frugal-iot-server 2.0.0 → 2.0.2

package/scripts/install-pi.sh

@@ -43,12 +43,15 @@ Usage: bash install-pi.sh [options]
   --name "<name>"      organization display name
   --email <address>    contact address for the organization
   --phone <number>     contact phone, "+" and digits only
-  --broker-password    the machine credential shared by the server, nodes and dashboards.
+  --broker-password    the organization's shared broker credential. Generated, and not needed on a
+                       Pi installed by this script: nodes are issued their own when they enrol and
+                       browsers derive their own at login. Set it only to match nodes flashed
+                       before enrolment existed.
   --superuser-password password for this server's administrator login.
   --login-password     web login password for the organization's own account, which is a different
                        thing from the broker credential above and should not be the same string.
-                       Any of these three not given is asked for, and generated if you just press
-                       Enter, or if there is no terminal to ask at.
+                       Either of the two logins, if not given, is asked for - and generated if you
+                       just press Enter, or if there is no terminal to ask at.
   --broker-host <host> what the browser and the nodes should call this Pi.
                        Default: this Pi's hostname with ".local". Use an IP address if you will
                        view the dashboard on Android, which cannot resolve ".local" names.
@@ -130,6 +133,18 @@ as_user_sh() {
 # sudo, or nothing if we are already root
 sudo_() { if [[ ${EUID} -eq 0 ]]; then "$@"; else sudo "$@"; fi; }
 
+# Read a file under /etc that may be readable only by root. An ordinary user gets "Permission
+# denied" on stderr and nothing on stdout, which is indistinguishable from "the setting you were
+# looking for is not in there" - so a grep over it reports the wrong problem entirely. Try plainly,
+# and fall back to sudo when a file that exists yields nothing.
+read_maybe_root() {
+  local f=$1 out
+  [[ -e "$f" ]] || return 0
+  out="$(cat "$f" 2>/dev/null || true)"
+  [[ -n "$out" ]] || out="$(sudo_ cat "$f" 2>/dev/null || true)"
+  printf '%s\n' "$out"
+}
+
 # ---------------------------------------------------------------- logging
 
 if (( DRY_RUN )); then
@@ -170,6 +185,15 @@ trap 'on_error $LINENO' ERR
 
 randpw() { ( set +o pipefail; LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 16 ); }
 
+# Everything a native module needs to compile. python3-setuptools is the one that is easy to miss:
+# node-gyp 8 imports Python's distutils, removed from the standard library in 3.12, and setuptools
+# is what puts an importable one back. Without it the build ends in "No module named 'distutils'".
+BUILD_PACKAGES=(build-essential python3-dev python3-setuptools)
+have_build_tools() { dpkg -s "${BUILD_PACKAGES[@]}" >/dev/null 2>&1; }
+install_build_tools() {
+  sudo_ env DEBIAN_FRONTEND=noninteractive apt-get install -y -qq "${BUILD_PACKAGES[@]}"
+}
+
 REBOOT_REASONS=()
 
 # Size and modification time of every kernel and initrd image, so that the upgrade replacing one can
@@ -269,18 +293,66 @@ if [[ -r /etc/os-release ]]; then
 fi
 [[ -r /proc/device-tree/model ]] && info "board:   $(tr -d '\0' < /proc/device-tree/model)"
 ARCH="$(uname -m)"
+# What the USERLAND is, which is not necessarily what "uname -m" says. uname reports the KERNEL, and
+# Raspberry Pi OS 32-bit boots the 64-bit kernel by default on any 64-bit-capable board - so a
+# perfectly ordinary Pi 4 running the 32-bit image reports "armv8l" while every binary on it is
+# 32-bit armhf. npm resolves prebuilt binaries against the userland, so that is what decides whether
+# anything has to be compiled. Deciding it from uname installed no compiler on exactly that
+# configuration, and the install then died part-way through building sqlite3.
+DEB_ARCH="$(dpkg --print-architecture 2>/dev/null || true)"
 MEM_KB="$(awk '/^MemTotal:/ {print $2}' /proc/meminfo 2>/dev/null || echo 0)"
-info "arch:    ${ARCH}, memory: $((MEM_KB / 1024)) MB"
+info "kernel:  ${ARCH}    userland: ${DEB_ARCH:-unknown}    memory: $((MEM_KB / 1024)) MB"
 
