frugal-iot-server 2.0.9 → 2.0.10

package/README.md

@@ -3,7 +3,7 @@
 ## Installation
 
 For a self-contained server on a Raspberry Pi - including the MQTT broker, and starting from a
-blank SD card - see [INSTALLATION.md](INSTALLATION.md), which also has a script that does the whole
+blank SD card - see [docs/INSTALLATION.md](docs/INSTALLATION.md), which also has a script that does the whole
 thing in one go once you can ssh in.
 
 On a unix box that is already running ...
@@ -91,7 +91,7 @@ verbose: true
 and each message reappears as `Received dev/lotus/esp8266-85ea2b/humidity   71.8`. `morgan: true`
 in `config.d/server.yaml` does the same for web requests. Turn both off again afterwards.
 There is more on what gets written, and how to see how much, under
-[Wear and tear on the SD card](INSTALLATION.md#wear-and-tear-on-the-sd-card).
+[Wear and tear on the SD card](docs/INSTALLATION.md#wear-and-tear-on-the-sd-card).
 
 Open a browser pointing at for example `localhost:8080` and you should see the UI.
 
@@ -161,7 +161,7 @@ expensive on an SD card.
 To set it up as a service that runs at startup (and instructions vary between flavors of Linux)
 
 copy and edit `extras/frugaliot.service` to `/etc/systemd/system/frugaliot.service`. As shipped it
-matches the Raspberry Pi install in [INSTALLATION.md](INSTALLATION.md) - user `pi`, installed in
+matches the Raspberry Pi install in [docs/INSTALLATION.md](docs/INSTALLATION.md) - user `pi`, installed in
 `/home/pi/frugal-iot` - so on any other machine change `User`, `WorkingDirectory` and `ExecStart`
 to the account and directory you installed into.
 ```

package/config.d/email.yaml

@@ -3,7 +3,7 @@
 #
 # Leave it commented out on a server that should not send mail.
 #
-# For Gmail - the common case, written out step by step in INSTALLATION.md section 9a:
+# For Gmail - the common case, written out step by step in docs/INSTALLATION.md section 9a:
 #   1. Turn on 2-Step Verification: https://myaccount.google.com/signinoptions/twosv
 #      App passwords do not exist until you do, which is where most people get stuck.
 #   2. Create an app password:      https://myaccount.google.com/apppasswords

package/config.d/opensearch.yaml

@@ -1,4 +1,4 @@
-# This server's own OpenSearch - the one INSTALL-OPENSEARCH.md sets up on the server itself.
+# This server's own OpenSearch - the one docs/INSTALL-OPENSEARCH.md sets up on the server itself.
 #
 # Leave it all commented out on a server without one. With it filled in, an organization's
 # administrator can choose "OpenSearch on this server" on the dashboard's Forwarders card, and make a
@@ -23,5 +23,5 @@
 #   password: change-me
 #
 # # The address Dashboards on someone's own computer uses to reach OpenSearch: https, through
-# # Apache (INSTALL-OPENSEARCH.md), never the port 9200 above.
+# # Apache (docs/INSTALL-OPENSEARCH.md), never the port 9200 above.
 # public: https://search.example.org

package/config.d/schema/modules.yaml

@@ -383,6 +383,13 @@ heatsink:
       name: Heatsink Temperature
       min: 0
       max: 120
+# Seeed HM3301 particulate sensor ("Grove - Laser PM2.5 Sensor") - Sensor_HM3301.
+hm3301:
+  name: "HM3301"
+  topics:
+    - leaf: pm1
+    - leaf: pm25
+    - leaf: pm10
 ht:
   name: HT
   topics:
@@ -617,6 +624,12 @@ sector:
     - leaf: valve
       leaf_from: controlouttoggle
       name: Valve
+# Nova Fitness SDS011 particulate sensor, as in sensor.community's airRohr - Sensor_SDS011.
+sds011:
+  name: "SDS011"
+  topics:
+    - leaf: pm25
+    - leaf: pm10
 sht:
   name: SHT
   topics:

package/config.d/schema/topics.yaml

@@ -549,6 +549,56 @@ percent:
     significantvalue: 1
   graphable:  true
   units:    "%"
+# Particulate matter, from the SDS011 or HM3301 - see sensor/pm.h in Frugal-IoT. Both are noisy,
+# and unreliable above ~70% humidity (they count droplets as particles). Only the HM3301 has pm1.
