wrolpi/controller/defaults.py

143 lines
4.2 KiB
Python
Raw Permalink Normal View History

"""
Code-defined default configuration for the Controller.
Controller starts with these defaults and loads overrides from
/media/wrolpi/config/controller.yaml after the drive is mounted.
"""
DEFAULT_CONFIG = {
"port": 80,
"media_directory": "/media/wrolpi",
"hide_cert_banner": False,
"drives": {
"supported_filesystems": ["ext4", "btrfs", "vfat", "exfat"],
"auto_mount": True,
"mounts": [], # Populated from controller.yaml after drive mount
# True when the user chose "Run repair without external drive"; the
# API then accepts an unmounted /media/wrolpi as the library.
"library_on_internal_disk": False,
},
"managed_services": [
# WROLPi services
{
"name": "wrolpi-controller",
"systemd_name": "wrolpi-controller",
"port": 80,
"viewable": True,
"use_https": False,
"description": "Controller API (FastAPI)",
},
{
"name": "wrolpi-api",
"systemd_name": "wrolpi-api",
"port": 8081,
"viewable": True,
"use_https": False,
"description": "Python API (Sanic)",
},
{
"name": "wrolpi-api-dev",
"systemd_name": "wrolpi-api-dev",
"port": 8081,
"viewable": True,
"use_https": False,
"description": "Python API (Development)",
"kind": "task",
"show_only_when_running": True,
},
{
"name": "wrolpi-app",
"systemd_name": "wrolpi-app",
"port": 3000,
"viewable": False,
"use_https": False,
"description": "React frontend",
},
{
"name": "wrolpi-app-dev",
"systemd_name": "wrolpi-app-dev",
"port": 3000,
"viewable": False,
"use_https": False,
"description": "React frontend (Development)",
"kind": "task",
"show_only_when_running": True,
},
{
"name": "wrolpi-help",
"systemd_name": "wrolpi-help",
"port": 8086,
"viewable": True,
"use_https": True,
"description": "Help documentation",
},
{
"name": "wrolpi-kiwix",
"systemd_name": "wrolpi-kiwix",
"port": 8085,
"viewable": True,
"use_https": True,
"description": "Kiwix/Zim server",
},
# System services
{
"name": "caddy",
"systemd_name": "caddy",
"port": 443,
"viewable": True,
"use_https": True,
"description": "Web proxy (HTTPS)",
},
# Samba file sharing services
{
"name": "smbd",
"systemd_name": "smbd",
"port": 445,
"viewable": False,
"use_https": False,
"description": "Samba file sharing",
},
{
"name": "nmbd",
"systemd_name": "nmbd",
"port": 137,
"viewable": False,
"use_https": False,
"description": "Samba NetBIOS name service",
},
# Upgrade service - only shown when running
{
"name": "wrolpi-upgrade",
"systemd_name": "wrolpi-upgrade",
"port": None,
"viewable": False,
"use_https": False,
"description": "WROLPi upgrade process",
"kind": "task",
"show_only_when_running": True,
},
],
"hotspot": {
"device": "wlan0",
"ssid": "WROLPi",
"password": "wrolpi hotspot",
"protocol": "wpa2", # wpa2 (wpa-psk) or wpa3 (sae); see get_device_hotspot_protocols
Hotspot captive portal: welcome page with the WROLPi's address (#709) * Hotspot captive portal: welcome page with the WROLPi's address Devices that join the hotspot probe a fixed plain-HTTP URL to check for Internet access. NetworkManager's shared-mode dnsmasq now resolves those probe hostnames (and `wrolpi`) to the hotspot address via an include the Controller writes when the hotspot starts, the probes land on the Controller (port 80), and are redirected to /portal: "This is your WROLPi, its address is 10.42.0.1, open WROLPi / open the Controller". Only the probe hostnames are hijacked so the hotspot keeps forwarding everything else when the WROLPi has an uplink. The include is corrected and the connection re-activated once if NetworkManager picked a non-default subnet. Writing the include is best-effort; the hotspot starts regardless. `hotspot.captive_portal` (controller.yaml, default true) toggles the probe redirects and the include; like the other hotspot settings it applies on the next hotspot start, so saving while the hotspot is up reports restart_required and both Controller UIs say so. The status endpoint gains the hotspot address and portal URL, shown in both UIs. repair.sh only creates the include directory so a disabled setting survives upgrades. Native only: Docker has no hotspot. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * captive portal: address review * React: re-read the hotspot address whenever the HotspotToggle starts or stops the hotspot, matching the fallback UI's refresh-on-status. * A WPA3 start that reverts to WPA2 leaves the hotspot up, so it now gets the captive portal address correction too. * The corrective `nmcli connection up` logs a warning on a non-zero exit; dnsmasq would otherwise keep the old address silently. * HotspotStatusResponse.captive_portal defaults to true like everywhere else. * Trim design narrative from the module docstring and React comments. * The include-before-activate test now observes the include at the moment of the `nmcli ... hotspot` call instead of inferring from call order. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * captive portal: never forward any record type for probe hosts `address=` only synthesizes A/AAAA answers. iOS also asks for the HTTPS record type; dnsmasq forwarded that upstream, Apple's answer aliased to captive.g.aaplimg.com, and the phone fetched the genuine "Success" from Apple instead of the portal. Each probe host now also gets `local=`, so dnsmasq answers every type itself, and the CDN alias is a probe host too. Observed with dnsmasq query logging on a hotspot with an eth0 uplink. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * captive portal: let acknowledged clients finish so the OS offers "Done" A phone's sign-in sheet only shows "Done" once the OS re-probes and gets the genuine success reply. The Controller now remembers each client (by hotspot IP) that has loaded the portal page and answers its later probes with the reply each OS expects (Apple "Success" HTML, Android 204, Windows "Microsoft Connect Test", ...). The set is cleared when the hotspot starts so a new session shows the page again. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * captive portal: acknowledge on Continue, not on view iOS fetches the portal page in the background before opening the sheet, then re-probes after the sheet's own navigation. Acknowledging on view made that re-probe return "Success" as the sheet's content. Phones only re-check the network (and offer "Done") after a full-page navigation, so the welcome page now has a Continue button leading to /portal/continue, which is the only place a client is acknowledged. The Continue page says to tap Done and links to WROLPi and the Controller. Also hijack clients3.google.com (older Android probe host). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * help: bump wrolpi-help to the captive portal and Speed Test docs Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * captive portal: comments describe the Continue design; clear acks on stop Three comments still described acknowledging on view, which c72a7f7b removed. Acknowledged clients are now also cleared when the hotspot stops, so a lease reused in a later session sees the portal page. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-13 20:09:48 -06:00
# Show a landing page (with this WROLPi's address) to devices that join the hotspot.
"captive_portal": True,
# Start the hotspot when WROLPi boots. Set false to never start it unless asked.
"on_startup": True,
},
"throttle": {
"default_governor": "ondemand",
},
"samba": {
"shares": [],
# Each share: {"name": str, "path": str, "read_only": bool, "comment": str}
},
}