-# A 32-bit ARMv6 board (Pi Zero W, Pi 1) has no ready-made sqlite3 binary, so it has to compile it,
-# which needs a compiler and more memory than the board has.
+# No ready-made sqlite3 binary is published for 32-bit ARM, so there it has to be compiled.
 NEEDS_BUILD_TOOLS=0
-NPM_SLOW_FLAGS=()
-case "$ARCH" in
-  armv6l|armv7l) NEEDS_BUILD_TOOLS=1; NPM_SLOW_FLAGS=(--maxsockets 1 --no-audit --no-fund) ;;
+case "$DEB_ARCH" in
+  armhf|armel)  NEEDS_BUILD_TOOLS=1 ;;
+  arm64|amd64)  NEEDS_BUILD_TOOLS=0 ;;
+  *)
+    # dpkg could not say. Fall back to the kernel, and lean towards installing the compiler: having
+    # it and not needing it costs disk, not having it and needing it stops the install dead.
+    case "$ARCH" in
+      aarch64|arm64|x86_64) NEEDS_BUILD_TOOLS=0 ;;
+      *)              NEEDS_BUILD_TOOLS=1 ;;
+    esac
+    ;;
 esac
+
+# A 64-bit kernel over a 32-bit userland means 64-bit hardware running the 32-bit image - almost
+# always the wrong card written by mistake, and worth saying before the 40 minutes rather than
+# after. It does work, so this warns and carries on rather than refusing.
+WRONG_IMAGE=0
+if [[ "$DEB_ARCH" == armhf ]]; then
+  case "$ARCH" in
+    aarch64|armv8l) WRONG_IMAGE=1 ;;
+  esac
+fi
+if (( WRONG_IMAGE )); then
+  BOARD="$( [[ -r /proc/device-tree/model ]] && tr -d '\0' < /proc/device-tree/model || echo "this board" )"
+  warn "-----------------------------------------------------------------------"
+  warn "${BOARD} is 64-bit, but the OS on the card is 32-bit (armhf)."
+  warn "That is almost always the wrong image written to the card."
+  warn ""
+  warn "It will work, but no ready-made sqlite3 is published for 32-bit ARM, so"
+  warn "it has to be compiled: minutes here, about 40 on a Pi Zero W."
+  warn ""
+  warn "To use the right one instead: write Raspberry Pi OS Lite (64-bit) to the"
+  warn "card and start again from step 1. Nothing here is worth keeping yet."
+  warn "-----------------------------------------------------------------------"
+  if (( ! ASSUME_YES )) && [[ -t 0 ]]; then
+    printf '    Carry on with the 32-bit OS anyway? [y/N] ' > /dev/tty
+    read -r REPLY < /dev/tty
+    [[ "$REPLY" == [yY]* ]] || { echo "Stopped. Nothing has been changed."; exit 0; }
+  fi
+fi
+
+# One thing at a time, which lowers npm's peak memory as much as it spares the card. This is about
+# how little memory the board has, not about its architecture - a 32-bit Pi 4 has plenty.
+NPM_SLOW_FLAGS=()
+if (( MEM_KB > 0 && MEM_KB < 1200000 )); then NPM_SLOW_FLAGS=(--maxsockets 1 --no-audit --no-fund); fi
 if (( MEM_KB > 0 && MEM_KB < 700000 )); then NEEDS_SWAP=1; else NEEDS_SWAP=0; fi
-(( NEEDS_BUILD_TOOLS )) && info "32-bit ARM: sqlite3 will be compiled, which is slow (allow 40 minutes on a Zero W)"
+(( NEEDS_BUILD_TOOLS )) && info "no ready-made sqlite3 for ${DEB_ARCH:-this architecture}, so it is compiled here (minutes on a Pi 4, about 40 on a Zero W)"
+(( ${#NPM_SLOW_FLAGS[@]} )) && info "limited memory: npm will be told to do one thing at a time"
 (( NEEDS_SWAP ))        && info "under 700 MB of memory: a swap file will be added so the install can finish"
 
