6 Commits

Include renames

Author	SHA1	Message	Date
Logan CusanoandClaude Sonnet 5	5b0048e8db	node: one-shot install.sh for a fresh Pi; retire setup.sh (node-26#4) ... install.sh is the `curl -fsSL <url> | sudo bash -s -- --token ...` bootstrap: preflight (root/arch/apt/SDR) → install docker + compose + git + jq → clone node-26 at a pinned ref (default `v1`, `--track-main` opt-in) → write .env non-interactively from flags/env with a /dev/tty interactive fallback → enroll with C2 (POST /nodes/enroll, poll GET /nodes/{id}/credentials, matches drb-c2-core/app/routers/enrollment.py exactly) and write configs/credentials.json → docker compose pull && up -d (prebuilt; --build opts into the ~1h op25 build) → print the admin-approval step. Idempotent: re-run picks up the api_key after approval; existing .env is preserved. - setup.sh deleted — two scripts writing .env drift. install.sh owns it now. - Makefile `setup:` no longer calls the removed script (cp .env.example fallback). - README Setup section rewritten around the one-liner; `make setup`/`make up` kept as the local-dev path. Notes carried in the script header: git.vpn.cusano.net is public (D1, settled); `v1` must be re-cut at this change's merge commit so the tag actually contains install.sh. Standing hazard D3: docker-compose.yml bind-mounts the app source over the image, so a pinned ref and the pulled image tags must not diverge. Client-side enrollment still belongs in the edge-node app (mqtt_manager.py:73-85); install.sh doing it is the interim. Tracked for follow-up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-06 19:14:40 -04:00
Logan Cusano	e6aab7589a	Stop shipping "hackme" as the Icecast password ... The source password had a `hackme` fallback in five places -- entrypoint.sh, docker-compose.yml, setup.sh's prompt default, .env.example, edge-node's config.py -- plus op25-container's os.getenv default and two README rows. Any node whose operator pressed Enter through setup.sh is running a credential that is written down in this repo. That matters more than the usual default-password case because Icecast binds all interfaces and the SOURCE password is write access: it does not just let a LAN neighbour listen, it lets them PUSH audio into the stream the frontend and mobile clients play as live radio. Injecting fake traffic into a public-safety feed is the failure worth preventing. Approach: remove every fallback rather than change them to a better default. - icecast/entrypoint.sh refuses to start if either password is empty, and says how to generate one. This is the single hard gate; everything else is defence in depth behind it. - docker-compose.yml uses ${VAR:?message} so a missing value stops the stack at compose time with a readable error instead of becoming an empty string. - setup.sh GENERATES a random password when the operator presses Enter, via openssl rand -base64 24 with a /dev/urandom fallback. Pressing Enter now gives you a random password rather than a known one, which is the actual behaviour change -- a prompt default nobody types over is not a default, it is the value. - .env.example ships the keys empty with the generation command in a comment, and README.md now marks both as required with no default. Client suite: 185 passed. Note this does NOT rotate anything already deployed. node-002's .env still has whatever it was set up with; that is an operational step, tracked in the issue. Closes logan/node-26#3	2026-08-20 03:12:44 -04:00
Logan Cusano	9f026fa262	update: scanner dashboard UI and Docker configuration for edge node	2026-07-12 21:44:36 -04:00
Logan	33cad7ed24	updates	2026-04-12 03:05:48 -04:00
Logan	c843bac5b7	readme update	2026-04-06 02:47:02 -04:00
Logan	1a9c92b6db	Initial commit — DRB client (edge node) stack ... Includes edge-node (FastAPI/MQTT/Discord voice), op25-container (SDR decoder), and icecast (audio streaming).	2026-04-05 19:01:51 -04:00