frugal-iot-server 0.3.7 → 0.3.9

package/public/service-worker.js

@@ -1,6 +1,7 @@
-// Change this version number if want existing installs of PWA to refresh their cache
-// TODO-28 - probably make this the same as the app version in frugal-iot-client
-const CACHE_NAME = 'frugal-iot-cache-1.3.13';
+// Changing this version is what makes an already installed PWA fetch the app again instead of
+// serving what it cached. It follows the version of frugal-iot-client this release installs, and
+// "npm run prerelease" sets it - so there is normally no reason to edit it by hand.
+const CACHE_NAME = 'frugal-iot-cache-1.3.15';
 const urlsToCache = [
     '/',
     '/index.html',
@@ -19,37 +20,36 @@ const urlsToCache = [
 self.addEventListener('install', event => {
     event.waitUntil(
         caches.open(CACHE_NAME)
-            .then(cache => {
-                console.log('Opened cache');
-                return cache.addAll(urlsToCache);
-            })
-    );
-});
-
-self.addEventListener('fetch', event => {
-    event.respondWith(
-        caches.match(event.request)
-            .then(response => {
-                if (response) {
-                    return response;
-                }
-                return fetch(event.request);
-            })
+            .then(cache => Promise.all(urlsToCache.map(url =>
+                // 'reload' bypasses the HTTP cache, which serves /node_modules immutable for a day -
+                // without it a same-day release caches the library it was meant to replace
+                fetch(new Request(url, {cache: 'reload'}))
+                    .then(response => response.ok
+                        ? cache.put(url, response)
+                        : Promise.reject(new Error(url + ' -> ' + response.status))))))
+            // Without this the new worker waits until every tab of the origin is closed at once.
+            // Reloading does not release the old one, so a release can stay invisible for days.
+            .then(() => self.skipWaiting())
     );
 });
 
 // Delete old caches during activation
 self.addEventListener('activate', event => {
-    const cacheWhitelist = [CACHE_NAME];
     event.waitUntil(
-        caches.keys().then(cacheNames => {
-            return Promise.all(
-                cacheNames.map(cacheName => {
-                    if (cacheWhitelist.indexOf(cacheName) === -1) {
-                        return caches.delete(cacheName);
-                    }
-                })
-            );
-        })
+        caches.keys()
+            .then(cacheNames => Promise.all(
+                cacheNames.filter(cacheName => cacheName !== CACHE_NAME)
+                    .map(cacheName => caches.delete(cacheName))))
+            // Take over the pages that are already open, rather than only ones opened from now on
+            .then(() => self.clients.claim())
+    );
+});
+
+self.addEventListener('fetch', event => {
+    event.respondWith(
+        // Scoped to CACHE_NAME: a bare caches.match searches every cache in the origin, so a
+        // leftover older cache answers first and the version bump achieves nothing
+        caches.match(event.request, {cacheName: CACHE_NAME})
+            .then(response => response || fetch(event.request))
     );
 });

package/scripts/addbridge-pi.zsh

@@ -0,0 +1,194 @@
+#!/usr/bin/env zsh
+#
+# Bridge this Pi's broker to a production Frugal IoT server. RUN THIS ON THE PI.
+#
+# After this, the Pi's readings also appear on the production server, and its nodes can be
+# controlled from there - while the Pi carries on recording and serving on its own whenever the
+# link is down. Readings taken during an outage stay on the Pi: production gets a gap rather than
+# a backlog delivered later with the wrong timestamps. INSTALLATION.md step 11 explains why.
+#
+# The relaying is done by the broker, so the server, the logger and the nodes are untouched.
+#
+# Run the companion script on the production server first - "frugal-iot-addbridge-prod" - which
+# creates the account this needs and tells you the password.
+#
+# Run from the server's own directory, the one holding frugal-iot.db.
+#
+# Usage:
+#   npx --no frugal-iot-addbridge-pi <org-id> <prod-host> <account>
+#   scripts/addbridge-pi.zsh --org myfarm --host prod.example.org --account bridge-northfield
+#
+# Both forms work. The positional one is the one to use with npx, because npm swallows any --flag
+# it does not recognise ("Unknown cli config") and passes only the values through, so
+# "npx ... --org myfarm" reaches this script as just "myfarm". Putting "--" before the flags also
+# works, but the positional form is harder to get wrong.