 ask ORG_ID    "Organization id (1-10 lower-case letters or digits, e.g. myfarm)" || exit 1
@@ -292,7 +364,15 @@ ask ORG_PHONE "Contact phone ('+' and digits only)" || exit 1
 # Asked for in the order they matter. Each may be typed, passed as an option, or generated.
 ask_password SUPER_PW  "the superuser login (this server's administrator)"
 ask_password LOGIN_PW  "the ${ORG_ID} web login"
-ask_password BROKER_PW "the ${ORG_ID} broker credential, shared by the nodes and dashboards"
+# Not asked for. addorganization.zsh requires one, and lib/retained.js falls back to it on a broker
+# with no dynamic security - but this installer always sets dynamic security up, so on this Pi every
+# node is issued its own credential when it enrols and every browser derives its own when it logs
+# in, and nothing reads this. Generated rather than asked, so there is one less thing to choose.
+# --broker-password still sets it, for an organization whose nodes predate enrolment.
+if [[ -z "$BROKER_PW" ]]; then
+  BROKER_PW="$(randpw)"
+  GENERATED+=(BROKER_PW)
+fi
 [[ -n "$BROKER_HOST" ]] || BROKER_HOST="$(hostname).local"
 
 info "install into:  ${INSTALL_DIR}  (owned by ${RUN_USER})"
@@ -315,7 +395,9 @@ $( (( NEEDS_SWAP )) && echo "  * add a 2G swap file, because this board has unde
 Passwords it would use. A generated one is different on every run, so pass it or type it if you
 want this exact set. All of them are shown here because a dry run writes no log; a real run prints
 only the generated ones, so the ones you chose stay out of the log:
-$(printf '  %-22s %s\n' "superuser login" "${SUPER_PW}" "${ORG_ID} web login" "${LOGIN_PW}" "${ORG_ID} broker" "${BROKER_PW}")
+$(printf '  %-22s %s\n' "superuser login" "${SUPER_PW}" "${ORG_ID} web login" "${LOGIN_PW}")
+The organization's broker credential is generated too, but not shown: nothing needs you to know it,
+since nodes are issued their own when they enrol. It lands in config.d/organizations/${ORG_ID}.yaml.
 PLAN
   exit 0
 fi
@@ -363,7 +445,7 @@ fi
 
