frugal-iot-server 2.0.1 → 2.0.3

package/package.json

@@ -12,8 +12,8 @@
     "cookie-parser": "^1.4.7",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
-    "frugal-iot-client": "^2.0.1",
-    "frugal-iot-logger": "^2.0.1",
+    "frugal-iot-client": "^2.0.3",
+    "frugal-iot-logger": "^2.0.3",
     "hash-wasm": "^4.12.0",
     "js-yaml": "^4.2.0",
     "morgan": "^1.11.0",
@@ -73,7 +73,10 @@
   "license": "MIT",
   "main": "frugal-iot-server.js",
   "name": "frugal-iot-server",
-  "repository": "https://github.com/mitra42/frugal-iot-server",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mitra42/frugal-iot-server.git"
+  },
   "scripts": {
     "test": "vitest run",
     "test:watch": "vitest",
@@ -83,5 +86,5 @@
     "check-files": "node scripts/check-published-files.js"
   },
   "type": "module",
-  "version": "2.0.1"
+  "version": "2.0.3"
 }

package/public/service-worker.js

@@ -6,7 +6,7 @@
 // it, an installed browser keeps serving the files it already cached - and since the list now covers
 // the dashboard's own code, that means old JS behind freshly fetched HTML. Any edit to the list
 // needs this bumped, or it does not reach anyone who already has the old one.
-const CACHE_NAME = 'frugal-iot-cache-2.0.1';
+const CACHE_NAME = 'frugal-iot-cache-2.0.3';
 /*
  * Everything the app needs, so that a phone on a poor or expensive link fetches it once.
  *

package/scripts/addbridge-prod.zsh

@@ -144,15 +144,28 @@ fi
 # user *before* reading it - so the broker then cannot read its own password file and refuses to
 # start, with an error that says nothing about ownership. mosquitto_passwd also writes a temporary
 # backup beside the file, so it needs the directory and not only the file.
+#
+# Whoever runs it must be able to write the DIRECTORY, not merely the file, and the file's owner
+# frequently cannot: a password file at /etc/mosquitto/mosquitto_passwords is owned by mosquitto
+# inside a directory owned by root, and picking the owner then fails with "Error creating backup
+# password file". So the last resort is root - and because that leaves the file owned by root,
+# where mosquitto (which drops privileges before reading it) could no longer read it, the
+# ownership and mode are put back immediately afterwards.
+# stat's spelling differs between Linux (-c) and BSD/macOS (-f)
+PWDIR="${PWFILE:h}"
+PWFILE_OWNER=$(stat -c '%U' "$PWFILE" 2>/dev/null || stat -f '%Su' "$PWFILE" 2>/dev/null || true)
+PWFILE_GROUP=$(stat -c '%G' "$PWFILE" 2>/dev/null || stat -f '%Sg' "$PWFILE" 2>/dev/null || true)
+PWFILE_MODE=$(stat -c '%a' "$PWFILE" 2>/dev/null || stat -f '%Lp' "$PWFILE" 2>/dev/null || true)
+RESTORE_OWNER=0
 MOSQ_PASSWD_CMD=(mosquitto_passwd)
-if [[ ! -w "${PWFILE:h}" || ( -e "$PWFILE" && ! -w "$PWFILE" ) ]]; then
+if [[ ! -w "$PWDIR" || ( -e "$PWFILE" && ! -w "$PWFILE" ) ]]; then
   if command -v sudo >/dev/null; then
-    # stat's spelling differs between Linux (-c) and BSD/macOS (-f)
-    PWFILE_OWNER=$(stat -c '%U' "$PWFILE" 2>/dev/null || stat -f '%Su' "$PWFILE" 2>/dev/null || true)
-    if [[ -n "$PWFILE_OWNER" && "$PWFILE_OWNER" != "$(id -un)" && "$PWFILE_OWNER" != "root" ]]; then
+    if [[ -n "$PWFILE_OWNER" && "$PWFILE_OWNER" != "$(id -un)" && "$PWFILE_OWNER" != "root" ]] \
+       && sudo -u "$PWFILE_OWNER" test -w "$PWDIR" 2>/dev/null; then
       MOSQ_PASSWD_CMD=(sudo -u "$PWFILE_OWNER" mosquitto_passwd)
     else
       MOSQ_PASSWD_CMD=(sudo mosquitto_passwd)
+      [[ -n "$PWFILE_OWNER" && "$PWFILE_OWNER" != "root" ]] && RESTORE_OWNER=1
     fi
   fi
 fi
@@ -162,6 +175,12 @@ if ! $MOSQ_PASSWD_CMD -b "$PWFILE" "$ACCOUNT" "$PASSWORD"; then
   echo "Error: mosquitto_passwd failed - nothing has been changed." >&2
   exit 1
 fi
+if (( RESTORE_OWNER )); then
+  # Written as root, so hand it back before mosquitto next needs to read it
+  sudo chown "${PWFILE_OWNER}:${PWFILE_GROUP}" "$PWFILE"
+  [[ -n "$PWFILE_MODE" ]] && sudo chmod "$PWFILE_MODE" "$PWFILE"
+  echo "  (written as root, then given back to ${PWFILE_OWNER}:${PWFILE_GROUP} mode ${PWFILE_MODE})"
+fi
 
