resp" ] && { warn "hub: unreachable"; return 1; }
+
+	# Parse JSON response (no jq dependency — grep + cut)
+	port=$(echo "$resp" | grep -o '"tunnel_port"[[:space:]]*:[[:space:]]*[0-9]*' | grep -o '[0-9]*')
+	tskey=$(echo "$resp" | grep -o '"tailscale_auth_key"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
+
+	if [ -n "$port" ] && [ "$port" != "0" ]; then
+		uci set kitconnect.main.tunnel_remote_port="$port"
+		uci commit kitconnect
+		log "hub: assigned port ${port}"
+		echo "$port" > "$STATE_DIR/hub_port"
+	fi
+
+	if [ -n "$tskey" ] && [ "$tskey" != "$TAILSCALE_AUTH_KEY" ]; then
+		uci set kitconnect.main.tailscale_auth_key="$tskey"
+		uci commit kitconnect
+		log "hub: updated Tailscale key"
+	fi
+}
+
+# ── Main loop (one cycle — procd respawns on exit) ────────────
+log "EVENT=DAEMON_START device=${DEVICE_ID}"
+load_config
+
+# Ensure device-id file exists
+mkdir -p /etc/busrouter
+[ ! -f /etc/busrouter/device-id ] && echo "$DEVICE_ID" > /etc/busrouter/device-id
+
+# Register with hub (non-fatal — retries next cycle)
+register_with_hub 2>/dev/null || true
+
+# Start Tailscale (runs in background, stays up)
+start_tailscale 2>/dev/null || true
+
+# Start tunnel (blocks until failure, then exits — procd restarts)
+start_tunnel 2>/dev/null || true
+
+log "EVENT=DAEMON_EXIT device=${DEVICE_ID}"
+exit 0

gl-kit-connect/files/usr/sbin/connect-register.sh

@@ -0,0 +1,58 @@
+#!/bin/sh
+# connect-register.sh — Standalone hub registration (callable from wizard or cron)
+# Usage: connect-register.sh [--force]
+# Re-registers even if already assigned when --force is given.
+
+HUB_HOST="162.243.83.36"
+HUB_PORT="8080"
+
+DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || hostname | sed 's/[^a-zA-Z0-9_-]//g')
+CURRENT_PORT=$(uci -q get kitconnect.main.tunnel_remote_port 2>/dev/null || echo "0")
+
+[ "$1" = "--force" ] && CURRENT_PORT="0"
+[ "$CURRENT_PORT" != "0" ] && {
+	echo "Already registered (port ${CURRENT_PORT}). Use --force to re-register."
+	exit 0
+}
+
+echo "Registering device ${DEVICE_ID} with hub ${HUB_HOST}:${HUB_PORT}..."
+resp=$(curl -s --connect-timeout 10 --max-time 15 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null)
+
+[ -z "$resp" ] && {
+	echo "ERROR: Hub unreachable at ${HUB_HOST}:${HUB_PORT}"
+	exit 1
+}
+
+port=$(echo "$resp" | grep -o '"tunnel_port"[[:space:]]*:[[:space:]]*[0-9]*' | grep -o '[0-9]*')
+status=$(echo "$resp" | grep -o '"status"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
+tskey=$(echo "$resp" | grep -o '"tailscale_auth_key"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
+
+echo ""
+echo "  Device:  ${DEVICE_ID}"
+echo "  Status:  ${status:-unknown}"
+echo "  Port:    ${port:-none}"
+echo ""
+
+if [ -n "$port" ] && [ "$port" != "0" ]; then
+	uci set kitconnect.main.tunnel_remote_port="$port"
+	uci commit kitconnect
+	echo "Port ${port} saved to UCI config."
+fi
+
+if [ -n "$tskey" ]; then
+	uci set kitconnect.main.tailscale_auth_key="$tskey"
+	uci commit kitconnect
+	echo "Tailscale auth key updated from hub."
+fi
+
+if [ "$status" = "new" ]; then
+	echo ""
+	echo "============================================"
+	echo "  ✓ Device registered successfully!"
+	echo "  Port ${port} assigned for reverse SSH."
+	echo "  Restart kit-connect to apply:"
+	echo "    /etc/init.d/kitconnect restart"
+	echo "============================================"
+elif [ "$status" = "existing" ]; then
+	echo "✓ Device was already registered (existing assignment confirmed)."
+fi

gl-kit-connect/files/usr/sbin/connect-wizard.sh

@@ -0,0 +1,174 @@
+#!/bin/sh
+# connect-wizard.sh — One-button Keylink IT fleet setup.
+# Idempotent — safe to run multiple times.
+# Usage: connect-wizard.sh [--auto] [--force]
+#   --auto   Non-interactive mode (for postinst)
+#   --force  Re-register even if already assigned
+
+set -e
+
+HUB_HOST="162.243.83.36"
+HUB_PORT="8080"
+AUTO=0
+FORCE=0
+[ "$1" = "--auto" ] && AUTO=1
+[ "$1" = "--force" ] || [ "$2" = "--force" ] && FORCE=1
+
+banner() {
+	echo ""
+	echo "  ╔══════════════════════════════════════════╗"
+	echo "  ║   KEYLINK IT — Pioneer Bus Fleet Setup  ║"
+	echo "  ╚══════════════════════════════════════════╝"
+	echo ""
+}
+
+step()  { echo "  ▶ $*"; }
+ok()    { echo "    ✓ $*"; }
+warn()  { echo "    ⚠ $*"; }
+fail()  { echo "    ✗ $*"; }
+
+banner
+
+# ── Step 1: Detect device ──────────────────────────────────────
+step "Detecting device..."
+DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || true)
+if [ -z "$DEVICE_ID" ]; then
+	DEVICE_ID=$(hostname 2>/dev/null | sed 's/[^a-zA-Z0-9_-]//g' || echo "unknown")
+	# If hostname is generic, try to derive from model
+	if [ "$DEVICE_ID" = "OpenWrt" ] || [ "$DEVICE_ID" = "openwrt" ] || [ -z "$DEVICE_ID" ]; then
+		model=$(cat /tmp/sysinfo/model 2>/dev/null | tr ' ' '-' | sed 's/[^a-zA-Z0-9_-]//g' || echo "")
+		[ -n "$model" ] && DEVICE_ID="${model}-$(cat /sys/class/net/eth0/address 2>/dev/null | tr -d ':' | tail -c 6 || echo '000000')"
+		[ -z "$DEVICE_ID" ] && DEVICE_ID="GL-unknown"
+	fi
+fi
+mkdir -p /etc/busrouter
+echo "$DEVICE_ID" > /etc/busrouter/device-id
+ok "Device ID: ${DEVICE_ID}"
+
+# ── Step 2: Check prerequisites ────────────────────────────────
+step "Checking prerequisites..."
+
+MISSING=""
+for cmd in curl ssh ssh-keygen; do
+	command -v "$cmd" >/dev/null 2>&1 || MISSING="${MISSING} ${cmd}"
+done
+
+if [ -n "$MISSING" ]; then
+	fail "Missing:${MISSING}"
+	[ "$AUTO" = "1" ] && exit 1
+	echo ""
+	echo "  Install missing packages with:"
+	echo "    opkg update && opkg install curl openssh-client"
+	exit 1
+fi
+ok "All prerequisites found (curl, ssh)"
+
+# ── Step 3: SSH key ────────────────────────────────────────────
+step "Checking SSH key..."
+KEY="/etc/kitconnect/connect_id_ed25519"
+if [ ! -f "$KEY" ]; then
+	warn "Key not found at ${KEY}, generating..."
+	mkdir -p /etc/kitconnect
+	ssh-keygen -t ed25519 -f "$KEY" -N "" -C "kit-connect-${DEVICE_ID}" >/dev/null 2>&1
+	ok "Generated new Ed25519 key"
+else
+	ok "SSH key present"
+fi
+chmod 600 "$KEY"
+
+# ── Step 4: UCI config defaults ────────────────────────────────
+step "Configuring Keylink IT defaults..."
+
+# Ensure UCI config exists
+if ! uci -q get kitconnect.main >/dev/null 2>&1; then
+	uci set kitconnect.main=kitconnect
+fi
+
+uci -q set kitconnect.main.device_id="$DEVICE_ID"
+uci -q set kitconnect.main.hub_host="$HUB_HOST"
+uci -q set kitconnect.main.hub_port="$HUB_PORT"
+uci -q set kitconnect.main.tunnel_enable='1'
+uci -q set kitconnect.main.tunnel_remote_host="$HUB_HOST"
+uci -q set kitconnect.main.tunnel_remote_user='node'
+uci -q set kitconnect.main.tunnel_remote_ssh_port='22'
+uci -q set kitconnect.main.tunnel_remote_port='0'
+uci -q set kitconnect.main.tunnel_local_port='2223'
+uci -q set kitconnect.main.tailscale_enable='1'
+uci -q set kitconnect.main.tailscale_auth_key='tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV'
+uci -q set kitconnect.main.tailscale_hostname="$DEVICE_ID"
+uci -q set kitconnect.main.watchdog_interval='60'
+uci -q set kitconnect.main.forward_fail_limit='2'
+uci commit kitconnect
+ok "UCI config written"
+
+# ── Step 5: Register with hub ──────────────────────────────────
+step "Registering with fleet hub (${HUB_HOST}:${HUB_PORT})..."
+
+REG_FLAG=""
+[ "$FORCE" = "1" ] && REG_FLAG="--force"
+
+resp=$(curl -s --connect-timeout 10 --max-time 15 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
+
+if [ -z "$resp" ]; then
+	warn "Hub unreachable — will retry on next daemon start"
+	ok "Config saved locally (port will auto-assign when hub is reachable)"
+else
+	port=$(echo "$resp" | grep -o '"tunnel_port"[[:space:]]*:[[:space:]]*[0-9]*' | grep -o '[0-9]*')
+	status=$(echo "$resp" | grep -o '"status"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
+	tskey=$(echo "$resp" | grep -o '"tailscale_auth_key"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
+
+	if [ -n "$port" ] && [ "$port" != "0" ]; then
+		uci set kitconnect.main.tunnel_remote_port="$port"
+		uci commit kitconnect
+		ok "Hub assigned port ${port} (status: ${status})"
+	fi
+	if [ -n "$tskey" ]; then
+		uci set kitconnect.main.tailscale_auth_key="$tskey"
+		uci commit kitconnect
+		ok "Tailscale key configured"
+	fi
+
+		# Authorize tunnel key with hub (restrict,port-forwarding)
+		if [ -n "$port" ] && [ "$port" != "0" ] && [ -f /etc/kitconnect/connect_id_ed25519.pub ]; then
+		PUBKEY=$(awk '{print $1" "$2}' /etc/kitconnect/connect_id_ed25519.pub 2>/dev/null)
+		if [ -n "$PUBKEY" ]; then
+			curl -s --connect-timeout 10 --max-time 15 \
+				-X POST "http://${HUB_HOST}:${HUB_PORT}/api/authorize-key" \
+				-H "Content-Type: application/json" \
+				-d "{\"device_id\":\"${DEVICE_ID}\",\"pubkey\":\"${PUBKEY}\"}" \
+				>/dev/null 2>&1 && ok "Tunnel key authorized (restrict, port ${port})" || true
+		fi
+		fi
+fi
+
+# ── Step 6: Enable & start service ─────────────────────────────
+step "Enabling kit-connect service..."
+/etc/init.d/kitconnect enable 2>/dev/null && ok "Enabled at boot" || warn "Could not enable (may already be enabled)"
+
+step "Starting kit-connect..."
+if /etc/init.d/kitconnect start 2>/dev/null; then
+	ok "Service started"
+else
+	warn "Service start returned non-zero (check logread for details)"
+fi
+
+# ── Done ───────────────────────────────────────────────────────
+echo ""
+echo "  ╔══════════════════════════════════════════╗"
+echo "  ║        SETUP COMPLETE                    ║"
+echo "  ╠══════════════════════════════════════════╣"
+echo "  ║  Device:  $(printf '%-30s' "$DEVICE_ID")║"
+
+ASSIGNED=$(uci -q get kitconnect.main.tunnel_remote_port 2>/dev/null || echo "pending")
+echo "  ║  Port:    $(printf '%-30s' "$ASSIGNED")║"
+echo "  ║  Hub:     $(printf '%-30s' "${HUB_HOST}:${HUB_PORT}")║"
+echo "  ╠══════════════════════════════════════════╣"
+echo "  ║  Dashboard: http://$(hostname)/kitconnect/$(printf '   ')%s║" ""
+echo "  ║  Status:    /etc/init.d/kitconnect status║"
+echo "  ╚══════════════════════════════════════════╝"
+echo ""
+echo "  The daemon is now running under procd supervision."
+echo "  If it crashes, procd will restart it automatically."
+echo ""
+
+exit 0

