boneio 1.6.0.dev6__tar.gz → 1.6.0.dev8__tar.gz

{boneio-1.6.0.dev6/boneio.egg-info → boneio-1.6.0.dev8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boneio
-Version: 1.6.0.dev6
+Version: 1.6.0.dev8
 Summary: Python App for BoneIO
 Author-email: Paweł Szafer <pszafer@gmail.com>
 License: GNU General Public License v3.0

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/const.py

@@ -97,6 +97,14 @@ HOST = "host"
 USERNAME = "username"
 PASSWORD = "password"
 PORT = "port"
+
+#: The port the device's built-in reverse proxy publishes HTTPS on.
+#:
+#: Set in docker-compose.yaml as HTTPS_PORT and defaulted there too; this is
+#: the same number, for the parts of the application that need to name the
+#: proxy without reading the compose file. It lives here rather than beside the
+#: web server so that core can use it without importing the web layer.
+DEFAULT_PROXY_PORT = 8443
 ONLINE = "online"
 OFFLINE = "offline"
 TOPIC = "topic"

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/core/cloud/data/init-certs-cloud.sh

@@ -74,6 +74,13 @@ fi
 # Generate Caddyfile
 cat > /tmp/Caddyfile << EOF
 {
+        # Six months, not the twelve hours Caddy defaults to — see the
+        # non-cloud script. The intermediate has to outlive the leaves.
+        pki {
+                ca local {
+                        intermediate_lifetime 365d
+                }
+        }
         # Global options - empty for internal issuer
 }
 
@@ -91,7 +98,10 @@ ${CLOUD_BLOCK}
 
 # HTTPS with self-signed certificate (catch-all for hostname and IP access)
 https:// {
-        tls internal {
+        tls {
+                issuer internal {
+                        lifetime 180d
+                }
                 on_demand
         }
 

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/core/cloud/registration.py

@@ -27,6 +27,7 @@ from boneio.core.cloud.secrets import MASTER_SECRET as DEFAULT_MASTER_SECRET
 from boneio.core.system.monitor import get_network_info
 
 from boneio.core import containers
+from boneio.core.system.monitor import get_network_info
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -688,8 +689,6 @@ async def set_enabled(config_helper, enabled: bool, local_ip: str | None = None)
     serial = getattr(config_helper, "serial_number", None)
     if not local_ip:
         try:
-            from boneio.core.system.monitor import get_network_info
-
             local_ip = (get_network_info() or {}).get("ip", "")
         except Exception as err:  # noqa: BLE001
             _LOGGER.warning("Could not read this device's address: %s", err)

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/core/config/config_helper.py

@@ -15,6 +15,8 @@ from boneio.const import (
     ALARM_CONTROL_PANEL,
     BINARY_SENSOR,
     BONEIO,
+    DEFAULT_PROXY_PORT,
+    IP,
     BUTTON,
     CLIMATE,
     COVER,
@@ -45,6 +47,7 @@ class ConfigHelper:
         is_web_active: bool = False,
         web_port: int = 8090,
         proxy_port: int | None = None,
+        expose: str = "all",
         config_file_path: str | None = None,
         send_boneio_autodiscovery: bool = True,
         receive_boneio_autodiscovery: bool = True,
@@ -98,6 +101,7 @@ class ConfigHelper:
         self._device_type = device_type
         self._web_port = web_port
         self._proxy_port = proxy_port
+        self._expose = expose
         self._fetch_old_discovery = None
 
         self._autodiscovery_messages = {
@@ -183,12 +187,54 @@ class ConfigHelper:
 
