frugal-iot-server 2.0.9 → 2.0.10

package/scripts/install-pi.sh

@@ -2,7 +2,7 @@
 #
 # Install a complete Frugal IoT server - broker, server, service - on a freshly flashed Raspberry Pi.
 #
-# This does automatically what INSTALLATION.md walks through by hand, steps 3 to 8. Read that if you
+# This does automatically what docs/INSTALLATION.md walks through by hand, steps 3 to 8. Read that if you
 # want to know why any of it is being done; this only says what it is doing as it goes.
 #
 #   curl -fsSLO https://raw.githubusercontent.com/mitra42/frugal-iot-server/main/scripts/install-pi.sh
@@ -20,15 +20,15 @@
 # step: compiling sqlite3 on a Zero W takes about 40 minutes and is not repeated once it is done.
 #
 # What it does NOT do:
-#   * flash the SD card, or set up wifi - INSTALLATION.md steps 1 and 2, before you can ssh in
+#   * flash the SD card, or set up wifi - docs/INSTALLATION.md steps 1 and 2, before you can ssh in
 #   * point your sensor nodes at this server - that means flashing the nodes, which happens on your
 #     workstation, not here. It prints the settings to give them.
-#   * HTTPS, which over-the-air firmware updates to ESP32 need - INSTALLATION.md step 10
+#   * HTTPS, which over-the-air firmware updates to ESP32 need - docs/INSTALLATION.md step 10
 #   * reboot. A reboot is worth doing afterwards if the upgrade brought a new kernel.
 #
 # It does set up what happens when the Pi later LOSES its WiFi - moved to another site, or the router
 # replaced: a network of its own, frugaliot-bridge-setup, whose page sets a new one. Otherwise a Pi
-# on WiFi is unreachable at exactly the moment it needs its WiFi changed. INSTALLATION.md, "Moving the
+# on WiFi is unreachable at exactly the moment it needs its WiFi changed. docs/INSTALLATION.md, "Moving the
 # Pi to another WiFi network", is the operator's side of it.
 
 set -Eeuo pipefail
@@ -460,8 +460,25 @@ ask ORG_EMAIL "Contact email" || exit 1
 ask ORG_PHONE "Contact phone ('+' and digits only)" || exit 1
 [[ "$ORG_PHONE" =~ ^[+]?[0-9]+$ ]] || { echo "Phone must be '+' and digits only: '${ORG_PHONE}'" >&2; exit 1; }
 # Asked for in the order they matter. Each may be typed, passed as an option, or generated.
-ask_password SUPER_PW  "the superuser login (this server's administrator)"
-ask_password LOGIN_PW  "the ${ORG_ID} web login"
+#
+# But not on a re-run where the account is already there: further down, an existing superuser or
+# organization keeps the password it has, so asking for one would take what you typed and quietly
+# ignore it - and the summary would then print a made-up password that was never set. What stands
+# in for the password is shown in the summary instead.