+#
+# The password is asked for rather than passed on the command line, so it does not end up in your
+# shell history. Give it with --password only for an unattended run.
+
+set -euo pipefail
+
+SCRIPT_NAME=$0
+
+usage() {
+  echo "Usage: ${SCRIPT_NAME} <org-id> <prod-host> <account> [password]" >&2
+  echo "   or: ${SCRIPT_NAME} --org <org-id> --host <prod-host> --account <account> [--port N] [--password PW] [--replace]" >&2
+  echo "Example: ${SCRIPT_NAME} myfarm prod.example.org bridge-northfield" >&2
+  echo "" >&2
+  echo "Through npx, use the positional form: npm swallows unrecognised --flags and passes only" >&2
+  echo "their values on, so '--org myfarm' arrives here as just 'myfarm'." >&2
+  exit 1
+}
+
+ORG_ID=""; PROD_HOST=""; ACCOUNT=""; PASSWORD=""; PROD_PORT=8883; REPLACE=false
+POSITIONAL=()
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --org)      ORG_ID=${2:-}; shift 2 ;;
+    --host)     PROD_HOST=${2:-}; shift 2 ;;
+    --account)  ACCOUNT=${2:-}; shift 2 ;;
+    --password) PASSWORD=${2:-}; shift 2 ;;
+    --port)     PROD_PORT=${2:-}; shift 2 ;;
+    --replace)  REPLACE=true; shift ;;
+    -*) echo "Error: unknown option '$1'" >&2; usage ;;
+    *)  POSITIONAL+=("$1"); shift ;;
+  esac
+done
+
+# Fill anything not given as a flag from the positional arguments, in the order the usage line
+# shows. This is what makes the npx form work: npm eats "--org" and hands us a bare "myfarm".
+# Written as "if" rather than "[[ ... ]] && X=Y", whose false case is a non-zero last command and
+# would end the script under "set -e".
+# Fill whichever are still empty, in the order the usage line shows them, consuming the
+# positionals in turn rather than by fixed position - so a half-and-half command line still lands
+# correctly. Done inline, not through a function returning its value: a command substitution runs
+# in a subshell, where the counter would advance and then be thrown away, giving every field the
+# same first positional.
+POS_N=1
+for _field in ORG_ID PROD_HOST ACCOUNT PASSWORD; do
+  if [[ -z "${(P)_field}" ]] && (( POS_N <= ${#POSITIONAL} )); then
+    typeset -g "${_field}"="${POSITIONAL[POS_N]}"
+    POS_N=$((POS_N + 1))
+  fi
+done
+unset _field
+
+if [[ -z "$ORG_ID" || -z "$PROD_HOST" || -z "$ACCOUNT" ]]; then usage; fi
+
+BRIDGE_CONF=/etc/mosquitto/conf.d/frugal-iot-bridge.conf
+
+# This Pi has to know the organization too, or its own logger will not be recording what it relays.
+if [[ ! -f "config.d/organizations/${ORG_ID}.yaml" ]]; then
+  echo "Error: no config.d/organizations/${ORG_ID}.yaml here." >&2
+  echo "Run this from the server's own directory, and check the organization id matches the one" >&2
+  echo "used on the production server - it is the first element of every topic, so the two ends" >&2
+  echo "must agree exactly." >&2
+  exit 1
+fi
+
+if [[ -e "$BRIDGE_CONF" && "$REPLACE" != true ]]; then
+  echo "Error: ${BRIDGE_CONF} already exists - this Pi is already bridged." >&2
+  echo "Add --replace to overwrite it, or edit it by hand. Through npx that flag needs a '--'" >&2
+  echo "ahead of it - 'npx --no frugal-iot-addbridge-pi -- --org ... --replace' - or npm eats it." >&2
+  exit 1
+fi
+
+# The example file ships with the server, so look beside this script rather than guessing a path -
+# that works both for an npm install and for a git checkout.