     @property
     def http_proto(self) -> str:
-        return "https" if self._proxy_port else "http"
+        """The scheme anything linking to this panel should use."""
+        return "https" if self._behind_proxy else "http"
+
+    @property
+    def _behind_proxy(self) -> bool:
+        """Whether the panel is reached through the reverse proxy.
+
+        Either because somebody named its port, or because the panel's own
+        port has been taken off the network and the proxy is the only way in.
+        """
+        return bool(self._proxy_port) or self._expose == "proxy"
+
+    @property
+    def configuration_url(self) -> str | None:
+        """The address anything linking to this panel should use.
+
+        Home Assistant puts this on the device page, and the panel shows it so
+        an operator can see what was published without opening Home Assistant.
+        Both read it here rather than each deciding for itself: the wording in
+        the panel drifted away from what discovery actually sends within a day
+        of being written, because it described the rule instead of asking.
+
+        Returns:
+            The URL, or None when there is no address to build one from.
+        """
+        if self._cloud_registration and self.serial_number:
+            # Registered with the cloud: a real certificate on a public name,
+            # pointing at the local address. Nothing else can beat that.
+            return f"https://{self.serial_number}.black.boneio.app:{DEFAULT_PROXY_PORT}"
+        address = (self._network_info or {}).get(IP)
+        if not (self._is_web_active and address):
+            return None
+        return f"{self.http_proto}://{address}:{self.web_configuration_port}"
 
     @property
     def web_configuration_port(self) -> int:
-        """Get port for HA discovery URL. Uses proxy_port if set, otherwise web_port."""
-        return self._proxy_port if self._proxy_port else self._web_port
+        """The port to put in a link to this panel.
+
+        The configured proxy port when there is one. Otherwise the panel's own
+        port — unless that port has been taken off the network, in which case
+        it answers nothing and linking to it would hand Home Assistant a dead
+        address. Then it is the port the built-in proxy serves on.
+        """
+        if self._proxy_port:
+            return self._proxy_port
+        if self._expose == "proxy":
+            return DEFAULT_PROXY_PORT
+        return self._web_port
 
     @property
     def topic_prefix(self) -> str:

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/core/security/posture.py

@@ -64,6 +64,14 @@ class Check:
     state: State
     detail: str
     remedy: str = ""
+    #: A fact about this device that belongs with the finding and must not be
+    #: translated away: the error a service reported, a name, a path.
+    #:
+    #: The panel replaces title, detail and remedy with its own wording, keyed
+    #: by check id — so anything the backend varies at runtime is lost the
+    #: moment somebody writes a translation for it. This is shown verbatim
+    #: underneath instead.
+    context: str = ""
     #: Where in the panel this is fixed, when it can be fixed there. A bare
     #: name is a Settings section; ``system:<anchor>`` is the System page.
     #: None means there is no control — the remedy is a file or a shell.
@@ -82,6 +90,7 @@ class Check:
             "state": str(self.state),
             "detail": self.detail,
             "remedy": self.remedy,
+            "context": self.context,
             "settings_section": self.settings_section,
         }
 
@@ -213,6 +222,9 @@ def evaluate(
     anonymous_allowed: bool,
     auth_required: bool,
     cloud_active: bool,
+    proxy_serving: bool | None = None,
+    custom_certificate: bool = False,
+    cloud_error: str | None = None,
 ) -> Posture:
     """Work out what is still unlocked.
 
@@ -222,6 +234,10 @@ def evaluate(
         anonymous_allowed: Whether the anonymous opt-out is set.
         auth_required: Whether requests currently need a token.
         cloud_active: Whether cloud registration is serving a real certificate.
+        proxy_serving: Whether the reverse proxy is answering for this
+            panel right now. None when nobody looked.
+        custom_certificate: Whether an uploaded certificate is installed.
+        cloud_error: What cloud registration last failed with, if anything.
 
