7 Commits

Include renames

Author	SHA1	Message	Date
Logan CusanoandClaude Opus 5	87633ab50d	Authenticate the node dashboard, and the broker connection per node ... Two unauthenticated surfaces closed on the edge node. Dashboard and API: the local dashboard and every /api/* route were open to anything on the node's LAN. Adds a login page plus session-cookie auth for the browser, and cookie-or-Basic for the API so scripted callers stay possible. Passwords are hashed with stdlib scrypt (no new dependency, this runs on a Pi) and compared in constant time; the salt and session-signing secret persist in credentials.json. Startup warns while the default password is still in place. No non-browser callers of the node API exist today (C2 talks to nodes over MQTT and nodes call C2 outbound), so nothing breaks. Adds python-multipart, which FastAPI's Form() needs for the login POST and which was missing from requirements entirely. MQTT: nodes authenticated with a shared drb-node password, and the broker ACL keyed off %c — the client-supplied client id — so any holder of that one password could claim another node's topic namespace. Nodes now connect as username=<node_id>, password=<their C2-issued api_key>, which mosquitto's dynamic-security plugin checks, with the ACL keyed off the authenticated %u. TLS is gated on MQTT_TLS and uses default CA verification. The old key_request MQTT path stays in place behind TODO(mqtt-cutover) markers as the fallback until the cutover is proven; a node with no api_key on disk logs a clear repeated refusal rather than spinning. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-16 09:34:16 -04:00
Logan Cusano	cc9af6ff26	feat: Buffer offline call_end events and relay them upon MQTT reconnection	2026-07-13 00:16:24 -04:00
Logan Cusano	857325af85	feat: Add local system override and manual entry controls with offline systems caching	2026-07-12 23:06:05 -04:00
Logan	d0e4734cf9	Linting + touches	2026-04-21 00:56:50 -04:00
Logan	d201d8124e	Issue 1 — Discord Audio (PulseAudio) ... docker-compose.yml: Added a pulse_socket named volume mounted at /run/pulse in both op25 and edge-node. Also set PULSE_SERVER=unix:/run/pulse/native in edge-node so libpulse (and ffmpeg's pulse input) finds the right socket. discord_radio.py: Removed _icecast_url and changed _play_stream() to use -f pulse -i default.monitor. This reads directly from the PulseAudio sink monitor — zero buffer delay. The PULSE_SERVER env var is inherited by the ffmpeg subprocess. Note: default.monitor captures whatever audio is playing on the default sink. If OP25 uses a named virtual sink, you may need to replace default.monitor with <sink_name>.monitor (run pactl list sinks short inside the op25 container to find the name). Issue 2 — No audio URL / GCS credentials storage.py: storage.Client() was using ADC but ADC isn't configured in the container. Now uses storage.Client.from_service_account_json(settings.gcp_credentials_path) when GCP_CREDENTIALS_PATH is set — same credential file Firebase already loads. You also need to mount the key file into the server container in docker-compose.yml: c2-core: volumes: - ./gcp-key.json:/app/gcp-key.json:ro And set GCS_BUCKET=your-bucket-name in .env. Issue 3 — Token orphaning mqtt_manager.py: Every checkin now includes "discord_connected": radio_bot.is_connected. mqtt_handler.py: On checkin, if discord_connected is explicitly False, calls release_token(node_id). Only fires on explicit false (missing field = unknown = no action). node_sweeper.py: When a node is swept to offline, its token is released too. This covers the case where the node stops checking in entirely (crash/power loss).	2026-04-11 20:29:33 -04:00
Logan	97ebcad3bc	Discord bot updates	2026-04-11 13:43:59 -04:00
Logan	1a9c92b6db	Initial commit — DRB client (edge node) stack ... Includes edge-node (FastAPI/MQTT/Discord voice), op25-container (SDR decoder), and icecast (audio streaming).	2026-04-05 19:01:51 -04:00