+EXAMPLE="${SCRIPT_NAME:A:h}/../extras/mosquitto-bridge.conf.example"
+if [[ ! -f "$EXAMPLE" ]]; then
+  echo "Error: cannot find mosquitto-bridge.conf.example (looked at ${EXAMPLE})" >&2
+  exit 1
+fi
+
+if [[ -z "$PASSWORD" ]]; then
+  echo -n "Password for ${ACCOUNT} on ${PROD_HOST} (not echoed): "
+  read -rs PASSWORD
+  echo ""
+  if [[ -z "$PASSWORD" ]]; then
+    echo "Error: no password given" >&2
+    exit 1
+  fi
+fi
+
+# Check the far end is reachable and its certificate checks out, before writing anything. Getting
+# this wrong is the usual reason a bridge silently fails to connect, and the broker's own log is
+# the only place it says so.
+if command -v openssl >/dev/null; then
+  echo "Checking ${PROD_HOST}:${PROD_PORT} ..."
+  if echo | openssl s_client -connect "${PROD_HOST}:${PROD_PORT}" -servername "$PROD_HOST" \
+       -verify_hostname "$PROD_HOST" -verify_return_error >/dev/null 2>&1; then
+    echo "  reachable, and the certificate is valid for that name"
+  else
+    echo "Warning: could not complete a TLS handshake with ${PROD_HOST}:${PROD_PORT}." >&2
+    echo "  Either the port is not open, or the certificate is not valid for that name." >&2
+    echo "  Carrying on - the bridge will keep retrying - but it will not connect until that is fixed." >&2
+  fi
+fi
+
+# Fill in the example. Everything the bridge needs, including why each setting is what it is, is in
+# the comments of that file, so it is copied whole rather than reduced to the active lines.
+TMP=$(mktemp)
+trap 'rm -f "$TMP"' EXIT
+sed -e "s|<prod-host>:8883|${PROD_HOST}:${PROD_PORT}|" \
+    -e "s|<bridge-account>|${ACCOUNT}|g" \
+    -e "s|<bridge-password>|${PASSWORD}|" \
+    -e "s|<org>/|${ORG_ID}/|g" \
+    -e "s|^# Replace <org> in all four lines with the organization id - the first element of every topic, and|# The organization here is \"${ORG_ID}\" - the first element of every topic, and|" \
+    "$EXAMPLE" > "$TMP"
+
+if grep -qE '<(prod-host|bridge-account|bridge-password)>' "$TMP"; then
+  echo "Error: some placeholders were not filled in - not installing. This is a bug in this script" >&2
+  echo "  or in extras/mosquitto-bridge.conf.example." >&2
+  exit 1
+fi
+
+# Mode 600 because it holds the password. Mosquitto reads its configuration as root, before
+# dropping privileges, so it can still read it - unlike the TLS key, which it reads afterwards.
+echo "Writing ${BRIDGE_CONF} ..."
+sudo install -o root -g root -m 600 "$TMP" "$BRIDGE_CONF"
+
+# A restart, not a reload: mosquitto does not pick up bridges on a reload signal. Every node
+# reconnects on its own afterwards.
+echo "Restarting mosquitto (nodes will reconnect on their own) ..."
+sudo systemctl restart mosquitto
+sleep 4
+
+if [[ "$(systemctl is-active mosquitto 2>/dev/null)" != "active" ]]; then
+  echo "Error: mosquitto did not come back up. Its own log says why:" >&2
+  echo "  sudo tail -20 /var/log/mosquitto/mosquitto.log" >&2
+  echo "To undo this: sudo rm ${BRIDGE_CONF} && sudo systemctl restart mosquitto" >&2
+  exit 1
+fi
+
+# Did it actually connect? The bridge publishes a retained 1 or 0 here whenever that changes, so
+# this is the real answer rather than the absence of an error.
+STATE=""
+if command -v mosquitto_sub >/dev/null; then
+  ORG_PW=$(sed -n 's/^mqtt_password:[[:space:]]*//p' "config.d/organizations/${ORG_ID}.yaml" | head -1 | tr -d '"'"'"'') || true
+  for attempt in 1 2 3 4 5; do
+    # "|| true" because mosquitto_sub always exits non-zero when -W times out, and under "set -e"
+    # that ends this script here - silently, after the restart, without ever printing the verdict
+    # below. Likewise "if" rather than "&& break", whose false case is a non-zero last command.
+    STATE=$(mosquitto_sub -h localhost -u "$ORG_ID" -P "$ORG_PW" \
+      -t "\$SYS/broker/connection/${ACCOUNT}/state" -W 3 2>/dev/null | tail -1) || true
+    if [[ "$STATE" == "1" ]]; then break; fi
+    sleep 3
+  done
+fi
+
+echo ""
+if [[ "$STATE" == "1" ]]; then
+  echo "Connected. This Pi is now relaying ${ORG_ID} to ${PROD_HOST}."