 step "Installing the packages the server needs"
 PACKAGES=(nodejs npm sqlite3 zsh curl)
-(( NEEDS_BUILD_TOOLS )) && PACKAGES+=(build-essential python3-dev python3-setuptools)
+(( NEEDS_BUILD_TOOLS )) && PACKAGES+=("${BUILD_PACKAGES[@]}")
 sudo_ env DEBIAN_FRONTEND=noninteractive apt-get install -y -qq "${PACKAGES[@]}"
 NODE_VERSION="$(node -v)"
 info "node ${NODE_VERSION}, npm $(npm -v), sqlite3 $(sqlite3 --version | awk '{print $1}')"
@@ -423,7 +505,22 @@ else
   if (( NEEDS_BUILD_TOOLS )); then
     info "this is the slow part - sqlite3 is compiled here. Leave it running."
   fi
-  as_user_sh "cd '${INSTALL_DIR}' && npm install ${NPM_SLOW_FLAGS[*]:-} frugal-iot-server"
+  # A failure here is nearly always the native module having to be compiled with no compiler
+  # present - which means the architecture was read wrong above. Rather than stopping and making
+  # you run the whole thing again, install what a build needs and have one more go.
+  if ! as_user_sh "cd '${INSTALL_DIR}' && npm install ${NPM_SLOW_FLAGS[*]:-} frugal-iot-server"; then
+    if have_build_tools; then
+      echo "npm install failed, and the compiler it would need is already installed - so this is" >&2
+      echo "something else. The reason is above, and in ${LOG}." >&2
+      exit 1
+    fi
+    warn "npm install failed and nothing here can compile a native module - installing the"
+    warn "  compiler and trying once more. (If it ended in \"No module named 'distutils'\", that"
+    warn "  is exactly this.)"
+    install_build_tools
+    NEEDS_BUILD_TOOLS=1
+    as_user_sh "cd '${INSTALL_DIR}' && npm install ${NPM_SLOW_FLAGS[*]:-} frugal-iot-server"
+  fi
   ok "installed"
 fi
 info "server $(as_user_sh "node -e \"console.log(require('${INSTALL_DIR}/node_modules/frugal-iot-server/package.json').version)\"")"
@@ -435,6 +532,10 @@ if as_user_sh "cd '${INSTALL_DIR}' && node -e \"require('sqlite3')\"" >/dev/null
   ok "sqlite3 loads"
 else
   warn "sqlite3 did not build on the first attempt - rebuilding it"
+  if ! have_build_tools; then
+    info "installing the compiler first - a rebuild cannot work without it"
+    install_build_tools
+  fi
   (( NEEDS_BUILD_TOOLS )) && info "expect around 40 minutes on a Pi Zero W; it is working as long as output keeps appearing"
   as_user_sh "cd '${INSTALL_DIR}' && npm rebuild sqlite3 --foreground-scripts"
   as_user_sh "cd '${INSTALL_DIR}' && node -e \"require('sqlite3')\"" >/dev/null 2>&1 \
@@ -490,15 +591,47 @@ SRC_CONF="${PKG_DIR}/extras/mosquitto.conf"
 # refused by a future version. Same rule as the password file below.
 SRC_ACL="${PKG_DIR}/extras/aclfile"
 [[ -f "$SRC_ACL" ]] || SRC_ACL="${INSTALL_DIR}/extras/aclfile"
-if [[ -f "$SRC_ACL" ]]; then
-  if cmp -s "$SRC_ACL" /etc/mosquitto/aclfile 2>/dev/null; then
-    skip "/etc/mosquitto/aclfile already current"
+[[ -f "$SRC_ACL" ]] || { echo "Expected extras/aclfile in ${PKG_DIR} or ${INSTALL_DIR}" >&2; exit 1; }
+
+# An existing ACL file is NOT simply replaced. addbridge-prod.zsh appends a stanza to it per Pi:
+#
+#   user <account>
+#   topic readwrite <org>/#
+#
+# Overwriting the file drops those, and because a mosquitto acl_file is deny-by-default the result
+# is every bridge account still logging in and reaching nothing at all - every site stops relaying,
+# on a broker that looks perfectly healthy. So the shipped file is treated as the set of lines that
+# must be PRESENT, not as the whole contents.
+#
+# Ownership and mode of a file that already exists are left alone deliberately. An older install has
+# it root-owned 644, which works and only draws a warning from the broker; "fixing" it to 600
+# without also chowning it to mosquitto stops the broker starting, because it reads this file after
+# dropping privileges. That is a migration to make deliberately, not a side effect of an upgrade -
+# INSTALLATION.md step 11 has it.
+if [[ ! -e /etc/mosquitto/aclfile ]]; then
+  sudo_ install -o mosquitto -g mosquitto -m 600 "$SRC_ACL" /etc/mosquitto/aclfile
+  ok "access control list installed at /etc/mosquitto/aclfile"
+else
+  # Read with sudo: the file is normally mode 600 owned by the broker's own user, so reading it as
+  # anyone else returns nothing, which would look exactly like "every shipped rule is missing".
+  ACL_MISSING=$(comm -23 \
+      <(grep -vE '^[[:space:]]*(#|$)' "$SRC_ACL" | sort -u) \
+      <(sudo_ grep -vE '^[[:space:]]*(#|$)' /etc/mosquitto/aclfile 2>/dev/null | sort -u) || true)
+  ACL_ADDED=$(sudo_ grep -cE '^[[:space:]]*user[[:space:]]' /etc/mosquitto/aclfile 2>/dev/null || true)
+  ACL_ADDED=${ACL_ADDED:-0}
+  if [[ -z "$ACL_MISSING" ]]; then
+    skip "/etc/mosquitto/aclfile has every rule this release ships${ACL_ADDED:+ (plus ${ACL_ADDED} added per bridge)}"
+  elif (( ACL_ADDED == 0 )); then
+    # Nothing has been added by hand, so there is nothing to lose by replacing it
+    sudo_ install -m "$(stat -c '%a' /etc/mosquitto/aclfile 2>/dev/null || echo 600)" \
+          "$SRC_ACL" /etc/mosquitto/aclfile
+    ok "access control list at /etc/mosquitto/aclfile brought up to date"
   else
-    sudo_ install -o mosquitto -g mosquitto -m 600 "$SRC_ACL" /etc/mosquitto/aclfile
-    ok "access control list installed at /etc/mosquitto/aclfile"
+    warn "/etc/mosquitto/aclfile is missing rules this release ships, and holds ${ACL_ADDED} rule(s)"
+    warn "  added per bridge, which replacing it would delete. Add these by hand instead:"
+    while IFS= read -r line; do [[ -n "$line" ]] && info "    ${line}"; done <<< "$ACL_MISSING"
+    warn "  then: sudo systemctl reload mosquitto"
   fi
-else
-  echo "Expected extras/aclfile in ${PKG_DIR} or ${INSTALL_DIR}" >&2; exit 1
 fi
 