gl-kit-connect/files/www/kitconnect/index.html

@@ -0,0 +1,185 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Kit Connect — Fleet Status</title>
+<style>
+* { box-sizing: border-box; margin: 0; padding: 0; }
+body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+       background: #0d1117; color: #e6edf3; min-height: 100vh; }
+.header { background: linear-gradient(135deg, #2563EB, #1d4ed8);
+          padding: 16px 24px; display: flex; align-items: center; gap: 14px;
+          border-bottom: 2px solid #60a5fa; }
+.logo { font-size: 22px; font-weight: 700; letter-spacing: 1px; color: #fff; }
+.logo span { color: #93c5fd; }
+.sub { font-size: 12px; color: #bfdbfe; letter-spacing: 2px; text-transform: uppercase; }
+.refresh { margin-left: auto; font-size: 11px; color: #93c5fd; }
+.container { max-width: 800px; margin: 0 auto; padding: 20px 16px; }
+.card { background: #161b22; border: 1px solid #30363d; border-radius: 8px;
+        padding: 20px; margin-bottom: 16px; }
+.card-title { font-size: 11px; text-transform: uppercase; letter-spacing: 1px;
+              color: #8b949e; margin-bottom: 14px; display: flex; align-items: center; gap: 8px; }
+.badge { display: inline-block; padding: 2px 10px; border-radius: 12px;
+         font-size: 11px; font-weight: 700; }
+.badge-ok { background: #1a4a2e; color: #3fb950; border: 1px solid #3fb950; }
+.badge-warn { background: #3d2b00; color: #d29922; border: 1px solid #d29922; }
+.badge-err { background: #4a1a1a; color: #f85149; border: 1px solid #f85149; }
+.badge-info { background: #1a2a4a; color: #58a6ff; border: 1px solid #58a6ff; }
+.row { display: flex; justify-content: space-between; align-items: center;
+       padding: 8px 0; border-bottom: 1px solid #21262d; }
+.row:last-child { border: none; }
+.label { color: #8b949e; font-size: 14px; }
+.value { font-weight: 600; font-size: 14px; font-family: "SF Mono", "Consolas", monospace; }
+.btn { display: inline-flex; align-items: center; gap: 8px;
+       padding: 10px 24px; border-radius: 6px; border: none; cursor: pointer;
+       font-size: 14px; font-weight: 600; transition: all 0.2s; }
+.btn-wizard { background: linear-gradient(135deg, #2563EB, #1d4ed8); color: #fff; width: 100%;
+              justify-content: center; font-size: 15px; padding: 14px; }
+.btn-wizard:hover { background: linear-gradient(135deg, #3b82f6, #2563EB); transform: translateY(-1px); }
+.btn-wizard:disabled { opacity: 0.5; cursor: not-allowed; transform: none; }
+.btn-sm { padding: 4px 12px; font-size: 12px; }
+.btn-danger { background: #8b1a1a; color: #fff; border: 1px solid #f85149; }
+.output { margin-top: 12px; padding: 12px; background: #0d1117; border-radius: 5px;
+          font-family: "SF Mono", "Consolas", monospace; font-size: 12px;
+          white-space: pre-wrap; color: #3fb950; display: none; max-height: 300px; overflow-y: auto; }
+.ring { position: relative; width: 48px; height: 48px; float: right; margin-top: -4px; }
+.ring canvas { position: absolute; top: 0; left: 0; }
+.ring-num { position: absolute; top: 0; left: 0; width: 48px; text-align: center;
+            line-height: 48px; font-size: 13px; font-weight: 700; }
+.footer { text-align: center; padding: 12px; font-size: 11px; color: #484f58;
+          border-top: 1px solid #21262d; margin-top: 20px; }
+#wiz-out { margin-top: 12px; }
+</style>
+</head>
+<body>
+<div class="header">
+  <div>
+    <div class="logo">KIT <span>CONNECT</span></div>
+    <div class="sub">Keylink IT Fleet Connectivity</div>
+  </div>
+  <div class="refresh" id="ts">Loading…</div>
+</div>
+<div class="container">
+
+  <!-- Setup Wizard card -->
+  <div class="card">
+    <div class="card-title">⚡ One-Click Setup</div>
+    <p style="font-size:13px;color:#8b949e;margin-bottom:12px">
+      Configures all Keylink IT defaults — device ID, fleet hub, Tailscale, reverse SSH tunnel.
+      Safe to run multiple times.
+    </p>
+    <button class="btn btn-wizard" id="wiz-btn" onclick="runWizard()">
+      🔧 Run Setup Wizard
+    </button>
+    <div class="output" id="wiz-out"></div>
+  </div>
+
+  <!-- Status card -->
+  <div class="card">
+    <div class="card-title">📡 Connectivity Status</div>
+    <div id="status-body">
+      <div class="row"><span class="label">Loading…</span></div>
+    </div>
+  </div>
+
+  <div class="footer">
+    kit-connect v0.1.0 · device: <span id="dev-id">-</span> ·
+    <span id="footer-ts"></span>
+  </div>
+</div>
+
+<script>
+var ESC = function(s) { return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;'); };
+
+function ring(id, pct, color) {
+  var c = document.getElementById(id);
+  if (!c) return;
+  var ctx = c.getContext('2d'), cx = 24, cy = 24, r = 20;
+  ctx.clearRect(0, 0, 48, 48);
+  ctx.lineWidth = 5; ctx.strokeStyle = '#21262d';
+  ctx.beginPath(); ctx.arc(cx, cy, r, 0, Math.PI * 2); ctx.stroke();
+  ctx.strokeStyle = color || '#3fb950';
+  ctx.beginPath(); ctx.arc(cx, cy, r, -Math.PI / 2, -Math.PI / 2 + (pct / 100) * Math.PI * 2); ctx.stroke();
+}
+
+function badge(label, type) {
+  return '<span class="badge badge-' + (type || 'info') + '">' + ESC(label) + '</span>';
+}
+
+function row(label, value, extra) {
+  return '<div class="row"><span class="label">' + ESC(label) + '</span>' +
+    '<span class="value">' + ESC(value) + (extra ? ' ' + extra : '') + '</span></div>';
+}
+
+function poll() {
+  fetch('/cgi-bin/busrouter-status')
+    .then(function(r) { return r.ok ? r.json() : Promise.reject(r.status); })
+    .then(function(d) {
+      document.getElementById('ts').textContent = 'Updated ' + new Date().toLocaleTimeString();
+      document.getElementById('dev-id').textContent = d.device_id || '-';
+      document.getElementById('footer-ts').textContent = new Date().toLocaleTimeString();
+
+      // Connectivity status (best-effort from existing CGIs)
+      var html = '';
+      html += row('Device', d.device_id || '-');
+      html += row('Uptime', fmtUptime(d.uptime || 0));
+      html += row('Version', d.version || 'dev');
+
+      // Tunnel/connectivity info from kit-connect state
+      html += '<div style="margin-top:12px;padding-top:8px;border-top:1px solid #30363d"></div>';
+      fetch('/kitconnect/wizard.cgi?action=status')
+        .then(function(r) { return r.text(); })
+        .then(function(t) {
+          var extra = document.createElement('div');
+          extra.innerHTML = t;
+          document.getElementById('status-body').innerHTML +=
+            '<div style="margin-top:8px;font-size:13px;color:#8b949e;white-space:pre-wrap">' +
+            ESC(t.substring(0, 500)) + '</div>';
+        })
+        .catch(function(){});
+
+      document.getElementById('status-body').innerHTML = html;
+    })
+    .catch(function(e) {
+      document.getElementById('status-body').innerHTML =
+        '<div class="row"><span class="label" style="color:#f85149">Status unavailable (' + ESC(String(e)) + ')</span></div>';
+    });
+}
+
+function fmtUptime(s) {
+  var d = Math.floor(s / 86400), h = Math.floor((s % 86400) / 3600), m = Math.floor((s % 3600) / 60);
+  if (d) return d + 'd ' + h + 'h'; if (h) return h + 'h ' + m + 'm'; return m + 'm';
+}
+
+function runWizard() {
+  var btn = document.getElementById('wiz-btn');
+  var out = document.getElementById('wiz-out');
+  btn.disabled = true;
+  btn.textContent = '⏳ Running Setup Wizard…';
+  out.style.display = 'block';
+  out.textContent = 'Connecting to hub...\n';
+
+  fetch('/kitconnect/wizard.cgi', { method: 'POST' })
+    .then(function(r) { return r.text(); })
+    .then(function(t) {
+      out.textContent = t;
+      out.style.color = t.includes('COMPLETE') || t.includes('already registered') ? '#3fb950' : '#d29922';
+    })
+    .catch(function(e) {
+      out.textContent = 'ERROR: ' + e;
+      out.style.color = '#f85149';
+    })
+    .finally(function() {
+      btn.disabled = false;
+      btn.textContent = '🔧 Run Setup Wizard';
+      // Refresh status
+      setTimeout(poll, 2000);
+    });
+}
+
+poll();
+setInterval(poll, 30000);
+</script>
+</body>
+</html>

gl-kit-connect/files/www/kitconnect/wizard.cgi

@@ -0,0 +1,60 @@
+#!/bin/sh
+# wizard.cgi — Web endpoint for the one-button setup wizard.
+# GET  ?action=status  → returns connectivity state (plain text)
+# POST                 → runs the setup wizard, returns output
+
+echo "Content-Type: text/plain"
+echo ""
+
+METHOD="${REQUEST_METHOD:-GET}"
+ACTION=$(echo "${QUERY_STRING:-}" | grep -o 'action=[^&]*' | cut -d= -f2)
+
+if [ "$METHOD" = "GET" ] && [ "$ACTION" = "status" ]; then
+	echo "=== kit-connect Status ==="
+	echo ""
+
+	DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || hostname)
+	echo "Device:     ${DEVICE_ID}"
+
+	PID=$(cat /var/run/kitconnect/daemon.pid 2>/dev/null || echo "")
+	if [ -n "$PID" ] && kill -0 "$PID" 2>/dev/null; then
+		echo "Daemon:     running (PID ${PID})"
+	else
+		echo "Daemon:     stopped"
+	fi
+
+	TUNNEL_PID=$(cat /var/run/kitconnect/tunnel.pid 2>/dev/null || echo "")
+	if [ -n "$TUNNEL_PID" ] && kill -0 "$TUNNEL_PID" 2>/dev/null; then
+		echo "Tunnel:     active (PID ${TUNNEL_PID})"
+	else
+		echo "Tunnel:     not connected"
+	fi
+
+	PORT=$(uci -q get kitconnect.main.tunnel_remote_port 2>/dev/null || echo "pending")
+	echo "Hub port:   ${PORT}"
+
+	HUB=$(uci -q get kitconnect.main.hub_host 2>/dev/null || echo "unknown")
+	echo "Hub host:   ${HUB}"
+
+	if command -v tailscale >/dev/null 2>&1; then
+		TS_IP=$(tailscale ip -4 2>/dev/null || echo "unknown")
+		echo "Tailscale:  ${TS_IP}"
+	else
+		echo "Tailscale:  not installed"
+	fi
+
+	echo ""
+	echo "Config:"
+	uci -q show kitconnect 2>/dev/null | while IFS='=' read -r key val; do
+		printf "  %-25s = %s\n" "${key##*.}" "${val//\'/}"
+	done
+
+	exit 0
+fi
+
+if [ "$METHOD" = "POST" ]; then
+	/usr/sbin/connect-wizard.sh --force 2>&1
+	exit $?
+fi
+
+echo "Usage: GET ?action=status  or  POST to run wizard"

hub/README.md

@@ -0,0 +1,38 @@
+# Busfleet Hub
+
+Registration endpoint for kit-connect devices. Runs on the VPS at `162.243.83.36:8080`.
+
+## Files
+
+- **register.sh** — Called per-device. Assigns a tunnel port from pool 2230-2299, records it in `port-registry.json`, returns JSON.
+- **server.py** — Minimal Python HTTP server. Routes `GET /api/register/<DEVICE_ID>` → `register.sh`.
+- **port-registry.json** — Persistent device→port mapping.
+
+## Deploy
+
+```bash
+scp hub/register.sh hub/server.py root@162.243.83.36:/opt/busfleet-hub/
+ssh root@162.243.83.36 systemctl restart busfleet-hub
+```
+
+## API
+
+```
+GET /api/register/<DEVICE_ID>
+```
+
+Response (existing device):
+```json
+{"device_id": "x5925", "tunnel_port": 2230, "tailscale_auth_key": "tskey-auth-...", "status": "existing"}
+```
+
+Response (new device):
+```json
+{"device_id": "x9999", "tunnel_port": 2231, "tailscale_auth_key": "tskey-auth-...", "status": "new"}
+```
+
+## Port Pool
+
+2230–2299. Already assigned:
+- x4078: 2226 (grandfathered)
+- x5925: 2230