+pm1:
+  leaf:     pm1
+  name:     PM1.0
+  type:     float
+  display:  bar
+  min:      0
+  max:      100
+  width:    5
+  color:    "#d2691e"
+  units:    ug/m3
+  rw:       r
+  graphable:  true
+  log:      true
+  duplicates:
+    significantdate: 900000
+    significantvalue: 1
+pm10:
+  leaf:     pm10
+  name:     PM10
+  type:     float
+  display:  bar
+  min:      0
+  max:      200
+  width:    5
+  color:    "#696969"
+  units:    ug/m3
+  rw:       r
+  graphable:  true
+  log:      true
+  duplicates:
+    significantdate: 900000
+    significantvalue: 1
+pm25:
+  leaf:     pm25
+  name:     PM2.5
+  type:     float
+  display:  bar
+  min:      0
+  max:      100
+  width:    5
+  color:    "#a0522d"
+  units:    ug/m3
+  rw:       r
+  graphable:  true
+  log:      true
+  duplicates:
+    significantdate: 900000
+    significantvalue: 1
 position:
   leaf:     position
   name:     Position

package/docs/OPENWRT.md

@@ -0,0 +1,208 @@
+# Running a Frugal IoT server on an OpenWrt router
+
+**Status: worked once, on one router, after fixes.** The Raspberry Pi installation
+([INSTALLATION.md](INSTALLATION.md)) is proven; this is the same thing re-done for OpenWrt. The first
+real run - an OpenWrt One, OpenWrt 25.12.5, see [Tested on](#tested-on) - needed five attempts and
+found ten problems, which are fixed or described below. Expect the next router to find more. This
+document says what a router needs, how to prepare it, gives two scripts, and says what to send back.
+
+## What you are installing
+
+A Frugal IoT server is three programs on one machine:
+
+* **mosquitto**, an MQTT broker. Small sensor boards (ESP32s) publish readings to it, and the
+  dashboard in your browser listens to it.
+* **the Frugal IoT server**, a Node.js program. It serves the dashboard on port 8080, keeps the
+  user logins and settings in an SQLite database, and writes every reading to disk.
+* nothing else. No cloud, no internet needed once it is installed.
+
+The router is simply where they run. It does not stop being a router.
+
+## What the router needs
+
+Run the preflight script (below) and it checks every line of this table for you.
+
+| | Needed | Why |
+| --- | --- | --- |
+| **CPU** | **aarch64 or x86_64.** 32-bit ARM might work. MIPS will not. | OpenWrt's `node` package is only built for some CPUs, and the database module (`sqlite3`) is a compiled binary that has to exist for that CPU and for OpenWrt's C library (musl). Both are most likely on 64-bit. |
+| **Memory** | 512 MB or more (256 MB at the very least) | The server uses about 250 MB once running. |
+| **Storage** | **About 400 MB free** on ext4, f2fs or btrfs | The software is ~100 MB; npm needs room to work; readings accumulate. **Most routers' own flash is far too small**, so this means a USB stick or SSD, set up as extroot or just mounted, and `--dir` pointing at it. Not FAT, exFAT or NTFS: the install needs symlinks and Unix permissions. The image may also lack the USB storage driver - see [Preparing the router](#preparing-the-router). |
+| **Node.js** | **20.17 or later**, and npm | From OpenWrt's feed if it has one - **OpenWrt 25.12 has none for aarch64**, in which case it is unpacked by hand from a musl build ([how](#if-the-feed-has-no-node)). The preflight and the installer accept either. |
+| **mosquitto** | A build with **websockets** | The browser dashboard connects over websockets. If the router's mosquitto has none, the dashboard cannot work. |
+| | Ideally the **dynamic security plugin** | It gives every node and every user its own broker password. Without it the server falls back to one shared password per organization: it works, but it is the older and weaker scheme. |
+| **Network** | Internet access while installing | opkg and npm download from their own servers. |
+| **Free ports** | 1883 (nodes), 9012 (dashboard websocket), 8080 (dashboard) | Nothing on OpenWrt uses these by default; LuCI is on 80/443. |
+
+Better to have, not required: a fixed LAN address (a router has one already), and a drive that
+tolerates constant small writes - the server logs readings all day, which is hard on a cheap USB stick.
+
+## Preparing the router
+
+Two things a router often lacks, both found on the first real run. Commands are shown for `apk`
+(OpenWrt 25.12 and later); on older releases use `opkg install` instead of `apk add`.