+elif [[ -z "$STATE" ]]; then
+  echo "Installed, but this script could not tell whether it connected."
+  echo "Check with:  npx --no frugal-iot-diagnostic"
+else
+  echo "Installed, but not connected yet (state=${STATE})."
+  echo "It keeps retrying, so a wrong password or an unreachable port will show up in the log:"
+  echo "  sudo tail -20 /var/log/mosquitto/mosquitto.log"
+  echo "and the state is reported by:  npx --no frugal-iot-diagnostic"
+fi
+echo ""
+echo "The readings this Pi has already recorded stay here - only new ones are relayed."

package/scripts/addbridge-prod.zsh

@@ -0,0 +1,221 @@
+#!/usr/bin/env zsh
+#
+# Authorize a Raspberry Pi to bridge into this server. RUN THIS ON THE PRODUCTION SERVER.
+#
+# A bridge relays a Pi's readings to this server, so the same nodes appear on a dashboard here and
+# can be controlled from here, while the Pi carries on working on its own when the link is down.
+# This end of it is one broker account and one access-control rule. The Pi end is a configuration
+# file, written by the companion script - "frugal-iot-addbridge-pi", run on the Pi.
+#
+# Each Pi gets its own account rather than sharing the organization's, for two reasons: the
+# organization's broker password is handed to every browser that logs in, so it is not a secret;
+# and a per-Pi account can be confined to one site's topics and revoked without disturbing anyone.
+#
+# Run from the server's own directory, the one holding frugal-iot.db.
+#
+# Usage:
+#   npx --no frugal-iot-addbridge-prod <org-id> <site-name> [password]
+#   scripts/addbridge-prod.zsh <org-id> <site-name> [password]
+# Example:
+#   npx --no frugal-iot-addbridge-prod myfarm northfield
+#
+# The site name only distinguishes one Pi from another within an organization, and becomes part of
+# the account name ("bridge-northfield"). With no password given, a strong one is generated and
+# printed - it is needed once, to type into the Pi.
+#
+# This assumes the server has already been set up to accept bridges at all: a TLS listener on 8883
+# with a certificate. That is a one-off, and INSTALLATION.md step 11 covers it.
+
+set -euo pipefail
+
+SCRIPT_NAME=$0
+
+usage() {
+  echo "Usage: ${SCRIPT_NAME} <org-id> <site-name> [password]" >&2
+  echo "Example: ${SCRIPT_NAME} myfarm northfield" >&2
+  exit 1
+}
+
+if [[ $# -lt 2 || $# -gt 3 ]]; then
+  usage
+fi
+
+ORG_ID=$1
+SITE=$2
+PASSWORD=${3:-}
+
+if [[ ! "$ORG_ID" =~ ^[a-z0-9]{1,10}$ ]]; then
+  echo "Error: org id must be 1-10 lower-case letters/digits, got '${ORG_ID}'" >&2
+  exit 1
+fi
+# The site name ends up in an account name and in an ACL file, so keep it to something that cannot
+# be mistaken for syntax in either
+if [[ ! "$SITE" =~ ^[a-z0-9-]{1,20}$ ]]; then
+  echo "Error: site name must be 1-20 lower-case letters, digits or hyphens, got '${SITE}'" >&2
+  exit 1
+fi
+
+ACCOUNT="bridge-${SITE}"
+CONFIG_FILE="config.d/organizations/${ORG_ID}.yaml"
+
+# The organization has to exist here, or the readings will arrive and nothing will record them:
+# this server's logger subscribes per organization, driven by these files.
+if [[ ! -f "$CONFIG_FILE" ]]; then
+  echo "Error: no ${CONFIG_FILE} - organization '${ORG_ID}' is not configured on this server." >&2
+  echo "Its readings would arrive at the broker and nothing would record them. Add it first:" >&2
+  echo "  npx --no frugal-iot-addorganization ${ORG_ID} \"<name>\" <email> <phone> \"<password>\"" >&2
+  exit 1
+fi
+
+if ! command -v mosquitto_passwd >/dev/null; then
+  echo "Error: mosquitto_passwd not found - is mosquitto installed on this machine?" >&2
+  exit 1
+fi
+
+# Which files the running broker actually uses, rather than where they usually are. Only ".conf"
+# files in conf.d are read, and the last setting wins.