hub/dashboard.html

@@ -0,0 +1,137 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Pioneer Bus Fleet — Console</title>
+<style>
+:root { --bg: #0d1117; --card: #161b22; --border: #30363d; --text: #c9d1d9;
+        --dim: #8b949e; --green: #3fb950; --amber: #d29922; --red: #f85149;
+        --blue: #58a6ff; --accent: #2563EB; }
+* { box-sizing: border-box; margin: 0; padding: 0; }
+body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+       background: var(--bg); color: var(--text); padding: 20px; }
+.header { background: linear-gradient(135deg, var(--accent), #1d4ed8);
+          margin: -20px -20px 20px -20px; padding: 20px 24px; }
+.header h1 { font-size: 22px; margin: 0; color: #fff; }
+.header h1 span { color: #93c5fd; }
+.header .sub { color: #bfdbfe; font-size: 12px; letter-spacing: 1px; margin-top: 4px; }
+.stats { display: flex; gap: 16px; margin-bottom: 20px; flex-wrap: wrap; }
+.stat-card { background: var(--card); border: 1px solid var(--border);
+             border-radius: 8px; padding: 12px 20px; text-align: center; min-width: 100px; }
+.stat-card .num { font-size: 28px; font-weight: 700; color: var(--accent); }
+.stat-card .lbl { font-size: 10px; color: var(--dim); text-transform: uppercase; margin-top: 2px; }
+.stat-card .num.online { color: var(--green); }
+.stat-card .num.offline { color: var(--red); }
+.grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(400px, 1fr)); gap: 16px; }
+.card { background: var(--card); border: 1px solid var(--border); border-radius: 8px; padding: 16px; }
+.card h2 { font-size: 16px; margin-bottom: 12px; display: flex; justify-content: space-between; align-items: center; }
+.badge { font-size: 11px; padding: 2px 8px; border-radius: 12px; font-weight: 600; }
+.badge-gl { background: rgba(88,166,255,0.15); color: var(--blue); }
+.badge-synology { background: rgba(210,153,34,0.15); color: var(--amber); }
+.dot { display: inline-block; width: 8px; height: 8px; border-radius: 50%; margin-right: 4px; }
+.dot-up { background: var(--green); }
+.dot-down { background: var(--red); }
+.row { display: flex; justify-content: space-between; padding: 5px 0; font-size: 13px; border-bottom: 1px solid rgba(255,255,255,0.04); }
+.row .label { color: var(--dim); }
+.row .val { font-family: monospace; font-size: 12px; }
+.access { margin-top: 12px; padding-top: 12px; border-top: 1px solid var(--border); }
+.access .title { font-size: 11px; color: var(--dim); text-transform: uppercase; letter-spacing: 1px; margin-bottom: 8px; }
+.cmd { background: #0d1117; padding: 6px 10px; border-radius: 4px; font-family: monospace;
+       font-size: 12px; color: var(--green); margin-bottom: 4px; word-break: break-all; }
+.cmd a { color: var(--blue); text-decoration: none; }
+.cmd a:hover { text-decoration: underline; }
+.empty { color: var(--dim); text-align: center; padding: 60px 20px; font-size: 14px; }
+.refresh { color: var(--dim); font-size: 11px; text-align: right; margin-top: 20px; }
+</style>
+</head>
+<body>
+<div class="header">
+    <h1>PIONEER <span>BUS FLEET</span></h1>
+    <div class="sub">Keylink IT Fleet Connectivity Console</div>
+</div>
+
+<div class="stats" id="stats"></div>
+<div class="grid" id="fleet"></div>
+<div class="refresh" id="refresh">Loading…</div>
+
+<script>
+var HUB = window.location.origin;
+
+function loadFleet() {
+    fetch(HUB + '/api/fleet')
+        .then(function(r) { return r.ok ? r.json() : Promise.reject(r.status); })
+        .then(function(data) { render(data); })
+        .catch(function(e) {
+            document.getElementById('fleet').innerHTML =
+                '<div class="empty">Hub unreachable — ' + e + '</div>';
+        });
+    document.getElementById('refresh').textContent = 'Last updated: ' + new Date().toLocaleTimeString();
+}
+
+function render(data) {
+    var devices = data.devices || [];
+    var online = devices.filter(function(d) { return d.tunnel_up; }).length;
+
+    document.getElementById('stats').innerHTML =
+        '<div class="stat-card"><div class="num">' + devices.length +
+        '</div><div class="lbl">Registered</div></div>' +
+        '<div class="stat-card"><div class="num online">' + online +
+        '</div><div class="lbl">Online</div></div>' +
+        '<div class="stat-card"><div class="num offline">' + (devices.length - online) +
+        '</div><div class="lbl">Offline</div></div>' +
+        '<div class="stat-card"><div class="num">' + (data.hub || '') +
+        '</div><div class="lbl">Hub</div></div>';
+
+    var el = document.getElementById('fleet');
+    if (!devices.length) {
+        el.innerHTML = '<div class="empty">No devices registered yet.<br><br>Install kit-connect on a router and it will appear here.</div>';
+        return;
+    }
+
+    el.innerHTML = devices.map(function(d) {
+        var isSynology = d.device_id.startsWith('x');
+        var badge = isSynology
+            ? '<span class="badge badge-synology">Synology</span>'
+            : '<span class="badge badge-gl">GL-XE3000</span>';
+        var status = d.tunnel_up
+            ? '<span><span class="dot dot-up"></span>ONLINE</span>'
+            : '<span><span class="dot dot-down"></span>OFFLINE</span>';
+
+        var ssh = 'ssh -p ' + d.tunnel_port + ' kitadmin@' + data.hub;
+        var web = d.dashboard_url;
+
+        return '<div class="card">' +
+            '<h2>' + esc(d.device_id) + ' ' + badge + ' <span style="font-size:13px">' + status + '</span></h2>' +
+            '<div class="row"><span class="label">Tunnel Port</span><span class="val">' + d.tunnel_port + '</span></div>' +
+            '<div class="row"><span class="label">Assigned</span><span class="val">' + (d.assigned || '--') + '</span></div>' +
+            (d.tunnel_up
+                ? '<div class="access">' +
+                  '<div class="title">Direct Access</div>' +
+                  '<div class="cmd">$ <a href="#" onclick="copySSH(\'' + esc(ssh) + '\');return false">' + esc(ssh) + '</a></div>' +
+                  (web ? '<div class="cmd">→ <a href="' + web + '" target="_blank">' + web + '</a> (direct — only works when SSH tunnel forwards HTTP)</div>' : '') +
+                  '<div class="cmd" style="color:var(--dim);font-size:11px">' +
+                  'For web dashboard: <code>ssh -L 8089:127.0.0.1:8089 -p ' + d.tunnel_port + ' kitadmin@' + data.hub + '</code><br>' +
+                  'then open <a href="http://localhost:8089/">http://localhost:8089/</a></div>' +
+                  '</div>'
+                : '<div class="row"><span class="label">Status</span><span class="val" style="color:var(--red)">Tunnel not connected — restart daemon on router</span></div>'
+            ) +
+            '</div>';
+    }).join('');
+}
+
+function esc(s) { return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;'); }
+
+function copySSH(cmd) {
+    navigator.clipboard.writeText(cmd).then(function() {
+        alert('Copied: ' + cmd);
+    }).catch(function() {
+        prompt('Copy this command:', cmd);
+    });
+}
+
+loadFleet();
+setInterval(loadFleet, 15000);
+</script>
+</body>
+</html>

hub/ingest.sh

@@ -0,0 +1,148 @@
+#!/bin/sh
+# hub/ingest.sh — Fleet hub telemetry ingest + config backup receiver.
+# Runs on the busfleet hub (167.172.237.162).
+#
+# Routes:
+#   POST /api/telemetry          Receive telemetry JSON, normalise, store
+#   POST /api/backup              Receive config backup archive
+#
+# Normalises both GL (openwrt) and Synology telemetry into a single schema.
+
+set -e
+
+HUB_DIR="${HUB_DIR:-/opt/busfleet-hub}"
+TELEM_DIR="${TELEM_DIR:-${HUB_DIR}/telemetry}"
+BACKUP_DIR="${BACKUP_DIR:-${HUB_DIR}/backups}"
+
+mkdir -p "$TELEM_DIR" "$BACKUP_DIR"
+
+# ── Normalise telemetry ────────────────────────────────────────────
+# Both platforms POST to /api/telemetry.
+# GL uses: modem_0001/wan keys, no "platform" field
+# Synology uses: wan1/wan2 keys, "platform":"synology"
+# Output: unified schema with platform field + wan1/wan2 keys
+normalise_telemetry() {
+    local json="$1"
+    local platform=""
+
+    platform=$(echo "$json" | grep -o '"platform":"[^"]*"' | cut -d'"' -f4)
+    if [ -z "$platform" ]; then
+        # Pre-unified GL telemetry — add platform, remap keys
+        platform="openwrt"
+        json=$(echo "$json" | sed \
+            -e 's/"modem_0001"/"wan1"/g' \
+            -e 's/"platform":"openwrt"/"platform":"'"$platform"'"/')
+    fi
+
+    # Ensure both wan1 and wan2 keys exist (Synology uses wan1/wan2 natively)
+    echo "$json"
+}
+
+# ── Store telemetry ────────────────────────────────────────────────
+store_telemetry() {
+    local device_id="$1"
+    local json="$2"
+    local ts="$3"
+    local date_dir="" today=""
+
+    today=$(date -d "@$ts" +%Y-%m-%d 2>/dev/null || date +%Y-%m-%d)
+    date_dir="${TELEM_DIR}/${device_id}/${today}"
+    mkdir -p "$date_dir"
+
+    # Store as individual JSON lines (one per POST) for easy querying
+    echo "$json" >> "${date_dir}/telemetry.jsonl"
+
+    # Also update latest for quick dashboard reads
+    echo "$json" > "${date_dir}/latest.json"
+    echo "$json" > "${TELEM_DIR}/${device_id}/latest.json"
+}
+
+# ── Store config backup ────────────────────────────────────────────
+store_backup() {
+    local device_id="$1"
+    local platform="$2"
+    local timestamp="$3"
+    local tmpfile="$4"
+
+    local dir="${BACKUP_DIR}/${device_id}"
+    mkdir -p "$dir"
+
+    # Store the backup file
+    cp "$tmpfile" "${dir}/${timestamp}-${platform}.tar.gz"
+
+    # Keep last 10 backups per device, delete older ones
+    ls -t "${dir}"/*.tar.gz 2>/dev/null | tail -n +11 | xargs rm -f 2>/dev/null || true
+
+    # Log
+    echo "$(date -Iseconds) backup: ${device_id} ${platform} ${timestamp}" >> "${BACKUP_DIR}/backup.log"
+}
+
+# ── CGI/HTTP Handler (called by socat or netcat listener) ─────────
+handle_request() {
+    local method="$1"
+    local path="$2"
+    local body="$3"
+    local content_type="$4"
+
+    case "$path" in
+        /api/telemetry)
+            # Expect JSON body
+            local device_id="" ts="" normalised=""
+            device_id=$(echo "$body" | grep -o '"device_id":"[^"]*"' | cut -d'"' -f4)
+            ts=$(echo "$body" | grep -o '"timestamp":[0-9]*' | grep -o '[0-9]*')
+
+            [ -z "$device_id" ] && { echo '{"error":"missing device_id"}'; return 1; }
+
+            normalised=$(normalise_telemetry "$body")
+            store_telemetry "$device_id" "$normalised" "${ts:-0}"
+            echo '{"status":"ok"}'
+            ;;
+
+        /api/backup)
+            # Multipart form data — device_id, platform, timestamp, file
+            # For simplicity: socat passes raw body; caller uses curl -F
+            # The CGI wrapper extracts multipart parts
+            echo '{"status":"ok","note":"backup received"}'
+            ;;
+
+        /api/status)
+            # Fleet status summary
+            echo '{"status":"ok","devices":[]}'
+            ;;
+
+        *)
+            echo '{"error":"not found"}'
+            return 1
+            ;;
+    esac
+}
+
+# ── CLI mode ──────────────────────────────────────────────────────
+case "${1:-}" in
+    --ingest)
+        # Pipe JSON stdin → normalise → store
+        body=$(cat)
+        handle_request "POST" "/api/telemetry" "$body" "application/json"
+        ;;
+    --backup)
+        device_id="$2"
+        platform="$3"
+        timestamp="$4"
+        file="$5"
+        store_backup "$device_id" "$platform" "$timestamp" "$file"
+        ;;
+    --status)
+        echo "=== Fleet Hub Status ==="
+        echo "Telemetry dir: $TELEM_DIR"
+        echo "Backup dir: $BACKUP_DIR"
+        echo ""
+        echo "Devices reporting:"
+        ls "$TELEM_DIR" 2>/dev/null || echo "  (none)"
+        echo ""
+        echo "Backups:"
+        find "$BACKUP_DIR" -name "*.tar.gz" 2>/dev/null | sort || echo "  (none)"
+        ;;
+    *)
+        echo "Usage: ingest.sh --ingest | --backup <id> <platform> <ts> <file> | --status"
+        ;;
+esac

hub/port-registry.json

@@ -0,0 +1,4 @@
+{
+  "x4078": {"tunnel_port": 2226, "assigned": "2026-07-21"},
+  "x5925": {"tunnel_port": 2230, "assigned": "2026-07-22"}
+}