 # The access control rule. Without one the account can connect and reach nothing at all, because a
 # mosquitto acl_file is deny-by-default.
@@ -171,15 +190,42 @@ if [[ -n "$ACLFILE" ]]; then
     echo "The account has been created but cannot reach anything until that is sorted out." >&2
     exit 1
   fi
-  if sudo grep -qE "^[[:space:]]*user[[:space:]]+${ACCOUNT}[[:space:]]*$" "$ACLFILE"; then
-    echo "ACL rule for ${ACCOUNT} is already in ${ACLFILE} - leaving it alone."
+  #
+  # Two grants, and the second is easy to leave out.
+  #
+  # A bridge with "notifications true" publishes a retained 1/0 to
+  # $SYS/broker/connection/<clientid>/state on the local AND the remote broker, and that is what the
+  # dashboard's Bridges card reads. The bridge's LOCAL side is exempt from the ACL, so the Pi always
+  # has it; the remote side is not, and on a deny-by-default broker the write is refused silently -
+  # so the card said "Unknown" for a bridge that was up and relaying perfectly. Measured on
+  # mosquitto 2.0.20: the write is allowed once the ACL says so, so this is an ACL matter and not
+  # one of mosquitto refusing $SYS writes outright.
+  ACL_ORG_RULE=0; ACL_SYS_RULE=0
+  sudo grep -qE "^[[:space:]]*user[[:space:]]+${ACCOUNT}[[:space:]]*$" "$ACLFILE" && ACL_ORG_RULE=1
+  sudo grep -qF "topic write \$SYS/broker/connection/${ACCOUNT}/state" "$ACLFILE" && ACL_SYS_RULE=1
+
+  if (( ACL_ORG_RULE && ACL_SYS_RULE )); then
+    echo "ACL rules for ${ACCOUNT} are already in ${ACLFILE} - leaving them alone."
+  elif (( ACL_ORG_RULE )); then
+    # An existing bridge from before the state grant existed. A second "user" stanza for the same
+    # account is valid and additive, which is simpler and safer than editing the first one in place.
+    echo "Adding the connection-state ACL rule for ${ACCOUNT} to ${ACLFILE} ..."
+    sudo tee -a "$ACLFILE" >/dev/null <<EOF
+
+# Lets the bridge report whether it is connected, for the dashboard's Bridges card
+user ${ACCOUNT}
+topic write \$SYS/broker/connection/${ACCOUNT}/state
+EOF
+    echo "  Restart the Pi's broker to have it republish that state: it is sent on connect only."
   else
-    echo "Adding ACL rule to ${ACLFILE} ..."
+    echo "Adding ACL rules to ${ACLFILE} ..."
     sudo tee -a "$ACLFILE" >/dev/null <<EOF
 
 # Pi bridge for site "${SITE}", confined to its organization's topics
 user ${ACCOUNT}
 topic readwrite ${ORG_ID}/#
+# ... and its own connection state, which the dashboard's Bridges card reads
+topic write \$SYS/broker/connection/${ACCOUNT}/state
 EOF
   fi
 else
@@ -237,16 +283,21 @@ if [[ -z "$REPLICA_TOKEN" ]]; then
 fi
 