+KEPT_PW="(unchanged - set by an earlier run)"
+if [[ -f "${INSTALL_DIR}/frugal-iot.db" ]] && command -v sqlite3 >/dev/null 2>&1 \
+   && [[ -n "$(sqlite3 "${INSTALL_DIR}/frugal-iot.db" "SELECT 1 FROM users WHERE username='superuser' AND hashed_password IS NOT NULL;" 2>/dev/null || true)" ]]; then
+  SUPER_PW="$KEPT_PW"
+  info "the superuser already has a password - leaving it alone"
+else
+  ask_password SUPER_PW  "the superuser login (this server's administrator)"
+fi
+if [[ -f "${INSTALL_DIR}/config.d/organizations/${ORG_ID}.yaml" ]]; then
+  LOGIN_PW="$KEPT_PW"
+  info "organization ${ORG_ID} already exists - leaving its login password alone"
+else
+  ask_password LOGIN_PW  "the ${ORG_ID} web login"
+fi
 # Not asked for. addorganization.zsh requires one, and lib/retained.js falls back to it on a broker
 # with no dynamic security - but this installer always sets dynamic security up, so on this Pi every
 # node is issued its own credential when it enrols and every browser derives its own when it logs
@@ -679,7 +696,7 @@ WANTED_BROKER="ws://${BROKER_HOST}:9012"
 if [[ "$CURRENT_BROKER" == "$WANTED_BROKER" ]]; then
   skip "broker already ${WANTED_BROKER}"
 else
-  as_user_sh "printf '# This Pi is its own broker - see INSTALLATION.md step 4\nbroker: %s\n' '${WANTED_BROKER}' > '${MQTT_YAML}'"
+  as_user_sh "printf '# This Pi is its own broker - see docs/INSTALLATION.md step 4\nbroker: %s\n' '${WANTED_BROKER}' > '${MQTT_YAML}'"
   ok "broker set to ${WANTED_BROKER} (was ${CURRENT_BROKER:-unset})"
 fi
 
@@ -730,7 +747,7 @@ SRC_ACL="${PKG_DIR}/extras/aclfile"
 # it root-owned 644, which works and only draws a warning from the broker; "fixing" it to 600
 # without also chowning it to mosquitto stops the broker starting, because it reads this file after
 # dropping privileges. That is a migration to make deliberately, not a side effect of an upgrade -
-# INSTALLATION.md step 11 has it.
+# docs/INSTALLATION.md step 11 has it.
 if [[ ! -e /etc/mosquitto/aclfile ]]; then
   sudo_ install -o mosquitto -g mosquitto -m 600 "$SRC_ACL" /etc/mosquitto/aclfile
   ok "access control list installed at /etc/mosquitto/aclfile"
@@ -875,6 +892,7 @@ ok "broker running"
 step "Creating the administrator login"
 if as_user_sh "cd '${INSTALL_DIR}' && sqlite3 frugal-iot.db \"SELECT 1 FROM users WHERE username='superuser' AND hashed_password IS NOT NULL;\"" | grep -q 1; then
   skip "superuser already has a password"
+  SUPER_PW="$KEPT_PW"   # whatever was asked or generated above was never used
 else
   as_user_sh "cd '${INSTALL_DIR}' && npx --no frugal-iot-setpassword superuser '${SUPER_PW}'" >/dev/null
   ok "superuser password set"
@@ -883,6 +901,7 @@ fi
 step "Creating the organization"
 if [[ -f "${INSTALL_DIR}/config.d/organizations/${ORG_ID}.yaml" ]]; then
   skip "organization ${ORG_ID} already exists"
+  LOGIN_PW="$KEPT_PW"
   BROKER_PW="$(sed -n 's/^mqtt_password:[[:space:]]*//p' "${INSTALL_DIR}/config.d/organizations/${ORG_ID}.yaml" | head -1 | tr -d "\"'" || true)"
   info "using the broker password already in its configuration"
 else
@@ -980,6 +999,18 @@ else
   echo "The server is not answering on port ${PORT} (last response: ${CODE:-none})." >&2
   echo "What it logged:" >&2
   sudo_ journalctl -u frugaliot -n 30 --no-pager >&2 || true
+  if [[ "${CODE:-}" == "404" ]]; then
+    # The server is up but cannot find its web pages. Seen when an earlier frugal-iot-init stopped
+    # part-way: the re-run leaves an existing server.yaml alone, still saying "publicdir: ./public".
