kitadmin
52e7e478e4
Synology kit-connect (SPK): - wizard.sh — one-button Keylink IT fleet setup (auto-runs on install) - www/index.html — dark-themed local dashboard (same design as busrouter) - bin/serve-dashboard.sh — busybox httpd on port 8089 with CGI endpoints - start-stop-status updated to manage dashboard alongside daemon - INFO updated: RT2600ac + RT6600ax compatibility noted - postinst now runs wizard --auto for first-time setup GL kit-connect (OpenWrt ipk): - Makefile — DEPENDS: +curl +openssh-client +tailscale - procd init — USE_PROCD=1, respawn with 5s delay - connect-daemon.sh — Tailscale + reverse SSH (same as Synology version) - connect-wizard.sh — one-button setup, idempotent, UCI config - connect-register.sh — standalone hub registration - www/kitconnect/index.html — dark-themed dashboard with wizard button - www/kitconnect/wizard.cgi — web-triggered wizard endpoint - UCI config at /etc/config/kitconnect Both platforms share: same hub protocol, same Tailscale key, same port pool. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kit-busrouter
Configuration and operational notes for the bus-fleet edge routers.
Hardware
GL.iNet GL-XE3000 (5G "Puli") running OpenWrt. LAN address 192.168.8.1, login root.
Management access
Routers are managed out-of-band over a WireGuard tunnel to the busfleet hub. Each router dials the hub and mgmt SSH is allowed inbound over the tunnel only — never exposed on the WAN.
| Item | Value |
|---|---|
| WG client interface / firewall zone | wgclient1 (proto=wgclient) |
| Router tunnel IP | 10.88.0.2/32 |
| Hub tunnel IP | 10.88.0.1 |
| Hub endpoint | 167.172.237.162:51820 (UDP) |
| Tunnel subnet | 10.88.0.0/24 |
| Inbound mgmt SSH rule | Allow-WG-mgmt-SSH — tcp/22 from 10.88.0.0/24, src zone wgclient1 |
| Hub jump key | busfleet-hub-jump (ed25519) in /etc/dropbear/authorized_keys, perms 600 |
The hub reaches a router with:
ssh -J busfleet-hub-jump root@10.88.0.2 # over the established tunnel
Docs
- docs/mgmt-tunnel-ssh.md — provisioning and troubleshooting inbound mgmt SSH over the WireGuard tunnel.