From 63eff3f0061d51c693eeebc8273b217f81fced8c Mon Sep 17 00:00:00 2001
From: Roland <roland@learningselfreliance.com>
Date: Sun, 22 Mar 2026 13:19:57 -0600
Subject: [PATCH] Generating temporary certificate on first startup so Caddy
 can redirect user to Controller for onboarding flow.

---
 etc/raspberrypios/Caddyfile.onboarding | 16 +++++++++++++
 wrolpi/scripts/first_startup.sh        | 33 ++++++++++++++++----------
 wrolpi/version.txt                     |  2 +-
 3 files changed, 38 insertions(+), 13 deletions(-)
 create mode 100644 etc/raspberrypios/Caddyfile.onboarding

diff --git a/etc/raspberrypios/Caddyfile.onboarding b/etc/raspberrypios/Caddyfile.onboarding
new file mode 100644
index 00000000..f647fbc0
--- /dev/null
+++ b/etc/raspberrypios/Caddyfile.onboarding
@@ -0,0 +1,16 @@
+# Pre-onboarding Caddyfile: temporary self-signed cert, no media drive.
+# Redirects all traffic to the Controller UI for onboarding.
+# Replaced by the full Caddyfile after onboarding + repair.
+
+{
+	auto_https disable_redirects
+}
+
+:80 {
+	redir * http://{host}:8087/ 302
+}
+
+:443 {
+	tls /etc/ssl/wrolpi/cert.crt /etc/ssl/wrolpi/cert.key
+	redir * http://{host}:8087/ 302
+}
diff --git a/wrolpi/scripts/first_startup.sh b/wrolpi/scripts/first_startup.sh
index f30f0ad8..f86fb070 100755
--- a/wrolpi/scripts/first_startup.sh
+++ b/wrolpi/scripts/first_startup.sh
@@ -3,22 +3,31 @@
 
 set -x
 
-# Generate certificate for HTTPS — only if primary drive is mounted.
-# If not mounted, onboarding + repair will generate certs after drive setup.
-if mountpoint -q /media/wrolpi; then
-  /opt/wrolpi/scripts/generate_certificates.sh
-else
-  echo "Primary drive not mounted, skipping certificate generation (onboarding will handle this)"
-fi
-
 # Copy landing page for HTTP certificate download.
 cp /opt/wrolpi/etc/raspberrypios/landing.html /var/www/landing.html
 
-# Ensure Caddy config is in place (safeguard in case build didn't complete this).
-if [ ! -f /etc/caddy/Caddyfile ]; then
-    echo "Caddyfile missing, copying from /opt/wrolpi..."
-    mkdir -p /etc/caddy
+mkdir -p /etc/caddy /etc/ssl/wrolpi
+
+if [ -f /media/wrolpi/config/ssl/ca.crt ]; then
+    # Persistent CA exists (drive mounted with previous install).
+    # Generate a fresh leaf cert from the existing CA and use the full Caddyfile.
+    echo "Persistent CA found, generating leaf cert and using full Caddyfile"
+    /opt/wrolpi/scripts/generate_certificates.sh
     cp /opt/wrolpi/etc/raspberrypios/Caddyfile /etc/caddy/Caddyfile
+else
+    # No persistent CA (fresh install, no drive, or empty drive).
+    # Generate a throwaway self-signed cert directly into /etc/ssl/wrolpi/
+    # so Caddy can listen on :443. Never writes to /media/wrolpi/.
+    echo "No persistent CA, generating temporary cert for onboarding"
+    openssl req -x509 -newkey rsa:2048 -nodes \
+        -keyout /etc/ssl/wrolpi/cert.key \
+        -out /etc/ssl/wrolpi/cert.crt \
+        -days 1 -subj "/CN=wrolpi-onboarding"
+    chmod 640 /etc/ssl/wrolpi/cert.key /etc/ssl/wrolpi/cert.crt
+    if id caddy >/dev/null 2>&1; then
+        chown root:caddy /etc/ssl/wrolpi/cert.key /etc/ssl/wrolpi/cert.crt
+    fi
+    cp /opt/wrolpi/etc/raspberrypios/Caddyfile.onboarding /etc/caddy/Caddyfile
 fi
 
 # Enable and start Caddy now that certificates exist.
diff --git a/wrolpi/version.txt b/wrolpi/version.txt
index bbc79db2..1924bdaa 100644
--- a/wrolpi/version.txt
+++ b/wrolpi/version.txt
@@ -1 +1 @@
-0.19.0-beta
+0.19.1-beta