+    echo "A 404 means the server is up but cannot find its web pages. Look at publicdir and htmldir in" >&2
+    echo "${INSTALL_DIR}/config.d/server.yaml: after a normal install they point into ./node_modules." >&2
+    echo "If publicdir is still './public', set these four lines there and restart" >&2
+    echo "(sudo systemctl restart frugaliot):" >&2
+    echo "    htmldir: ./node_modules/frugal-iot-client" >&2
+    echo "    nodemodulesdir: ./node_modules" >&2
+    echo "    publicdir: ./node_modules/frugal-iot-server/public" >&2
+    echo "    privatedir: ./node_modules/frugal-iot-server/private" >&2
+  fi
   exit 1
 fi
 systemctl is-enabled --quiet frugaliot && ok "will start again at boot"
@@ -1055,7 +1086,10 @@ ENROL_SECRET="$(as_user_sh "grep -A1 '^enrolment_${ORG_ID}:' '${INSTALL_DIR}/con
 # Only the generated ones are worth printing - and printing a password you typed would put it in the
 # log for no reason
 was_generated() { local v; for v in ${GENERATED[@]+"${GENERATED[@]}"}; do [[ "$v" == "$1" ]] && return 0; done; return 1; }
-shown() { if was_generated "$1"; then echo "${!1}"; else echo "(the one you gave)"; fi; }
+shown() {
+  [[ "${!1}" == "("* ]] && { echo "${!1}"; return; }   # not set by this run
+  if was_generated "$1"; then echo "${!1}"; else echo "(the one you gave)"; fi
+}
 
 if (( ${#REBOOT_REASONS[@]} )); then
   REBOOT_TEXT=" 3. REBOOT NEEDED - $(printf '%s' "${REBOOT_REASONS[0]}")."
@@ -1079,7 +1113,7 @@ else
   AP_TEXT=" If this Pi cannot find its WiFi - moved, or a new router - it raises a network
     called ${AP_NAME}. Join it from a phone or laptop; the password is
     ${AP_PW_TEXT}. A page opens to choose the new WiFi.
-    INSTALLATION.md, \"Moving the Pi to another WiFi network\", has the rest."
+    docs/INSTALLATION.md, \"Moving the Pi to another WiFi network\", has the rest."
 fi
 
 cat <<SUMMARY
@@ -1130,9 +1164,9 @@ ${REBOOT_TEXT}
 
  4. Outgoing mail, if you want people to be able to reset a forgotten password themselves.
     Without it only you can, on this Pi, with frugal-iot-setpassword.
-    Optional - see INSTALLATION.md step 9a.
+    Optional - see docs/INSTALLATION.md step 9a.
 
- 5. HTTPS. NOT WRITTEN YET: step 10 of INSTALLATION.md describes what it will cover - a DNS
+ 5. HTTPS. NOT WRITTEN YET: step 10 of docs/INSTALLATION.md describes what it will cover - a DNS
     name, port forwarding, nginx in front of port ${PORT}, and certbot - but there are no
     instructions to follow there yet. Until then this is a plain HTTP server on your own
     network, which is all an offline installation needs. What you do not get is over-the-air

package/scripts/openwrt-preflight.sh

@@ -0,0 +1,363 @@
+#!/bin/sh
+#
+# Will a Frugal IoT server run on this OpenWrt router?  Run this BEFORE install-openwrt.sh.
+#
+#   wget -O openwrt-preflight.sh https://raw.githubusercontent.com/mitra42/frugal-iot-server/main/scripts/openwrt-preflight.sh
+#   sh openwrt-preflight.sh --install 2>&1 | tee preflight.txt
+#
+# It looks at the things that have decided whether this works, in the order they are likely to stop it:
+# the CPU, memory, a place to put ~400 MB, whether OpenWrt's package feed has a recent enough node,
+# and - by actually trying them - whether this build of mosquitto can do websockets and load the dynamic
+# security plugin, and whether the sqlite3 module can be installed here at all.
+#
+# Without --install it changes nothing except refreshing the package list. With --install it also
+# installs the packages the server needs (the same ones install-openwrt.sh would), so the last three
+# checks can be run for real. It asks first.
+#
+# Plain /bin/sh on purpose: a fresh OpenWrt has no bash. Safe to run as often as you like.