 echo ""
-echo "Done. On the Pi at site '${SITE}', run:"
+echo "Done. Collect these, then run the command at the bottom on the Pi."
 echo ""
-echo "  npx --no frugal-iot-addbridge-pi ${ORG_ID} <this server's public name> ${ACCOUNT}"
+echo "1. THE FQDN OF THIS SERVER - the DNS name on its TLS certificate."
+echo "   The Pi verifies the certificate against exactly what you type, so a local hostname, an IP"
+echo "   address, or a domain the certificate does not cover will fail to connect."
+echo "   TO TEST IT: open https://<name>/ in a browser. Loading with no certificate warning means"
+echo "   the name matches the certificate, which is the part that is easy to get wrong. The bridge"
+echo "   then uses port 8883 on that same host, so that port has to be open to the Pi as well."
+echo "   This host calls itself \"$(hostname -f 2>/dev/null || hostname)\" - use that only if it is"
+echo "   also the name on the certificate and one the Pi can resolve. Not guessed here, because"
+echo "   what a machine calls itself usually is not its public name."
 echo ""
-echo "Positional arguments on purpose: npm swallows any --flag it does not recognise and passes"
-echo "only the value on, so the --org form would arrive at that script as a bare word."
+echo "2. THE PASSWORD for ${ACCOUNT}, which the Pi's script will prompt for:"
 echo ""
-echo "It will ask for this password:"
-echo ""
-echo "  ${PASSWORD}"
+echo "   ${PASSWORD}"
 echo ""
 if [[ "$GENERATED" == true ]]; then
   echo "That was generated just now and is not stored anywhere you can read it back - copy it before"
@@ -255,15 +306,23 @@ if [[ "$GENERATED" == true ]]; then
   echo "and use that on the Pi instead."
 fi
 if [[ -n "$REPLICA_TOKEN" ]]; then
-  echo "And this replica token, so people registered here can log in on the Pi as well:"
+  echo "3. THE REPLICA TOKEN, so people registered here can log in on the Pi as well:"
   echo ""
-  echo "  ${REPLICA_TOKEN}"
+  echo "   ${REPLICA_TOKEN}"
   echo ""
-  echo "A new one replaces the old, so re-running this script revokes the Pi's previous token."
+  echo "   A new one replaces the old, so re-running this script revokes the Pi's previous token."
   echo ""
 fi
-echo "Fill in the public name yourself - it is deliberately not guessed here, because what this"
-echo "machine calls itself is usually not it. This host answers to \"$(hostname -f 2>/dev/null || hostname)\","
-echo "which is only the right answer if that is also the DNS name the Pi can reach and the name on"
-echo "the TLS certificate. The Pi verifies the certificate against whatever you put here, so a"
-echo "local hostname, or a domain the certificate does not cover, fails to connect."
+echo "Then, on the Pi at site '${SITE}':"
+echo ""
+echo "  npx --no frugal-iot-addbridge-pi ${ORG_ID} <fqdn-from-1-above> ${ACCOUNT}"
+echo ""
+if [[ -n "$REPLICA_TOKEN" ]]; then
+  echo "It asks for the password from 2, then for the replica token from 3. Neither is given on the"
+  echo "command line on purpose, so that neither ends up in that Pi's shell history."
+else
+  echo "It asks for the password from 2. Neither secret is given on the command line on purpose, so"
+  echo "that neither ends up in that Pi's shell history."
+fi
+echo "The arguments are positional because npm swallows any --flag it does not recognise and passes"
+echo "only the value on, so the --org form would arrive at that script as a bare word."

package/scripts/addorganization.zsh

@@ -107,19 +107,38 @@ fi
 # opening it, and mosquitto_passwd writes a temporary backup beside it, so it needs the directory too
 # - neither of which we get by running as ourselves against a file owned by mosquitto or by root.
 # On Raspberry Pi OS the first user has passwordless sudo, so this is invisible.
+#
+# The owner is not always able to do it either: a file at /etc/mosquitto/mosquitto_passwords is
+# owned by mosquitto inside a directory owned by root, and the backup then cannot be written -
+# "Error creating backup password file". So check the chosen account can write the directory, and
+# fall back to root, putting the ownership back afterwards so mosquitto can still read the file.
+# stat's spelling differs between Linux (-c) and BSD/macOS (-f)
+MOSQUITTO_PASSWD_DIR="${MOSQUITTO_PASSWD_FILE:h}"
+MOSQUITTO_PASSWD_OWNER=$(stat -c '%U' "$MOSQUITTO_PASSWD_FILE" 2>/dev/null \
+  || stat -f '%Su' "$MOSQUITTO_PASSWD_FILE" 2>/dev/null || true)
+MOSQUITTO_PASSWD_GROUP=$(stat -c '%G' "$MOSQUITTO_PASSWD_FILE" 2>/dev/null \
+  || stat -f '%Sg' "$MOSQUITTO_PASSWD_FILE" 2>/dev/null || true)
+MOSQUITTO_PASSWD_MODE=$(stat -c '%a' "$MOSQUITTO_PASSWD_FILE" 2>/dev/null \
+  || stat -f '%Lp' "$MOSQUITTO_PASSWD_FILE" 2>/dev/null || true)
+MOSQUITTO_RESTORE_OWNER=0
 MOSQUITTO_PASSWD_CMD=(mosquitto_passwd)
-if [[ ! -w "${MOSQUITTO_PASSWD_FILE:h}" || ( -e "$MOSQUITTO_PASSWD_FILE" && ! -w "$MOSQUITTO_PASSWD_FILE" ) ]]; then
+if [[ ! -w "$MOSQUITTO_PASSWD_DIR" || ( -e "$MOSQUITTO_PASSWD_FILE" && ! -w "$MOSQUITTO_PASSWD_FILE" ) ]]; then
   if command -v sudo >/dev/null; then
-    # stat's spelling differs between Linux (-c) and BSD/macOS (-f)
-    MOSQUITTO_PASSWD_OWNER=$(stat -c '%U' "$MOSQUITTO_PASSWD_FILE" 2>/dev/null \
-      || stat -f '%Su' "$MOSQUITTO_PASSWD_FILE" 2>/dev/null || true)
-    if [[ -n "$MOSQUITTO_PASSWD_OWNER" && "$MOSQUITTO_PASSWD_OWNER" != "$(id -un)" && "$MOSQUITTO_PASSWD_OWNER" != "root" ]]; then
+    if [[ -n "$MOSQUITTO_PASSWD_OWNER" && "$MOSQUITTO_PASSWD_OWNER" != "$(id -un)" && "$MOSQUITTO_PASSWD_OWNER" != "root" ]] \
+       && sudo -u "$MOSQUITTO_PASSWD_OWNER" test -w "$MOSQUITTO_PASSWD_DIR" 2>/dev/null; then
       MOSQUITTO_PASSWD_CMD=(sudo -u "$MOSQUITTO_PASSWD_OWNER" mosquitto_passwd)
     else
       MOSQUITTO_PASSWD_CMD=(sudo mosquitto_passwd)
+      [[ -n "$MOSQUITTO_PASSWD_OWNER" && "$MOSQUITTO_PASSWD_OWNER" != "root" ]] && MOSQUITTO_RESTORE_OWNER=1
     fi
   fi
 fi
+# Called after any successful mosquitto_passwd run below
+restore_passwd_owner() {
+  (( MOSQUITTO_RESTORE_OWNER )) || return 0
+  sudo chown "${MOSQUITTO_PASSWD_OWNER}:${MOSQUITTO_PASSWD_GROUP}" "$MOSQUITTO_PASSWD_FILE"
+  [[ -n "$MOSQUITTO_PASSWD_MODE" ]] && sudo chmod "$MOSQUITTO_PASSWD_MODE" "$MOSQUITTO_PASSWD_FILE"
+}
 
