frugal-iot-server 2.0.3 → 2.0.5

package/INSTALLATION.md

@@ -217,6 +217,15 @@ organization's web login - twice each, not echoed, and pressing Enter has one ge
 and `--yes` asks nothing at all, which is what to use over ssh with no terminal. A password you
 chose is not written to the log; a generated one has to be, or you would have no way of knowing it.
 
+It also asks for the password of **the login you are using on the Pi** (`pi`, normally), and gives
+that same password to the setup network the Pi raises if it ever loses its WiFi - see
+[Moving the Pi to another WiFi network](#moving-the-pi-to-another-wifi-network). Then whoever moves
+the Pi needs to know only one password. Linux keeps only a scrambled (hashed) form of a login
+password, so the installer cannot read it; it checks that what you type matches, so a typing slip
+does not give the network a password nobody knows. Press Enter instead to give the network a password
+of its own, or pass `--ap-password`. WiFi needs 8 to 63 characters, so a shorter login password
+cannot be reused. `--no-setup-ap` leaves the setup network out.
+
 The organization's *broker* credential is no longer among them: it is generated and never shown,
 because nothing on the Pi needs you to know it. Nodes are issued their own credential when they
 enrol, and browsers derive their own when they log in. `--broker-password` still sets it, for an
@@ -462,6 +471,14 @@ sudo cp extras/mosquitto.conf /etc/mosquitto/conf.d/frugal-iot.conf
 (Everything in `/etc/mosquitto/conf.d/` is read in addition to the packaged
 `/etc/mosquitto/mosquitto.conf`, which keeps its own settings for logging and persistence.)
 
+It also says how long the broker holds messages for a node that is asleep. Nodes keep their
+session with the broker across a sleep, so a setting changed on the dashboard while a node sleeps
+is held and handed over when it wakes - up to `max_queued_messages` (1000) per node, for up to
+`persistent_client_expiration` (14 days) of not reconnecting, after which the node simply
+subscribes afresh. Holding them across a broker restart relies on `persistence true` in the
+packaged `mosquitto.conf`, which Raspberry Pi OS and Debian both ship; check with
+`grep persistence /etc/mosquitto/mosquitto.conf`.
+
 That file also turns off the broker's per-connection logging, because a node on a weak signal
 reconnects constantly and each of those lines is a write to the SD card. Nothing is lost — the
 readings themselves are recorded by the server, and everything else the broker says, including why
@@ -701,6 +718,50 @@ journalctl -u frugaliot -f
 Reboot the Pi (`sudo reboot`), wait a couple of minutes, and check `http://frugaliot.local:8080`
 still answers. Your server is now installed.
 
+### 8a. A setup network, for when the Pi loses its WiFi
+
+A Pi on WiFi that is moved to another site, or whose router is replaced, cannot be reached, and
+changing its WiFi needs a login. [comitup](https://davesteele.github.io/comitup/) fixes that: when
+no saved network is in range, the Pi raises a network of its own, `frugaliot-bridge-setup`. Its page
+lists the WiFi networks the Pi can see and takes the password for one.
+[Moving the Pi to another WiFi network](#moving-the-pi-to-another-wifi-network) is how it is used.
+
+**Write comitup's configuration before installing it.** Installing the package starts it at once,
+and without this file it uses its defaults: a network called `comitup-<nnn>` with **no password**,
+raised straight away if the Pi has no WiFi connection at that moment.
+
+```
+sudo install -m 600 /dev/null /etc/comitup.conf
+sudo nano /etc/comitup.conf
+```
+
+Put these two lines in it. The password is normally the one for the `pi` login, so that whoever moves
+the Pi needs only one. WiFi needs 8 to 63 characters.
+
+```
+ap_name: frugaliot-bridge-setup
+ap_password: <the pi login password>
+```
+
+Do not call it `frugaliot`. comitup announces its name on the network too, and announcing the Pi's own
+name a second time stops `frugaliot.local` resolving for up to 15 minutes after each reconnect.
+
+Then install comitup, and the watchdog that covers two ways comitup alone can strand a Pi (the
+comments in `extras/frugaliot-ap-watchdog` give both):
+
+```
+sudo apt-get install -y -o Dpkg::Options::=--force-confold comitup
+sudo install -m 755 node_modules/frugal-iot-server/extras/frugaliot-ap-watchdog /usr/local/sbin/
+sudo install -m 644 node_modules/frugal-iot-server/extras/frugaliot-ap-watchdog.service \
+                    node_modules/frugal-iot-server/extras/frugaliot-ap-watchdog.timer /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now frugaliot-ap-watchdog.timer
+```
+
+`--force-confold` keeps the `/etc/comitup.conf` you just wrote, instead of stopping to ask about the
+one the package ships. `systemctl is-active comitup` should say `active`. The Pi stays on its WiFi;
+nothing changes until that WiFi goes away.
+
 ### 9. Point your sensor nodes at the Pi
 
 A node is flashed with an **enrolment secret**,
@@ -1138,6 +1199,89 @@ and read the **Wear on the SD card** section, which reports how much has been wr
 whether the machine is swapping, and whether each of the settings above is in force. Run it twice a
 few days apart — the interesting number is the rate, not the total.
 
+## Moving the Pi to another WiFi network
+
+This is how to give the Pi a new WiFi network when you cannot log in to it, because it no longer
+finds the old one: it has moved to another site, or the router has been replaced. It needs the setup
+network from [step 8a](#8a-a-setup-network-for-when-the-pi-loses-its-wifi), which the installer sets
+up.
+
+**You need:**
+
+* a phone or laptop;
+* the setup network's password - the `pi` login's password, unless the installer said otherwise;
+* the name and password of the new WiFi network.
+
+**Then:**
+
+1. Power the Pi up where it is going, and give it about three minutes. It tries every network it
+   has saved first, and each one that is not there costs it about half a minute.
+2. On the phone or laptop, join the network **`frugaliot-bridge-setup`** with that password. A
+   "sign in to network" page should open by itself. If it does not, browse to `http://10.41.0.1`.
+3. Choose the new network from the list, and type its password. The setup network disappears as the
+   Pi leaves it to join the new one.
+4. Join the phone or laptop to the new network too, and check the dashboard at
+   `http://frugaliot.local:8080`.
+5. **Tell the phone or laptop to forget `frugaliot-bridge-setup`.** Devices rejoin a network they know
+   whenever it appears. While anything is connected to the setup network, the Pi stops looking for
+   its real WiFi. It gives up waiting after 15 minutes, so nothing is stranded for good, but a phone
+   left in the house can delay the Pi's recovery after every power cut.
+
+**If the setup network comes back a minute or so later**, the Pi could not join the network you
+chose, usually because the password was mistyped. Join the setup network again and choose it again.
+
+**If `frugaliot.local` does not answer on the new network**, find the Pi's address in the router's
+list of connected devices and use that instead, e.g. `http://192.168.1.107:8080`. Some range
+extenders, and possibly phone hotspots, pass ordinary traffic but not the lookups that make `.local`
+names work.
+
+**If the page will not do it**, log in while you are joined to the setup network, and set the WiFi
+by hand as in [step 2](#2-log-in-over-the-network):
+
+```
+ssh pi@10.41.0.1
+sudo nmtui
+```
+
+**A phone hotspot as the new network** works, with two things to know on an iPhone: turn on
+*Maximise Compatibility*, and keep the *Personal Hotspot* screen open while the Pi joins. Without
+that, the iPhone often ignores a new device.
+
+### What it does by itself
+
+Nobody needs to be there for any of this:
+
+* **After a power cut**, the Pi usually boots faster than the router. It raises the setup network,
+  tries its saved networks again every three to six minutes, and rejoins the router once it is up.
+* **If a device sits on the setup network**, the Pi stops retrying while it is there - so that you
+  are not cut off while you are using the page. After 15 minutes it retries regardless.
+* **A network that connects but hands out no address** counts as a failure, and the Pi moves on.
+  Without that, a range extender whose router is switched off holds the Pi for ever, because the WiFi
+  connection itself succeeds.
+
+### Deleting networks the Pi no longer needs
+
+Every network it has saved costs the Pi about half a minute each time it searches, so remove the
+ones it will not see again. This needs a login - the setup page cannot do it:
+
+```
+nmcli connection show
+sudo nmcli connection delete "<name>"
+```
+
+or `sudo nmtui`, then *Edit a connection*. Leave `frugaliot-bridge-setup-0000`, which is the setup
+network itself.
+
+### Changing the setup network's password
+
+Changing the `pi` login's password later does **not** change the setup network's. To change that,
+edit `ap_password` in `/etc/comitup.conf` (`sudo nano /etc/comitup.conf`), then
+`sudo systemctl restart comitup`. The password matters because anyone who has it can point the Pi
+at a network of their choosing, and the Pi stops talking to your sensors until that is undone.
+
+What it has been doing is in `sudo tail -50 /var/log/comitup.log`, and the watchdog's part in
+`journalctl -u frugaliot-ap-watchdog`.
+
 ## When something does not work
 