+
+set -u
+
+DIR=/opt/frugal-iot; INSTALL=0; ASSUME_YES=0
+
+usage() {
+  cat <<USAGE
+Usage: sh openwrt-preflight.sh [options]
+
+  --dir <path>   where the server would be installed (default: ${DIR}). Only used to check there is
+                 room, and as the place to try the sqlite3 module.
+  --install      also install node, mosquitto and the other packages, so everything can be tested
+  --yes          do not ask before installing
+  --help
+USAGE
+  exit "${1:-0}"
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --dir)      [ $# -ge 2 ] || usage 1; DIR=$2; shift 2 ;;
+    --install)  INSTALL=1; shift ;;
+    --yes|-y)   ASSUME_YES=1; shift ;;
+    --help|-h)  usage 0 ;;
+    *) echo "Unknown option: $1" >&2; usage 1 ;;
+  esac
+done
+
+N_PASS=0; N_WARN=0; N_FAIL=0
+BLOCKERS=""
+pass()  { N_PASS=$((N_PASS+1)); echo "  PASS  $*"; }
+warn()  { N_WARN=$((N_WARN+1)); echo "  WARN  $*"; }
+fail()  { N_FAIL=$((N_FAIL+1)); echo "  FAIL  $*"; BLOCKERS="${BLOCKERS}
+    - $*"; }
+info()  { echo "        $*"; }
+head_() { echo; echo "== $* =="; }
+
+# Needed by the server and its setup commands. zsh because every "npx frugal-iot-..." command is a
+# zsh script; ca-bundle because npm fetches over https; sqlite3-cli because frugal-iot-init uses it.
+PKGS="node node-npm zsh sqlite3-cli curl ca-bundle"
+
+# ---------------------------------------------------------------- package manager
+if command -v opkg >/dev/null 2>&1; then PM=opkg
+elif command -v apk >/dev/null 2>&1; then PM=apk
+else PM=""; fi
+
+pkg_update() { case "$PM" in opkg) opkg update >/dev/null 2>&1 ;; apk) apk update >/dev/null 2>&1 ;; esac; }
+pkg_installed() {
+  case "$PM" in
+    opkg) opkg list-installed 2>/dev/null | grep -q "^$1 " ;;
+    apk)  apk info -e "$1" >/dev/null 2>&1 ;;
+    *)    return 1 ;;
+  esac
+}
+# Prints the version a feed offers for a package, nothing if it has none
+pkg_version() {
+  case "$PM" in
+    opkg) opkg list "$1" 2>/dev/null | awk -v n="$1" '$1==n {print $3; exit}' ;;
+    apk)  apk search -e -v "$1" 2>/dev/null | head -1 | sed "s/^$1-//" ;;
+  esac
+}
+pkg_install() {
+  case "$PM" in
+    opkg) opkg install "$@" ;;
+    apk)  apk add "$@" ;;
+  esac
+}
+
+# "20.18.1-r1" -> true if at least 20.17
+node_version_ok() {
+  echo "$1" | sed 's/^v//' | awk -F'[.-]' '{ exit !($1 > 20 || ($1 == 20 && $2 >= 17)) }'
+}
+
+# Longest mount point that holds a path, and its filesystem type
+mount_info() {
+  p=$1
+  while [ ! -e "$p" ] && [ "$p" != / ]; do p=$(dirname "$p"); done
+  p=$(cd "$p" 2>/dev/null && pwd -P || echo "$p")
+  awk -v p="$p" '
+    { m = $2; pre = (m == "/") ? "/" : (m "/")
+      if ((p == m || index(p, pre) == 1) && length(m) >= length(best)) { best = m; fs = $3 } }
+    END { print best, fs }' /proc/mounts
+}
+free_mb() { p=$1; while [ ! -e "$p" ] && [ "$p" != / ]; do p=$(dirname "$p"); done
+            df -Pk "$p" 2>/dev/null | awk 'NR==2 {print int($4/1024)}'; }
+
+echo "Frugal IoT on OpenWrt - preflight check"
+echo "Date: $(date)"
+
+# ---------------------------------------------------------------- the machine
+head_ "The router"
+if [ -r /etc/openwrt_release ]; then
+  . /etc/openwrt_release
+  info "${DISTRIB_DESCRIPTION:-OpenWrt}   target ${DISTRIB_TARGET:-?}   package arch ${DISTRIB_ARCH:-?}"
+  pass "this is OpenWrt"
+else
+  warn "no /etc/openwrt_release - this does not look like OpenWrt. The checks below still run."