+
+### A drive the router can see
+
+The preflight tells you when none is visible. A USB drive formatted ext4 was invisible on the test
+router because the image carried no USB storage driver:
+
+```sh
+apk add kmod-usb-storage kmod-fs-ext4 block-mount
+block info                          # is the drive listed now? what is it called?
+block detect > /etc/config/fstab    # NOTE: replaces your mount configuration - if you already have
+block mount                         #   mounts there, add the new one by hand (LuCI: System > Mount Points)
+df -h /mnt/sda1
+```
+
+Check that the drive is mounted again after a reboot (`uci show fstab`, or LuCI's Mount Points), or
+the server will not find its files and will not start.
+
+### If the feed has no node
+
+The preflight's feed check says `no node package in this feed` when this applies. Node.js publishes
+musl builds, which is what OpenWrt uses, at <https://unofficial-builds.nodejs.org/download/release/>.
+Pick a version of 20.17 or later (24.9.0 worked) and the file for your CPU: `linux-arm64-musl` for
+aarch64, `linux-x64-musl` for x86_64. **Take the `.tar.gz`, not the `.tar.xz`** - BusyBox `tar` cannot
+unpack xz. Put it on the drive, not the router's flash:
+
+```sh
+cd /mnt/sda1
+wget https://unofficial-builds.nodejs.org/download/release/v24.9.0/node-v24.9.0-linux-arm64-musl.tar.gz
+tar xzf node-v24.9.0-linux-arm64-musl.tar.gz
+for t in node npm npx; do ln -sf /mnt/sda1/node-v24.9.0-linux-arm64-musl/bin/$t /usr/bin/$t; done
+apk add libstdcpp6 libatomic1       # the musl build needs both
+node -v; npm -v
+```
+
+If `node -v` says a library is missing, that is the `apk add` line. The preflight and installer then
+see node on the router and do not look for a package.
+
+## Doing it
+
+You need `ssh` access to the router as root. On the router, fetch the two scripts from the `main` branch:
+
+```sh
+B=https://raw.githubusercontent.com/mitra42/frugal-iot-server/main/scripts
+wget -O openwrt-preflight.sh $B/openwrt-preflight.sh
+wget -O install-openwrt.sh   $B/install-openwrt.sh
+```
+
+If `wget` complains about https, the router has no TLS support for it yet
+(`apk add ca-bundle libustream-mbedtls`, or `opkg update && opkg install ...` on older releases), or download the files on your computer
+and copy them across with `scp`.
+
+### 1. Preflight - on each candidate router
+
+```sh
+sh openwrt-preflight.sh --dir /mnt/sda1/frugal-iot --install 2>&1 | tee preflight.txt
+```
+
+* `--dir` is where you intend to put the server: a path on the drive. The default is `/opt/frugal-iot`.
+* Without `--install` it only reads things, and refreshes the package list. **With `--install` it
+  installs node, mosquitto and the other packages**, after asking, so that it can try mosquitto and
+  sqlite3 for real rather than guess. That is the same set the installer would put there anyway, but it
+  does use the router's own flash: it prints how much is free first. If the flash is nearly full, run
+  it without `--install` first.
+* It ends with `PASS`/`WARN`/`FAIL` counts and a verdict. **Please send the whole of `preflight.txt`
+  for every router you try**, including the ones that fail - which ones fail, and why, is the most
+  useful thing this stage can tell us.
+
+Which router to choose is then mostly: one with no `FAIL`, a USB port with a decent drive in it, and
+512 MB or more.
+
+### 2. Install - on the one you pick
+
+```sh
+sh install-openwrt.sh --org myfarm --name "My Farm" --email you@example.com \
+     --phone +61123456789 --dir /mnt/sda1/frugal-iot
+```
+
+* `--org` is 1-10 lower-case letters or digits. It becomes the first part of every MQTT topic, and
+  the sensor boards must be flashed with the same one. Pick something you will keep.
+* Passwords you do not give are generated and printed at the end. The whole run is also logged to
+  `/root/frugal-iot-install-<date>.log` (readable only by root; the generated passwords are in it).
+* `--dry-run` checks the arguments and the router and says what it would do, changing nothing.
+* It is safe to run again after a failure: steps already done are skipped. Give it the **same**
+  `--org` and `--dir` as before - a different `--org` creates a second organization. Passwords already
+  set are left alone, and the summary says "unchanged" rather than printing a made-up one.