 From your install directory:
@@ -1258,6 +1402,10 @@ install these three, because none of them can simply be copied into place:
 | `extras/aclfile` | `frugal-iot-addbridge-prod` appends a rule per Pi. Copying over it deletes them, and a mosquitto `acl_file` is deny-by-default — so every bridge goes on logging in and reaches nothing at all. |
 | `extras/frugaliot.service` | written for user `pi` in `/home/pi/frugal-iot`; the installer rewrites `User`, `WorkingDirectory` and `ExecStart` for wherever this actually went. |
 
+The setup network's watchdog, `extras/frugaliot-ap-watchdog` and its `.service` and `.timer`, *can* be
+copied as they are; step 8a has the commands. On a Pi installed before the setup network existed,
+re-running the installer adds it, and asks once for the `pi` login's password to give it.
+
 The installer will not overwrite an ACL file that has per-bridge rules in it. If this release adds a
 rule to a broker that has them, it says which lines are missing and leaves the file alone for you to
 add them by hand, then `sudo systemctl reload mosquitto`.

package/config.d/schema/modules.yaml

@@ -136,6 +136,109 @@ carousel:
   name: Display carousel
   topics:
     - leaf:     select
+# The lcd_ht example's control - formats another node's temperature and humidity for an LCD.
+# Its inputs are wired to the remote node, its output to this node's lcd/message.
+control_lcd_ht:
+  summary: false   # its readings are another node's, shown on that node's card
+  name: LCD SHT
+  topics:
+    - leaf: temperature
+      leaf_from: controlfloat
+      name: Temperature
+      min: -40
+      max: 85
+      color: "#ff0000"
+    - leaf: humidity
+      leaf_from: controlfloat
+      name: Humidity
+      color: "#0000ff"
+    - leaf: message
+      leaf_from: controltext
+      name: Message
+      rw: r
+# The OLED display controls. Each input is wired to whatever reading it should show, often another
+# node's, so like the LCD they stay off the summary. Ranges and colours match the firmware.
+# control_oled_gps is in the gps example.
+control_oled_gps:
+  summary: false   # a display, not a reading
+  name: OLED GPS
+  topics:
+    - leaf: latitude
+      leaf_from: controlfloat
+      name: Latitude
+      min: -90
+      max: 90
+      width: 10
+      color: "#0000ff"
+    - leaf: longitude
+      leaf_from: controlfloat
+      name: Longitude
+      min: -180
+      max: 180
+      width: 11
+      color: "#0000ff"
+    - leaf: altitude
+      leaf_from: controlfloat
+      name: Altitude
+      min: -500
+      max: 9000
+      width: 6
+      color: "#008000"
+    - leaf: speed
+      leaf_from: controlfloat
+      name: Speed
+      max: 999
+      color: "#ffa500"
+    - leaf: course
+      leaf_from: controlfloat
+      name: Course
+      max: 360
+    - leaf: satellites
+      leaf_from: controlfloat
+      name: Satellites
+      max: 32
+    - leaf: hdop
+      leaf_from: controlfloat
+      name: HDOP
+      max: 50
+# In the sht, loramesher and remotedisplay examples, and in frugal-iot-demo
+control_oled_ht:
+  summary: false   # a display, not a reading
+  name: OLED HT
+  topics:
+    - leaf: temperature
+      leaf_from: controlfloat
+      name: Temperature
+      max: 50
+      color: "#ff0000"
+    - leaf: humidity
+      leaf_from: controlfloat
+      name: Humidity
+      color: "#0000ff"
+    - leaf: battery
+      leaf_from: controlfloat
+      name: Battery
+      max: 5000
+      color: "#00ff00"
+# Library control - src/control/oled_loramesher.cpp. The mesh status it shows is read directly, not wired.
+control_oled_loramesher:
+  summary: false   # a display, not a reading
+  name: OLED LoRaMesher
+  topics:
+    - leaf: battery
+      leaf_from: controlfloat
+      name: Battery
+      max: 5000
+      color: "#00ff00"
+# Library control - src/control/oled_single.cpp. One reading, unit and label set in the sketch.
+control_oled_single:
+  summary: false   # a display, not a reading
+  name: OLED
+  topics:
+    - leaf: value
+      leaf_from: controlfloat
+      name: Value
+      max: 10000
 controlblinken:
   name: "Control Blinken"
   topics:

package/extras/frugaliot-ap-watchdog

@@ -0,0 +1,46 @@
+#!/usr/bin/zsh
+# Two guards for comitup, which raises the frugaliot-bridge-setup access point when no known WiFi
+# is in range. Installed to /usr/local/sbin by install-pi.sh, and run every minute by
+# frugaliot-ap-watchdog.timer. Argument: how many seconds the access point may stay up.
+#
+# 1. A WiFi network that gives no IPv4 address must count as FAILED. NetworkManager's default,
+#    ipv4.may-fail yes, together with the link-local IPv6 comitup sets, makes any network that
+#    completes the WiFi handshake "connected" - so a range extender that outlives its router, with
+#    no DHCP behind it, holds the Pi for ever and the access point never appears. comitup creates a
+#    new profile for each network chosen on its page, so this is applied every minute, not once.
+#
+# 2. Restart comitup when it has held the access point for too long. comitup only retries the saved
+#    networks while NOBODY is connected to its access point, and a phone or laptop that joined it
+#    once rejoins by itself whenever it appears - so after a power cut it could hold the Pi in AP
+#    mode for ever, with the real WiFi back and the bridge down. On a restart comitup tries every
+#    saved network before raising the access point again.
+
+LIMIT=${1:-900}
+MARK=/run/frugaliot-ap-since    # /run is emptied at boot, which is what we want
+
+for UUID in ${(f)"$(nmcli -t -f UUID,TYPE connection show | grep ':802-11-wireless$' | cut -d: -f1)"}; do
+  SETTINGS=("${(@f)$(nmcli -g 802-11-wireless.mode,ipv4.may-fail,connection.id connection show $UUID)}")
+  if [[ $SETTINGS[1] != ap && $SETTINGS[2] == yes ]]; then
+    echo "Requiring IPv4 on WiFi profile '$SETTINGS[3]'"
+    nmcli connection modify $UUID ipv4.may-fail no
+  fi
+done
+
+WIFI=$(nmcli -t -f DEVICE,TYPE device | awk -F: '$2 == "wifi" { print $1; exit }')
+if [[ -z $WIFI || "$(iw dev $WIFI info 2>/dev/null)" != *"type AP"* ]]; then
+  rm -f $MARK
+  exit 0
+fi
+
+NOW=$(date +%s)
+if [[ ! -f $MARK ]]; then
+  echo $NOW > $MARK
+  exit 0
+fi
+
+SINCE=$(<$MARK)
+if (( NOW - SINCE >= LIMIT )); then
+  echo "In AP mode for $(( NOW - SINCE ))s (limit ${LIMIT}s) - restarting comitup to retry saved networks"
+  rm -f $MARK
+  systemctl restart comitup
+fi

package/extras/frugaliot-ap-watchdog.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Frugal IoT: stop the fallback access point holding the Pi for too long
+After=comitup.service
+
+[Service]
+Type=oneshot
+# Seconds the frugaliot-bridge-setup access point may stay up before comitup is made to retry
+ExecStart=/usr/local/sbin/frugaliot-ap-watchdog 900

package/extras/frugaliot-ap-watchdog.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Frugal IoT: check every minute whether the fallback access point has been up too long
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=1min
+
+[Install]
+WantedBy=timers.target

package/extras/mosquitto.conf

@@ -38,6 +38,25 @@ acl_file /etc/mosquitto/aclfile
 plugin PLUGIN_PATH_SET_BY_INSTALLER
 plugin_opt_config_file /var/lib/mosquitto/dynamic-security.json
 
+# Messages held for nodes that are asleep. A node keeps a persistent session across a sleep, and the
+# broker holds every QoS 1 message for its subscriptions until it reconnects - which is how a setting
+# changed on the dashboard, or sent by another node, reaches a node that was asleep when it was sent.
+# (The dashboard and the nodes send "set/" commands at QoS 1 for exactly this reason.)
+#
+# Persistence itself - which keeps those sessions, and the retained values, across a broker restart -
+# is NOT set here: the packaged /etc/mosquitto/mosquitto.conf already has "persistence true", and
+# repeating its settings in this file can stop the broker starting.
+#
+# At most this many held messages per node, beyond those in flight; once full, newer ones are dropped.
+# Plenty for a node that sleeps for minutes. A node that sleeps for a day and has wired inputs from
+# busy nodes can exceed it, but it resubscribes on waking, which brings each topic's latest retained
+# value anyway. This is the broker's own default, set here so the limit is visible.
+max_queued_messages 1000
+# A session nobody has reconnected to in this long is discarded, with whatever it holds - otherwise a
+# node taken out of service keeps up to max_queued_messages on the broker forever. A node that comes
+# back after longer simply finds no session, and subscribes afresh.
+persistent_client_expiration 14d
+
 # A node on a weak WiFi signal reconnects often, and each connection and disconnection would be a
 # line in /var/log/mosquitto/mosquitto.log. On an SD card those writes wear the card out, and
 # nothing is lost by dropping them, since the readings themselves are recorded by the server.

package/frugal-iot-createdb.sql

@@ -80,6 +80,11 @@ CREATE TABLE IF NOT EXISTS `bridges` (
   `token` TEXT NOT NULL,
   `created_at` INTEGER NOT NULL,
   `last_pull` INTEGER,
+  -- Where the bridge's broker password lives, and so whether frugal-iot-rebuild-dynsec may set it:
+  -- 'derived' (issued by the dashboard), 'password_file' (frugal-iot-addbridge-prod), or NULL for a
+  -- row from before this was recorded. See bridgesToSync in lib/dynsec-plan.js. Added after the
+  -- table first shipped, so lib/schema-columns.js adds it to an existing database.
+  `credential` TEXT,
   UNIQUE(`org`, `site`)
 );
 

package/frugal-iot-server.js

@@ -114,6 +114,7 @@ import { enrol, ENROL, enrolmentSecretsFor, makeRateLimiter, forgetNode,
          makeAttemptLog, setGrant, clearGrant, readGrants } from './lib/enrol.js';
 import { deleteRetained } from './lib/retained.js';
 import { replicaFor, bridgeForToken, noteBridgePull, startReplica } from './lib/replica.js';
+import { addMissingColumns } from './lib/schema-columns.js';
 import { createLoggerClient } from './lib/logger-client.js';
 import { createPushManager } from './lib/farm-platform-push.js';
 import { APIError } from './lib/api-errors.js';
@@ -578,7 +579,8 @@ function execSqlStart(cb) {
           cb(err);
         } else {
           console.log("Exec-ed starting SQL");
-          cb(null, db);
+          // A column added to an existing table, which CREATE TABLE IF NOT EXISTS cannot do
+          addMissingColumns(db, (err2) => (err2 ? cb(err2) : cb(null, db)));
         }
       });
     }
@@ -1649,9 +1651,16 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
             }
             const now = Date.now();
             const token = crypto.randomBytes(32).toString('base64url');
-            db.run(`INSERT INTO bridges (org, site, token, created_at) VALUES (?, ?, ?, ?)
+            // Whether this re-issues a bridge that exists, because then the Pi already has a bridge
+            // configuration, and the command it is given has to say --replace or it refuses
+            db.get('SELECT 1 AS found FROM bridges WHERE org = ? AND site = ?', [org, site], (gerr, existing) => {
+            if (gerr) { return res.status(500).json({ error: gerr.message }); }
+            // credential 'derived' is what lets frugal-iot-rebuild-dynsec recreate this account,
+            // and tells it apart from one authorized with addbridge-prod - see bridgesToSync
+            db.run(`INSERT INTO bridges (org, site, token, created_at, credential) VALUES (?, ?, ?, ?, 'derived')
                     ON CONFLICT(org, site) DO UPDATE SET token = excluded.token,
-                                                         created_at = excluded.created_at`,
+                                                         created_at = excluded.created_at,
+                                                         credential = excluded.credential`,
               [org, site, token, now], (err) => {
                 if (err) { return res.status(500).json({ error: err.message }); }
                 syncBridge(config, { org, site, createdAt: now }, (serr, result) => {
@@ -1669,11 +1678,15 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
                     replica_token: token,
                     // The command to run on the Pi. Neither secret is in it on purpose: that
                     // script prompts for both precisely so they stay out of the Pi's shell history,
-                    // and putting them here would undo that.
-                    command: `npx --no frugal-iot-addbridge-pi ${org} <this-server-fqdn> ${result.username}`,
+                    // and putting them here would undo that. Re-issuing needs --replace, which npm
+                    // would swallow without the "--" ahead of it - hence the flag form there.
+                    command: existing
+                      ? `npx --no frugal-iot-addbridge-pi -- --org ${org} --host <this-server-fqdn> --account ${result.username} --replace`
+                      : `npx --no frugal-iot-addbridge-pi ${org} <this-server-fqdn> ${result.username}`,
                   });
                 });
               });
+            });
           },
         );
         app.post('/node_reset/:org',

package/lib/dynsec-plan.js

@@ -298,6 +298,36 @@ export function deriveBridgePassword(userSecret, site, createdAt) {
     .digest('base64url').slice(0, 22);
 }
 
