Remove a lot of duplication and move to seperate libs in internal/
Also, instead of polling upgrade status using src/rauc-installation-status,
hook into the dbus monitor.
When a veth pair has one end in a container and the other in the host
namespace, removing it failed: the container end's teardown deleted the
whole pair, so the host end's own delete then failed ("Cannot find
device") and aborted the teardown, leaving the interface behind.
The host-namespace delete added for the both-ends-in-container case was
emitted for every container veth end. Restrict it to the primary end,
which for a host/container pair is the host end that already deletes the
pair itself.
Extend the container veth tests to remove the pair and verify it is gone,
covering both the single-end (regression) and both-ends teardown paths.
Fixes: #1546
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
crond shipped auto-enabled in finit (symlinked into enabled/), so it ran
on every boot. With no cron jobs /var/spool/cron/crontabs does not exist
and 'crond -f' exits non-zero, which finit then crash-loops until it gives
up ("Service crond keeps crashing, not restarting").
Ship crond available-only and let confd manage it: the schedule plugin
already rebuilds the crontab on every change, so enable + touch crond when
at least one consumer is active and disable it otherwise. No jobs, no
crond, no crash loop.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Previously at least one end of a veth pair had to remain in the host
namespace, because that end created and destroyed the pair. Assigning
both ends to containers left no one to create it.
Select a deterministic primary end so exactly one side creates the pair.
When the primary is itself a container interface, create the pair in the
host namespace before the container starts; CNI host-device then moves
each end into its container. Teardown is deferred to the container
removal script so the pair does not linger and block re-creation.
Drop the now-obsolete limitation notes from the documentation and YANG,
and add a regression test connecting two containers over a veth pair.
Fixes: #941
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The per-port PHY temperature sensors on Marvell DSA switches show up in
'show hardware' with the name the kernel derives from the full device
tree path, e.g. cp0busbusf2000000mdio12a200switch2mdio01, which honestly
is completely unreadable and also overruns the value column. Name each
sensor after the front-panel port it serves (e1, e2, ...) by matching
the PHY's device-tree phandle against each interface's phy-handle.
Also:
- show system: report a representative SoC temperature on CN913x by
matching the ap-* and cp<N>-* thermal zones, hottest wins.
- cli-pretty: truncate over-long sensor names so they can never spill
into the value column again.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The three YANG 1.1 fixes lived as a frozen, one-shot copy of goyang
v1.6.3 under internal/goyang (via a local `replace`) — invisible to
dependency/CVE tracking and impossible to update. Move them to the
maintained kernelkit/goyang fork (v1.6.3-kkit branch) and depend on it
through go.mod, pinned by commit hash; drop the in-tree copy. getopt
falls out of the dependency set since it was only used by goyang's CLI,
not pkg/yang.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The "unsaved changes" banner was set unconditionally at every site that
touches config, so it could appear when running-config actually equals
startup — contradicting the "Show diff" modal, which correctly showed
nothing. A shared updateCfgUnsaved helper now compares running against
startup (the same datastore pair the diff uses) and sets or clears the
banner cookie to match:
- Apply and restore-to-running clear it when an Apply/restore reverts
an out-of-band (e.g. CLI) change back to match startup, instead of
always showing it.
- The advanced-tree presence toggle writes only the candidate
datastore, so it no longer sets the running-vs-startup banner at all
(matching the other candidate-only tree handlers).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These two shortcuts are toggleable in the configuration but were only
detected once at login and baked into the session, so disabling them
didn't drop the topbar icon / user-menu entry until re-login.
Refresh just those two from running-config on full page loads (htmx
swaps and pollers, which never re-draw them, are skipped), so toggling
takes effect on the next reload without logging out.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a Hash dropdown to the add-user and change-password forms — yescrypt
(default), SHA-512, SHA-256, MD5 — passed through to mkpasswd. These are
exactly the four hashes the infix-system:crypt-hash YANG type accepts;
unknown values fall back to the default. Password inputs switch to the
CSS-masked type=text used by keystore secrets, which keeps the browser
password manager from offering to save device credentials. Each add-user
field gets a YANG description as a hover tooltip.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds a button next to "Save to startup" that opens a modal showing a
unified diff between startup-config and running-config, so the pending
changes can be reviewed before persisting them. The handler fetches
both datastores over RESTCONF (same serializer → low-noise diff),
writes them to temp files, and runs busybox `diff -u`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Move the per-user shell editor out of the always-visible row into the
expanded detail; the summary now reports the shell as plain text. This
also fixes the editor showing "bash" for non-bash users: the dropdown
matched the module-prefixed option value against the bare stored shell,
so it never matched and fell back to the first option.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add conditional YANG feature 'web-ui' to infix-services.yang, set when
the webui is built. This feature is what the test now looks for to
determine if it should be skipped or not.
Also, clean up remnant of old test, which was entirely replaced by
Mattias' login/csrf test.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Surface network diagnostics the Overview lacked: default gateway(s) with
a live reachability dot, an Internet reachability check, the effective DNS
resolvers (origin static vs DHCP, plus the interface), search domains, NTP
sync, and the IP addresses of every L3 interface.
All from the operational datastore. Reachability is an async per-address
ping (pulsing green dot on reply, red cross on none).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Auto-logout was client-side only while the server kept a fixed 1h idle
timeout, so "Off" still logged you out. Sessions now carry a per-session
timeout the client syncs from the menu (0 = never), capped at 24h.
Theme: the login toggle icon was never initialised on load (stuck on the
'auto' glyph); add color-scheme so native controls follow the OS on
'auto', and re-apply on OS theme change.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Mattias Walström