+* It runs the server as root, as most OpenWrt services do. `--user frugal` creates and uses a
+  separate account instead, which is tidier but is another thing that has not been tried.
+
+When it finishes it prints the dashboard address and the settings the sensor boards need.
+
+### 3. If something goes wrong
+
+Send back:
+
+1. `preflight.txt`
+2. the install log (`/root/frugal-iot-install-*.log`) - or just the end of the terminal output
+3. `logread -e frugaliot | tail -50` and `logread -e mosquitto | tail -50`
+4. the output of `apk list -I | grep -E 'mosquitto|node|sqlite|zsh'` (`opkg list-installed | grep ...`
+   on older releases)
+
+## What is different from a Raspberry Pi, and why it might fail
+
+The installer is the Pi one, redone, so these are the places it can be wrong:
+
+* **No systemd.** The service is a procd init script, `/etc/init.d/frugaliot`. Control it with
+  `service frugaliot restart`. Logs go to the system log: `logread -e frugaliot`.
+* **`/var` is RAM.** On OpenWrt `/var` is `/tmp`, emptied at every reboot. The broker's password file
+  and account database would normally live in `/var/lib/mosquitto`, which would lose every account on
+  restart, so the installer keeps them in `/etc/mosquitto/state` and points the configuration there.
+  It also moves mosquitto's own persistence (the retained values) there if it was set to a
+  RAM path; the original configuration is kept as `/etc/mosquitto/mosquitto.conf.pre-frugal`.
+* **No bash, no zsh, no sudo, no apt.** The installer is plain `sh` and installs zsh itself (the
+  server's own commands are zsh scripts). BusyBox lacks `install(1)` (it is in `coreutils-install`),
+  which stopped the first run, so the installer places files with `cp`, `chown`, `chmod` and `mv`
+  instead; and its `tar` cannot unpack `.xz`. `stat`, `sed`, `grep` and `su` worked.
+* **The sqlite3 module.** The most likely single failure. If a binary does not exist for your CPU
+  and musl, `npm install` will try to compile it, and there is no compiler. The installer stops there
+  with the error. A fix exists (compile it on another machine, or use a build environment) but it
+  is a different project.
+* **The mosquitto package.** Which parts OpenWrt builds in - websockets, the dynamic security plugin,
+  `mosquitto_ctrl`, `mosquitto_passwd` - is the main thing nobody here knows. The preflight tries each
+  one, and the installer lists every mosquitto package the feed offers into the log.
+* **No WiFi fallback network.** On the Pi, a setup network is raised if its WiFi is lost. A router is
+  the access point, so this is skipped.
+* **Time.** Routers without a battery clock start at an old date until NTP runs. The server stamps
+  readings when they arrive, so check the router has the right time.
+
+## After it is running
+
+* **Do not open the ports to the internet.** OpenWrt accepts LAN connections and refuses WAN ones by
+  default; leave 1883, 9012 and 8080 that way. HTTPS (needed for over-the-air firmware updates to the
+  boards) is not covered here.
+* **Upgrading:**
+  ```sh
+  cd /mnt/sda1/frugal-iot && npm update frugal-iot-server && service frugaliot restart
+  ```
+  (and re-run `install-openwrt.sh` with the same arguments afterwards, which brings the broker
+  configuration up to date.)
+* **If `http://<router>:8080/` answers 404** (the dashboard at `/dashboard` may still work), the
+  server cannot find its own web pages. An install whose `frugal-iot-init` failed part-way and was
+  re-run - as on the first OpenWrt run, before `init` was fixed - keeps a `config.d/server.yaml`
+  with `publicdir: ./public`. Set these in `<install dir>/config.d/server.yaml`, then
+  `service frugaliot restart`:
+  ```yaml
+  htmldir: ./node_modules/frugal-iot-client
+  nodemodulesdir: ./node_modules
+  publicdir: ./node_modules/frugal-iot-server/public
+  privatedir: ./node_modules/frugal-iot-server/private
+  ```
+  Without `publicdir` the home page, `/about.html` and the PWA's `service-worker.js` are missing too.
+* **`npx --no frugal-iot-diagnostic`** was written for systemd and will report some things that do
+  not apply here. Treat it as a hint, not a verdict.