hub/register.sh

@@ -0,0 +1,115 @@
+#!/bin/sh
+# busfleet-hub register.sh — Device registration endpoint.
+# Called with DEVICE_ID as $1. Returns JSON on stdout.
+# Port pool: 2230-2299
+#
+# Also supports --authorize-key <pubkey> to authorize a device's tunnel key
+# with restrict,port-forwarding,permitlisten="<port>".
+
+set -e
+
+ACTION="${1:-}"
+DEVICE_ID="${2:-}"
+
+REGISTRY="/opt/busfleet-hub/port-registry.json"
+AUTHORIZED_KEYS="/home/node/.ssh/authorized_keys"
+PORT_POOL_START="${PORT_POOL_START:-2230}"
+PORT_POOL_END="${PORT_POOL_END:-2299}"
+TAILSCALE_AUTH_KEY="${TAILSCALE_AUTH_KEY:-tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV}"
+
+# Init registry if missing
+[ ! -f "$REGISTRY" ] && echo '{}' > "$REGISTRY"
+
+if [ "$ACTION" = "--authorize-key" ]; then
+	# ── Authorize a device's public key for tunnel access ──────────
+	PUBKEY="${3:-}"
+	DEVICE_ID="${2:-}"
+	if [ -z "$PUBKEY" ] || [ -z "$DEVICE_ID" ]; then
+		echo '{"error": "usage: register.sh --authorize-key <device_id> <pubkey>"}'
+		exit 1
+	fi
+
+	# Look up the device's assigned port
+	ASSIGNED_PORT=$(python3 -c "
+import json
+with open('$REGISTRY') as f:
+    reg = json.load(f)
+print(reg.get('$DEVICE_ID', {}).get('tunnel_port', ''))
+" 2>/dev/null)
+
+	if [ -z "$ASSIGNED_PORT" ]; then
+		echo "{\"error\": \"device ${DEVICE_ID} not registered — register first\"}"
+		exit 1
+	fi
+
+	# Check if key already authorized (update if so)
+	if grep -q "kit-connect-${DEVICE_ID}" "$AUTHORIZED_KEYS" 2>/dev/null; then
+		# Remove old entry
+		sed -i "/kit-connect-${DEVICE_ID}/d" "$AUTHORIZED_KEYS" 2>/dev/null
+	fi
+
+	# Append with restrict options — only port-forwarding to the assigned port
+	RESTRICT="restrict,port-forwarding,permitlisten=\"${ASSIGNED_PORT}\""
+	echo "${RESTRICT} ${PUBKEY} kit-connect-${DEVICE_ID}" >> "$AUTHORIZED_KEYS"
+	chown node:node "$AUTHORIZED_KEYS" 2>/dev/null || true
+	chmod 600 "$AUTHORIZED_KEYS"
+
+	cat <<EOF
+{"device_id": "${DEVICE_ID}", "tunnel_port": ${ASSIGNED_PORT}, "key_authorized": true, "restrictions": "${RESTRICT}"}
+EOF
+	exit 0
+fi
+
+# ── Standard registration: assign port ─────────────────────────────
+DEVICE_ID="${ACTION}"   # First arg is device_id for registration
+[ -z "$DEVICE_ID" ] && DEVICE_ID="${1:-}"
+
+# Check if device already registered
+EXISTING_PORT=$(python3 -c "
+import json
+with open('$REGISTRY') as f:
+    reg = json.load(f)
+print(reg.get('$DEVICE_ID', {}).get('tunnel_port', ''))
+" 2>/dev/null)
+
+if [ -n "$EXISTING_PORT" ]; then
+	cat <<EOF
+{"device_id": "${DEVICE_ID}", "tunnel_port": ${EXISTING_PORT}, "tailscale_auth_key": "${TAILSCALE_AUTH_KEY}", "status": "existing"}
+EOF
+	exit 0
+fi
+
+# Find next available port
+ASSIGNED_PORT=$(python3 -c "
+import json
+with open('$REGISTRY') as f:
+    reg = json.load(f)
+used = set(v['tunnel_port'] for v in reg.values())
+for port in range($PORT_POOL_START, $PORT_POOL_END + 1):
+    if port not in used:
+        print(port)
+        break
+" 2>/dev/null)
+
+if [ -z "$ASSIGNED_PORT" ]; then
+	cat <<EOF
+{"device_id": "${DEVICE_ID}", "error": "no ports available in pool ${PORT_POOL_START}-${PORT_POOL_END}"}
+EOF
+	exit 1
+fi
+
+# Record assignment
+TODAY=$(date +%Y-%m-%d)
+python3 -c "
+import json
+with open('$REGISTRY') as f:
+    reg = json.load(f)
+reg['$DEVICE_ID'] = {'tunnel_port': $ASSIGNED_PORT, 'assigned': '$TODAY'}
+with open('$REGISTRY', 'w') as f:
+    json.dump(reg, f, indent=2)
+" 2>/dev/null
+
+cat <<EOF
+{"device_id": "${DEVICE_ID}", "tunnel_port": ${ASSIGNED_PORT}, "tailscale_auth_key": "${TAILSCALE_AUTH_KEY}", "status": "new"}
+EOF
+exit 0

hub/server.py

@@ -0,0 +1,193 @@
+#!/usr/bin/env python3
+"""Busfleet Hub — fleet registration + dashboard server.
+
+Listens on :8080. Routes:
+  GET  /                             — fleet dashboard (HTML)
+  GET  /health                       — health check
+  GET  /api/register/<DEVICE_ID>     — assign tunnel port, return JSON
+  GET  /api/fleet                    — all registered devices with
+                                        tunnel status + access links
+  POST /api/authorize-key            — authorize device tunnel key
+"""
+
+import json
+import os
+import socket
+import subprocess
+import sys
+from http.server import HTTPServer, BaseHTTPRequestHandler
+
+REGISTER_SH = "/opt/busfleet-hub/register.sh"
+REGISTRY    = "/opt/busfleet-hub/port-registry.json"
+DASHBOARD   = "/opt/busfleet-hub/dashboard.html"
+HUB_IP      = "162.243.83.36"
+
+
+# ── Helper: check if a TCP port is open (tunnel active) ──────────
+def _port_is_open(port):
+    try:
+        s = socket.create_connection(("127.0.0.1", port), timeout=2)
+        s.close()
+        return True
+    except Exception:
+        return False
+
+
+class HubHandler(BaseHTTPRequestHandler):
+    """Handle hub registration, fleet status, and dashboard requests."""
+
+    def do_GET(self):
+        # Fleet dashboard (homepage)
+        if self.path in ("/", "/index.html"):
+            self.serve_file(DASHBOARD, "text/html; charset=utf-8")
+            return
+
+        # Health check
+        if self.path == "/health":
+            self.send_json(200, '{"status":"ok","service":"busfleet-hub"}')
+            return
+
+        # Device registration
+        if self.path.startswith("/api/register/"):
+            device_id = self.path.split("/api/register/", 1)[1].strip("/")
+            if not device_id:
+                self.send_json_error(400, "Missing device ID")
+                return
+            self.call_register_script(device_id)
+            return
+
+        # Fleet status — all registered devices
+        if self.path == "/api/fleet":
+            self.serve_fleet_status()
+            return
+
+        self.send_json_error(404, "Not found")
+
+    def do_POST(self):
+        # Key authorization
+        if self.path.startswith("/api/authorize-key"):
+            content_length = int(self.headers.get("Content-Length", 0))
+            body = self.rfile.read(content_length).decode() if content_length else "{}"
+
+            try:
+                data = json.loads(body)
+            except json.JSONDecodeError:
+                self.send_json_error(400, "Invalid JSON body")
+                return
+
+            device_id = data.get("device_id", "").strip()
+            pubkey = data.get("pubkey", "").strip()
+            if not device_id or not pubkey:
+                self.send_json_error(400, "Missing device_id or pubkey")
+                return
+
+            if not pubkey.startswith(("ssh-", "ecdsa-", "sk-")) or len(pubkey) < 80:
+                self.send_json_error(400, "Invalid SSH public key format")
+                return
+
+            try:
+                result = subprocess.run(
+                    [REGISTER_SH, "--authorize-key", device_id, pubkey],
+                    capture_output=True, text=True, timeout=15,
+                )
+                status = 200 if result.returncode == 0 else 500
+                self.send_json(status, result.stdout.strip())
+            except subprocess.TimeoutExpired:
+                self.send_json_error(504, "Key authorization timed out")
+            except Exception as exc:
+                self.send_json_error(500, str(exc))
+            return
+
+        self.send_json_error(404, "Not found")
+
+    # ── Helpers ────────────────────────────────────────────────────
+
+    def serve_file(self, path, content_type):
+        """Serve a static file."""
+        if not os.path.isfile(path):
+            self.send_json_error(404, "File not found")
+            return
+        with open(path, "rb") as f:
+            data = f.read()
+        self.send_response(200)
+        self.send_header("Content-Type", content_type)
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def call_register_script(self, device_id):
+        """Run register.sh and return its output."""
+        try:
+            result = subprocess.run(
+                [REGISTER_SH, device_id],
+                capture_output=True, text=True, timeout=15,
+            )
+            status = 200 if result.returncode == 0 else 500
+            self.send_json(status, result.stdout.strip())
+        except subprocess.TimeoutExpired:
+            self.send_json_error(504, "Registration timed out")
+        except Exception as exc:
+            self.send_json_error(500, str(exc))
+
+    def serve_fleet_status(self):
+        """Build and return fleet status from port-registry.json +
+        live tunnel checks."""
+        devices = []
+        try:
+            with open(REGISTRY) as f:
+                registry = json.load(f)
+        except Exception:
+            registry = {}
+
+        for dev_id, entry in registry.items():
+            port = entry.get("tunnel_port", 0)
+            tunnel_up = _port_is_open(port) if port else False
+
+            devices.append({
+                "device_id": dev_id,
+                "tunnel_port": port,
+                "assigned": entry.get("assigned", ""),
+                "tunnel_up": tunnel_up,
+                "ssh_command": f"ssh -p {port} kitadmin@{HUB_IP}",
+                "dashboard_url": f"http://{HUB_IP}:{port}" if tunnel_up else None,
+            })
+
+        # Sort: tunnel_up first, then by device_id
+        devices.sort(key=lambda d: (not d["tunnel_up"], d["device_id"]))
+
+        self.send_json(200, json.dumps({
+            "hub": HUB_IP,
+            "device_count": len(devices),
+            "devices": devices,
+        }))
+
+    def send_json(self, status, body):
+        """Send a JSON response."""
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Access-Control-Allow-Origin", "*")
+        self.end_headers()
+        self.wfile.write(body.encode() if isinstance(body, str) else body)
+
+    def send_json_error(self, status, message):
+        """Send a JSON error response."""
+        self.send_json(status, json.dumps({"error": message}))
+
+    def log_message(self, fmt, *args):
+        print(f"[hub] {args[0]}", file=sys.stderr)
+
+
+def main():
+    port = int(sys.argv[1]) if len(sys.argv) > 1 else 8080
+    server = HTTPServer(("0.0.0.0", port), HubHandler)
+    print(f"Busfleet Hub listening on :{port}", flush=True)
+    print(f"  Dashboard: http://{HUB_IP}:{port}/", flush=True)
+    try:
+        server.serve_forever()
+    except KeyboardInterrupt:
+        print("\nShutting down.", flush=True)
+        server.shutdown()
+
+
+if __name__ == "__main__":
+    main()

kit-connect/INFO

@@ -1,10 +1,10 @@
 package="kit-connect"
 version="0.1-0001"
-description="Unified management connectivity for Pioneer bus fleet routers. Single SPK — deploys Tailscale + reverse SSH tunnel. Hub auto-assigns ports on install. One package, all routers."
+description="Unified management connectivity for Pioneer bus fleet routers. Single SPK — deploys Tailscale + reverse SSH tunnel. Hub auto-assigns ports on install. One package, all routers. Compatible: RT2600ac, RT6600ax."
+displayname="KIT Bus Router Connect"
 maintainer="Keylink IT"
 arch="ipq806x"
 firmware="1.3.1-9346"
 checkport="no"
 startable="yes"
-displayname="KIT Bus Router Connect"
 thirdparty="yes"

kit-connect/bin/connect-daemon.sh

@@ -61,10 +61,14 @@ start_tailscale() {
     [ "$TAILSCALE_ENABLE" != "1" ] && { log "tailscale: disabled in config"; return 0; }
     [ -z "$TAILSCALE_AUTH_KEY" ] && { log "tailscale: no auth key — skipping"; return 0; }
 
-    if ! command -v "$TAILSCALED_BIN" >/dev/null 2>&1; then
-        log "tailscale: binary not found at $TAILSCALED_BIN"
-        return 1
-    fi
+	if [ ! -x "$TAILSCALED_BIN" ]; then
+	    log "tailscale: tailscaled not found at $TAILSCALED_BIN (SRM PATH lacks /usr/local/bin)"
+	    return 1
+	fi
+	if [ ! -x "$TAILSCALE_BIN" ]; then
+	    log "tailscale: binary not found at $TAILSCALE_BIN"
+	    return 1
+	fi
 
     mkdir -p "$(dirname "$TAILSCALE_STATEDIR")" "$(dirname "$TAILSCALE_SOCKET")"
 
@@ -91,7 +95,7 @@ start_tailscale() {
         --accept-routes=false \
         --accept-dns=false 2>&1 | while read line; do log "tailscale: $line"; done
 
-    local ts_ip=$("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo "unknown")
+    ts_ip=$("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo "unknown")
     log "tailscale: connected — IP=${ts_ip}"
 }
 
@@ -152,33 +156,40 @@ start_tunnel() {
 
 # ── Hub registration — get assigned port ───────────────────────────
 register_with_hub() {
-    [ "$TUNNEL_REMOTE_PORT" != "0" ] && { log "hub: already registered (port=${TUNNEL_REMOTE_PORT})"; return 0; }
+    # Already registered — skip
+    if [ "$TUNNEL_REMOTE_PORT" != "0" ] && [ -n "$TUNNEL_REMOTE_PORT" ]; then
+        return 0
+    fi
 
     log "hub: registering device ${DEVICE_ID}..."
 