 # ---- Escaping helpers ----
 # Escape a value for embedding in a double-quoted YAML string
@@ -229,6 +248,7 @@ else
     echo "If it complains about creating a backup file, the directory holding that file is not" >&2
     echo "writable by you - which is why the command above uses sudo." >&2
   else
+    restore_passwd_owner
     echo "Set mosquitto password for ${ORG_ID} in ${MOSQUITTO_PASSWD_FILE}"
   fi
 fi

package/scripts/diagnostic.zsh

@@ -10,10 +10,40 @@
 #
 # Paste the whole output into a bug report. Passwords are deliberately not printed: the password
 # file is reported by account name only, and organization configs by name only.
-
+#
+# QUIET MODE says nothing at all unless something is wrong, which is what makes it usable as a
+# periodic check rather than only as something to read when you already have a problem:
+#   npx --no frugal-iot-diagnostic quiet        # positional, see below
+#   zsh diagnostic.zsh -q
+#
+# The word "quiet" with no dash is not a typo. npm parses the whole command line itself and passes
+# only the values through, so a flag never reaches a script run by npx - and "-q" is worse than
+# most, because it is npm's OWN abbreviation for --quiet, so npm consumes it and goes quiet itself.
+# "npx --no frugal-iot-diagnostic -- --quiet" also works, if you would rather remember that.
+#
+# Exit status, either mode:
+#   0  nothing found
+#   1  problems found - they are listed, and are the only thing a quiet run prints
+#
 # No "set -e": a failing check should report and carry on, not stop the script.
 setopt no_unset 2>/dev/null
 
+QUIET=0
+for arg in "$@"; do
+  case "$arg" in
+    -q|--quiet|quiet) QUIET=1 ;;
+    -h|--help|help)   sed -n '3,28p' "$0" | sed -e 's/^#$//' -e 's/^# //'; exit 0 ;;
+    *) print -u2 "Unknown argument: $arg (try \"quiet\", or \"help\")"; exit 2 ;;
+  esac
+done
+
+# Keep the real stdout on fd 3 for the summary, which prints in both modes. Under -q everything
+# else - including whatever the commands being run write - goes nowhere, so a quiet run that
+# prints anything is a quiet run that found something. stderr goes too: the noise it carries is
+# things like sudo declining, which the checks below already turn into findings of their own.
+exec 3>&1
+(( QUIET )) && exec 1>/dev/null 2>/dev/null
+
 section() { print -r -- ""; print -r -- "===== $* ====="; }
 item()    { print -r -- "  $*"; }
 have()    { command -v "$1" >/dev/null 2>&1; }
@@ -115,9 +145,33 @@ for f in /etc/mosquitto/conf.d/*(N); do
 done
 [[ -z "$(print -r -- /etc/mosquitto/conf.d/*(N))" ]] && problem "Nothing in /etc/mosquitto/conf.d - the Frugal IoT config was never copied there (step 5)"
 