 # The dynamic security plugin. Its state file has to exist before the configuration naming it is
@@ -510,12 +643,34 @@ DYNSEC_SO=""
 for cand in /usr/lib/*/mosquitto_dynamic_security.so /usr/lib/mosquitto_dynamic_security.so             /usr/lib/*/mosquitto/mosquitto_dynamic_security.so /usr/lib/mosquitto/mosquitto_dynamic_security.so; do
   [[ -f "$cand" ]] && { DYNSEC_SO="$cand"; break; }
 done
+# An earlier release appended to this as whoever ran the script, so a run under sudo left it owned
+# by root - unreadable to the server, which is an ordinary user, and the symptom is every login
+# being told there is no broker credential. Put it right before anything below reads it.
+if [[ -f "${INSTALL_DIR}/config.d/secrets.yaml" ]]; then
+  SECRETS_OWNER="$(stat -c '%U' "${INSTALL_DIR}/config.d/secrets.yaml" 2>/dev/null || true)"
+  if [[ -n "$SECRETS_OWNER" && "$SECRETS_OWNER" != "$RUN_USER" ]]; then
+    sudo_ chown "${RUN_USER}" "${INSTALL_DIR}/config.d/secrets.yaml"
+    sudo_ chmod 600 "${INSTALL_DIR}/config.d/secrets.yaml"
+    ok "config.d/secrets.yaml belonged to ${SECRETS_OWNER}, not ${RUN_USER} - ownership corrected"
+  fi
+fi
+
 DYNSEC_JSON=/var/lib/mosquitto/dynamic-security.json
 if [[ -z "$DYNSEC_SO" ]]; then
   warn "mosquitto's dynamic security plugin was not found - per-user broker accounts will not work."
   warn "  Looked in /usr/lib. The broker will still run on the organization passwords."
 elif [[ -f "$DYNSEC_JSON" ]]; then
-  skip "dynamic security already initialised at ${DYNSEC_JSON}"
+  if as_user_sh "grep -q '^dynsec_admin_password:' '${INSTALL_DIR}/config.d/secrets.yaml'" 2>/dev/null; then
+    skip "dynamic security already initialised at ${DYNSEC_JSON}"
+  else
+    # Re-running cannot mend this: mosquitto_ctrl will not re-initialise over an existing state
+    # file, and the password it chose the first time was never written down anywhere.
+    warn "${DYNSEC_JSON} exists but config.d/secrets.yaml has no dynsec_admin_password."
+    warn "  A previous run must have stopped between the two. The password it used is not"
+    warn "  recoverable, so start that part again:"
+    warn "    sudo rm ${DYNSEC_JSON}"
+    warn "  then run this script again. Nothing else is affected - no accounts exist yet."
+  fi
 else
   # dynsec init asks for the admin password twice on stdin. The password is generated here and kept
   # in the server's own config.d/secrets.yaml, which is never served to a browser.
@@ -530,8 +685,8 @@ else
       echo "# \$CONTROL/dynamic-security/v1. Created by install-pi.sh."
       echo "dynsec_admin_user: \"frugal-admin\""
       echo "dynsec_admin_password: \"${DYNSEC_PW}\""
-    } >> "${INSTALL_DIR}/config.d/secrets.yaml"
-    chmod 600 "${INSTALL_DIR}/config.d/secrets.yaml"
+    } | as_user_sh "cat >> '${INSTALL_DIR}/config.d/secrets.yaml' && chmod 600 '${INSTALL_DIR}/config.d/secrets.yaml'"
+    # Through a pipe, not on the command line: an argument to sudo would put the password in "ps"