     Returns:
         The full set of checks.
@@ -269,20 +285,35 @@ def evaluate(
         Check(
             id="web_exposed_in_clear",
             title="Panel served in the clear",
-            severity=Severity.WARNING,
+            # Three states, not two. Telling somebody to move the panel behind
+            # a proxy that is not serving it is advice we would then refuse to
+            # carry out, and they would find that out by clicking. Where the
+            # proxy is not answering this drops to advice and points at the
+            # proxy instead of at the panel.
+            severity=Severity.WARNING if proxy_serving is not False else Severity.INFO,
             state=State.OK if behind_proxy else State.FAILED,
             detail=(
-                "The panel answers on its own port on every network interface, "
-                "without TLS. Anyone who can see the traffic sees the login "
-                "form, the token it hands back, and a configuration that "
-                "carries passwords."
-                if not behind_proxy
-                else "The panel is reachable only through the encrypted proxy."
+                "The panel is reachable only through the encrypted proxy."
+                if behind_proxy
+                else (
+                    "The panel answers on its own port on every network "
+                    "interface, without TLS. Anyone who can see the traffic "
+                    "sees the login form, the token it hands back, and a "
+                    "configuration that carries passwords."
+                    if proxy_serving is not False
+                    else "The panel answers on its own port on every network "
+                    "interface, without TLS — and the proxy that would replace "
+                    "it is not serving this panel, so closing that port now "
+                    "would leave the device reachable on nothing."
+                )
             ),
             remedy=(
-                "Move it behind the proxy from the Security section. The panel "
-                "then answers on https and through an SSH tunnel, and not on "
-                "the local network in the clear."
+                "Move it behind the proxy. It then answers over HTTPS and "
+                "through an SSH tunnel, and not on the local network in the "
+                "clear."
+                if proxy_serving is not False
+                else "Get the proxy serving this panel first — check that "
+                "HTTPS answers on its port — and this becomes one click."
             ),
             settings_section="security",
         )
@@ -312,6 +343,7 @@ def evaluate(
     )
 
     web = config.get("web") if isinstance(config.get("web"), dict) else {}
+    cloud_enabled = bool((web.get("cloud") or {}).get("enabled"))
     has_legacy = _legacy_web_auth(config)
     checks.append(
         Check(
@@ -342,15 +374,42 @@ def evaluate(
             id="certificate",
             title="HTTPS certificate",
             severity=Severity.INFO,
-            state=State.OK if cloud_active else State.FAILED,
+            # Four states. This used to have two, and told an operator to
+            # enable cloud registration on a device where it was already on and
+            # failing with an error the application had in hand — while a
+            # second route to a trusted certificate, uploading one, had been
+            # added and this check knew nothing about it.
+            state=State.OK if (custom_certificate or cloud_active) else State.FAILED,
             detail=(
-                "Served with a certificate browsers trust."
+                "Served with the certificate you uploaded."
+                if custom_certificate
+                else "Served with a certificate browsers trust."
                 if cloud_active
-                else "Served with a self-signed certificate, so browsers warn "
-                "on every visit and people learn to click through the warning."
+                else (
+                    "Cloud registration is switched on but is not serving a "
+                    "certificate, so the panel is still served with a "
+                    "self-signed one."
+                    if cloud_enabled and cloud_error
+                    else "Cloud registration is switched on but has not "
+                    "produced a certificate yet, so the panel is still served "
+                    "with a self-signed one."
+                    if cloud_enabled
+                    else "Served with a self-signed certificate, so browsers "
+                    "warn on every visit and people learn to click through the "
+                    "warning."
+                )
             ),
-            remedy="Enable boneIO Cloud registration to get a trusted certificate.",
-            settings_section="web",
+            remedy=(
+                ""
+                if custom_certificate or cloud_active
+                else "Sort out the registration error, or upload a certificate "
+                "of your own below."
+                if cloud_enabled
+                else "Enable boneIO Cloud registration, or upload a certificate "
+                "of your own below."
+            ),
+            context=cloud_error or "",
+            settings_section="security",
         )
     )
 

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/integration/homeassistant.py

@@ -82,11 +82,9 @@ def ha_availabilty_message(
     topic = config_helper.topic_prefix if topic is None else topic
     device_name = config_helper.name if device_name is None else device_name
     model = f"boneIO Black {config_helper.device_type.title().replace('X', 'x')}"
-    if config_helper.cloud_registration and config_helper.serial_number:
-        # PWA-registered device: use the public PWA domain with TLS
-        web_url = f"https://{config_helper.serial_number}.black.boneio.app:8443"
-    elif config_helper.is_web_active and config_helper.network_info and IP in config_helper.network_info:
-        web_url = f"{config_helper.http_proto}://{config_helper.network_info[IP]}:{config_helper.web_configuration_port}"
+    # Decided in one place, which the panel reads too. Built here, the panel's
+    # description of it drifted out of date within a day.
+    web_url = config_helper.configuration_url or web_url
     
     web_url_dict = {
         "configuration_url": web_url

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/migrations/assets/MANIFEST.sha256