+# The files the broker actually reads. mosquitto's include_dir only loads names ending in .conf,
+# so look at exactly those - and the last setting wins, hence "tail -1" everywhere below.
+BROKER_CONF_FILES=(/etc/mosquitto/mosquitto.conf(N) /etc/mosquitto/conf.d/*.conf(N))
+
+# Everything the broker reads, as one stream - with sudo if reading it plainly gives nothing. A
+# file under /etc can be readable only by root, and an ordinary user then gets silence rather than
+# an error, which is indistinguishable from "that setting is not configured". Left unguarded, the
+# comparison below reported a broker as missing EVERY setting this release ships, which as a
+# periodic check is worse than no check at all.
+broker_conf_text() {
+  local t
+  (( ${#BROKER_CONF_FILES} )) || return 0
+  t=$(cat "${BROKER_CONF_FILES[@]}" 2>/dev/null) || true
+  if [[ -z "$t" ]] && have sudo; then
+    t=$(sudo -n cat "${BROKER_CONF_FILES[@]}" 2>/dev/null) || true
+  fi
+  print -r -- "$t"
+}
+
+# Where the packaged copy of a shipped file is. What is in ./extras is NOT it: frugal-iot-init
+# copies extras/ in and then never overwrites it, so once a release changes one of these files the
+# local copy is a fossil. Checks below read the package.
+PKG_EXTRAS="node_modules/frugal-iot-server/extras"
+[[ -d "$PKG_EXTRAS" ]] || PKG_EXTRAS="${0:A:h:h}/extras"
+
 # Which password file does the running configuration actually name?
-# mosquitto's include_dir only loads files ending in .conf, so look at exactly those, last one wins
-CONFIGURED_PWFILE=$(grep -hE '^[[:space:]]*password_file[[:space:]]' /etc/mosquitto/mosquitto.conf /etc/mosquitto/conf.d/*.conf(N) 2>/dev/null | tail -1 | awk '{print $2}')
+CONFIGURED_PWFILE=$(broker_conf_text | grep -hE '^[[:space:]]*password_file[[:space:]]' | tail -1 | awk '{print $2}')
 section "Mosquitto password file"
 if [[ -n "$CONFIGURED_PWFILE" ]]; then
   item "configuration names: $CONFIGURED_PWFILE"
@@ -133,12 +187,35 @@ else
   item "no password_file line found in any mosquitto configuration"
   problem "No password_file configured - the broker would allow anonymous access or reject everything"
 fi
-# The copy in this installation is what step 5 tells you to put into /etc - if the two disagree,
-# either the copy never happened or the installed package is older than the instructions.
-if [[ -f extras/mosquitto.conf ]]; then
-  item "this installation's extras/mosquitto.conf names: $(grep -hE '^[[:space:]]*password_file' extras/mosquitto.conf 2>/dev/null | awk '{print $2}')"
-  if [[ -n "$CONFIGURED_PWFILE" ]] && ! diff -q extras/mosquitto.conf /etc/mosquitto/conf.d/frugal-iot.conf >/dev/null 2>&1; then
-    problem "extras/mosquitto.conf here differs from /etc/mosquitto/conf.d/frugal-iot.conf - if you followed step 5 with an older installed package, copy it again after upgrading"
+# What this release ships, against what the broker is actually running.
+#
+# This used to be "diff ./extras/mosquitto.conf /etc/mosquitto/conf.d/frugal-iot.conf", which
+# reported a problem on every machine there has ever been, for three separate reasons: ./extras is
+# a fossil frugal-iot-init will not overwrite, so it differs from the release for ever; the
+# installed copy has the dynamic-security plugin's path substituted, so it differs from the shipped
+# one by design; and "diff -q" against a frugal-iot.conf that does not exist fails too, which is
+# the normal state of a broker whose configuration was assembled by hand as several small files in
+# conf.d. A check that is always wrong is one you stop reading, so this asks the question that
+# actually matters instead: is the broker missing a setting this release ships?
+if [[ -f "${PKG_EXTRAS}/mosquitto.conf" ]]; then
+  item "this release's mosquitto.conf names: $(grep -hE '^[[:space:]]*password_file' "${PKG_EXTRAS}/mosquitto.conf" 2>/dev/null | awk '{print $2}')"
+  if (( ${#BROKER_CONF_FILES} )); then
+    # The plugin line is normalised: the installer substitutes a path that varies by distribution.
+    # Comparing settings rather than files means this works whether the configuration arrived as one
+    # frugal-iot.conf or as several hand-written pieces.
+    MISSING_CONF=$(comm -23 \
+      <(sed -E 's#^plugin .*#plugin -#' "${PKG_EXTRAS}/mosquitto.conf" | grep -vE '^[[:space:]]*(#|$)' | sort -u) \
+      <(broker_conf_text | sed -E 's#^plugin .*#plugin -#' | grep -vE '^[[:space:]]*(#|$)' | sort -u) 2>/dev/null)
+    # password_file and the listeners are allowed to be sited differently on an older installation,
+    # so a difference in those is reported without being called a fault.
+    MISSING_REAL=$(print -r -- "$MISSING_CONF" | grep -vE '^[[:space:]]*(password_file|listener|protocol)[[:space:]]' || true)
+    if [[ -n "$MISSING_CONF" ]]; then
+      item "settings this release ships that the broker does not have:"
+      print -r -- "$MISSING_CONF" | while IFS= read -r l; do [[ -n "$l" ]] && item "    $l"; done
+    else
+      item "the broker has every setting this release ships"
+    fi
+    [[ -n "$MISSING_REAL" ]] && problem "The broker is missing $(print -r -- "$MISSING_REAL" | grep -c .) setting(s) this release ships - see \"Mosquitto password file\" above. Re-run install-pi.sh, or add them by hand if this broker's config.d was written by hand."
   fi
 fi
 item "candidate locations, whether or not configured:"
@@ -270,15 +347,10 @@ section "Broker access control"
 # An acl_file confines each account to its own organization's topics; without one, every account
 # that can log in reaches every topic on the broker. Reported here because a broker installed before
 # the ACL shipped will not have one, and nothing else says so.
-BROKER_CONF_FILES=(/etc/mosquitto/mosquitto.conf /etc/mosquitto/conf.d/*.conf(N))