+MOSQ_CONFS=(/etc/mosquitto/mosquitto.conf(N) /etc/mosquitto/conf.d/*.conf(N))
+if (( ${#MOSQ_CONFS} == 0 )); then
+  echo "Error: no mosquitto configuration found in /etc/mosquitto" >&2
+  exit 1
+fi
+# Read one setting out of the broker's configuration. Two things to be careful of: a conf.d file
+# can be root-only (a bridge configuration holds a password, so it should be), which makes grep
+# fail rather than return nothing - and under "set -e" a failing command substitution would end
+# this script silently, before it had printed anything at all. Hence "|| true" and the sudo retry.
+mosq_setting() {
+  local out
+  out=$(grep -hE "^[[:space:]]*$1[[:space:]]" "${MOSQ_CONFS[@]}" 2>/dev/null | tail -1 | awk '{print $2}') || true
+  if [[ -z "$out" ]] && command -v sudo >/dev/null; then
+    out=$(sudo grep -hE "^[[:space:]]*$1[[:space:]]" "${MOSQ_CONFS[@]}" 2>/dev/null | tail -1 | awk '{print $2}') || true
+  fi
+  print -r -- "$out"
+}
+PWFILE=$(mosq_setting password_file)
+ACLFILE=$(mosq_setting acl_file)
+
+if [[ -z "$PWFILE" ]]; then
+  echo "Error: no password_file in the mosquitto configuration - this broker is not using accounts." >&2
+  exit 1
+fi
+if [[ ! -e "$PWFILE" ]]; then
+  echo "Error: mosquitto names ${PWFILE} as its password file but it does not exist." >&2
+  exit 1
+fi
+
+# The account names in the password file. Needs the same sudo retry as the settings above: the
+# password file is normally mode 600 owned by the broker's own user, so reading it as anyone else
+# silently returns nothing - which would look exactly like "this account does not exist yet".
+account_exists() {
+  local names
+  names=$(cut -d: -f1 "$PWFILE" 2>/dev/null) || true
+  if [[ -z "$names" ]] && command -v sudo >/dev/null; then
+    names=$(sudo cut -d: -f1 "$PWFILE" 2>/dev/null) || true
+  fi
+  print -r -- "$names" | grep -qx "$1"
+}
+
+# Refuse to rotate the password of a bridge that is presumably working: the Pi holds the old one,
+# and it would stop relaying the moment this changed without anyone touching the Pi.
+if account_exists "$ACCOUNT"; then
+  echo "Error: account '${ACCOUNT}' already exists in ${PWFILE}." >&2
+  echo "If a Pi is already using it, leave it alone. To give it a new password, run" >&2
+  echo "mosquitto_passwd as the owner of that file - as root it rewrites the file owned by root," >&2
+  echo "and the broker, which reads it as the mosquitto user, then will not start:" >&2
+  echo "  sudo -u \"\$(stat -c '%U' ${PWFILE})\" mosquitto_passwd -b ${PWFILE} ${ACCOUNT} '<new password>'" >&2
+  echo "and then update /etc/mosquitto/conf.d/frugal-iot-bridge.conf on that Pi to match." >&2
+  exit 1
+fi
+
+if [[ -z "$PASSWORD" ]]; then
+  # Unlike the organization's broker password, this one is never given to a browser - it lives only
+  # in a root-owned file on the Pi - so it can and should be a real one.
+  # The subshell turns pipefail off: head closes the pipe after 24 characters, tr is killed by
+  # SIGPIPE, and with pipefail on that failure would end this script before it printed anything.
+  # install-pi.sh's randpw does the same for the same reason.
+  PASSWORD=$( set +o pipefail; LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 24 )
+  GENERATED=true
+else
+  GENERATED=false
+fi
+
+# Run mosquitto_passwd as whoever owns the password file, the same way addorganization.zsh does.
+# Running it as root instead rewrites the file owned by root, and mosquitto drops to the mosquitto
+# user *before* reading it - so the broker then cannot read its own password file and refuses to
+# start, with an error that says nothing about ownership. mosquitto_passwd also writes a temporary
+# backup beside the file, so it needs the directory and not only the file.