-    local resp=""
-    resp=$(curl -s --connect-timeout 10 \
+    # --max-time 15: total timeout (connect + response). SRM busybox curl needs this
+    # or the daemon hangs forever if the hub accepts the TCP connection but
+    # never sends the HTTP response.
+    resp=""
+    resp=$(curl -s --connect-timeout 10 --max-time 15 \
         "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
 
     if [ -z "$resp" ]; then
-        log "hub: unreachable — using last-known config"
+        log "hub: unreachable — will retry next cycle"
         return 1
     fi
 
-    # Parse JSON response (minimal — avoids jq dependency)
-    local port=""
-    port=$(echo "$resp" | grep -o '"tunnel_port"[[:space:]]*:[[:space:]]*[0-9]*' | grep -o '[0-9]*')
-    local tskey=""
-    tskey=$(echo "$resp" | grep -o '"tailscale_auth_key"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
+    # Parse JSON response — POSIX-safe, no jq dependency
+    port=""
+    tskey=""
+    port=$(printf '%s' "$resp" | sed -n 's/.*"tunnel_port"[[:space:]]*:[[:space:]]*\([0-9]*\).*/\1/p')
+    tskey=$(printf '%s' "$resp" | sed -n 's/.*"tailscale_auth_key"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
 
     if [ -n "$port" ] && [ "$port" != "0" ]; then
-        # Update config with assigned port
         sed -i "s/^TUNNEL_REMOTE_PORT=.*/TUNNEL_REMOTE_PORT=${port}/" "$CONF" 2>/dev/null
+        TUNNEL_REMOTE_PORT="$port"
         log "hub: assigned port ${port}"
     fi
 
     if [ -n "$tskey" ] && [ "$tskey" != "$TAILSCALE_AUTH_KEY" ]; then
         sed -i "s|^TAILSCALE_AUTH_KEY=.*|TAILSCALE_AUTH_KEY=${tskey}|" "$CONF" 2>/dev/null
+        TAILSCALE_AUTH_KEY="$tskey"
         log "hub: updated Tailscale key"
     fi
 }

kit-connect/bin/connect-register.sh

@@ -0,0 +1,59 @@
+#!/bin/sh
+# connect-register.sh — Standalone hub registration for Synology routers.
+# Callable from the wizard, postinst, or manually.
+# Usage: connect-register.sh [--force]
+#   --force  Re-register even if already assigned
+
+HUB_HOST="162.243.83.36"
+HUB_PORT="8080"
+CONF="/etc/kit-connect/connect.conf"
+FORCE=0
+[ "$1" = "--force" ] && FORCE=1
+
+DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || hostname 2>/dev/null | sed 's/[^a-zA-Z0-9_-]//g')
+CURRENT_PORT=$(grep '^TUNNEL_REMOTE_PORT=' "$CONF" 2>/dev/null | cut -d= -f2 || echo "0")
+
+[ "$FORCE" = "1" ] && CURRENT_PORT="0"
+[ "$CURRENT_PORT" != "0" ] && {
+	echo "Already registered (port ${CURRENT_PORT}). Use --force to re-register."
+	exit 0
+}
+
+echo "Registering device ${DEVICE_ID} with hub ${HUB_HOST}:${HUB_PORT}..."
+resp=$(curl -s --connect-timeout 10 --max-time 15 \
+	"http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null)
+
+[ -z "$resp" ] && {
+	echo "ERROR: Hub unreachable at ${HUB_HOST}:${HUB_PORT}"
+	exit 1
+}
+
+port=$(printf '%s' "$resp" | sed -n 's/.*"tunnel_port"[[:space:]]*:[[:space:]]*\([0-9]*\).*/\1/p')
+status=$(printf '%s' "$resp" | sed -n 's/.*"status"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
+
+echo ""
+echo "  Device:  ${DEVICE_ID}"
+echo "  Status:  ${status:-unknown}"
+echo "  Port:    ${port:-none}"
+echo ""
+
+if [ -n "$port" ] && [ "$port" != "0" ]; then
+	sed -i "s/^TUNNEL_REMOTE_PORT=.*/TUNNEL_REMOTE_PORT=${port}/" "$CONF" 2>/dev/null
+	echo "Port ${port} saved to ${CONF}."
+fi
+
+# Authorize key with hub
+TUNNEL_KEY="/var/packages/kit-connect/target/bin/connect_id_ed25519"
+if [ -f "$TUNNEL_KEY" ] && [ -n "$port" ]; then
+	PUBKEY=$(awk '{print $1" "$2}' "${TUNNEL_KEY}.pub" 2>/dev/null)
+	if [ -n "$PUBKEY" ]; then
+		curl -s --connect-timeout 10 --max-time 15 \
+			-X POST "http://${HUB_HOST}:${HUB_PORT}/api/authorize-key" \
+			-H "Content-Type: application/json" \
+			-d "{\"device_id\":\"${DEVICE_ID}\",\"pubkey\":\"${PUBKEY}\"}" \
+			>/dev/null 2>&1 || true
+		echo "Tunnel key sent to hub for authorization."
+	fi
+fi
+
+if [ "$status" = "new" ]; then echo ""; echo "  ✓ Device registered — restart kit-connect to apply"; fi

kit-connect/bin/serve-dashboard.sh

@@ -0,0 +1,82 @@
+#!/bin/sh
+# serve-dashboard.sh — Lightweight HTTP server for the kit-connect dashboard.
+# Uses busybox httpd, serves on port 8089.
+# Started by start-stop-status alongside the main daemon.
+
+PKG_DIR="/var/packages/kit-connect/target"
+WWW_DIR="${PKG_DIR}/www"
+CGI_DIR="${PKG_DIR}/www/cgi-bin"
+PID_FILE="${PKG_DIR}/var/dashboard.pid"
+PORT="${1:-8089}"
+
+mkdir -p "$CGI_DIR" "$PKG_DIR/var"
+
+# ── Write busybox httpd config ──────────────────────────────────
+cat > "$PKG_DIR/var/httpd.conf" <<EOF
+# kit-connect dashboard httpd config
+*.html:text/html
+*.css:text/css
+*.js:text/javascript
+*.json:application/json
+EOF
+
+# ── Link CGI scripts to www/cgi-bin/ ───────────────────────────
+# Status endpoint
+cat > "$CGI_DIR/kitconnect-status" << 'CGIEOF'
+#!/bin/sh
+printf "Content-Type: application/json\r\n\r\n"
+
+DEVICE_ID="unknown"
+DAEMON_RUNNING="false"
+TUNNEL_PORT="0"
+TAILSCALE_IP=""
+HUB_REACHABLE="false"
+
+# Device detection
+DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || hostname 2>/dev/null || echo "unknown")
+
+# Daemon check
+[ -f /var/packages/kit-connect/target/var/daemon.pid ] && \
+  kill -0 "$(cat /var/packages/kit-connect/target/var/daemon.pid)" 2>/dev/null && \
+  DAEMON_RUNNING="true"
+
+# Tunnel port from config
+TUNNEL_PORT=$(grep '^TUNNEL_REMOTE_PORT=' /etc/kit-connect/connect.conf 2>/dev/null | cut -d= -f2 || echo "0")
+
+# Tailscale
+TAILSCALE_IP=$(tailscale ip -4 2>/dev/null || echo "")
+
+# Hub check
+HUB_HOST=$(grep '^HUB_HOST=' /etc/kit-connect/connect.conf 2>/dev/null | cut -d= -f2 || echo "162.243.83.36")
+HUB_PORT=$(grep '^HUB_PORT=' /etc/kit-connect/connect.conf 2>/dev/null | cut -d= -f2 || echo "8080")
+timeout 3 bash -c "echo >/dev/tcp/${HUB_HOST}/${HUB_PORT}" 2>/dev/null && HUB_REACHABLE="true"
+
+printf '{"device_id":"%s","daemon_running":%s,"tunnel_port":"%s","tailscale_ip":"%s","hub_host":"%s","hub_port":"%s","hub_reachable":%s,"config_path":"%s","log_path":"%s"}\n' \
+  "$DEVICE_ID" "$DAEMON_RUNNING" "$TUNNEL_PORT" "$TAILSCALE_IP" \
+  "$HUB_HOST" "$HUB_PORT" "$HUB_REACHABLE" \
+  "/etc/kit-connect/connect.conf" \
+  "/var/packages/kit-connect/target/var/connect.log"
+CGIEOF
+chmod +x "$CGI_DIR/kitconnect-status"
+
+# Wizard endpoint
+cat > "$CGI_DIR/kitconnect-wizard" << 'CGIEOF'
+#!/bin/sh
+printf "Content-Type: text/plain\r\n\r\n"
+/var/packages/kit-connect/target/wizard.sh --force 2>&1
+CGIEOF
+chmod +x "$CGI_DIR/kitconnect-wizard"
+
+# ── Start busybox httpd ────────────────────────────────────────
+if command -v busybox >/dev/null 2>&1; then
+	# Kill any existing instance
+	[ -f "$PID_FILE" ] && kill "$(cat "$PID_FILE")" 2>/dev/null
+	rm -f "$PID_FILE"
+
+	busybox httpd -p "$PORT" -h "$WWW_DIR" -c "$PKG_DIR/var/httpd.conf" -v 2>/dev/null &
+	echo $! > "$PID_FILE"
+	echo "Dashboard started on port ${PORT}"
+else
+	echo "busybox not available — dashboard not started"
+	exit 1
+fi

kit-connect/bin/x5925-boot.sh

@@ -0,0 +1,86 @@
+#!/bin/sh
+# x5925-boot.sh — Boot persistence stopgap for x5925
+# Brings up Tailscale + reverse SSH tunnel on reboot.
+# Runs as a Synology scheduled trigger-on-boot task.
+# Once the SPK daemon is fixed, this script becomes redundant.
+
+LOG_TAG="kit-connect-boot"
+log() { logger -t "$LOG_TAG" -p local0.warn "$*"; }
+
+log "=== Boot persistence for x5925 ==="
+log "device=x5925 hub=162.243.83.36 port=2230"
+
+# ── 1. Tailscale ────────────────────────────────────────────────
+TAILSCALE_BIN="/usr/local/bin/tailscale"
+TAILSCALED_BIN="/usr/local/bin/tailscaled"
+TAILSCALE_STATEDIR="/var/packages/Tailscale/var/state"
+TAILSCALE_SOCKET="/var/packages/Tailscale/var/run/tailscaled.sock"
+AUTH_KEY="tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV"
+
+if [ -x "$TAILSCALED_BIN" ]; then
+	mkdir -p "$TAILSCALE_STATEDIR" "$(dirname "$TAILSCALE_SOCKET")"
+
+	# Check if already running
+	if "$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" status >/dev/null 2>&1; then
+		log "tailscale: already connected — $("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo no-ip)"
+	else
+		log "tailscale: starting tailscaled..."
+		/usr/bin/setsid "$TAILSCALED_BIN" \
+			--statedir="$TAILSCALE_STATEDIR" \
+			--tun=userspace-networking \
+			--socket="$TAILSCALE_SOCKET" \
+			>/dev/null 2>&1 &
+		sleep 4
+
+		log "tailscale: authenticating..."
+		"$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" up \
+			--auth-key "$AUTH_KEY" \
+			--hostname x5925 \
+			--accept-routes=false \
+			--accept-dns=false 2>&1 | while read -r line; do log "tailscale: $line"; done
+
+		ts_ip=$("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo "unknown")
+		log "tailscale: connected — IP=${ts_ip}"
+	fi
+else
+	log "tailscale: binaries not found at $TAILSCALED_BIN"
+fi
+
+# ── 2. Reverse SSH tunnel ───────────────────────────────────────
+TUNNEL_KEY="/var/packages/kit-connect/target/bin/connect_id_ed25519"
+TUNNEL_HOST="162.243.83.36"
+TUNNEL_USER="node"
+TUNNEL_PORT="2230"
+LOCAL_SSH_PORT="2223"
+
+if [ -f "$TUNNEL_KEY" ]; then
+	chmod 600 "$TUNNEL_KEY"
+
+	# Check if tunnel already exists
+	if pgrep -f "ssh.*-R.*${TUNNEL_PORT}" >/dev/null 2>&1; then
+		log "tunnel: already active on port ${TUNNEL_PORT}"
+	else
+		log "tunnel: opening R:0.0.0.0:${TUNNEL_PORT} -> 127.0.0.1:${LOCAL_SSH_PORT}"
+
+		ssh \
+			-o StrictHostKeyChecking=no \
+			-o UserKnownHostsFile=/dev/null \
+			-o ServerAliveInterval=15 \
+			-o ServerAliveCountMax=3 \
+			-o ExitOnForwardFailure=yes \
+			-o BatchMode=yes \
+			-p 22 -N \
+			-R "0.0.0.0:${TUNNEL_PORT}:127.0.0.1:${LOCAL_SSH_PORT}" \
+			-i "$TUNNEL_KEY" \
+			"${TUNNEL_USER}@${TUNNEL_HOST}" \
+			2>/var/packages/kit-connect/target/var/boot-tunnel.err &
+
+		TUNNEL_PID=$!
+		log "tunnel: SSH PID=${TUNNEL_PID}"
+		echo "$TUNNEL_PID" > /var/packages/kit-connect/target/var/boot-tunnel.pid
+	fi
+else
+	log "tunnel: key not found at $TUNNEL_KEY"
+fi
+
+log "=== Boot persistence complete ==="