 BROKER_SETTING=""
 broker_setting() {  # name -> value from the broker's own configuration, sudo only if needed
-  local v
-  v=$(grep -hE "^[[:space:]]*$1[[:space:]]" "${BROKER_CONF_FILES[@]}" 2>/dev/null | tail -1 | awk '{print $2}') || true
-  if [[ -z "$v" ]] && have sudo; then
-    v=$(sudo -n grep -hE "^[[:space:]]*$1[[:space:]]" "${BROKER_CONF_FILES[@]}" 2>/dev/null | tail -1 | awk '{print $2}') || true
-  fi
-  BROKER_SETTING="$v"
+  # broker_conf_text carries the sudo fallback this used to spell out for itself
+  BROKER_SETTING=$(broker_conf_text | grep -hE "^[[:space:]]*$1[[:space:]]" | tail -1 | awk '{print $2}') || true
 }
 broker_setting acl_file; ACLFILE="$BROKER_SETTING"
 if [[ -z "$ACLFILE" ]]; then
@@ -317,11 +389,45 @@ else
     fi
   fi
   # Can the server actually drive it? That needs the admin credential frugal-iot-init recorded.
-  DYNUSER=$(sed -n 's/^dynsec_admin_user:[[:space:]]*//p' config.d/secrets.yaml 2>/dev/null | tr -d '"'"'"'' | head -1)
-  DYNPW=$(sed -n 's/^dynsec_admin_password:[[:space:]]*//p' config.d/secrets.yaml 2>/dev/null | tr -d '"'"'"'' | head -1)
+  #
+  # Read with a sudo fallback, and report the file's ownership, because the two ways this goes wrong
+  # look identical from here: the setting really is absent, or the file belongs to somebody else and
+  # an ordinary reader gets silence. The second is the one that matters, since the SERVER is an
+  # ordinary reader too - it runs as the account in the unit file, and a secrets.yaml it cannot read
+  # leaves it with no credential to hand a browser, whatever is written inside.
+  item "  secrets file: config.d/secrets.yaml $(fileinfo config.d/secrets.yaml)"
+  SERVICE_USER=$(sed -n 's/^User=//p' /etc/systemd/system/frugaliot.service 2>/dev/null | head -1)
+  [[ -z "$SERVICE_USER" ]] && SERVICE_USER=$(sudo -n sed -n 's/^User=//p' /etc/systemd/system/frugaliot.service 2>/dev/null | head -1)
+  secret_value() {   # name -> its value, with sudo if reading it plainly gives nothing
+    local v
+    v=$(sed -n "s/^$1:[[:space:]]*//p" config.d/secrets.yaml 2>/dev/null | tr -d "\"'" | head -1)
+    if [[ -z "$v" ]] && have sudo; then
+      v=$(sudo -n sed -n "s/^$1:[[:space:]]*//p" config.d/secrets.yaml 2>/dev/null | tr -d "\"'" | head -1)
+    fi
+    print -r -- "$v"
+  }
+  if [[ -f config.d/secrets.yaml && -n "$SERVICE_USER" ]] && have stat; then
+    SECRETS_OWNER=$(stat -c '%U' config.d/secrets.yaml 2>/dev/null || true)
+    if [[ -n "$SECRETS_OWNER" && "$SECRETS_OWNER" != "$SERVICE_USER" && "$SECRETS_OWNER" != root ]]; then
+      problem "config.d/secrets.yaml belongs to ${SECRETS_OWNER} but the server runs as ${SERVICE_USER}, so the server cannot read it. Fix with: sudo chown ${SERVICE_USER} config.d/secrets.yaml"
+    elif [[ "$SECRETS_OWNER" == root && "$SERVICE_USER" != root ]]; then
+      problem "config.d/secrets.yaml belongs to root but the server runs as ${SERVICE_USER}, so the server reads nothing from it - every login is told live data is unavailable. Fix with: sudo chown ${SERVICE_USER} config.d/secrets.yaml && sudo systemctl restart frugaliot"
+    fi
+  fi
+  # Without this a login gets no broker credential at all, whatever else is right - which shows up
+  # in the dashboard as "No broker credential for this login".
+  USERSECRET=$(secret_value user_secret)
+  if [[ -z "$USERSECRET" ]]; then
+    item "  user_secret: MISSING - no login can be given a broker credential"
+    problem "config.d/secrets.yaml has no user_secret, so every login is told \"No broker credential for this login\". The server writes one at startup; if it cannot, it says so in its log."
+  else
+    item "  user_secret: present (each login's broker password is derived from it)"
+  fi
+  DYNUSER=$(secret_value dynsec_admin_user)
+  DYNPW=$(secret_value dynsec_admin_password)
   if [[ -z "$DYNUSER" || -z "$DYNPW" ]]; then
-    item "  admin credential: not in config.d/secrets.yaml - the server cannot create accounts"
-    problem "dynamic security is enabled but config.d/secrets.yaml has no dynsec_admin_user/password"
+    item "  admin credential: not readable in config.d/secrets.yaml - the server cannot create accounts"
+    problem "dynamic security is enabled but config.d/secrets.yaml has no readable dynsec_admin_user/password, so no login gets a broker credential"
   elif have mosquitto_ctrl; then
     if DYNOUT=$(mosquitto_ctrl -h localhost -u "$DYNUSER" -P "$DYNPW" dynsec listClients 2>&1 | grep -viE 'without encryption|visible on the network'); then
       item "  admin credential works ($(print -r -- $DYNOUT | tr '\n' ' ' | cut -c1-60))"
@@ -515,8 +621,11 @@ if [[ -f config.d/server.yaml ]]; then
   MORGANSET=$(sed -n 's/^morgan:[[:space:]]*//p' config.d/server.yaml 2>/dev/null | head -1)
   item "server morgan:       ${MORGANSET:-not set, so on - a line logged per HTTP request}"
 fi
-if [[ -f /etc/mosquitto/conf.d/frugal-iot.conf ]]; then
-  if grep -qE '^[[:space:]]*connection_messages[[:space:]]+false' /etc/mosquitto/conf.d/frugal-iot.conf 2>/dev/null; then
+# Across every file the broker reads, not just frugal-iot.conf: a configuration assembled by hand
+# puts this wherever it likes, and looking in one file meant a broker that logs every connect and
+# disconnect was never reported as doing so.
+if (( ${#BROKER_CONF_FILES} )); then
+  if broker_conf_text | grep -qhE '^[[:space:]]*connection_messages[[:space:]]+false'; then
     item "mosquitto connections: not logged"
   else
     item "mosquitto connections: logged - every connect and disconnect is a write"
@@ -539,10 +648,23 @@ if [[ -d data ]]; then
   [[ -n "$OLDEST" ]] && item "  oldest day: ${OLDEST}"
 fi
 