+/*
+ * Which bridges a rebuild may create or re-password broker accounts for. A bridge's password comes
+ * from one of two places, recorded in bridges.credential, and only one of them is ours to set:
+ *
+ *   'derived'        issued by the dashboard (POST /bridge_add) from user_secret and created_at, so
+ *                    it can be recreated exactly - always applied.
+ *   'password_file'  authorized with frugal-iot-addbridge-prod: a random password in mosquitto's
+ *                    password file, which only the Pi holds. Creating a plugin client of that name
+ *                    REPLACES it, because the plugin's answer for a client it knows is final - which
+ *                    is how a rebuild during the 2.0.3 release cut a working bridge off.
+ *   null             a row from before that was recorded. Applied only if the plugin already has
+ *                    the client, because then its password is the derived one already; otherwise
+ *                    there is no telling, and replacing a working credential is the worse mistake.
+ *
+ * Pure, so it is tested without a broker. clients is the plugin's list of client names.
+ */
+export function bridgesToSync(bridges, clients) {
+  const apply = [];
+  const skipped = [];
+  for (const b of bridges) {
+    const account = names.bridgeClient(b.site);
+    if (b.credential === 'derived' || (b.credential == null && clients.includes(account))) {
+      apply.push(b);
+    } else {
+      skipped.push({ ...b, account, reason: b.credential === 'password_file' ? 'password_file' : 'unknown' });
+    }
+  }
+  return { apply, skipped };
+}
+
 // The server's administrative account for one organization. Derived, like the logger's, with its
 // own label so the two can never collide.
 export function deriveOrgAdminPassword(userSecret, org) {

package/lib/schema-columns.js

@@ -0,0 +1,31 @@
+/*
+ * Columns added to a table after it first shipped.
+ *
+ * frugal-iot-createdb.sql is all CREATE TABLE IF NOT EXISTS, which creates a new table whole but
+ * cannot add a column to one that exists already - so a database from an earlier release would
+ * otherwise never get it, and the first INSERT naming it would fail. Each is added here, guarded on
+ * its absence, every time the server starts. ADD COLUMN only: anything that changes a constraint
+ * needs the table rebuilt, which is what scripts/init.zsh step 3a does for permissions.project.
+ */
+const ADDED = [
+  { table: 'bridges', column: 'credential', type: 'TEXT' },
+];
+
+export function addMissingColumns(db, cb) {
+  let i = 0;
+  const next = (err) => {
+    if (err) return cb(err);
+    if (i >= ADDED.length) return cb(null);
+    const { table, column, type } = ADDED[i++];
+    db.all(`PRAGMA table_info(${table})`, [], (e, cols) => {
+      if (e) return cb(e);
+      // No such table means CREATE TABLE has not run yet, or it is a table this database never had
+      if (!cols.length || cols.some((c) => c.name === column)) return next();
+      db.run(`ALTER TABLE ${table} ADD COLUMN ${column} ${type}`, [], (e2) => {
+        if (!e2) console.log(`Database: added ${table}.${column}`);
+        next(e2);
+      });
+    });
+  };
+  next();
+}

package/package.json

@@ -12,8 +12,8 @@
     "cookie-parser": "^1.4.7",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
-    "frugal-iot-client": "^2.0.3",
-    "frugal-iot-logger": "^2.0.3",
+    "frugal-iot-client": "^2.0.5",
+    "frugal-iot-logger": "^2.0.5",
     "hash-wasm": "^4.12.0",
     "js-yaml": "^4.2.0",
     "morgan": "^1.11.0",
@@ -56,6 +56,9 @@
     "extras/aclfile",
     "extras/mosquitto-bridge.conf.example",
     "extras/frugaliot.service",
+    "extras/frugaliot-ap-watchdog",
+    "extras/frugaliot-ap-watchdog.service",
+    "extras/frugaliot-ap-watchdog.timer",
     "API.md",
     "INSTALLATION.md"
   ],
@@ -86,5 +89,5 @@
     "check-files": "node scripts/check-published-files.js"
   },
   "type": "module",
-  "version": "2.0.3"
+  "version": "2.0.5"
 }

package/public/service-worker.js

@@ -6,7 +6,7 @@
 // it, an installed browser keeps serving the files it already cached - and since the list now covers
 // the dashboard's own code, that means old JS behind freshly fetched HTML. Any edit to the list
 // needs this bumped, or it does not reach anyone who already has the old one.
-const CACHE_NAME = 'frugal-iot-cache-2.0.3';
+const CACHE_NAME = 'frugal-iot-cache-2.0.5';
 /*
  * Everything the app needs, so that a phone on a poor or expensive link fetches it once.
  *

package/scripts/addbridge-prod.zsh

@@ -72,6 +72,29 @@ if ! command -v mosquitto_passwd >/dev/null; then
   exit 1
 fi
 