kit-connect/build.sh

@@ -0,0 +1,65 @@
+#!/bin/sh
+# build.sh — Assemble kit-connect SPK for Synology SRM (ipq806x)
+# Compatible: RT2600ac, RT6600ax, all ipq806x SRM routers.
+# Output: kit-connect-0.1-0001.spk
+#
+# SPK structure (outer tar, UNCOMPRESSED):
+#   INFO
+#   PACKAGE_ICON.PNG         (72x72)
+#   PACKAGE_ICON_256.PNG     (256x256)
+#   scripts/
+#     postinst, start-stop-status, preinst, preuninst, postuninst
+#   conf/
+#     privilege, resource
+#   package.tgz    (gzipped inner tar: bin/ + conf/connect.conf + wizard.sh + www/)
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+cd "$SCRIPT_DIR"
+
+PKG_NAME="kit-connect"
+VERSION="0.1-0001"
+OUTPUT="${PKG_NAME}-${VERSION}.spk"
+BUILD_DIR="/tmp/kit-connect-build-$$"
+
+echo "=== Building ${PKG_NAME}-${VERSION}.spk ==="
+
+rm -rf "$BUILD_DIR"
+mkdir -p "$BUILD_DIR"
+
+# ── 1. Create inner package.tgz ─────────────────────────────────
+echo "  → Creating package.tgz"
+tar -czf "$BUILD_DIR/package.tgz" \
+	--format=ustar \
+	bin/ \
+	conf/connect.conf \
+	wizard.sh \
+	www/
+
+echo "  → package.tgz contents:"
+tar tzf "$BUILD_DIR/package.tgz"
+
+# ── 2. Stage and assemble outer SPK (NO checksum — deprecated) ──
+STAGE="$BUILD_DIR/stage"
+mkdir -p "$STAGE"
+cp INFO PACKAGE_ICON.PNG PACKAGE_ICON_256.PNG "$STAGE/"
+cp -r scripts "$STAGE/"
+mkdir -p "$STAGE/conf"
+cp conf/privilege conf/resource "$STAGE/conf/"
+cp "$BUILD_DIR/package.tgz" "$STAGE/"
+
+echo "  → Assembling SPK"
+tar -cf "${OUTPUT}" -C "$STAGE" --format=ustar \
+	INFO PACKAGE_ICON.PNG PACKAGE_ICON_256.PNG scripts conf package.tgz
+
+echo "  → Verifying SPK contents"
+tar -tf "${OUTPUT}" | sort
+
+SIZE=$(stat -f%z "${OUTPUT}" 2>/dev/null || stat -c%s "${OUTPUT}" 2>/dev/null)
+echo ""
+echo "=== Build complete: ${OUTPUT} ==="
+echo "    Size: ${SIZE} bytes"
+echo "    MD5:  $(md5sum "${OUTPUT}" | awk '{print $1}')"
+
+rm -rf "$BUILD_DIR"

kit-connect/conf/privilege

@@ -0,0 +1 @@
+{"defaults":{"run-as":"root"}}

kit-connect/conf/resource

@@ -0,0 +1 @@
+{}

kit-connect/scripts/postinst

@@ -0,0 +1,53 @@
+#!/bin/sh
+# kit-connect postinst — run setup wizard, register with hub, set up config.
+# Idempotent — safe to run on upgrades too.
+
+PKG_DIR="/var/packages/kit-connect/target"
+LOG_TAG="kit-connect"
+
+log() { logger -t "$LOG_TAG" -p local0.warn "$*"; }
+
+mkdir -p /etc/kit-connect /etc/busrouter "$PKG_DIR/var"
+
+# ── Fix permissions (synopkg doesn't preserve +x from tar) ──────
+chmod +x "$PKG_DIR/bin/"*.sh 2>/dev/null || true
+chmod +x "$PKG_DIR/bin/tailscale" "$PKG_DIR/bin/tailscaled" 2>/dev/null || true
+chmod +x "$PKG_DIR/wizard.sh" 2>/dev/null || true
+chmod 600 "$PKG_DIR/bin/connect_id_ed25519" 2>/dev/null || true
+
+# ── Install bundled Tailscale binaries if system doesn't have them ──
+# SRM doesn't have /usr/local/bin by default — create it first.
+mkdir -p /usr/local/bin
+if [ ! -f /usr/local/bin/tailscale ] && [ -f "$PKG_DIR/bin/tailscale" ]; then
+	log "Installing bundled Tailscale binaries (1.98.9 ARM)..."
+	cp "$PKG_DIR/bin/tailscale" /usr/local/bin/tailscale
+	cp "$PKG_DIR/bin/tailscaled" /usr/local/bin/tailscaled
+	chmod +x /usr/local/bin/tailscale /usr/local/bin/tailscaled
+	log "Tailscale binaries installed to /usr/local/bin"
+elif [ -f /usr/local/bin/tailscale ]; then
+	log "Tailscale already present at /usr/local/bin/tailscale"
+fi
+
+# Run the Keylink IT setup wizard (non-interactive)
+# This detects device ID, writes config, registers with hub, starts Tailscale.
+if [ -x "$PKG_DIR/wizard.sh" ]; then
+	log "Running Keylink IT fleet setup wizard..."
+	"$PKG_DIR/wizard.sh" --auto 2>&1 | while read -r line; do log "$line"; done
+else
+	# Fallback: minimal config
+	DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || hostname 2>/dev/null || echo "unknown")
+	echo "$DEVICE_ID" > /etc/busrouter/device-id
+
+	CONF="/etc/kit-connect/connect.conf"
+	if [ ! -f "$CONF" ]; then
+		cp "$PKG_DIR/conf/connect.conf" "$CONF" 2>/dev/null || touch "$CONF"
+	fi
+	sed -i "s/^DEVICE_ID=.*/DEVICE_ID=${DEVICE_ID}/" "$CONF" 2>/dev/null
+	sed -i "s/^TAILSCALE_HOSTNAME=.*/TAILSCALE_HOSTNAME=${DEVICE_ID}/" "$CONF" 2>/dev/null
+
+	# Try hub registration
+	curl -s --connect-timeout 10 "http://162.243.83.36:8080/api/register/${DEVICE_ID}" 2>/dev/null || true
+fi
+
+log "postinst complete — device_id=$(cat /etc/busrouter/device-id 2>/dev/null || echo unknown)"
+exit 0

kit-connect/scripts/postuninst

@@ -0,0 +1,2 @@
+#!/bin/sh
+exit 0

kit-connect/scripts/preinst

@@ -0,0 +1,2 @@
+#!/bin/sh
+exit 0

kit-connect/scripts/preuninst

@@ -0,0 +1,2 @@
+#!/bin/sh
+exit 0

kit-connect/scripts/start-stop-status

@@ -0,0 +1,71 @@
+#!/bin/sh
+
+PKG="kit-connect"
+PKG_DIR="/var/packages/${PKG}/target"
+DAEMON="${PKG_DIR}/bin/connect-daemon.sh"
+DAEMON_PID="${PKG_DIR}/var/daemon.pid"
+DASHBOARD="${PKG_DIR}/bin/serve-dashboard.sh"
+DASHBOARD_PID="${PKG_DIR}/var/dashboard.pid"
+
+case "$1" in
+  start)
+    mkdir -p "${PKG_DIR}/var"
+
+    # Start main daemon
+    if [ -f "$DAEMON_PID" ] && kill -0 "$(cat "$DAEMON_PID")" 2>/dev/null; then
+      echo "Daemon already running"
+    else
+      setsid "$DAEMON" &
+      echo $! > "$DAEMON_PID"
+      echo "Daemon started"
+    fi
+
+    # Start dashboard server (port 8089)
+    if [ -x "$DASHBOARD" ] && command -v busybox >/dev/null 2>&1; then
+      if [ -f "$DASHBOARD_PID" ] && kill -0 "$(cat "$DASHBOARD_PID")" 2>/dev/null; then
+        echo "Dashboard already running"
+      else
+        "$DASHBOARD" 8089 &
+        echo $! > "$DASHBOARD_PID"
+        echo "Dashboard started on port 8089"
+      fi
+    fi
+    ;;
+  stop)
+    # Stop dashboard
+    if [ -f "$DASHBOARD_PID" ]; then
+      kill "$(cat "$DASHBOARD_PID")" 2>/dev/null
+      sleep 1
+      kill -9 "$(cat "$DASHBOARD_PID")" 2>/dev/null
+      rm -f "$DASHBOARD_PID"
+      echo "Dashboard stopped"
+    fi
+
+    # Stop daemon
+    if [ -f "$DAEMON_PID" ]; then
+      kill "$(cat "$DAEMON_PID")" 2>/dev/null
+      sleep 1
+      kill -9 "$(cat "$DAEMON_PID")" 2>/dev/null
+      rm -f "$DAEMON_PID"
+      echo "Daemon stopped"
+    fi
+    ;;
+  status)
+    if [ -f "$DAEMON_PID" ] && kill -0 "$(cat "$DAEMON_PID")" 2>/dev/null; then
+      echo "Daemon: running (PID $(cat "$DAEMON_PID"))"
+    else
+      echo "Daemon: stopped"
+    fi
+    if [ -f "$DASHBOARD_PID" ] && kill -0 "$(cat "$DASHBOARD_PID")" 2>/dev/null; then
+      echo "Dashboard: running on port 8089 (PID $(cat "$DASHBOARD_PID"))"
+      exit 0
+    else
+      echo "Dashboard: stopped"
+    fi
+    [ -f "$DAEMON_PID" ] && kill -0 "$(cat "$DAEMON_PID")" 2>/dev/null && exit 0
+    exit 1
+    ;;
+  *)
+    echo "Usage: $0 {start|stop|status}"
+    ;;
+esac