-section "Summary"
+# The summary prints to fd 3, which is the real stdout whether or not the rest was silenced. A
+# quiet run with nothing to report prints nothing at all, which is the point of it.
 if (( ${#PROBLEMS} == 0 )); then
-  item "No problems detected by these checks."
-else
-  for p in $PROBLEMS; do item "PROBLEM: $p"; done
+  if (( ! QUIET )); then
+    print -r -- "" >&3
+    print -r -- "===== Summary =====" >&3
+    print -r -- "  No problems detected by these checks." >&3
+    print -r -- "" >&3
+  fi
+  exit 0
+fi
+print -r -- "" >&3
+print -r -- "===== Summary: ${#PROBLEMS} problem(s) =====" >&3
+for p in $PROBLEMS; do print -r -- "  PROBLEM: $p" >&3; done
+if (( QUIET )); then
+  print -r -- "" >&3
+  print -r -- "  Run it again without \"quiet\" for the whole report." >&3
 fi
-print -r -- ""
+print -r -- "" >&3
+exit 1

package/scripts/init.zsh

@@ -63,10 +63,16 @@ done
 for f in "${PKG}"/config.d/schema/*.yaml(N); do
   copy_if_missing "$f" "./config.d/schema/${f:t}" compare
 done
-# Copied so that mosquitto.conf and frugaliot.service can be edited and installed from here. Worth
-# comparing: these get copied on somewhere else (/etc/...), where an old version lingers unnoticed.
+# Copied so that mosquitto.conf and frugaliot.service can be there to read and install from.
+#
+# NOT compared against the packaged copy. This copy is never overwritten - that is the whole point
+# of copy_if_missing - so once a release changes one of these it differs for ever, and says so at
+# every upgrade whether or not anything is actually out of date. A warning that is always wrong is
+# one you learn to skip past, and then miss on the day it is right. What matters is not whether
+# this copy is current but whether the file actually in use is, so that is what is checked, below,
+# where it really lives.
 for f in "${PKG}"/extras/*(N); do
-  copy_if_missing "$f" "./extras/${f:t}" compare
+  copy_if_missing "$f" "./extras/${f:t}"
 done
 
 # ---- 1b. Secrets this server generates for itself ----
@@ -182,6 +188,74 @@ else
   echo "  kept    ${DB} permissions.project (already present)"
 fi
 