+MOSQ_PASSWD_CMD=(mosquitto_passwd)
+if [[ ! -w "${PWFILE:h}" || ( -e "$PWFILE" && ! -w "$PWFILE" ) ]]; then
+  if command -v sudo >/dev/null; then
+    # stat's spelling differs between Linux (-c) and BSD/macOS (-f)
+    PWFILE_OWNER=$(stat -c '%U' "$PWFILE" 2>/dev/null || stat -f '%Su' "$PWFILE" 2>/dev/null || true)
+    if [[ -n "$PWFILE_OWNER" && "$PWFILE_OWNER" != "$(id -un)" && "$PWFILE_OWNER" != "root" ]]; then
+      MOSQ_PASSWD_CMD=(sudo -u "$PWFILE_OWNER" mosquitto_passwd)
+    else
+      MOSQ_PASSWD_CMD=(sudo mosquitto_passwd)
+    fi
+  fi
+fi
+
+echo "Creating broker account ${ACCOUNT} in ${PWFILE} ..."
+if ! $MOSQ_PASSWD_CMD -b "$PWFILE" "$ACCOUNT" "$PASSWORD"; then
+  echo "Error: mosquitto_passwd failed - nothing has been changed." >&2
+  exit 1
+fi
+
+# The access control rule. Without one the account can connect and reach nothing at all, because a
+# mosquitto acl_file is deny-by-default.
+if [[ -n "$ACLFILE" ]]; then
+  if [[ ! -e "$ACLFILE" ]]; then
+    echo "Error: mosquitto names ${ACLFILE} as its ACL file but it does not exist." >&2
+    echo "The account has been created but cannot reach anything until that is sorted out." >&2
+    exit 1
+  fi
+  if sudo grep -qE "^[[:space:]]*user[[:space:]]+${ACCOUNT}[[:space:]]*$" "$ACLFILE"; then
+    echo "ACL rule for ${ACCOUNT} is already in ${ACLFILE} - leaving it alone."
+  else
+    echo "Adding ACL rule to ${ACLFILE} ..."
+    sudo tee -a "$ACLFILE" >/dev/null <<EOF
+
+# Pi bridge for site "${SITE}", confined to its organization's topics
+user ${ACCOUNT}
+topic readwrite ${ORG_ID}/#
+EOF
+  fi
+else
+  echo ""
+  echo "NOTE: this broker has no acl_file, so ${ACCOUNT} can reach every topic on it, not just"
+  echo "  ${ORG_ID}/#. That is how the broker already treats every other account, so this is no"
+  echo "  worse than what is there - but see INSTALLATION.md step 11 for restricting it."
+fi
+
+# password_file and acl_file are both re-read on a reload, so nothing needs to be disconnected.
+echo "Reloading mosquitto ..."
+sudo systemctl reload mosquitto || {
+  echo "Warning: reload failed - the account exists but the broker has not re-read the files." >&2
+  echo "  Try: sudo systemctl restart mosquitto" >&2
+}
+
+echo ""
+echo "Done. On the Pi at site '${SITE}', run:"
+echo ""
+echo "  npx --no frugal-iot-addbridge-pi ${ORG_ID} <this server's public name> ${ACCOUNT}"
+echo ""
+echo "Positional arguments on purpose: npm swallows any --flag it does not recognise and passes"
+echo "only the value on, so the --org form would arrive at that script as a bare word."
+echo ""
+echo "It will ask for this password:"
+echo ""
+echo "  ${PASSWORD}"
+echo ""
+if [[ "$GENERATED" == true ]]; then
+  echo "That was generated just now and is not stored anywhere you can read it back - copy it before"
+  echo "you lose this output. If it does get lost, set a new one with:"
+  echo "  sudo -u \"\$(stat -c '%U' ${PWFILE})\" mosquitto_passwd -b ${PWFILE} ${ACCOUNT} '<new password>'"
+  echo "and use that on the Pi instead."
+fi
+echo "Fill in the public name yourself - it is deliberately not guessed here, because what this"
+echo "machine calls itself is usually not it. This host answers to \"$(hostname -f 2>/dev/null || hostname)\","
+echo "which is only the right answer if that is also the DNS name the Pi can reach and the name on"
+echo "the TLS certificate. The Pi verifies the certificate against whatever you put here, so a"
+echo "local hostname, or a domain the certificate does not cover, fails to connect."