+# A bridge issued from the dashboard has its account in the dynamic security plugin, and the
+# plugin's answer for a client it knows is final - so a password-file entry made here for the same
+# name would simply be ignored, and the Pi given it refused. The same trap the other way round cut a
+# working bridge off in 2.0.3 (see bridgesToSync in lib/dynsec-plan.js). Node, not sqlite3, for the
+# reason given at the replica token below.
+BRIDGE_CREDENTIAL=$(node -e '
+const sqlite3 = require("sqlite3");
+const [org, site] = process.argv.slice(1);
+const db = new sqlite3.Database("./frugal-iot.db", sqlite3.OPEN_READONLY, (err) => {
+  if (err) process.exit(0);
+  db.get("SELECT * FROM bridges WHERE org = ? AND site = ?", [org, site], (e, row) => {
+    process.stdout.write((row && row.credential) || "");
+    db.close();
+  });
+});
+' "$ORG_ID" "$SITE" 2>/dev/null) || true
+if [[ "$BRIDGE_CREDENTIAL" == derived ]]; then
+  echo "Error: bridge '${SITE}' was issued from the dashboard, so its account is in the broker's" >&2
+  echo "dynamic security plugin, which would ignore a password-file entry made here." >&2
+  echo "To give its Pi new credentials, re-issue it on the dashboard's Bridges card instead." >&2
+  exit 1
+fi
+
 # Which files the running broker actually uses, rather than where they usually are. Only ".conf"
 # files in conf.d are read, and the last setting wins.
 MOSQ_CONFS=(/etc/mosquitto/mosquitto.conf(N) /etc/mosquitto/conf.d/*.conf(N))
@@ -263,15 +286,24 @@ const token = randomBytes(32).toString("base64url");
 const db = new sqlite3.Database("./frugal-iot.db", (err) => {
   if (err) { console.error(err.message); process.exit(1); }
   db.run(`CREATE TABLE IF NOT EXISTS bridges (org TEXT NOT NULL, site TEXT NOT NULL,
-            token TEXT NOT NULL, created_at INTEGER NOT NULL, last_pull INTEGER,
+            token TEXT NOT NULL, created_at INTEGER NOT NULL, last_pull INTEGER, credential TEXT,
             UNIQUE(org, site))`, () => {
-    db.run(`INSERT INTO bridges (org, site, token, created_at) VALUES (?, ?, ?, ?)
-            ON CONFLICT(org, site) DO UPDATE SET token = excluded.token, created_at = excluded.created_at`,
-      [org, site, token, Date.now()], (e) => {
-        if (e) { console.error(e.message); process.exit(1); }
-        process.stdout.write(token);
-        db.close();
+    // An existing table may predate the credential column, if the server has not been restarted
+    // on this release yet - it adds it at startup, so do the same here
+    db.all("PRAGMA table_info(bridges)", [], (pe, cols) => {
+      const add = (pe || cols.some((c) => c.name === "credential")) ? "SELECT 1" : "ALTER TABLE bridges ADD COLUMN credential TEXT";
+      db.run(add, [], () => {
+        // "password_file" tells frugal-iot-rebuild-dynsec this account is not its to set
+        db.run(`INSERT INTO bridges (org, site, token, created_at, credential) VALUES (?, ?, ?, ?, 'password_file')
+                ON CONFLICT(org, site) DO UPDATE SET token = excluded.token, created_at = excluded.created_at,
+                                                     credential = excluded.credential`,
+          [org, site, token, Date.now()], (e) => {
+            if (e) { console.error(e.message); process.exit(1); }
+            process.stdout.write(token);
+            db.close();
+          });
       });
+    });
   });
 });
 ' "$ORG_ID" "$SITE") || true
@@ -317,6 +349,11 @@ echo "Then, on the Pi at site '${SITE}':"
 echo ""
 echo "  npx --no frugal-iot-addbridge-pi ${ORG_ID} <fqdn-from-1-above> ${ACCOUNT}"
 echo ""
+echo "If that Pi already has a bridge configured, to anywhere, it needs --replace, which"
+echo "npm swallows unless a \"--\" comes first:"
+echo ""
+echo "  npx --no frugal-iot-addbridge-pi -- --org ${ORG_ID} --host <fqdn-from-1-above> --account ${ACCOUNT} --replace"
+echo ""
 if [[ -n "$REPLICA_TOKEN" ]]; then
   echo "It asks for the password from 2, then for the replica token from 3. Neither is given on the"
   echo "command line on purpose, so that neither ends up in that Pi's shell history."

package/scripts/diagnostic.zsh

@@ -496,15 +496,31 @@ section "Bridge to a production server (optional)"
 # extras/mosquitto-bridge.conf.example. It is configured by a "connection" line in one of
 # mosquitto's own config files, so most installations have none, which is not a problem.
 BRIDGECONFS=(/etc/mosquitto/mosquitto.conf(N) /etc/mosquitto/conf.d/*.conf(N))
-BRIDGENAMES=""
-(( ${#BRIDGECONFS} )) && BRIDGENAMES=$(grep -hE '^[[:space:]]*connection[[:space:]]' $BRIDGECONFS 2>/dev/null | awk '{print $2}')
-if [[ -z "$BRIDGENAMES" ]]; then
+# The bridge's own file is 600 root, because it holds the bridge's password - so read as an ordinary
+# user it yields nothing, which looked exactly like "no bridge configured" on a Pi whose bridge was
+# configured and failing. Read each file with sudo when it cannot be read plainly, and say so when
+# even that fails rather than report an answer that was never looked for.
+BRIDGETEXT=""; BRIDGEUNREAD=()
+for f in $BRIDGECONFS; do
+  if [[ -r $f ]]; then
+    BRIDGETEXT+="$(<$f)"$'\n'
+  elif have sudo && t=$(sudo -n cat $f 2>/dev/null); then
+    BRIDGETEXT+="$t"$'\n'
+  else
+    BRIDGEUNREAD+=($f)
+  fi
+done
+BRIDGENAMES=$(print -r -- "$BRIDGETEXT" | grep -E '^[[:space:]]*connection[[:space:]]' | awk '{print $2}')
+if [[ -z "$BRIDGENAMES" ]] && (( ${#BRIDGEUNREAD} )); then
+  item "cannot tell whether a bridge is configured: not readable as $(id -un) - ${(j:, :)BRIDGEUNREAD}"
+  item "  sudo npx --no frugal-iot-diagnostic   reads them"
+elif [[ -z "$BRIDGENAMES" ]]; then
   item "no bridge configured - readings stay on this Pi"
 else
   for b in ${(f)BRIDGENAMES}; do item "configured bridge: $b"; done
   # What it is set to relay and where. remote_password is deliberately not among these.
   item "its settings:"
-  grep -hE '^[[:space:]]*(address|remote_username|remote_clientid|topic|cleansession|restart_timeout|notifications)[[:space:]]' $BRIDGECONFS 2>/dev/null | sed 's/^/      /'
+  print -r -- "$BRIDGETEXT" | grep -E '^[[:space:]]*(address|remote_username|remote_clientid|topic|cleansession|restart_timeout|notifications)[[:space:]]' | sed 's/^/      /'
   # Whether it is actually up, rather than what the configuration hoped for. With "notifications"
   # left on, the bridge publishes a retained 1 or 0 here each time it connects or drops.
   if have mosquitto_sub; then

package/scripts/init.zsh

@@ -255,6 +255,11 @@ check_installed() {
 check_installed "${PKG}/extras/mosquitto.conf"    /etc/mosquitto/conf.d/frugal-iot.conf  plugin
 check_installed "${PKG}/extras/aclfile"           /etc/mosquitto/aclfile                 subset
 check_installed "${PKG}/extras/frugaliot.service" /etc/systemd/system/frugaliot.service  service
+# Installed as they are, so compared exactly. Absent on a machine with no WiFi, which install-pi.sh
+# leaves without a setup network - reported as "nothing to compare", which is what it is.
+check_installed "${PKG}/extras/frugaliot-ap-watchdog"         /usr/local/sbin/frugaliot-ap-watchdog             exact
+check_installed "${PKG}/extras/frugaliot-ap-watchdog.service" /etc/systemd/system/frugaliot-ap-watchdog.service  exact
+check_installed "${PKG}/extras/frugaliot-ap-watchdog.timer"   /etc/systemd/system/frugaliot-ap-watchdog.timer    exact
 
 if (( ${#DIFFER_TO} )); then
   echo

package/scripts/install-pi.sh

@@ -25,13 +25,18 @@
 #     workstation, not here. It prints the settings to give them.
 #   * HTTPS, which over-the-air firmware updates to ESP32 need - INSTALLATION.md step 10
 #   * reboot. A reboot is worth doing afterwards if the upgrade brought a new kernel.
+#
+# It does set up what happens when the Pi later LOSES its WiFi - moved to another site, or the router
+# replaced: a network of its own, frugaliot-bridge-setup, whose page sets a new one. Otherwise a Pi
+# on WiFi is unreachable at exactly the moment it needs its WiFi changed. INSTALLATION.md, "Moving the
+# Pi to another WiFi network", is the operator's side of it.
 