+  DISTRIB_ARCH=$(uname -m)
+fi
+MODEL=$( { cat /tmp/sysinfo/model || tr -d '\0' < /proc/device-tree/model; } 2>/dev/null || echo unknown)
+info "board:  ${MODEL}"
+info "kernel: $(uname -m)   $(uname -r)"
+[ -n "$PM" ] && pass "package manager: ${PM}" || fail "neither opkg nor apk found"
+[ "$(id -u)" = 0 ] && pass "running as root" || warn "not root - the installer must run as root"
+
+case "${DISTRIB_ARCH:-}" in
+  x86_64*|aarch64*)
+    pass "CPU architecture ${DISTRIB_ARCH} - the kind this is most likely to work on" ;;
+  arm_*|i386*|x86*)
+    warn "CPU architecture ${DISTRIB_ARCH}: 32-bit. node may exist for it, but sqlite3 has no ready-made binary there, so it would have to be compiled" ;;
+  *)
+    fail "CPU architecture ${DISTRIB_ARCH}: OpenWrt is not known to have node for this (mips, powerpc, riscv...). The feed check below is the real test" ;;
+esac
+
+MEM_KB=$(awk '/^MemTotal:/ {print $2}' /proc/meminfo 2>/dev/null || echo 0)
+AVAIL_KB=$(awk '/^MemAvailable:/ {print $2}' /proc/meminfo 2>/dev/null || echo 0)
+info "memory: $((MEM_KB/1024)) MB total, $((AVAIL_KB/1024)) MB available now"
+if   [ "$MEM_KB" -lt 240000 ]; then fail "under 256 MB of memory: the server alone uses about 250 MB"
+elif [ "$MEM_KB" -lt 460000 ]; then warn "under 512 MB: may work, but the router's own services and the server will be competing"
+else pass "memory"; fi
+
+YEAR=$(date +%Y)
+if [ "$YEAR" -lt 2024 ]; then warn "the clock says ${YEAR}. Readings are stamped on arrival, so set the time (NTP) first"
+else pass "clock is set (${YEAR})"; fi
+
+# ---------------------------------------------------------------- storage
+head_ "Storage"
+info "wanted: about 400 MB free on a normal Linux filesystem (ext4, f2fs, btrfs). The software is"
+info "~100 MB, npm needs room while installing, and sensor data keeps growing."
+info "Not FAT/exFAT/NTFS - the install uses symlinks and Unix permissions."
+echo "  Filesystems with room:"
+awk '$3 ~ /^(ext2|ext3|ext4|f2fs|btrfs|xfs|overlay|ubifs|jffs2)$/ {print $2, $3}' /proc/mounts | sort -u | while read -r mnt fs; do
+  mb=$(free_mb "$mnt"); [ -n "$mb" ] && echo "        ${mnt}  (${fs})  ${mb} MB free"
+done
+
+set -- $(mount_info "$DIR"); DMNT=${1:-/}; DFS=${2:-?}
+DFREE=$(free_mb "$DIR"); DFREE=${DFREE:-0}
+info "install directory ${DIR} is on ${DMNT} (${DFS}), ${DFREE} MB free"
+case "$DFS" in
+  vfat|exfat|msdos|ntfs|fuseblk) fail "${DIR} is on ${DFS}, which cannot hold the install. Put it on an ext4 drive: --dir /mnt/<drive>/frugal-iot" ;;
+  *) if [ "$DFREE" -lt 400 ]; then
+       fail "only ${DFREE} MB free for ${DIR}. Attach a USB/SSD drive (extroot, or mount it) and use --dir"
+       if ! ls /dev/sd[a-z]* /dev/mmcblk[1-9]* /dev/nvme* >/dev/null 2>&1; then
+         # Seen on a real router: the drive was plugged in and formatted ext4, and invisible, because
+         # the image carried no USB storage driver.