@@ -4,7 +4,7 @@
 
 f2ed05c6f5934a15f12571139bdc225804f67b8c83561cc39868f7b2296d2697  docker/daemon.json
 22dfe7d55e5ed85ea0f4149b7776b7504a12b91905701657a88840ae1208087c  docker/nodered/caddy/502.html
-217e3cc6e24ae8241d23b15cfecaa477ac05fe031078cd72c472d36a11835443  docker/nodered/caddy/init-certs.sh
+93342a62f024235b2deefd2cd833ef72d7a9cf14a8ad0727ab0dc422e78e8388  docker/nodered/caddy/init-certs.sh
 fba1a5bc6a6b6aaaff8cced9f6ee1350a16ad1a5ddde2af366c198881698d264  docker/nodered/docker-compose-cloud.yaml
 cd90e1bcb6488669179c8e7a40a6265923e0fea045cc79d5b7559ebb309131b6  docker/nodered/docker-compose.yaml
 bff00753c72fb17609a6f7b3a58ef78b7b394da12d19fd65b875f2889695e2b4  docker/nodered/node-red/settings.js

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/migrations/assets/docker/nodered/caddy/init-certs.sh

@@ -42,7 +42,10 @@ if [ -f "$CUSTOM_CERT" ] && [ -f "$CUSTOM_KEY" ]; then
         TLS_DIRECTIVE="tls $CUSTOM_CERT $CUSTOM_KEY"
 else
         echo "Serving Caddy's own certificate (no uploaded one found)"
-        TLS_DIRECTIVE="tls internal {
+        TLS_DIRECTIVE="tls {
+                issuer internal {
+                        lifetime 180d
+                }
                 on_demand
         }"
 fi
@@ -50,7 +53,17 @@ fi
 # Generate Caddyfile
 cat > /tmp/Caddyfile << EOF
 {
-        # Global options - empty for internal issuer
+        # The device's own certificate authority issues for six months rather
+        # than the twelve hours Caddy defaults to. Nobody trusts this authority
+        # until they choose to, and when they do — by installing the root on
+        # their own machines, or by clicking through once — a certificate that
+        # expires the same evening undoes that daily. The intermediate has to
+        # outlive the leaves it signs, or Caddy refuses to start.
+        pki {
+                ca local {
+                        intermediate_lifetime 365d
+                }
+        }
 }
 
 # HTTP — redirect to HTTPS.

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/migrations/plans/1.4.4.json

@@ -1 +1 @@
-[{"action":"install_file","dst":"/home/boneio/docker/nodered/caddy/init-certs.sh","expected_sha256":"217e3cc6e24ae8241d23b15cfecaa477ac05fe031078cd72c472d36a11835443","group":"boneio","mode":493,"owner":"boneio","src":"docker/nodered/caddy/init-certs.sh","template_vars":{}},{"action":"install_file","dst":"/home/boneio/docker/nodered/caddy/502.html","expected_sha256":"22dfe7d55e5ed85ea0f4149b7776b7504a12b91905701657a88840ae1208087c","group":"boneio","mode":420,"owner":"boneio","src":"docker/nodered/caddy/502.html","template_vars":{}},{"action":"install_file","dst":"/home/boneio/docker/nodered/docker-compose.yaml","expected_sha256":"cd90e1bcb6488669179c8e7a40a6265923e0fea045cc79d5b7559ebb309131b6","group":"boneio","mode":420,"owner":"boneio","src":"docker/nodered/docker-compose.yaml","template_vars":{}},{"action":"remove_file","path":"/home/boneio/docker/nodered/nginx/default.conf"}]
+[{"action":"install_file","dst":"/home/boneio/docker/nodered/caddy/init-certs.sh","expected_sha256":"93342a62f024235b2deefd2cd833ef72d7a9cf14a8ad0727ab0dc422e78e8388","group":"boneio","mode":493,"owner":"boneio","src":"docker/nodered/caddy/init-certs.sh","template_vars":{}},{"action":"install_file","dst":"/home/boneio/docker/nodered/caddy/502.html","expected_sha256":"22dfe7d55e5ed85ea0f4149b7776b7504a12b91905701657a88840ae1208087c","group":"boneio","mode":420,"owner":"boneio","src":"docker/nodered/caddy/502.html","template_vars":{}},{"action":"install_file","dst":"/home/boneio/docker/nodered/docker-compose.yaml","expected_sha256":"cd90e1bcb6488669179c8e7a40a6265923e0fea045cc79d5b7559ebb309131b6","group":"boneio","mode":420,"owner":"boneio","src":"docker/nodered/docker-compose.yaml","template_vars":{}},{"action":"remove_file","path":"/home/boneio/docker/nodered/nginx/default.conf"}]