 set -Eeuo pipefail
 
 # ---------------------------------------------------------------- settings and arguments
 
 ORG_ID=""; ORG_NAME=""; ORG_EMAIL=""; ORG_PHONE=""
-BROKER_PW=""; SUPER_PW=""; LOGIN_PW=""; BROKER_HOST=""
+BROKER_PW=""; SUPER_PW=""; LOGIN_PW=""; BROKER_HOST=""; AP_PW=""; SETUP_AP=1
 INSTALL_DIR=""; RUN_USER=""; ASSUME_YES=0; DRY_RUN=0; RANDOM_PASSWORDS=0
 
 usage() {
@@ -52,6 +57,12 @@ Usage: bash install-pi.sh [options]
                        thing from the broker credential above and should not be the same string.
                        Either of the two logins, if not given, is asked for - and generated if you
                        just press Enter, or if there is no terminal to ask at.
+  --ap-password        password of the frugaliot-bridge-setup network this Pi raises when it cannot
+                       find its WiFi, 8 to 63 characters. If not given you are asked for the
+                       password of this Pi's login, and that is used - so whoever moves the Pi
+                       needs to know only one. Generated if there is no terminal to ask at.
+  --no-setup-ap        do not set that network up. Leaves a Pi that loses its WiFi reachable only
+                       by plugging in a screen and keyboard, or an Ethernet cable.
   --broker-host <host> what the browser and the nodes should call this Pi.
                        Default: this Pi's hostname with ".local". Use an IP address if you will
                        view the dashboard on Android, which cannot resolve ".local" names.
@@ -76,6 +87,8 @@ while (( $# )); do
     --superuser-password)  SUPER_PW="${2:-}"; shift 2 ;;
     --login-password)      LOGIN_PW="${2:-}"; shift 2 ;;
     --broker-host)         BROKER_HOST="${2:-}"; shift 2 ;;
+    --ap-password)         AP_PW="${2:-}"; shift 2 ;;
+    --no-setup-ap)         SETUP_AP=0; shift ;;
     --dir)                 INSTALL_DIR="${2:-}"; shift 2 ;;
     --user)                RUN_USER="${2:-}"; shift 2 ;;
     --yes|-y)              ASSUME_YES=1; shift ;;
@@ -265,6 +278,91 @@ ask() { # ask <variable name> <prompt> [generated]
   [[ -n "${!var}" ]] || { echo "That cannot be empty" >&2; return 1; }
 }
 
+# ---------------------------------------------------------------- the setup network
+# What this Pi raises, through comitup, when no saved WiFi network is in range. Not "frugaliot":
+# comitup also announces its name over mDNS, and announcing the Pi's own hostname a second time made
+# avahi refuse the real one - frugaliot.local stopped resolving for up to 15 minutes after every
+# reconnect.
+AP_NAME="frugaliot-bridge-setup"
+COMITUP_CONF=/etc/comitup.conf
+AP_SOURCE=""    # login, own, given or kept - which password the network ended up with, for the summary
+
+# Why there can be no setup network on this machine, or nothing if there can be
+ap_unavailable() {
+  command -v nmcli >/dev/null 2>&1 || { echo "NetworkManager is not installed"; return 0; }
+  systemctl is-active --quiet NetworkManager 2>/dev/null || { echo "NetworkManager is not running"; return 0; }
+  nmcli -t -f TYPE device 2>/dev/null | grep -qx wifi || echo "this machine has no WiFi"
+}
+
+# Is "$1" the password of RUN_USER's login? 0 yes, 1 no, 2 cannot tell.
+# Linux keeps only a one-way hash of a password, in /etc/shadow, so there is nothing to read back -
+# instead what was typed is hashed the same way, with the same salt, and the two compared. Without
+# that a typing slip would give the network a password nobody knows. libcrypt through ctypes because
+# Python 3.13 removed its crypt module; both values go to python on stdin, since "ps" shows arguments.
+login_password_matches() {
+  local stored rc=0
+  stored="$(sudo_ getent shadow "$RUN_USER" 2>/dev/null | cut -d: -f2 || true)"
+  [[ "$stored" == \$* ]] || return 2      # locked ("!"), no password ("*"), or unreadable
+  printf '%s\n%s' "$stored" "$1" | python3 -c '
+import ctypes, sys
+stored, typed = sys.stdin.read().split("\n", 1)
+try:
+    lib = ctypes.CDLL("libcrypt.so.1")
+except OSError:
+    sys.exit(2)
+lib.crypt.restype = ctypes.c_char_p
+lib.crypt.argtypes = [ctypes.c_char_p, ctypes.c_char_p]
+result = lib.crypt(typed.encode(), stored.encode())
+sys.exit(0 if result and result.decode() == stored else 1)
+' || rc=$?
+  (( rc <= 1 )) || rc=2                   # 127 is no python3 at all, which is also "cannot tell"
+  return $rc
+}
+
+wifi_length_ok() { (( ${#1} >= 8 && ${#1} <= 63 )); }   # what WPA accepts
+
+ask_ap_password() {
+  if [[ -n "$AP_PW" ]]; then
+    AP_SOURCE=given
+    return 0
+  fi
+  if (( RANDOM_PASSWORDS )) || (( ASSUME_YES )) || [[ ! -t 0 ]]; then
+    AP_PW="$(randpw)"; GENERATED+=(AP_PW); AP_SOURCE=own
+    info "generated a password for the ${AP_NAME} network$( [[ -t 0 ]] || echo ' (no terminal to ask at)' )"
+    return 0
+  fi
+  local typed rc tries=0
+  printf '    When this Pi cannot find its WiFi it raises a network called %s,\n' "$AP_NAME" > /dev/tty
+  printf '    whose password is that of the %s login - so whoever moves it needs to know only one.\n' "$RUN_USER" > /dev/tty
+  while (( tries < 3 )); do
+    printf '    Password for the %s login\n      (or press Enter to give that network a password of its own): ' "$RUN_USER" > /dev/tty
+    read -rs typed < /dev/tty; printf '\n' > /dev/tty
+    [[ -n "$typed" ]] || break
+    rc=0; login_password_matches "$typed" || rc=$?
+    case $rc in
+      0)
+        if wifi_length_ok "$typed"; then
+          AP_PW="$typed"; AP_SOURCE=login
+          info "the ${AP_NAME} network will have the password of the ${RUN_USER} login"
+          return 0
+        fi
+        printf '      That is right, but a WiFi password must be 8 to 63 characters, so this\n      network needs one of its own.\n' > /dev/tty
+        break ;;
+      1) printf '      That is not the password for %s - try again.\n' "$RUN_USER" > /dev/tty ;;
+      *) printf '      That cannot be checked against the %s login here, so this network gets\n      a password of its own.\n' "$RUN_USER" > /dev/tty
+         break ;;
+    esac
+    tries=$((tries+1))
+  done
+  AP_SOURCE=own
+  while true; do
+    ask_password AP_PW "the ${AP_NAME} network (8 to 63 characters)"
+    wifi_length_ok "$AP_PW" && return 0
+    printf '      A WiFi password must be 8 to 63 characters - try again.\n' > /dev/tty
+    AP_PW=""
+  done
+}
+
 echo "Frugal IoT server installation"
 (( DRY_RUN )) && echo "Dry run - nothing will be changed" || echo "Log: ${LOG}"
 
