What we take from digilan¶
Digilan (gitlab.com/digilan) already solved most of the "never brick, never
drive to site" problems on OpenBSD. This page maps each pattern to its Jumo
equivalent so the work isn't done twice.
| Pattern | Digilan source | Jumo status |
|---|---|---|
| Config confirm-or-rollback (snapshot, 60 s confirm window, resume after crash) | edge/gateway/internal/rollback/rollback.go |
Done: internal/guard (network, firewall, dhcp; 90 s; deadline on flash) |
| Self-update watchdog (ed25519 + SHA-256, detached shell watchdog, staged copy + rename to avoid ETXTBSY) | edge/gateway/internal/selfupdate/watchdog.go |
Port nearly as is. AgentUpdate is already in the proto. |
| Self-heal (known-good snapshot after 15 min, cron restore when contact is stale and the box drifted) | edge/gateway/internal/selfheal/selfheal.go |
Port. Uplink ladder: bounce wwan, renew, reboot. |
| Identity store (atomic write) | edge/gateway/internal/identity/identity.go |
Done: agent/internal/identity |
| Enroll codes (hashed, MAC-bound) | platform/nexus/internal/enrollcode/ |
Done in a simpler form: one reusable code per device. |
| Desired-state appliers | edge/gateway/cmd/agent/serve.go, per-subsystem appliers |
Done for the tunnel: internal/netconfig renders uci. Wi-Fi to do. |
| Realtime DO with hibernation | platform/realtime/ |
Done: control-plane/src/realtime/device-room.ts + agent client, protobuf frames |
| Shell over WebSocket, single-use 30 s ticket, 60 min cap | edge/gateway/internal/shell/, platform/nexus/internal/shellticket/ |
Done differently: one recorded command per request (debug console); interactive shell later |
| Relay transport ladder (WG UDP, UDP/443, WS/443) | edge/gateway/internal/relaylink/ladder.go |
Needed: TCP 443 fallback and relay rungs (5G Home, Starlink, UDP-blocking hotels) |
| Cloudflare DNS per device | platform/nexus/internal/gwdns/ |
Later, for the optional port-forward mode. |
| OpenWrt ImageBuilder workspace | provisioning/openwrt-workspace/ |
Copied into firmware/. |
| MkDocs Material layout | documentation/mkdocs/ |
Copied into this site. |
Connect client in a Worker: workerd rejects redirect: "error" |
platform/realtime/src/nexus.ts |
Hit again in the admin; same fix in web/src/lib/server/control-plane.ts |