boneio-1.6.0.dev8/boneio/migrations/plans/1.4.4.sig

@@ -0,0 +1,2 @@
+�
+MU0���W��r�Z������/�y
c]	9�Y��*g;O�u���OU���W����k�Q�	

boneio-1.6.0.dev8/boneio/migrations/plans/1.6.13.json

@@ -0,0 +1 @@
+[{"action":"install_file","dst":"/home/boneio/docker/nodered/caddy/init-certs.sh","expected_sha256":"93342a62f024235b2deefd2cd833ef72d7a9cf14a8ad0727ab0dc422e78e8388","group":"boneio","mode":493,"owner":"boneio","src":"docker/nodered/caddy/init-certs.sh","template_vars":{}}]

boneio-1.6.0.dev8/boneio/migrations/plans/1.6.13.sig

@@ -0,0 +1 @@
+�,�L�5�02i%�u��G�c:m �����CM 0�z���X>j��v]Bo��~�|�;<f

boneio-1.6.0.dev8/boneio/migrations/plans/1.6.14.json

@@ -0,0 +1 @@
+[{"action":"install_file","dst":"/home/boneio/docker/nodered/caddy/init-certs.sh","expected_sha256":"93342a62f024235b2deefd2cd833ef72d7a9cf14a8ad0727ab0dc422e78e8388","group":"boneio","mode":493,"owner":"boneio","src":"docker/nodered/caddy/init-certs.sh","template_vars":{}}]

boneio-1.6.0.dev8/boneio/migrations/plans/1.6.14.sig

@@ -0,0 +1 @@
+�,�L�5�02i%�u��G�c:m �����CM 0�z���X>j��v]Bo��~�|�;<f

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/migrations/plans/manifest.json

@@ -1 +1 @@
-{"plans":{"1.3.0":"3199d74a6dda33162bbee4fc650a5a0d70d5372258f3305ad92501215e22a7fd","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"27ebf198e03c882c21572a9be02f63e8ffe6a610f6f395d7116ad9e258b4dac7","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"035a0d32c891746e315fd228f8107680c856d9d128e3b4a19f6629256b3ef9b1","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"358dacbc8d16b1b665167de3bc1c42d101d82733502048f345184d1841ce03f2","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"7175f827b99c602df80436db588c87277ce50f2734051a444163b048f5d0b23e","1.6.9":"732d5a9bcd2e496a260263a643c78a6346e9f3cef5b48fe59ac6b120bd03ba4e"},"release":"1.6.0.dev6"}
+{"plans":{"1.3.0":"3199d74a6dda33162bbee4fc650a5a0d70d5372258f3305ad92501215e22a7fd","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"8658ec11d4b2d32e2e5c6154a7b052f518aecdd4d610a99a05a462aded671079","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"6e4a259795749084d2d01f97750a57528662898edf14a3a990ccfaffd414ac44","1.6.14":"6e4a259795749084d2d01f97750a57528662898edf14a3a990ccfaffd414ac44","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"358dacbc8d16b1b665167de3bc1c42d101d82733502048f345184d1841ce03f2","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"7175f827b99c602df80436db588c87277ce50f2734051a444163b048f5d0b23e","1.6.9":"732d5a9bcd2e496a260263a643c78a6346e9f3cef5b48fe59ac6b120bd03ba4e"},"release":"1.6.0.dev8"}