@@ -375,6 +473,21 @@ if [[ -z "$BROKER_PW" ]]; then
 fi
 [[ -n "$BROKER_HOST" ]] || BROKER_HOST="$(hostname).local"
 
+# The setup network: whether it can be had here, and whether a previous run already gave it a
+# password - re-running this should not ask again. Read without a pipe into "grep -q", which under
+# pipefail can report a match as a failure when grep closes the pipe early.
+if (( SETUP_AP )); then AP_SKIP="$(ap_unavailable)"; else AP_SKIP="--no-setup-ap was given"; fi
+if [[ -n "$AP_PW" ]] && ! wifi_length_ok "$AP_PW"; then
+  echo "--ap-password must be 8 to 63 characters, which is what WiFi accepts" >&2; exit 1
+fi
+AP_KEEP=0
+if [[ -z "$AP_SKIP" && -z "$AP_PW" ]]; then
+  COMITUP_NOW="$(read_maybe_root "$COMITUP_CONF")"
+  grep -q '^ap_password:' <<< "$COMITUP_NOW" && { AP_KEEP=1; AP_SOURCE=kept; }
+fi
+# Not in a dry run: it would mean typing the login password for a run that then does nothing with it
+if [[ -z "$AP_SKIP" ]] && (( ! AP_KEEP )) && (( ! DRY_RUN )); then ask_ap_password; fi
+
 info "install into:  ${INSTALL_DIR}  (owned by ${RUN_USER})"
 info "organization:  ${ORG_ID} (${ORG_NAME})"
 info "broker URL:    ws://${BROKER_HOST}:9012"
@@ -391,6 +504,13 @@ $( (( NEEDS_SWAP )) && echo "  * add a 2G swap file, because this board has unde
   * install and configure mosquitto, with listeners on 1883 and 9012
   * create the superuser login and the ${ORG_ID} organization, and test the broker
   * install and start the frugaliot service, running as ${RUN_USER}
+$( if [[ -n "$AP_SKIP" ]]; then
+     echo "  * no setup network: ${AP_SKIP}"
+   else
+     echo "  * install comitup and the watchdog that keeps it honest, so that with no saved WiFi in"
+     echo "    range this Pi raises a network called ${AP_NAME} whose page sets a new one."
+     echo "    Its password: $( (( AP_KEEP )) && echo "kept, from ${COMITUP_CONF}" || { [[ -n "$AP_PW" ]] && echo "the one given" || echo "that of the ${RUN_USER} login, asked for"; } )"
+   fi )
 
 Passwords it would use. A generated one is different on every run, so pass it or type it if you
 want this exact set. All of them are shown here because a dry run writes no log; a real run prints
@@ -413,7 +533,9 @@ UPGRADE_PLAN="$(sudo_ apt-get -s full-upgrade 2>/dev/null | awk '/^Inst /{print
 BOOT_BEFORE="$(boot_fingerprint)"
 # No reboot here even if this brings a new kernel, so that the run can continue unattended. Whether
 # one is needed is worked out below and said plainly in the summary.
-sudo_ env DEBIAN_FRONTEND=noninteractive apt-get full-upgrade -y -qq
+# --force-confold: a package whose shipped configuration changed keeps the one on this machine
+# rather than stopping to ask. /etc/comitup.conf, written below, is one such.
+sudo_ env DEBIAN_FRONTEND=noninteractive apt-get full-upgrade -y -qq -o Dpkg::Options::=--force-confold
 if [[ -n "$UPGRADE_PLAN" ]]; then
   info "upgraded: $(echo "$UPGRADE_PLAN" | wc -l | tr -d ' ') package(s)"
 else
@@ -861,6 +983,66 @@ else
 fi
 systemctl is-enabled --quiet frugaliot && ok "will start again at boot"
 
+step "A setup network, for when this Pi cannot find its WiFi"
+# Moved to another site, or the router replaced, a Pi on WiFi is unreachable - and changing its WiFi
+# needs a login. comitup raises a network of its own whenever no saved one is in range; its page
+# lists the networks it can see and takes the password for one. The watchdog covers two ways comitup
+# alone was seen to strand a Pi - see the comments in extras/frugaliot-ap-watchdog.
+if [[ -n "$AP_SKIP" ]]; then
+  info "not set up: ${AP_SKIP}"
+else
+  # The configuration goes in BEFORE the package, because installing it starts comitup at once - and
+  # without this file it uses its defaults, a network called comitup-<nnn> with NO password, raised
+  # straight away on a Pi that has no WiFi connection at that moment. Root 600: it holds a password,
+  # by default the login's, and comitup runs as root.
+  if (( AP_KEEP )); then
+    skip "${COMITUP_CONF} already has a password"
+  else
+    sudo_ install -o root -g root -m 600 /dev/null "$COMITUP_CONF"
+    printf '# Written by install-pi.sh: the network this Pi raises when no saved WiFi is in range.\n# After changing either line: sudo systemctl restart comitup\nap_name: %s\nap_password: %s\n' \
+        "$AP_NAME" "$AP_PW" | sudo_ tee "$COMITUP_CONF" >/dev/null
+    ok "${COMITUP_CONF} written"
+  fi
+  if dpkg -s comitup >/dev/null 2>&1; then
+    skip "comitup already installed"
+    # A restart while connected keeps the connection; it only matters for the next time it is lost
+    (( AP_KEEP )) || { sudo_ systemctl restart comitup; ok "comitup restarted to read the new password"; }
+  else
+    # --force-confold: the package ships its own /etc/comitup.conf, and would otherwise stop to ask
+    # which to keep
+    sudo_ env DEBIAN_FRONTEND=noninteractive apt-get install -y -qq -o Dpkg::Options::=--force-confold comitup
+    ok "comitup installed"
+  fi
+
+  # From the installed package, not ${INSTALL_DIR}/extras - frugal-iot-init never overwrites its
+  # copy, so a release that changed one of these would otherwise never reach the system
+  install_extra() { # install_extra <file in extras/> <destination> <mode>; fails if already current
+    local src="${PKG_DIR}/extras/$1"
+    [[ -f "$src" ]] || src="${INSTALL_DIR}/extras/$1"
+    [[ -f "$src" ]] || { echo "Expected extras/$1 in ${PKG_DIR} or ${INSTALL_DIR}" >&2; exit 1; }
+    cmp -s "$src" "$2" && return 1
+    sudo_ install -o root -g root -m "$3" "$src" "$2"
+  }
+  WD_CHANGED=0
+  install_extra frugaliot-ap-watchdog         /usr/local/sbin/frugaliot-ap-watchdog            755 && WD_CHANGED=1 || true
+  install_extra frugaliot-ap-watchdog.service /etc/systemd/system/frugaliot-ap-watchdog.service 644 && WD_CHANGED=1 || true
+  install_extra frugaliot-ap-watchdog.timer   /etc/systemd/system/frugaliot-ap-watchdog.timer   644 && WD_CHANGED=1 || true
+  if (( WD_CHANGED )); then
+    sudo_ systemctl daemon-reload
+    ok "watchdog installed"
+  else
+    skip "watchdog already current"
+  fi
+  sudo_ systemctl enable -q --now frugaliot-ap-watchdog.timer
+
+  if systemctl is-active --quiet comitup; then
+    ok "comitup running: with no saved WiFi in range, this Pi raises ${AP_NAME}"
+  else
+    warn "comitup is not running, so this Pi will NOT raise ${AP_NAME} if it loses its WiFi."
+    warn "  Why: sudo tail -20 /var/log/comitup.log"
+  fi
+fi
+
 # ---------------------------------------------------------------- what is left to do
 