+* **Removing it:**
+  ```sh
+  service frugaliot stop; /etc/init.d/frugaliot disable; rm /etc/init.d/frugaliot
+  rm -rf /mnt/sda1/frugal-iot                     # your install directory: this deletes the readings too
+  rm /etc/mosquitto/conf.d/frugal-iot.conf /etc/mosquitto/aclfile; rm -rf /etc/mosquitto/state
+  cp /etc/mosquitto/mosquitto.conf.pre-frugal /etc/mosquitto/mosquitto.conf   # if it exists
+  /etc/init.d/mosquitto restart
+  ```
+
+## Tested on
+
+| Date | Router | OpenWrt | Node | Server | Result |
+| --- | --- | --- | --- | --- | --- |
+| 2026-11 | OpenWrt One (Banana Pi), MediaTek Filogic, aarch64_cortex-a53, 986 MB; USB drive, ext4, mounted at `/mnt/sda1` | 25.12.5 with LibreMesh, `apk`, kernel 6.12.94 | v24.9.0 and npm 11.6.0, unpacked by hand (no node in the aarch64 feed) | 2.0.8 | Installed and running: broker (websockets and dynamic security both present), organization, procd service, dashboard. Took five runs: no USB storage driver; no node package; no `install` command; `frugal-iot-init` failing on `extras/grafana`, which also left `server.yaml` unconfigured and made `/` answer 404. All now handled by the scripts or described above, except the `init` fix, which needs a server release to reach a router. |

package/extras/frugaliot.service

@@ -1,6 +1,6 @@
 # Systemd unit for the Frugal IoT server.
 #
-# As shipped this matches the Raspberry Pi installation in INSTALLATION.md: user "pi", installed
+# As shipped this matches the Raspberry Pi installation in docs/INSTALLATION.md: user "pi", installed
 # with npm into /home/pi/frugal-iot. If that is what you have, install it unedited:
 #   sudo cp extras/frugaliot.service /etc/systemd/system/frugaliot.service
 #   sudo systemctl daemon-reload

package/extras/mosquitto.conf

@@ -6,7 +6,7 @@ protocol websockets
 # Kept under /var/lib/mosquitto, which belongs to the mosquitto user, rather than /etc/mosquitto,
 # which belongs to root. Both the broker and mosquitto_passwd warn unless the file belongs to
 # whoever opened it, and mosquitto_passwd also writes a temporary backup beside it, so the
-# directory has to be writable by that same user. See INSTALLATION.md step A5.
+# directory has to be writable by that same user. See docs/INSTALLATION.md step A5.
 password_file /var/lib/mosquitto/passwords
 
 # Which topics each account may reach. Without this, every account that can log in can publish and

package/frugal-iot-createdb.sql

@@ -108,7 +108,7 @@ CREATE TABLE IF NOT EXISTS `forwarders` (
 CREATE INDEX IF NOT EXISTS `forwarders_org` ON `forwarders` (`org`);
 
 -- A credential for Grafana (or anything else that reads history over HTTP), see lib/grafana.js and
--- GRAFANA.md. Read-only, and scoped to one organization: it can fetch that organization's readings
+-- docs/GRAFANA.md. Read-only, and scoped to one organization: it can fetch that organization's readings
 -- through /grafana/:org/ and nothing else.
 --
 -- Only a SHA-256 of the token is kept, so a copy of this database does not hand out working
@@ -269,3 +269,12 @@ CREATE TABLE IF NOT EXISTS `node_attempts` (
   `count` INTEGER NOT NULL DEFAULT 1,
   UNIQUE(`org`, `nodeid`)
 );
+
+-- Which languages browsers ask for, counted at each sign-in, to choose what to translate next - see
+-- lib/language-requests.js. Codes only: nothing records who asked.