boneio-1.6.0.dev8/boneio/migrations/plans/manifest.sig

@@ -0,0 +1 @@
+�\�c1�U����[(O��+p��F�t�m43'�F���J��)�=�98Kf�k�_D[+��s6

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/migrations/runner.py

@@ -116,12 +116,15 @@ class MigrationInfo:
         module_name: Full dotted module path.
         description: Human-readable description.
         requires_root: Whether ``boneio-migrate`` helper is needed.
+        superseded_by: A later migration that redoes everything this one does,
+            so a device applying both from scratch can skip this one.
     """
 
     version: str
     module_name: str
     description: str
     requires_root: bool = True
+    superseded_by: str | None = None
 
     def version_tuple(self) -> tuple[int, ...]:
         """Return version as comparable integer tuple."""
@@ -576,6 +579,7 @@ class MigrationRunner:
                 version = getattr(mod, "VERSION", None)
                 description = getattr(mod, "DESCRIPTION", module_name)
                 requires_root = getattr(mod, "REQUIRES_ROOT", True)
+                superseded_by = getattr(mod, "SUPERSEDED_BY", None)
 
                 if version is None:
                     _LOGGER.warning("Migration module %s has no VERSION, skipping.", full_name)
@@ -587,6 +591,7 @@ class MigrationRunner:
                         module_name=full_name,
                         description=description,
                         requires_root=requires_root,
+                        superseded_by=superseded_by,
                     )
                 )
             except Exception as exc:
@@ -607,8 +612,49 @@ class MigrationRunner:
         _LOGGER.debug("Applied migrations: %s", applied)
 
     def _get_pending(self) -> list[MigrationInfo]:
-        """Return migrations not yet applied."""
-        return [m for m in self._all_migrations if m.version not in self._applied]
+        """Return migrations not yet applied, and not made pointless by a later one.
+
+        A file installed by one migration and replaced by a later one is
+        written twice on a device that applies both from scratch — three times
+        by the third revision, and so on. Each write is a signature check, a
+        digest check and a validator run through the privileged helper, which
+        on a controller is seconds, and each is another step that can fail on
+        the way to a result the next step throws away.
+
+        Only whole migrations are ever skipped, never individual actions. The
+        helper reads the plan from a signed file and is given nothing but a
+        version string; letting the application say which parts to run would
+        put it back in charge of what happens as root, which is the hole this
+        protocol exists to close. Choosing not to apply something can only ever
+        do less, so it is safe here.
+
+        A migration is skipped only when the one that supersedes it is itself
+        about to run or has already run — otherwise the work would be dropped
+        rather than deferred. ``test_migration_consistency`` checks that every
+        declared supersession really does cover everything the older migration
+        did, because getting that wrong loses a change silently.
+
+        Returns:
+            The migrations to apply, in version order.
+        """
+        pending = [m for m in self._all_migrations if m.version not in self._applied]
+        known = {m.version for m in self._all_migrations}
+        pending_versions = {m.version for m in pending}
+
+        kept = []
+        for migration in pending:
+            successor = migration.superseded_by
+            if successor and successor in known and (
+                successor in pending_versions or successor in self._applied
+            ):
+                _LOGGER.info(
+                    "Skipping %s: %s does everything it does.",
+                    migration.version,
+                    successor,
+                )
+                continue
+            kept.append(migration)
+        return kept
 
     def _apply_pending(
         self,

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/migrations/versions/v1_6_13_custom_certificate.py

@@ -31,6 +31,13 @@ VERSION = "1.6.13"
 DESCRIPTION = "Allow an uploaded TLS certificate"
 REQUIRES_ROOT = True
 