 IP_ADDR="$(hostname -I 2>/dev/null | awk '{print $1}' || true)"
@@ -883,6 +1065,22 @@ else
     installed here is already running."
 fi
 
+if [[ -n "$AP_SKIP" ]]; then
+  AP_TEXT=" If this Pi loses its WiFi there is no setup network to fix it with (${AP_SKIP}).
+    It can then be reached only with a screen and keyboard, or an Ethernet cable."
+else
+  case "$AP_SOURCE" in
+    login) AP_PW_TEXT="the password of the ${RUN_USER} login" ;;
+    kept)  AP_PW_TEXT="unchanged - see ${COMITUP_CONF}" ;;
+    given) AP_PW_TEXT="the one you gave" ;;
+    *)     AP_PW_TEXT="$(shown AP_PW)" ;;
+  esac
+  AP_TEXT=" If this Pi cannot find its WiFi - moved, or a new router - it raises a network
+    called ${AP_NAME}. Join it from a phone or laptop; the password is
+    ${AP_PW_TEXT}. A page opens to choose the new WiFi.
+    INSTALLATION.md, \"Moving the Pi to another WiFi network\", has the rest."
+fi
+
 cat <<SUMMARY
 
 =======================================================================
@@ -939,6 +1137,8 @@ ${REBOOT_TEXT}
     network, which is all an offline installation needs. What you do not get is over-the-air
     firmware updates, since an ESP32 requires HTTPS to fetch them.
 
+${AP_TEXT}
+
  If anything looks wrong:
      cd ${INSTALL_DIR} && npx --no frugal-iot-diagnostic
 

package/scripts/rebuild-dynsec.js

@@ -24,7 +24,7 @@ import {
   applyRolesAndGroups, applyUser, applyNode, applyLogger, applyOrgAdmin, applyBridge,
   checkRolesAndGroups,
 } from '../lib/dynsec-sync.js';
-import { names } from '../lib/dynsec-plan.js';
+import { names, bridgesToSync } from '../lib/dynsec-plan.js';
 
 const userClientName = names.userClient;
 
@@ -90,10 +90,14 @@ new MqttLogger().readYamlConfig('.', (err, config) => {
                     const want = names.loggerClient(org);
                     if (!clients.includes(want)) differences.push(`client missing: ${want}`);
                   }
-                  for (const b of bridges) {
+                  // Only a bridge whose password this server derives can be missing - see
+                  // bridgesToSync for why the others are left alone rather than reported
+                  const { apply, skipped } = bridgesToSync(bridges, clients);
+                  for (const b of apply) {
                     const want = names.bridgeClient(b.site);
                     if (!clients.includes(want)) differences.push(`client missing: ${want}`);
                   }
+                  reportSkippedBridges(skipped);
                   report(differences);
                   dynsec.end(() => process.exit(differences.length ? 3 : 0));
                 });
@@ -118,9 +122,10 @@ new MqttLogger().readYamlConfig('.', (err, config) => {
                   syncOrgAdmins(dynsec, orgs, userSecret, (e7, j) => {
                     if (e7) return fail(`Syncing admin accounts: ${e7.message}`);
                     console.log(`${j} server admin account(s)`);
-                    syncBridges(dynsec, bridges, userSecret, (e8, b) => {
+                    syncBridges(dynsec, bridges, userSecret, (e8, b, skipped) => {
                       if (e8) return fail(`Syncing bridge accounts: ${e8.message}`);
                       console.log(`${b} bridge account(s)`);
+                      reportSkippedBridges(skipped);
                       dynsec.end(() => process.exit(0));
                     });
                   });
@@ -146,19 +151,41 @@ function readBridges(db, cb) {
   db.all("SELECT name FROM sqlite_master WHERE type='table' AND name='bridges'", [], (err, t) => {
     if (err) return cb(err);
     if (!t.length) return cb(null, []);
-    db.all('SELECT org, site, created_at FROM bridges', [], (e, rows) => cb(e, rows || []));
+    // "*" and not a column list: credential is absent from a database the server has not yet
+    // started on since it was added, and a missing column must read as null, not fail the query
+    db.all('SELECT * FROM bridges', [], (e, rows) => cb(e, rows || []));
   });
 }
 
+// Only the bridges whose password this server derives - see bridgesToSync in lib/dynsec-plan.js.
+// A bridge authorized with frugal-iot-addbridge-prod has its own password in mosquitto's password
+// file, and creating a plugin client of the same name would silently replace it.
 function syncBridges(dynsec, bridges, userSecret, cb) {
-  let i = 0;
-  const next = () => {
-    if (i >= bridges.length) return cb(null, bridges.length);
-    const b = bridges[i++];
-    applyBridge(dynsec, { org: b.org, site: b.site, createdAt: b.created_at, userSecret },
-      (e) => (e ? cb(e) : next()));
-  };
-  next();
+  dynsec.listClients((err, clients) => {
+    if (err) return cb(err);
+    const { apply, skipped } = bridgesToSync(bridges, clients);
+    let i = 0;
+    const next = () => {
+      if (i >= apply.length) return cb(null, apply.length, skipped);
+      const b = apply[i++];
+      applyBridge(dynsec, { org: b.org, site: b.site, createdAt: b.created_at, userSecret },
+        (e) => (e ? cb(e) : next()));
+    };
+    next();
+  });
+}
+
+function reportSkippedBridges(skipped) {
+  for (const b of skipped) {
+    if (b.reason === 'password_file') {
+      console.log(`  ${b.account}: left alone - authorized with frugal-iot-addbridge-prod, so its password`);
+      console.log('    is in mosquitto\'s password file. Re-issue it on the dashboard\'s Bridges card to move it here.');
+    } else {
+      console.log(`  ${b.account}: left alone - no account for it here, and nothing records whether its password`);
+      console.log('    is in mosquitto\'s password file. If its Pi is connected, it is, and nothing is wrong;');
+      console.log('    if not, re-issue it on the dashboard\'s Bridges card.');
+    }
+  }
 }
 
 function report(differences) {