     ok "dynamic security initialised; admin credential saved to config.d/secrets.yaml"
   else
     warn "mosquitto_ctrl dynsec init failed - continuing without it"
@@ -548,19 +703,36 @@ if [[ -n "$DYNSEC_SO" ]]; then
 else
   sed -e "s|^plugin PLUGIN_PATH_SET_BY_INSTALLER|#plugin (not installed)|"       -e "s|^plugin_opt_config_file|#plugin_opt_config_file|" "$SRC_CONF" > "$TMP_CONF"
 fi
-if cmp -s "$TMP_CONF" /etc/mosquitto/conf.d/frugal-iot.conf 2>/dev/null; then
+if [[ "$(read_maybe_root /etc/mosquitto/conf.d/frugal-iot.conf)" == "$(cat "$TMP_CONF")" ]]; then
   skip "/etc/mosquitto/conf.d/frugal-iot.conf already current"
 else
-  sudo_ cp "$TMP_CONF" /etc/mosquitto/conf.d/frugal-iot.conf
+  # "install" and not "cp": cp gives a new destination the mode of its source, and the source here
+  # is a mktemp file, which is 600. That left this root-only - unreadable to the grep below, to
+  # frugal-iot-init's comparison, and to the diagnostic. It holds paths, not secrets.
+  sudo_ install -o root -g root -m 644 "$TMP_CONF" /etc/mosquitto/conf.d/frugal-iot.conf
   ok "configuration copied to /etc/mosquitto/conf.d/frugal-iot.conf"
 fi
+# Repair the mode even when the contents already matched. A release before this one installed this
+# file with "cp" from a mktemp file, leaving it 600 root - and since the contents are right, the
+# branch above skips, so nothing else would ever put that straight.
+CONF_MODE="$(stat -c '%a' /etc/mosquitto/conf.d/frugal-iot.conf 2>/dev/null || true)"
+if [[ -n "$CONF_MODE" && "$CONF_MODE" != 644 ]]; then
+  sudo_ chown root:root /etc/mosquitto/conf.d/frugal-iot.conf
+  sudo_ chmod 644 /etc/mosquitto/conf.d/frugal-iot.conf
+  ok "mode corrected to 644 (was ${CONF_MODE}) - it holds paths, not secrets, and several things read it"
+fi
 rm -f "$TMP_CONF"
 # The broker refuses to start if the password file it is told about does not exist. It has to belong
 # to the mosquitto user, because both the broker and mosquitto_passwd warn unless the file belongs to
 # whoever opened it - and mosquitto_passwd writes a temporary file beside it, so the directory has to
 # be writable by that user too.
-PWFILE="$(grep -hE '^[[:space:]]*password_file[[:space:]]' /etc/mosquitto/conf.d/frugal-iot.conf | tail -1 | awk '{print $2}' || true)"
-[[ -n "$PWFILE" ]] || { echo "No password_file line in /etc/mosquitto/conf.d/frugal-iot.conf" >&2; exit 1; }
+PWFILE="$(read_maybe_root /etc/mosquitto/conf.d/frugal-iot.conf | grep -hE '^[[:space:]]*password_file[[:space:]]' | tail -1 | awk '{print $2}' || true)"
+if [[ -z "$PWFILE" ]]; then
+  echo "No password_file line found in /etc/mosquitto/conf.d/frugal-iot.conf" >&2
+  echo "That file is: $(ls -ld /etc/mosquitto/conf.d/frugal-iot.conf 2>&1)" >&2
+  echo "If it cannot be read even with sudo, check what is in it - the broker needs that line." >&2
+  exit 1
+fi
 if [[ -f "$PWFILE" ]]; then
   skip "password file ${PWFILE} exists"
 else
@@ -603,6 +775,19 @@ fi
 sudo_ systemctl restart mosquitto   # so it re-reads the password file
 sleep 2
 