+         info "No USB, SD or NVMe drive is visible at all. If one is plugged in, this OpenWrt image has no"
+         info "driver for it. Install the driver, then mount it:"
+         info "    $( [ "$PM" = apk ] && echo 'apk add' || echo 'opkg install' ) kmod-usb-storage kmod-fs-ext4 block-mount"
+         info "    block detect > /etc/config/fstab; block mount"
+         info "and run this again with --dir /mnt/<drive>/frugal-iot (see 'block info' for the name)."
+       else
+         info "A drive is visible but has no room under ${DIR}. If it is not mounted: block detect > /etc/config/fstab; block mount"
+       fi
+     else pass "room for the install (${DFREE} MB)"; fi ;;
+esac
+
+# ---------------------------------------------------------------- the package feed
+head_ "OpenWrt's package feed"
+if [ -n "$PM" ]; then
+  info "refreshing the package list ($PM) - this changes nothing else"
+  pkg_update || warn "could not refresh the package list - no internet from the router?"
+  # Node may be on the router without being a package: OpenWrt 25.12 has no node for aarch64, and
+  # one that was unpacked by hand from a musl build is just as good. So look at what runs, not at
+  # what the package manager knows.
+  HAVE_NODE=0
+  command -v node >/dev/null 2>&1 && command -v npm >/dev/null 2>&1 && HAVE_NODE=1
+  for p in $PKGS; do
+    v=$(pkg_version "$p")
+    if pkg_installed "$p"; then info "${p}: installed"
+    elif [ -n "$v" ]; then info "${p}: available (${v})"
+    else
+      case "$p" in
+        node|node-npm)
+          if [ "$HAVE_NODE" = 1 ]; then info "${p}: not in this feed, but node and npm are already on this router"
+          elif [ "$p" = node ]; then
+            fail "no node package in this feed, and no node on this router. Node 20.17 or later has to be installed by hand - docs/OPENWRT.md, 'If the feed has no node'"
+          fi ;;
+        zsh) fail "package '${p}' is not in this feed" ;;
+        *) warn "package '${p}' is not in this feed" ;;
+      esac
+    fi
+  done
+  NV=""; NSRC="in the feed"
+  if command -v node >/dev/null 2>&1; then
+    NSRC="already on this router"
+    NV=$(node -v 2>/dev/null || true)
+    [ -n "$NV" ] || fail "node is on this router but will not run - a musl build needs libstdcpp6 and libatomic1"
+  else
+    NV=$(pkg_version node)
+  fi
+  if [ -n "$NV" ]; then
+    if node_version_ok "$NV"; then pass "node ${NV}, ${NSRC} (the server needs 20.17 or later)"
+    else fail "node ${NV} is older than the 20.17 the server needs"; fi
+  fi
+  if command -v node >/dev/null 2>&1 && ! command -v npm >/dev/null 2>&1; then warn "node is here but npm is not on the PATH"; fi
+  MQ=""
+  for cand in mosquitto-ssl mosquitto-nossl; do
+    if pkg_installed "$cand" || [ -n "$(pkg_version "$cand")" ]; then MQ=$cand; break; fi