+#: 1.6.14 installs the same file with a later revision of it. A device applying
+#: both from scratch would write it twice, each write a signature check, a
+#: digest check and a validator run through the privileged helper — so this one
+#: is skipped when the other is going to run anyway. A test checks the claim:
+#: everything this migration does has to be something 1.6.14 also does.
+SUPERSEDED_BY = "1.6.14"
+
 _BONEIO_HOME = "/home/boneio"
 _BONEIO_USER = "boneio"
 

boneio-1.6.0.dev8/boneio/migrations/versions/v1_6_14_certificate_lifetime.py

@@ -0,0 +1,48 @@
+"""Stop the device's own certificate expiring twice a day.
+
+Caddy's internal issuer defaults to a twelve-hour leaf. For a public site
+renewed automatically that is a virtue; for a certificate nobody trusts until
+they decide to, it undoes the decision daily. Somebody who clicks through the
+warning once, or adds an exception, or installs this device's authority on
+their laptop, is back to a fresh unknown certificate by the evening.
+
+Six months instead. The intermediate is extended to a year with it, because
+Caddy refuses to start when a leaf would outlive the intermediate signing it —
+which is the part that makes this two settings rather than one.
+
+This is a change to the script the container runs at start, so it only takes
+effect when Caddy is next restarted. Nothing here restarts it: the certificate
+in use is valid, and interrupting the panel to replace a working certificate
+with a longer-lived one is not a trade worth making unasked.
+
+To retry on a device, delete ``/var/lib/boneio/migrations.d/1.6.14.applied``
+and restart boneIO.
+"""
+
+from __future__ import annotations
+
+from boneio.migrations.actions import InstallFile, MigrationAction
+
+VERSION = "1.6.14"
+DESCRIPTION = "Issue the device certificate for six months, not twelve hours"
+REQUIRES_ROOT = True
+
+_BONEIO_HOME = "/home/boneio"
+_BONEIO_USER = "boneio"
+
+
+def plan() -> list[MigrationAction]:
+    """Return the ordered list of migration actions.
+
+    Returns:
+        List of :class:`MigrationAction` to apply in order.
+    """
+    return [
+        InstallFile(
+            src="docker/nodered/caddy/init-certs.sh",
+            dst=f"{_BONEIO_HOME}/docker/nodered/caddy/init-certs.sh",
+            mode=0o755,
+            owner=_BONEIO_USER,
+            group=_BONEIO_USER,
+        ),
+    ]

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/runner.py

@@ -212,6 +212,7 @@ async def async_run(
         is_web_active=web_active,
         web_port=web_config.get("port", 8090),
         proxy_port=web_config.get("proxy_port"),
+        expose=web_config.get("expose", "all"),
         ha_discovery=mqtt_config.get(HA_DISCOVERY, {}).get(ENABLED, False),
         ha_discovery_prefix=mqtt_config.get(HA_DISCOVERY, {}).get(TOPIC_PREFIX, "homeassistant"),
         config_file_path=config_file,

{boneio-1.6.0.dev6 → boneio-1.6.0.dev8}/boneio/schema/schema.yaml

@@ -203,12 +203,18 @@ web:
       default: 8090
       meta:
         label: Port to run web server
+    # Not offered in the panel any more. It only ever chose the port in the
+    # link Home Assistant shows, the built-in proxy answers on 8443 either
+    # way, and a device reachable only through that proxy derives the port by
+    # itself. Kept here because the validator purges unknown keys: removing it
+    # would delete the setting from the config.yaml of the few people who have
+    # one, and change where their Home Assistant link points, silently.
     proxy_port:
       required: False
       type: integer
       nullable: True
       meta:
-        label: Reverse proxy port (used in HA discovery URL). If not set, uses 'port' value.
+        label: Reverse proxy port for the Home Assistant link. Advanced; set it only when your own proxy fronts this panel on another port.
     expose:
       required: False
       type: string

boneio-1.6.0.dev8/boneio/version.py

@@ -0,0 +1,2 @@
+# flake8: noqa
+__version__ = "1.6.0.dev8"