+step "Creating the broker's roles and groups"
+# dynsec init creates only the admin account. The roles and groups every other account is put into
+# are built from lib/dynsec-plan.js by this one command, and nothing else creates them - not the
+# server at startup, not addorganization. Without it the first login fails with
+# "addGroupClient: Group not found" and the dashboard says there is no broker credential.
+# Idempotent by design: it is also how a release that adds a rule delivers it.
+if [[ -n "$DYNSEC_SO" ]]; then
+  as_user_sh "cd '${INSTALL_DIR}' && npx --no frugal-iot-rebuild-dynsec"
+  ok "roles and groups built from the database"
+else
+  skip "no dynamic security plugin, so there are no groups to build"
+fi
+
 step "Testing the broker end to end"
 # Proves the account, the password file and the port 1883 listener the nodes use all work together.
 TEST_TOPIC="${ORG_ID}/installtest/hello"
@@ -627,8 +812,12 @@ rm -f "$SUB_OUT"
 step "Running the server as a service"
 # The shipped unit is written for user "pi" installing into /home/pi/frugal-iot, so the three lines
 # that depend on that are rewritten for wherever this actually went.
-SRC_SERVICE="${INSTALL_DIR}/extras/frugaliot.service"
-[[ -f "$SRC_SERVICE" ]] || { echo "Expected ${SRC_SERVICE} to exist after frugal-iot-init" >&2; exit 1; }
+# From the installed package, not ${INSTALL_DIR}/extras - for the same reason as the broker
+# configuration above. frugal-iot-init never overwrites its copy, so a release that changes the
+# unit would otherwise never reach /etc however often this is re-run.
+SRC_SERVICE="${PKG_DIR}/extras/frugaliot.service"
+[[ -f "$SRC_SERVICE" ]] || SRC_SERVICE="${INSTALL_DIR}/extras/frugaliot.service"
+[[ -f "$SRC_SERVICE" ]] || { echo "Expected extras/frugaliot.service in ${PKG_DIR} or ${INSTALL_DIR}" >&2; exit 1; }
 TMP_SERVICE="$(mktemp)"
 sed -e "s|^User=.*|User=${RUN_USER}|" \
     -e "s|^WorkingDirectory=.*|WorkingDirectory=${INSTALL_DIR}|" \
@@ -637,9 +826,18 @@ sed -e "s|^User=.*|User=${RUN_USER}|" \
 if cmp -s "$TMP_SERVICE" /etc/systemd/system/frugaliot.service 2>/dev/null; then
   skip "service file already current"
 else
-  sudo_ cp "$TMP_SERVICE" /etc/systemd/system/frugaliot.service
+  # "install" not "cp", for the reason given at the broker configuration above: a unit file copied
+  # from a mktemp file inherits mode 600, which "systemctl cat" and frugal-iot-init cannot read
+  sudo_ install -o root -g root -m 644 "$TMP_SERVICE" /etc/systemd/system/frugaliot.service
   ok "service installed, running as ${RUN_USER} from ${INSTALL_DIR}"
 fi
+# Same repair as for the broker configuration above, and for the same reason
+SERVICE_MODE="$(stat -c '%a' /etc/systemd/system/frugaliot.service 2>/dev/null || true)"
+if [[ -n "$SERVICE_MODE" && "$SERVICE_MODE" != 644 ]]; then
+  sudo_ chown root:root /etc/systemd/system/frugaliot.service
+  sudo_ chmod 644 /etc/systemd/system/frugaliot.service
+  ok "service file mode corrected to 644 (was ${SERVICE_MODE}) - systemctl cat could not read it"
+fi
 rm -f "$TMP_SERVICE"
 sudo_ systemctl daemon-reload
 sudo_ systemctl enable -q frugaliot
@@ -667,17 +865,21 @@ systemctl is-enabled --quiet frugaliot && ok "will start again at boot"
 