+# ---- 4. Is what was installed FROM extras/ still current? ----
+# The files in extras/ are templates for files that live somewhere else - the broker's
+# configuration, its ACL, the systemd unit. Whether this directory's copy matches the release says
+# nothing about any of them, so the question is asked where the file actually is.
+#
+# Each of these is checked in the way that file is allowed to differ, because two of them are
+# *supposed* to differ and a plain cmp would cry wolf at every upgrade:
+#  - mosquitto.conf carries a placeholder for the dynamic security plugin, which the installer
+#    replaces with a path that varies by distribution.
+#  - aclfile gets a stanza appended per bridge by addbridge-prod, so the installed file is
+#    expected to be a superset - only a line this release ships and it lacks is a finding.
+STALE=()        # installed, and older than this release
+UNINSTALLED=()  # nothing at the usual place, so there was nothing to compare
+UNREADABLE=()   # there, but not readable without sudo
+
+# check_installed <packaged file> <installed path> <exact|plugin|subset>
+check_installed() {
+  local from=$1 to=$2 how=$3 a b missing
+  [[ -e "$from" ]] || return 0
+  if [[ ! -e "$to" ]]; then
+    UNINSTALLED+=("${to}|${from}")
+    return 0
+  fi
+  if [[ ! -r "$to" ]]; then
+    UNREADABLE+=("$to")
+    return 0
+  fi
+  # Both sides through the same filter, so only a real difference survives. Note the "#"
+  # delimiter: an alternation inside an "s|...|" would end the expression at its first branch, and
+  # the "|| true" below would then hide the error and report the two files as identical.
+  local norm
+  case "$how" in
+    plugin)  norm='s#^plugin .*#plugin -#' ;;
+    # The installer rewrites User, WorkingDirectory and ExecStart for whoever runs it and wherever
+    # the server went, so those three are normalised - comparing them exactly would report every
+    # installation that is not user "pi" in /home/pi/frugal-iot as out of date at every upgrade.
+    service) norm='s#^(User|WorkingDirectory|ExecStart)=.*#\1=-#' ;;
+    *)       norm='' ;;
+  esac
+
+  case "$how" in
+    plugin|service)
+      a=$(sed -E "$norm" "$from" | grep -vE '^[[:space:]]*(#|$)' | sort || true)
+      b=$(sed -E "$norm" "$to"   | grep -vE '^[[:space:]]*(#|$)' | sort || true)
+      # Neither of these files is ever empty once the comments are gone. Both blank means the
+      # filter failed rather than that they agree, and reporting "current" on that would be the
+      # worst answer of the three.
+      if [[ -z "$a" || -z "$b" ]]; then
+        UNREADABLE+=("$to")
+      elif [[ "$a" != "$b" ]]; then
+        STALE+=("${to}|${from}")
+      fi
+      ;;
+    subset)
+      missing=$(comm -23 <(grep -vE '^[[:space:]]*(#|$)' "$from" | sort -u || true) \
+                         <(grep -vE '^[[:space:]]*(#|$)' "$to"   | sort -u || true) || true)
+      [[ -z "$missing" ]] || STALE+=("${to}|${from}")
+      ;;
+    *)
+      cmp -s "$from" "$to" || STALE+=("${to}|${from}")
+      ;;
+  esac
+}
+
+check_installed "${PKG}/extras/mosquitto.conf"    /etc/mosquitto/conf.d/frugal-iot.conf  plugin
+check_installed "${PKG}/extras/aclfile"           /etc/mosquitto/aclfile                 subset
+check_installed "${PKG}/extras/frugaliot.service" /etc/systemd/system/frugaliot.service  service
+
 if (( ${#DIFFER_TO} )); then
   echo
   echo "These files were left as you have them, but this release ships a different version:"
@@ -189,9 +263,35 @@ if (( ${#DIFFER_TO} )); then
     echo "  ${DIFFER_TO[$i]}"
     echo "    compare with:  diff ${DIFFER_TO[$i]} ${DIFFER_FROM[$i]}"
   done
-  echo "Usually that just means you edited it, and there is nothing to do. But a release can also"
-  echo "change one of these files - and anything installed elsewhere from it, such as"
-  echo "/etc/mosquitto/conf.d/frugal-iot.conf, keeps the old content until you copy it again."
+  echo "The schema describes the sensor types the software understands. If you added one of your"
+  echo "own that is exactly as it should be; if you did not, this release changed it and the"
+  echo "difference is worth reading."
+fi
+
+if (( ${#STALE} )); then
+  echo
+  echo "Installed elsewhere from extras/, and older than this release:"
+  for e in $STALE; do
+    echo "  ${e%%|*}"
+    echo "    compare with:  sudo diff ${e%%|*} ${e#*|}"
+  done
+  echo "Re-running the installer brings these up to date and is the safe way to do it - it"
+  echo "substitutes the plugin path and will not discard ACL rules added per bridge:"
+  echo "  bash node_modules/frugal-iot-server/scripts/install-pi.sh"
+fi
+
+if (( ${#UNINSTALLED} )); then
+  echo
+  echo "Nothing at the usual place, so these were not compared:"
+  for e in $UNINSTALLED; do echo "  ${e%%|*}  (would come from extras/${${e#*|}:t})"; done
+  echo "Either install-pi.sh has not been run here, or this machine's broker configuration was put"
+  echo "together by hand under another name - several small files in /etc/mosquitto/conf.d is a"
+  echo "normal way to have done it. Nothing is out of date; there is simply nothing to compare."
+fi
+
+if (( ${#UNREADABLE} )); then
+  echo
+  echo "There, but not readable as $(id -un), so not compared: ${(j:, :)UNREADABLE}"
 fi
 
 echo