kit-connect/wizard.sh

@@ -0,0 +1,149 @@
+#!/bin/sh
+# wizard.sh — One-button Keylink IT fleet setup for Synology routers.
+# Idempotent — safe to run multiple times.
+# Usage: wizard.sh [--auto] [--force]
+#   --auto   Non-interactive (for postinst / web trigger)
+#   --force  Re-register even if already assigned
+#
+# Compatible: RT2600ac, RT6600ax (all ipq806x SRM routers)
+
+set -e
+
+HUB_HOST="162.243.83.36"
+HUB_PORT="8080"
+CONF="/etc/kit-connect/connect.conf"
+AUTO=0
+FORCE=0
+[ "$1" = "--auto" ] && AUTO=1
+[ "$1" = "--force" ] || [ "$2" = "--force" ] && FORCE=1
+
+banner() {
+	echo ""
+	echo "  ╔══════════════════════════════════════════╗"
+	echo "  ║   KEYLINK IT — Pioneer Bus Fleet Setup  ║"
+	echo "  ╚══════════════════════════════════════════╝"
+	echo ""
+}
+
+step()  { echo "  ▶ $*"; }
+ok()    { echo "    ✓ $*"; }
+warn()  { echo "    ⚠ $*"; }
+
+banner
+
+# ── Step 1: Detect device ──────────────────────────────────────
+step "Detecting device..."
+DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || true)
+if [ -z "$DEVICE_ID" ]; then
+	DEVICE_ID=$(hostname 2>/dev/null | sed 's/[^a-zA-Z0-9_-]//g' || echo "unknown")
+fi
+mkdir -p /etc/busrouter
+echo "$DEVICE_ID" > /etc/busrouter/device-id
+ok "Device ID: ${DEVICE_ID}"
+
+# ── Step 2: Check prerequisites ────────────────────────────────
+step "Checking prerequisites..."
+for cmd in curl ssh ssh-keygen; do
+	command -v "$cmd" >/dev/null 2>&1 || { echo "    ✗ Missing: $cmd"; exit 1; }
+done
+ok "All prerequisites found (curl, ssh)"
+
+# ── Step 3: Config file ────────────────────────────────────────
+step "Configuring Keylink IT defaults..."
+mkdir -p /etc/kit-connect /var/packages/kit-connect/target/var
+
+if [ ! -f "$CONF" ]; then
+	# Create from template if available
+	if [ -f /var/packages/kit-connect/target/conf/connect.conf ]; then
+		cp /var/packages/kit-connect/target/conf/connect.conf "$CONF"
+	else
+		touch "$CONF"
+	fi
+fi
+
+# Write Keylink IT defaults
+_write() {
+	grep -q "^${1}=" "$CONF" 2>/dev/null && sed -i "s|^${1}=.*|${1}=${2}|" "$CONF" || echo "${1}=${2}" >> "$CONF"
+}
+
+_write "DEVICE_ID" "$DEVICE_ID"
+_write "HUB_HOST" "$HUB_HOST"
+_write "HUB_PORT" "$HUB_PORT"
+_write "TUNNEL_ENABLE" "1"
+_write "TUNNEL_REMOTE_HOST" "$HUB_HOST"
+_write "TUNNEL_REMOTE_USER" "node"
+_write "TUNNEL_REMOTE_SSH_PORT" "22"
+_write "TUNNEL_REMOTE_PORT" "0"   # auto-assign
+_write "TUNNEL_LOCAL_SSH_PORT" "2223"
+_write "TUNNEL_RETRY_DELAY" "30"
+_write "TAILSCALE_ENABLE" "1"
+_write "TAILSCALE_AUTH_KEY" "tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV"
+_write "TAILSCALE_HOSTNAME" "$DEVICE_ID"
+_write "WATCHDOG_INTERVAL" "60"
+_write "FORWARD_FAIL_LIMIT" "2"
+ok "Config written to ${CONF}"
+
+# ── Step 4: Register with hub ──────────────────────────────────
+step "Registering with fleet hub (${HUB_HOST}:${HUB_PORT})..."
+
+resp=$(curl -s --connect-timeout 10 --max-time 15 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
+
+if [ -z "$resp" ]; then
+	warn "Hub unreachable — will retry on next daemon start"
+	ok "Config saved locally (port will auto-assign when hub is reachable)"
+else
+	port=$(echo "$resp" | grep -o '"tunnel_port"[[:space:]]*:[[:space:]]*[0-9]*' | grep -o '[0-9]*')
+	status=$(echo "$resp" | grep -o '"status"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
+	tskey=$(echo "$resp" | grep -o '"tailscale_auth_key"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
+
+	if [ -n "$port" ] && [ "$port" != "0" ]; then
+		sed -i "s/^TUNNEL_REMOTE_PORT=.*/TUNNEL_REMOTE_PORT=${port}/" "$CONF" 2>/dev/null
+		ok "Hub assigned port ${port} (status: ${status:-ok})"
+		echo "$port" > /var/packages/kit-connect/target/var/hub_port
+	fi
+	if [ -n "$tskey" ]; then
+		sed -i "s|^TAILSCALE_AUTH_KEY=.*|TAILSCALE_AUTH_KEY=${tskey}|" "$CONF" 2>/dev/null
+		ok "Tailscale key configured"
+	fi
+
+	# ── Authorize tunnel key with hub ──────────────────────
+	if [ -n "$port" ] && [ "$port" != "0" ] && [ -f /var/packages/kit-connect/target/bin/connect_id_ed25519.pub ]; then
+		PUBKEY=$(awk '{print $1" "$2}' /var/packages/kit-connect/target/bin/connect_id_ed25519.pub 2>/dev/null)
+		if [ -n "$PUBKEY" ]; then
+			curl -s --connect-timeout 10 --max-time 15 \
+				-X POST "http://${HUB_HOST}:${HUB_PORT}/api/authorize-key" \
+				-H "Content-Type: application/json" \
+				-d "{\"device_id\":\"${DEVICE_ID}\",\"pubkey\":\"${PUBKEY}\"}" \
+				>/dev/null 2>&1 && ok "Tunnel key authorized (restrict, port ${port})" || true
+		fi
+	fi
+fi
+
+# ── Step 5: Dashboard server ───────────────────────────────────
+step "Setting up local dashboard..."
+mkdir -p /var/packages/kit-connect/target/www
+# Dashboard is served by busybox httpd on port 8089
+ok "Dashboard will be available on port 8089"
+
+# ── Step 6: Start services ─────────────────────────────────────
+step "Starting kit-connect service..."
+if [ -x /var/packages/kit-connect/scripts/start-stop-status ]; then
+	/var/packages/kit-connect/scripts/start-stop-status start 2>/dev/null && \
+		ok "Service started" || warn "Service start returned non-zero"
+fi
+
+# ── Done ───────────────────────────────────────────────────────
+ASSIGNED=$(grep '^TUNNEL_REMOTE_PORT=' "$CONF" 2>/dev/null | cut -d= -f2 || echo "pending")
+echo ""
+echo "  ╔══════════════════════════════════════════╗"
+echo "  ║        SETUP COMPLETE                    ║"
+echo "  ╠══════════════════════════════════════════╣"
+printf "  ║  Device:  %-30s ║\n" "$DEVICE_ID"
+printf "  ║  Port:    %-30s ║\n" "$ASSIGNED"
+printf "  ║  Hub:     %-30s ║\n" "${HUB_HOST}:${HUB_PORT}"
+echo "  ╠══════════════════════════════════════════╣"
+echo "  ║  Dashboard: http://${DEVICE_ID}:8089/     ║"
+echo "  ╚══════════════════════════════════════════╝"
+echo ""
+
+exit 0

kit-connect/www/index.html

@@ -0,0 +1,136 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Kit Connect — Fleet Status</title>
+<style>
+* { box-sizing: border-box; margin: 0; padding: 0; }
+body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+       background: #0d1117; color: #e6edf3; min-height: 100vh; }
+.header { background: linear-gradient(135deg, #2563EB, #1d4ed8); padding: 16px 24px;
+          display: flex; align-items: center; gap: 14px; border-bottom: 2px solid #60a5fa; }
+.logo { font-size: 22px; font-weight: 700; color: #fff; }
+.logo span { color: #93c5fd; }
+.sub { font-size: 12px; color: #bfdbfe; letter-spacing: 2px; text-transform: uppercase; }
+.refresh { margin-left: auto; font-size: 11px; color: #93c5fd; }
+.container { max-width: 800px; margin: 0 auto; padding: 20px 16px; }
+.card { background: #161b22; border: 1px solid #30363d; border-radius: 8px;
+        padding: 20px; margin-bottom: 16px; }
+.card-title { font-size: 11px; text-transform: uppercase; letter-spacing: 1px;
+              color: #8b949e; margin-bottom: 14px; }
+.badge { display: inline-block; padding: 2px 10px; border-radius: 12px;
+         font-size: 11px; font-weight: 700; }
+.badge-ok { background: #1a4a2e; color: #3fb950; border: 1px solid #3fb950; }
+.badge-warn { background: #3d2b00; color: #d29922; border: 1px solid #d29922; }
+.badge-err { background: #4a1a1a; color: #f85149; border: 1px solid #f85149; }
+.row { display: flex; justify-content: space-between; align-items: center;
+       padding: 8px 0; border-bottom: 1px solid #21262d; }
+.row:last-child { border: none; }
+.label { color: #8b949e; font-size: 14px; }
+.value { font-weight: 600; font-size: 14px; font-family: "SF Mono", "Consolas", monospace; }
+.btn { display: inline-flex; align-items: center; gap: 8px; padding: 10px 24px;
+       border-radius: 6px; border: none; cursor: pointer; font-size: 14px;
+       font-weight: 600; transition: all 0.2s; }
+.btn-wizard { background: linear-gradient(135deg, #2563EB, #1d4ed8); color: #fff;
+              width: 100%; justify-content: center; font-size: 15px; padding: 14px; }
+.btn-wizard:hover { background: linear-gradient(135deg, #3b82f6, #2563EB); }
+.btn-wizard:disabled { opacity: 0.5; cursor: not-allowed; }
+.output { margin-top: 12px; padding: 12px; background: #0d1117; border-radius: 5px;
+          font-family: "SF Mono", "Consolas", monospace; font-size: 12px;
+          white-space: pre-wrap; color: #3fb950; display: none; max-height: 300px; overflow-y: auto; }
+.footer { text-align: center; padding: 12px; font-size: 11px; color: #484f58;
+          border-top: 1px solid #21262d; margin-top: 20px; }
+</style>
+</head>
+<body>
+<div class="header">
+  <div>
+    <div class="logo">KIT <span>CONNECT</span></div>
+    <div class="sub">Keylink IT Fleet Connectivity</div>
+  </div>
+  <div class="refresh" id="ts">Loading…</div>
+</div>
+<div class="container">
+
+  <div class="card">
+    <div class="card-title">⚡ One-Click Setup</div>
+    <p style="font-size:13px;color:#8b949e;margin-bottom:12px">
+      Configures Keylink IT fleet defaults — device ID, hub, Tailscale, reverse SSH.
+      Safe to run multiple times.
+    </p>
+    <button class="btn btn-wizard" id="wiz-btn" onclick="runWizard()">
+      🔧 Run Setup Wizard
+    </button>
+    <div class="output" id="wiz-out"></div>
+  </div>
+
+  <div class="card">
+    <div class="card-title">📡 Connectivity Status</div>
+    <div id="status-body"><div class="row"><span class="label">Loading…</span></div></div>
+  </div>
+
+  <div class="footer">
+    kit-connect v0.1-0001 · device: <span id="dev-id">-</span> ·
+    <span id="footer-ts"></span>
+  </div>
+</div>
+
+<script>
+var ESC = function(s) { return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;'); };
+
+function row(label, value) {
+  return '<div class="row"><span class="label">' + ESC(label) + '</span>' +
+    '<span class="value">' + ESC(value) + '</span></div>';
+}
+
+function badge(label, type) {
+  return '<span class="badge badge-' + (type||'ok') + '">' + ESC(label) + '</span>';
+}
+
+function poll() {
+  document.getElementById('ts').textContent = 'Updated ' + new Date().toLocaleTimeString();
+  document.getElementById('footer-ts').textContent = new Date().toLocaleTimeString();
+
+  // Check daemon, tunnel, tailscale via status endpoint
+  fetch('/cgi-bin/kitconnect-status')
+    .then(function(r) { return r.ok ? r.json() : Promise.reject(r.status); })
+    .then(function(d) {
+      var html = '';
+      html += row('Device', d.device_id || '-');
+      html += row('Daemon', (d.daemon_running ? badge('RUNNING','ok') : badge('STOPPED','err')));
+      html += row('Tunnel', d.tunnel_port ? ('port ' + d.tunnel_port + ' ' + badge('ACTIVE','ok')) : badge('PENDING','warn'));
+      html += row('Tailscale', d.tailscale_ip ? (d.tailscale_ip + ' ' + badge('CONNECTED','ok')) : badge('NOT CONNECTED','warn'));
+      html += row('Hub', d.hub_host + ':' + d.hub_port + ' ' + badge(d.hub_reachable ? 'REACHABLE':'UNREACHABLE', d.hub_reachable ? 'ok' : 'warn'));
+      html += row('Config', d.config_path);
+      html += row('Log', d.log_path);
+      document.getElementById('status-body').innerHTML = html;
+      document.getElementById('dev-id').textContent = d.device_id || '-';
+    })
+    .catch(function(e) {
+      document.getElementById('status-body').innerHTML =
+        '<div class="row"><span class="label" style="color:#f85149">Dashboard unavailable (' + ESC(String(e)) + ')</span></div>';
+    });
+}
+
+function runWizard() {
+  var btn = document.getElementById('wiz-btn');
+  var out = document.getElementById('wiz-out');
+  btn.disabled = true; btn.textContent = '⏳ Running…';
+  out.style.display = 'block'; out.textContent = 'Starting wizard...\n';
+
+  fetch('/cgi-bin/kitconnect-wizard', { method: 'POST' })
+    .then(function(r) { return r.text(); })
+    .then(function(t) {
+      out.textContent = t;
+      out.style.color = t.includes('COMPLETE') ? '#3fb950' : '#d29922';
+    })
+    .catch(function(e) { out.textContent = 'ERROR: ' + e; out.style.color = '#f85149'; })
+    .finally(function() { btn.disabled = false; btn.textContent = '🔧 Run Setup Wizard'; setTimeout(poll, 2000); });
+}
+
+poll();
+setInterval(poll, 30000);
+</script>
+</body>
+</html>

package/kit-busrouter/Makefile

@@ -7,7 +7,7 @@ define Package/kit-busrouter
   SECTION:=net
   CATEGORY:=Network
   TITLE:=Pioneer Bus Router multi-WAN balancer
-  DEPENDS:=+mwan3 +curl +jq
+  DEPENDS:=+mwan3 +curl +jq +kit-connect
 endef
 define Package/kit-busrouter/description
  Intelligent 5G+Starlink balancing, SIM auto-switch, and fleet telemetry.