+  done
+  [ -n "$MQ" ] && pass "mosquitto package: ${MQ}" || fail "no mosquitto-ssl or mosquitto-nossl package in this feed"
+  info "everything the feed has with 'mosquitto' in its name:"
+  case "$PM" in
+    opkg) opkg list 2>/dev/null | awk '/^(lib)?mosquitto/ {print "        " $1, $2, $3}' ;;
+    apk)  apk search mosquitto 2>/dev/null | sed 's/^/        /' ;;
+  esac
+fi
+
+# ---------------------------------------------------------------- optional install
+if [ "$INSTALL" = 1 ] && [ -n "$PM" ]; then
+  head_ "Installing what is needed to test the rest"
+  MQ_ALL="${MQ:-mosquitto-ssl}"
+  case "$MQ_ALL" in *-nossl) MQC=mosquitto-client-nossl ;; *) MQC=mosquitto-client-ssl ;; esac
+  WANT=""
+  for p in $PKGS; do
+    case "$p" in node|node-npm) [ "$HAVE_NODE" = 1 ] && continue ;; esac
+    WANT="$WANT $p"
+  done
+  WANT="${WANT# } $MQ_ALL $MQC"
+  info "will install: ${WANT}"
+  info "free space on the router's own flash: $(free_mb /) MB. Node alone is tens of MB."
+  go=1
+  if [ "$ASSUME_YES" != 1 ]; then
+    printf '        Install these now? [y/N] '; read -r reply || reply=n
+    case "$reply" in y|Y|yes) ;; *) go=0 ;; esac
+  fi
+  if [ "$go" = 1 ]; then
+    for p in $WANT; do
+      pkg_installed "$p" && continue
+      [ -n "$(pkg_version "$p")" ] || { info "${p} is not in this feed - skipped"; continue; }
+      pkg_install "$p" >/dev/null 2>&1 && info "installed ${p}" || warn "could not install ${p}"
+    done
+  else
+    info "skipped - the broker and sqlite3 tests below will be skipped too"
+  fi
+fi
+
+# ---------------------------------------------------------------- the broker, tried for real
+head_ "mosquitto, tried for real"
+TMP=$(mktemp -d 2>/dev/null || echo /tmp/frugal-preflight-$$); mkdir -p "$TMP"
+cleanup() {
+  [ -n "${MQPID:-}" ] && kill "$MQPID" 2>/dev/null
+  rm -rf "$TMP"
+  [ -n "${SQDIR:-}" ] && rm -rf "$SQDIR"
+}
+trap cleanup EXIT
+
+if ! command -v mosquitto >/dev/null 2>&1; then
+  warn "mosquitto is not installed, so it cannot be tested. Run again with --install"
+else
+  info "$(mosquitto -h 2>&1 | head -1)"
+  # Does this build do websockets? The dashboard in a browser needs it. Ask the broker to open one.
+  cat > "$TMP/ws.conf" <<CONF
+allow_anonymous true
+listener 29883 127.0.0.1
+protocol mqtt
+listener 29012 127.0.0.1
+protocol websockets
+CONF
+  mosquitto -c "$TMP/ws.conf" > "$TMP/ws.log" 2>&1 &
+  MQPID=$!; sleep 2
+  if kill -0 "$MQPID" 2>/dev/null; then
+    pass "websockets listener starts (the browser dashboard needs one)"
+    kill "$MQPID" 2>/dev/null; MQPID=""
+  else
+    fail "this mosquitto will not start with a websockets listener: $(tail -1 "$TMP/ws.log")"
+  fi
+
+  # The dynamic security plugin: where is it, and does it load?