 IP_ADDR="$(hostname -I 2>/dev/null | awk '{print $1}' || true)"
 
+# What a node presents once to be issued its own broker credential. The server generates one per
+# organization at startup, so it exists by now; secrets.yaml is 600 and owned by the server's user.
+ENROL_SECRET="$(as_user_sh "grep -A1 '^enrolment_${ORG_ID}:' '${INSTALL_DIR}/config.d/secrets.yaml' 2>/dev/null | tail -1" 2>/dev/null | sed -e 's/^[[:space:]]*-[[:space:]]*//' -e 's/^"//' -e 's/"$//' || true)"
+
 # Only the generated ones are worth printing - and printing a password you typed would put it in the
 # log for no reason
 was_generated() { local v; for v in ${GENERATED[@]+"${GENERATED[@]}"}; do [[ "$v" == "$1" ]] && return 0; done; return 1; }
 shown() { if was_generated "$1"; then echo "${!1}"; else echo "(the one you gave)"; fi; }
 
 if (( ${#REBOOT_REASONS[@]} )); then
-  REBOOT_TEXT=" 2. REBOOT NEEDED - $(printf '%s' "${REBOOT_REASONS[0]}")."
+  REBOOT_TEXT=" 3. REBOOT NEEDED - $(printf '%s' "${REBOOT_REASONS[0]}")."
   for r in "${REBOOT_REASONS[@]:1}"; do REBOOT_TEXT="${REBOOT_TEXT}"$'\n'"    Also: ${r}."; done
   REBOOT_TEXT="${REBOOT_TEXT}"$'\n'"        sudo reboot"$'\n'"    The server and broker both come back by themselves afterwards."
 else
-  REBOOT_TEXT=" 2. No reboot needed. The kernel running now is the one on disk, and everything
+  REBOOT_TEXT=" 3. No reboot needed. The kernel running now is the one on disk, and everything
     installed here is already running."
 fi
 
@@ -693,26 +895,49 @@ cat <<SUMMARY
  Logins         superuser / $(shown SUPER_PW)
                 ${ORG_ID} / $(shown LOGIN_PW)
 
- Broker         ws://${BROKER_HOST}:9012        for browsers
-                ${BROKER_HOST}:1883             for sensor nodes
-                user ${ORG_ID}, password $(shown BROKER_PW)
+ Broker         ws://${BROKER_HOST}:9012        for browsers - each login is issued its own
+                                                credential, so there is nothing to type in
+                ${BROKER_HOST}:1883             for sensor nodes, which are issued their own
+                                                credential when they enrol (below)
 
  Installed in   ${INSTALL_DIR}, running as ${RUN_USER}
  Log of this run ${LOG}   (readable only by you; any generated password above is in it)
 
  Still to do:
 
- 1. Your sensor nodes. This cannot be done from here - a node learns the broker by being
-    flashed with it, which happens on your workstation. Build each node's firmware with:
-        broker    ${BROKER_HOST}
-        org       ${ORG_ID}
-        password  $(shown BROKER_PW)
-    They appear on the dashboard by themselves once they connect.
+ 1. A project. Create one on the dashboard before flashing any node: a node says which
+    project it is in, and enrolling into one this server does not know is refused.
+    Your organization "${ORG_ID}" starts with none.
+
+ 2. Your sensor nodes. This cannot be done from here - it happens on your workstation. In the
+    PlatformIO project's platformio-secrets-local.ini:
+
+        build_flags_local =
+            '-D SYSTEM_FRUGAL_ORG="${ORG_ID}"'
+            '-D SYSTEM_FRUGAL_PROJECT="<the project from 1>"'
+            '-D SYSTEM_MQTT_HOST="${BROKER_HOST}"'
+            '-D SYSTEM_MQTT_ENROL_URL="http://${BROKER_HOST}:${PORT}/enrol"'
+            '-D SYSTEM_MQTT_ENROL_SECRET="${ENROL_SECRET:-see the dashboard, gear icon -> Nodes}"'
+
+    http and not https, because this Pi has no certificate yet - see 5 below.
+    The node presents that secret once, is issued a broker credential of its own, and stores it.
+    The secret grants nothing else, so it is not the thing to guard. Nodes appear on the
+    dashboard by themselves once they connect.
+
+    To rotate it, add a line above the old one in ${INSTALL_DIR}/config.d/secrets.yaml and leave
+    the old one until every node flashed with it has enrolled - deleting it first strands them.
 
 ${REBOOT_TEXT}
 
- 3. HTTPS, if you want over-the-air firmware updates - ESP32 requires it for those.
-    See INSTALLATION.md step 10.
+ 4. Outgoing mail, if you want people to be able to reset a forgotten password themselves.
+    Without it only you can, on this Pi, with frugal-iot-setpassword.
+    Optional - see INSTALLATION.md step 9a.
+
+ 5. HTTPS. NOT WRITTEN YET: step 10 of INSTALLATION.md describes what it will cover - a DNS
+    name, port forwarding, nginx in front of port ${PORT}, and certbot - but there are no
+    instructions to follow there yet. Until then this is a plain HTTP server on your own
+    network, which is all an offline installation needs. What you do not get is over-the-air
+    firmware updates, since an ESP32 requires HTTPS to fetch them.
 
  If anything looks wrong:
      cd ${INSTALL_DIR} && npx --no frugal-iot-diagnostic