+CREATE TABLE IF NOT EXISTS `language_requests` (
+  `code` TEXT PRIMARY KEY, -- lower-case, as the browser sent it: hi-in, pt-br
+  `count` INTEGER NOT NULL,
+  `last_seen` INTEGER NOT NULL,
+  `supported` INTEGER NOT NULL -- 1 if the client had a file for it at the last count
+);

package/frugal-iot-server.js

@@ -140,6 +140,7 @@ import crypto from 'crypto'; /* https://nodejs.org/api/crypto.html */
 import {waterfall, each} from 'async';
 import { mailInit, mailConfigured, sendMail } from './lib/mailer.js';
 import { resetCodeMake, resetCodeCheck, resetRateOk } from './lib/resetcode.js';
+import { countLanguages, parseBrowserLanguages } from './lib/language-requests.js';
 // import { openDB } from 'sqlite-express-package'; /* appContent, appSelect, validateId, validateAlias, tagCloud, atom, rss,*/
 
 export let config; // Live binding - lib/api-routes.js reads the current value at request time
@@ -155,8 +156,16 @@ function loginRedirect(res, { mode = 'signin', message, messagetype, url }) {
   if (message) { q.set('message', message); }
   if (messagetype) { q.set('messagetype', messagetype); }
   if (url) { q.set('url', url); }   // Encoded here: a return url usually has a query string of its own
+  const lang = langOf(url);
+  if (lang) { q.set('lang', lang); }
   res.redirect(`${loginUrl}?${q}`);
 }
+// The language of the page being returned to. login.html reads only its own ?lang=, and without it
+// falls back to the browser's language rather than the one picked before signing in.
+function langOf(url) {
+  if (!url) return null;
+  try { return new URL(url, 'http://localhost').searchParams.get('lang'); } catch (e) { return null; }
+}
 // A password reset link carries its token in the query string, and everything that logs a URL goes
 // to the journal, which outlives the ten minutes the token is good for.
 function redactUrl(url) {
@@ -1241,7 +1250,7 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
         app.use('/api', apiRouter);
         console.log("Mounted API routes at /api");
 
-        // History for Grafana, by bearer token - see lib/grafana.js and GRAFANA.md
+        // History for Grafana, by bearer token - see lib/grafana.js and docs/GRAFANA.md
         const grafana = createGrafanaRouters(db, config.server.datadir, loggerClient, { loggedInOrFail, can_READ });
         app.use('/grafana', grafana.data);
         app.use('/grafana_token', grafana.admin);
@@ -1273,21 +1282,33 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
           (req,res,next) => {
             console.log("Trying to login with redirect to",req.body.url);
             // This is ugly, but I cannot see how to pass the URL to passport.authenticate options
-            // Default the destination rather than trusting every caller to supply one: with no
-            // successRedirect, passport calls next() on success and the request 404s as
-            // "Cannot POST /login" - a confusing way to report a missing form field.
+            // Default the destination rather than trusting every caller to supply one - a missing
+            // form field should still land somewhere, here and in the success handler below.
             const returnTo = req.body.url || '/dashboard';
             const failureQuery = new URLSearchParams({
               mode: 'signin', messagetype: 'error',
               message: 'Incorrect username or password', url: returnTo });
+            const lang = langOf(returnTo);
+            if (lang) { failureQuery.set('lang', lang); }
             passport.authenticate('local', {
               session: true,
               //failWithError: true,
               failureRedirect: `${loginUrl}?${failureQuery}`,
-              successRedirect: returnTo,
+              // No successRedirect: on success passport calls next(), which counts and then redirects
               // In failure case will also be messages in the session which need clearing out TODO-N89
               //failureRedirect: `${loginUrl}?register=false&message=Incorrect+username+or+password&url=${req.body.url}`,
             })(req, res, next);
+          },
+          // Counted only once signed in, so failed attempts cannot pad the numbers. Not waited for.
+          (req, res) => {
+            const codes = parseBrowserLanguages(req.body.browserlangs);
+            if (codes.length) {
+              console.log("Browser languages", codes.join(','));
+              countLanguages(db, config.server.htmldir, codes, (err) => {
+                if (err) console.error("Could not count browser languages:", err.message);
+              });
+            }
+            res.redirect(req.body.url || '/dashboard');
           }
         );
         app.post('/register', (req, res) => {

package/lib/grafana.js

@@ -21,7 +21,7 @@
  *   GET  /grafana_token/:org                   list names and when last used (yours; all, for an org-wide administrator)
  *   POST /grafana_token/:org/revoke  {name}   yours; any, for an org-wide administrator
  *
- * See GRAFANA.md for setting up Grafana to use these.
+ * See docs/GRAFANA.md for setting up Grafana to use these.
  */
 
 import crypto from 'crypto';
@@ -398,7 +398,7 @@ export function createGrafanaRouters(db, dataDir, loggerClient, auth) {
       res.json(rows.map(({ user_id, ...t }) => ({ ...t, mine: user_id === Number(req.user.id) })));
     } catch (err) { next(err); }
   });
-  // The starter dashboard, to save and import into Grafana (GRAFANA.md). Nothing in it is secret.