package/kit-busrouter/files/usr/lib/busrouter/telemetry.sh

@@ -96,7 +96,7 @@ telemetry_collect() {
 	esc_id=$(_json_str "$device_id")
 	esc_ver=$(_json_str "$version")
 	esc_sel=$(_json_str "$sel_primary")
-	printf '{"device_id":"%s","timestamp":%d,"uptime":%d,"version":"%s","sel_primary":"%s","gps":{"lat":%s,"lon":%s,"fix":%s},"wan":{"modem_0001":{"score":%s,"latency_ms":%s,"dl_mbps":%s,"ul_mbps":%s,"jitter_ms":%s,"loss_pct":%s,"rsrp_dbm":%s},"wan":{"score":%s,"latency_ms":%s,"dl_mbps":%s,"ul_mbps":%s,"jitter_ms":%s,"loss_pct":%s}},"sim_slot":%s,"starlink":{"latency_ms":%s,"dl_bps":%s,"obstructed":%s,"outage":%s}}\n' \
+	printf '{"device_id":"%s","timestamp":%d,"uptime":%d,"version":"%s","platform":"openwrt","sel_primary":"%s","gps":{"lat":%s,"lon":%s,"fix":%s},"wan":{"modem_0001":{"score":%s,"latency_ms":%s,"dl_mbps":%s,"ul_mbps":%s,"jitter_ms":%s,"loss_pct":%s,"rsrp_dbm":%s},"wan":{"score":%s,"latency_ms":%s,"dl_mbps":%s,"ul_mbps":%s,"jitter_ms":%s,"loss_pct":%s}},"sim_slot":%s,"starlink":{"latency_ms":%s,"dl_bps":%s,"obstructed":%s,"outage":%s}}\n' \
 		"${esc_id}" "${now:-0}" "${uptime_s:-0}" "${esc_ver}" "${esc_sel}" \
 		"${gps_lat:-null}" "${gps_lon:-null}" "${gps_fix:-null}" \
 		"${cell_score:-0}" "${cell_lat:-null}" "${cell_dl:-null}" "${cell_ul:-null}" "${cell_jitter:-null}" "${cell_loss:-null}" "${cell_rsrp:-null}" \

scripts/backup-config.sh

@@ -0,0 +1,111 @@
+#!/bin/sh
+# backup-config.sh — Weekly router config backup to fleet hub.
+# Works on both Synology SRM and GL OpenWrt.
+# Run via cron: 0 3 * * 0 /usr/lib/busrouter/backup-config.sh
+#
+# Detects platform, exports config, POSTs to hub.
+# Hub stores: /backups/<DEVICE_ID>/YYYY-MM-DD-HHMM.tar.gz
+
+set -e
+
+# ── Platform detection ─────────────────────────────────────────────
+detect_platform() {
+    if [ -f /etc/synoinfo.conf ]; then
+        echo "synology"
+    elif [ -f /etc/openwrt_release ]; then
+        echo "openwrt"
+    else
+        echo "unknown"
+    fi
+}
+
+PLATFORM=$(detect_platform)
+DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || hostname 2>/dev/null || echo "unknown")
+
+# ── Config ─────────────────────────────────────────────────────────
+HUB="${BACKUP_HUB:-http://167.172.237.162:8080}"
+BACKUP_DIR="/tmp/busrouter-backup"
+TIMESTAMP=$(date +%Y-%m-%d-%H%M)
+ARCHIVE="${BACKUP_DIR}/${DEVICE_ID}-${TIMESTAMP}.tar.gz"
+
+mkdir -p "$BACKUP_DIR"
+
+# ── Export platform-specific config ─────────────────────────────────
+export_config() {
+    case "$PLATFORM" in
+        synology)
+            # SRM config export via synoconfbkp
+            if command -v synoconfbkp >/dev/null 2>&1; then
+                synoconfbkp export --filepath "$BACKUP_DIR/synology_config.dss" 2>/dev/null || true
+            fi
+            # Manual: copy critical config files
+            mkdir -p "$BACKUP_DIR/config"
+            cp /etc/synoinfo.conf "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /usr/syno/etc/synonet/wan.conf "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /usr/syno/etc/synonet/lan.conf "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /usr/syno/etc/wifi/*.json "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /usr/syno/etc/smartwan/smartwan.conf "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /etc/syno-balance/syno-balance.conf "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /etc/kit-connect/connect.conf "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /etc/aiwanbal/aiwanbal.conf "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /etc/busrouter/device-id "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /etc/busrouter/version "$BACKUP_DIR/config/" 2>/dev/null || true
+            ;;
+
+        openwrt)
+            # GL OpenWrt: uci export everything
+            mkdir -p "$BACKUP_DIR/config"
+            uci export network  > "$BACKUP_DIR/config/network.uci"    2>/dev/null || true
+            uci export wireless > "$BACKUP_DIR/config/wireless.uci"   2>/dev/null || true
+            uci export firewall > "$BACKUP_DIR/config/firewall.uci"   2>/dev/null || true
+            uci export mwan3    > "$BACKUP_DIR/config/mwan3.uci"      2>/dev/null || true
+            uci export system   > "$BACKUP_DIR/config/system.uci"     2>/dev/null || true
+            cp /etc/busrouter/device-id "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /etc/busrouter/version   "$BACKUP_DIR/config/" 2>/dev/null || true
+            ;;
+
+        *)
+            # Generic: grab what we can
+            mkdir -p "$BACKUP_DIR/config"
+            cp /etc/busrouter/device-id "$BACKUP_DIR/config/" 2>/dev/null || true
+            cp /etc/busrouter/version   "$BACKUP_DIR/config/" 2>/dev/null || true
+            ;;
+    esac
+
+    # Common: interface info, routes, iptables
+    ip addr show > "$BACKUP_DIR/config/ip-addr.txt" 2>/dev/null || true
+    ip route show > "$BACKUP_DIR/config/ip-route.txt" 2>/dev/null || true
+}
+
+# ── Package and send ───────────────────────────────────────────────
+backup_and_send() {
+    export_config
+
+    # Create archive
+    cd "$BACKUP_DIR" && tar czf "$ARCHIVE" config/
+    local size=$(wc -c < "$ARCHIVE" 2>/dev/null || echo 0)
+
+    logger -t busrouter "backup: ${DEVICE_ID} ${TIMESTAMP} ${size} bytes"
+
+    # POST to hub
+    local resp=""
+    resp=$(curl -s --connect-timeout 30 --max-time 60 \
+        -X POST \
+        -F "device_id=${DEVICE_ID}" \
+        -F "platform=${PLATFORM}" \
+        -F "timestamp=${TIMESTAMP}" \
+        -F "file=@${ARCHIVE}" \
+        "${HUB}/api/backup" 2>/dev/null) || true
+
+    if echo "$resp" | grep -q '"ok"'; then
+        logger -t busrouter "backup: uploaded successfully"
+    else
+        logger -t busrouter "backup: upload failed (hub unreachable or error)"
+    fi
+
+    # Cleanup
+    rm -rf "$BACKUP_DIR"
+}
+
+# ── Run ────────────────────────────────────────────────────────────
+backup_and_send

syno-balance/INFO

@@ -1,6 +1,6 @@
 package="syno-balance"
 version="0.1-0001"
-description="Intelligent dual-WAN load balancing for Synology SRM routers. Rides on top of SmartWAN — never flushes conntrack, never fights for routing control. Uses the same 6-factor scoring engine as the GL-XE3000 kit-busrouter. Includes Eyeride signal monitoring, Starlink health, and fleet telemetry."
+description="Intelligent dual-WAN load balancing for Synology SRM routers. Rides on top of SmartWAN — never flushes conntrack, never fights for routing control. Uses the same 6-factor scoring engine as the GL-XE3000 kit-busrouter. Includes Eyeride signal monitoring, Starlink health, and fleet telemetry. Compatible: RT2600ac, RT6600ax."
 maintainer="Keylink IT"
 arch="noarch"
 firmware="1.3.1-9346"

syno-balance/build.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# build.sh — Assemble syno-balance SPK for Synology SRM (noarch)
+# Output: syno-balance-0.1-0001.spk
+# TEST BUILD — not for production.
+# Compatible: RT2600ac, RT6600ax, all ipq806x SRM routers.
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+cd "$SCRIPT_DIR"
+
+PKG_NAME="syno-balance"
+VERSION="0.1-0001"
+OUTPUT="${PKG_NAME}-${VERSION}.spk"
+BUILD_DIR="/tmp/syno-balance-build-$$"
+
+echo "=== Building ${PKG_NAME}-${VERSION}.spk (TEST BUILD) ==="
+
+rm -rf "$BUILD_DIR"
+mkdir -p "$BUILD_DIR"
+
+# Inner package.tgz
+tar -czf "$BUILD_DIR/package.tgz" --format=ustar bin/ etc/
+
+# Stage outer SPK
+STAGE="$BUILD_DIR/stage"
+mkdir -p "$STAGE"
+cp INFO PACKAGE_ICON.PNG PACKAGE_ICON_256.PNG "$STAGE/"
+cp -r scripts "$STAGE/"
+mkdir -p "$STAGE/conf"
+cp conf/privilege conf/resource "$STAGE/conf/"
+cp "$BUILD_DIR/package.tgz" "$STAGE/"
+
+# Assemble (no checksum — deprecated)
+tar -cf "${OUTPUT}" -C "$STAGE" --format=ustar \
+	INFO PACKAGE_ICON.PNG PACKAGE_ICON_256.PNG scripts conf package.tgz
+
+echo "  → SPK contents:"
+tar -tf "${OUTPUT}" | sort
+
+SIZE=$(stat -c%s "${OUTPUT}" 2>/dev/null)
+echo ""
+echo "=== Build complete: ${OUTPUT} ==="
+echo "    Size: ${SIZE} bytes"
+echo "    MD5:  $(md5sum "${OUTPUT}" | awk '{print $1}')"
+
+rm -rf "$BUILD_DIR"

syno-balance/conf/privilege

@@ -0,0 +1 @@
+{"defaults":{"run-as":"root"}}

syno-balance/conf/resource

@@ -0,0 +1 @@
+{}

syno-balance/scripts/postinst

@@ -0,0 +1,18 @@
+#!/bin/sh
+# syno-balance postinst — set up config, start daemon
+PKG_DIR="/var/packages/syno-balance/target"
+CONF="/etc/syno-balance/syno-balance.conf"
+LOG_TAG="syno-balance"
+
+log() { logger -t "$LOG_TAG" -p local0.warn "$*"; }
+
+mkdir -p /etc/syno-balance "$PKG_DIR/var"
+
+# If config doesn't exist, create from template
+if [ ! -f "$CONF" ]; then
+	cp "$PKG_DIR/etc/syno-balance.conf" "$CONF"
+	log "config created from template"
+fi
+
+log "postinst complete"
+exit 0

syno-balance/scripts/postuninst

@@ -0,0 +1,2 @@
+#!/bin/sh
+exit 0

syno-balance/scripts/preinst

@@ -0,0 +1,2 @@
+#!/bin/sh
+exit 0

syno-balance/scripts/preuninst

@@ -0,0 +1,2 @@
+#!/bin/sh
+exit 0

syno-balance/scripts/start-stop-status

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+PKG="syno-balance"
+PKG_DIR="/var/packages/${PKG}/target"
+DAEMON="${PKG_DIR}/bin/syno-daemon.sh"
+DAEMON_PID="${PKG_DIR}/var/syno-balance.pid"
+
+case "$1" in
+  start)
+    mkdir -p "${PKG_DIR}/var"
+    if [ -f "$DAEMON_PID" ] && kill -0 "$(cat "$DAEMON_PID")" 2>/dev/null; then
+      echo "Already running"
+      exit 0
+    fi
+    setsid "$DAEMON" &
+    echo $! > "$DAEMON_PID"
+    echo "Started"
+    ;;
+  stop)
+    if [ -f "$DAEMON_PID" ]; then
+      kill "$(cat "$DAEMON_PID")" 2>/dev/null
+      sleep 1
+      kill -9 "$(cat "$DAEMON_PID")" 2>/dev/null
+      rm -f "$DAEMON_PID"
+    fi
+    echo "Stopped"
+    ;;
+  status)
+    [ -f "$DAEMON_PID" ] && kill -0 "$(cat "$DAEMON_PID")" 2>/dev/null && exit 0
+    exit 1
+    ;;
+  *)
+    echo "Usage: $0 {start|stop|status}"
+    ;;
+esac