6 Commits

Include renames

Author	SHA1	Message	Date
Logan Cusano	e6aab7589a	Stop shipping "hackme" as the Icecast password ... The source password had a `hackme` fallback in five places -- entrypoint.sh, docker-compose.yml, setup.sh's prompt default, .env.example, edge-node's config.py -- plus op25-container's os.getenv default and two README rows. Any node whose operator pressed Enter through setup.sh is running a credential that is written down in this repo. That matters more than the usual default-password case because Icecast binds all interfaces and the SOURCE password is write access: it does not just let a LAN neighbour listen, it lets them PUSH audio into the stream the frontend and mobile clients play as live radio. Injecting fake traffic into a public-safety feed is the failure worth preventing. Approach: remove every fallback rather than change them to a better default. - icecast/entrypoint.sh refuses to start if either password is empty, and says how to generate one. This is the single hard gate; everything else is defence in depth behind it. - docker-compose.yml uses ${VAR:?message} so a missing value stops the stack at compose time with a readable error instead of becoming an empty string. - setup.sh GENERATES a random password when the operator presses Enter, via openssl rand -base64 24 with a /dev/urandom fallback. Pressing Enter now gives you a random password rather than a known one, which is the actual behaviour change -- a prompt default nobody types over is not a default, it is the value. - .env.example ships the keys empty with the generation command in a comment, and README.md now marks both as required with no default. Client suite: 185 passed. Note this does NOT rotate anything already deployed. node-002's .env still has whatever it was set up with; that is an operational step, tracked in the issue. Closes logan/node-26#3	2026-08-20 03:12:44 -04:00
Logan CusanoandClaude Opus 5	a61a7b2c31	Bind OP25 control API and terminal to loopback by default ... Both :8001 (FastAPI control API) and :8081 (OP25's HTTP terminal) listened on 0.0.0.0 with no authentication, on a container that is privileged with /dev mounted and network_mode: host. Nodes get deployed to third-party sites, so that exposed start/stop/retune to anyone on the host's LAN. All three containers share the host network namespace, so edge-node still reaches both over 127.0.0.1 unchanged. OP25_DEBUG_EXPOSE=true restores the old 0.0.0.0 binding and logs a loud warning; it is off by default. Confirmed against boatbod/op25 gr310 that the terminal's http:<host>:<port> string is honoured as a real bind address (http_server.py splits it and hands the host to create_server), so no flag was invented. Also reorder models.py so IcecastConfig precedes ConfigGenerator, which annotates a field with it. That only worked because python:slim-trixie is currently Python 3.14, where PEP 649 defers annotation evaluation; on 3.13 or earlier the same file is a hard NameError at import. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-16 09:33:25 -04:00
Logan	16f6e0de95	audio fixes attempt	2026-05-23 14:59:48 -04:00
Logan	33cad7ed24	updates	2026-04-12 03:05:48 -04:00
Logan	7de55f9885	changes	2026-04-06 00:23:33 -04:00
Logan	1a9c92b6db	Initial commit — DRB client (edge node) stack ... Includes edge-node (FastAPI/MQTT/Discord voice), op25-container (SDR decoder), and icecast (audio streaming).	2026-04-05 19:01:51 -04:00