+  SO=""
+  for cand in /usr/lib/mosquitto/mosquitto_dynamic_security.so /usr/lib/mosquitto_dynamic_security.so \
+              /usr/lib/*/mosquitto_dynamic_security.so /usr/lib/*/mosquitto/mosquitto_dynamic_security.so; do
+    [ -f "$cand" ] && { SO=$cand; break; }
+  done
+  if [ -z "$SO" ]; then
+    warn "no mosquitto_dynamic_security.so found. The server would run on the older shared-password scheme: every node and browser uses the organization's password. Works, but less secure"
+  else
+    cat > "$TMP/dyn.conf" <<CONF
+allow_anonymous true
+listener 29884 127.0.0.1
+plugin ${SO}
+plugin_opt_config_file ${TMP}/dynsec.json
+CONF
+    mosquitto -c "$TMP/dyn.conf" > "$TMP/dyn.log" 2>&1 &
+    MQPID=$!; sleep 2
+    if kill -0 "$MQPID" 2>/dev/null; then pass "dynamic security plugin loads (${SO})"
+    else warn "dynamic security plugin found at ${SO} but did not load: $(tail -1 "$TMP/dyn.log")"; fi
+    kill "$MQPID" 2>/dev/null; MQPID=""
+  fi
+  for t in mosquitto_ctrl mosquitto_passwd mosquitto_pub mosquitto_sub; do
+    command -v "$t" >/dev/null 2>&1 && info "have ${t}" || {
+      case "$t" in
+        mosquitto_passwd) fail "no mosquitto_passwd: the installer needs it" ;;
+        mosquitto_ctrl)   [ -n "$SO" ] && warn "no mosquitto_ctrl: the dynamic security plugin cannot be set up without it" ;;
+        *) warn "no ${t}" ;;
+      esac; }
+  done
+fi
+
+# ---------------------------------------------------------------- sqlite3, the module that most often fails
+head_ "sqlite3 (the server's database module)"
+if command -v node >/dev/null 2>&1 && command -v npm >/dev/null 2>&1; then
+  if [ "$DFREE" -lt 150 ]; then
+    warn "not enough room under ${DIR} to try it (${DFREE} MB) - skipped"
+  else
+    SQDIR="${DIR}/.preflight-$$"
+    mkdir -p "$SQDIR" && cd "$SQDIR" || SQDIR=""
+    if [ -n "$SQDIR" ]; then
+      info "node $(node -v), npm $(npm -v). Trying: npm install sqlite3 (needs the internet)"
+      export npm_config_cache="${SQDIR}/.cache"
+      if npm install --no-audit --no-fund --loglevel=error 'sqlite3@^6.0.1' > "$SQDIR/npm.log" 2>&1 \
+         && node -e "
+const s = require('sqlite3');
+new s.Database(':memory:').get('select sqlite_version() v', (e, r) => {
+  if (e) { console.error(e); process.exit(1); } console.log(r.v); })" > "$SQDIR/run.log" 2>&1; then
+        pass "sqlite3 installs and runs here (SQLite $(cat "$SQDIR/run.log"))"
+      else
+        fail "sqlite3 would not install or load on this router. Last lines:"
+        tail -8 "$SQDIR/npm.log" "$SQDIR/run.log" 2>/dev/null | sed 's/^/        /'
+      fi
+      cd /
+    fi
+  fi
+else
+  warn "node/npm are not installed, so sqlite3 cannot be tested. Run again with --install"
+fi
+
+# ---------------------------------------------------------------- ports
+head_ "Ports"
+for port in 1883 9012 8080; do
+  if netstat -ln 2>/dev/null | grep -q "[:.]${port} "; then warn "port ${port} is already in use here - something else is listening on it"
+  else info "port ${port} is free"; fi
+done
+
+# ---------------------------------------------------------------- verdict
+head_ "Verdict"
+echo "  ${N_PASS} passed, ${N_WARN} warnings, ${N_FAIL} failed"
+if [ "$N_FAIL" -gt 0 ]; then
+  echo "  NOT READY:${BLOCKERS}"
+elif [ "$N_WARN" -gt 0 ]; then
+  echo "  Probably workable - read the warnings above."
+else
+  echo "  Looks good."
+fi
+echo
+echo "Please send everything above to whoever asked you to try this."
+exit 0