+  // The starter dashboard, to save and import into Grafana (docs/GRAFANA.md). Nothing in it is secret.
   admin.get('/:org/dashboard', auth.loggedInOrFail, auth.can_READ, async (req, res, next) => {
     try {
       const dash = await dashboardFor(req.params.org, String(req.query.server || ''));

package/lib/language-requests.js

@@ -0,0 +1,50 @@
+/*
+ * Which languages people's browsers ask for, counted at each sign-in, so the next language to
+ * translate is the one most asked for (frugal-iot-client docs/LANGUAGES_PLAN.md, Phase 3). Codes
+ * only - nothing records who asked.
+ *
+ * To read it: SELECT * FROM language_requests ORDER BY supported, count DESC;
+ */
+import { existsSync } from 'fs';
+import { join } from 'path';
+
+// A browser sends a handful; anything longer is not a browser
+const MAX_CODES = 10;
+const CODE = /^[a-z]{2,3}(-[a-z0-9]{1,8}){0,3}$/;
+// As languageAliases in the client's core.js: browsers call Tagalog "fil", and its file is tl.yaml
+const ALIASES = { fil: 'tl' };
+
+// The form field is untrusted: keep only what looks like a language tag, lower-cased, once each
+export function parseBrowserLanguages(value) {
+  if (typeof value !== 'string') return [];
+  const codes = value.split(',').map((c) => c.trim().toLowerCase()).filter((c) => CODE.test(c));
+  return [...new Set(codes)].slice(0, MAX_CODES);
+}
+
+// The client has a file per language it supports, so whether one exists is the answer, and the
+// server keeps no list of its own. fr-CA is served by fr, as the client matches it; English is the
+// keys themselves, so it has no file.
+export function isSupported(htmldir, code) {
+  const primary = ALIASES[code.split('-')[0]] || code.split('-')[0];
+  if (primary === 'en') return true;
+  return [code, primary].some((c) => existsSync(join(htmldir, 'languages', `${c}.yaml`)));
+}
+
+// One upsert per code. cb(err) - a failure to count must never stand in the way of a login
+export function countLanguages(db, htmldir, codes, cb = () => {}) {
+  const now = Date.now();
+  let pending = codes.length;
+  let failed = null;
+  if (!pending) { cb(null); return; }
+  codes.forEach((code) => {
+    db.run(
+      `INSERT INTO language_requests (code, count, last_seen, supported) VALUES (?, 1, ?, ?)
+       ON CONFLICT(code) DO UPDATE SET count = count + 1, last_seen = excluded.last_seen,
+                                       supported = excluded.supported`,
+      [code, now, isSupported(htmldir, code) ? 1 : 0],
+      (err) => {
+        failed = failed || err;
+        if (--pending === 0) cb(failed);
+      });
+  });
+}

package/package.json

@@ -12,8 +12,8 @@
     "cookie-parser": "^1.4.7",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
-    "frugal-iot-client": "^2.0.9",
-    "frugal-iot-logger": "^2.0.9",
+    "frugal-iot-client": "^2.0.10",
+    "frugal-iot-logger": "^2.0.10",
     "hash-wasm": "^4.12.0",
     "js-yaml": "^4.2.0",
     "morgan": "^1.11.0",
@@ -64,9 +64,10 @@
     "extras/frugaliot-ap-watchdog.service",
     "extras/frugaliot-ap-watchdog.timer",
     "API.md",
-    "GRAFANA.md",
-    "INSTALL-OPENSEARCH.md",
-    "INSTALLATION.md"
+    "docs/GRAFANA.md",
+    "docs/INSTALL-OPENSEARCH.md",
+    "docs/INSTALLATION.md",
+    "docs/OPENWRT.md"
   ],
   "devDependencies": {
     "supertest": "^7.2.2",
@@ -93,7 +94,7 @@
     "check-files": "node scripts/check-published-files.js"
   },
   "type": "module",
-  "version": "2.0.9",
+  "version": "2.0.10",
   "overrides": {
     "uuid": "^11.1.1"
   }

package/public/service-worker.js

@@ -6,7 +6,7 @@
 // it, an installed browser keeps serving the files it already cached - and since the list now covers
 // the dashboard's own code, that means old JS behind freshly fetched HTML. Any edit to the list
 // needs this bumped, or it does not reach anyone who already has the old one.
-const CACHE_NAME = 'frugal-iot-cache-2.0.9';
+const CACHE_NAME = 'frugal-iot-cache-2.0.10';
 /*
  * Everything the app needs, so that a phone on a poor or expensive link fetches it once.
  *
@@ -100,6 +100,14 @@ self.addEventListener('fetch', event => {
         // Scoped to CACHE_NAME: a bare caches.match searches every cache in the origin, so a
         // leftover older cache answers first and the version bump achieves nothing
         caches.match(event.request, {cacheName: CACHE_NAME})
-            .then(response => response || fetch(event.request))
+            .then(response => response || fetch(event.request).then(fetched => {
+                // A language is cached when first used, not at install: there are many, and a
+                // phone wants one
+                if (fetched.ok && new URL(event.request.url).pathname.startsWith('/dashboard/languages/')) {
+                    const copy = fetched.clone();
+                    caches.open(CACHE_NAME).then(cache => cache.put(event.request, copy));
+                }
+                return fetched;
+            }))
     );
 });

package/scripts/addbridge-pi.zsh

@@ -5,7 +5,7 @@
 # After this, the Pi's readings also appear on the production server, and its nodes can be
 # controlled from there - while the Pi carries on recording and serving on its own whenever the
 # link is down. Readings taken during an outage stay on the Pi: production gets a gap rather than
-# a backlog delivered later with the wrong timestamps. INSTALLATION.md step 11 explains why.
+# a backlog delivered later with the wrong timestamps. docs/INSTALLATION.md step 11 explains why.
 #
 # The relaying is done by the broker, so the server, the logger and the nodes are untouched.
 #

package/scripts/addbridge-prod.zsh

@@ -24,7 +24,7 @@
 # printed - it is needed once, to type into the Pi.
 #
 # This assumes the server has already been set up to accept bridges at all: a TLS listener on 8883
-# with a certificate. That is a one-off, and INSTALLATION.md step 11 covers it.
+# with a certificate. That is a one-off, and docs/INSTALLATION.md step 11 covers it.
 
 set -euo pipefail
 
@@ -255,7 +255,7 @@ else
   echo ""
   echo "NOTE: this broker has no acl_file, so ${ACCOUNT} can reach every topic on it, not just"
   echo "  ${ORG_ID}/#. That is how the broker already treats every other account, so this is no"
-  echo "  worse than what is there - but see INSTALLATION.md step 11 for restricting it."
+  echo "  worse than what is there - but see docs/INSTALLATION.md step 11 for restricting it."
 fi
 
 # password_file and acl_file are both re-read on a reload, so nothing needs to be disconnected.

package/scripts/addorganization.zsh

@@ -133,11 +133,20 @@ if [[ ! -w "$MOSQUITTO_PASSWD_DIR" || ( -e "$MOSQUITTO_PASSWD_FILE" && ! -w "$MO
     fi
   fi
 fi
+# Run as root there is no sudo to go through (OpenWrt has none, and runs everything as root), and
+# mosquitto_passwd then rewrites the file as root - which the broker, running as its own account,
+# cannot read. So when root is doing it and somebody else owns the file, hand it back afterwards.
+if (( EUID == 0 )) && [[ -n "$MOSQUITTO_PASSWD_OWNER" && "$MOSQUITTO_PASSWD_OWNER" != "root" ]]; then
+  MOSQUITTO_RESTORE_OWNER=1
+fi
 # Called after any successful mosquitto_passwd run below
 restore_passwd_owner() {
   (( MOSQUITTO_RESTORE_OWNER )) || return 0
-  sudo chown "${MOSQUITTO_PASSWD_OWNER}:${MOSQUITTO_PASSWD_GROUP}" "$MOSQUITTO_PASSWD_FILE"
-  [[ -n "$MOSQUITTO_PASSWD_MODE" ]] && sudo chmod "$MOSQUITTO_PASSWD_MODE" "$MOSQUITTO_PASSWD_FILE"
+  local SUDO=(sudo)
+  (( EUID == 0 )) && SUDO=()
+  "${SUDO[@]}" chown "${MOSQUITTO_PASSWD_OWNER}:${MOSQUITTO_PASSWD_GROUP}" "$MOSQUITTO_PASSWD_FILE"
+  [[ -n "$MOSQUITTO_PASSWD_MODE" ]] && "${SUDO[@]}" chmod "$MOSQUITTO_PASSWD_MODE" "$MOSQUITTO_PASSWD_FILE"
+  return 0
 }
 
 # ---- Escaping helpers ----