Skip to content
Snippets Groups Projects

Compare revisions

Changes are shown as if the source revision was being merged into the target revision. Learn more about comparing revisions.

Source

Select target project
No results found
Select Git revision
  • 0x4A6F-master
  • 0x4A6F-rpi4
  • autinerd/experimental-openwrt-24.10
  • experimental
  • feature/addMikrotikwAP
  • master
  • nrb/airmax-test
  • nrb/ar9344-reset-sequence
  • nrb/ex400-remove-wps
  • nrb/gluon-master-cpe510
  • nrb/test-radv-filter
  • nrbffs/fastd-remove-delay
  • nrbffs/netgear-ex6120
  • v2018.2.2-ffs
  • v2018.2.3-ffs
  • v2019.1-ffs
  • v2019.1.1-ffs
  • v2019.1.2-ffs
  • v2020.1-ffs
  • v2020.1.1-ffs
  • v2020.1.3-ffs
  • v2020.2-ffs
  • v2020.2.1-ffs
  • v2020.2.2-ffs
  • v2020.2.3-ffs
  • v2021.1-ffs
  • v2021.1.1-ffs
  • v2021.1.2-ffs
  • v2022.1.1-ffs
  • v2022.1.3-ffs
  • v2022.1.4-ffs
  • v2023.1-ffs
  • v2023.2-ffs
  • v2023.2.2-ffs
  • v2023.2.3-ffs
  • v2023.2.4-ffs
  • v2023.2.5-ffs
  • experimental-2022-09-24
  • experimental-2022-09-24-base
  • experimental-2023-03-11
  • experimental-2023-03-11-base
  • experimental-2023-03-12
  • experimental-2023-03-12-base
  • experimental-2023-03-16
  • experimental-2023-03-16-base
  • experimental-2023-03-20
  • experimental-2023-03-20-base
  • experimental-2023-03-23
  • experimental-2023-03-23-base
  • experimental-2023-03-25
  • experimental-2023-03-25-base
  • experimental-2023-03-26
  • experimental-2023-03-26-base
  • experimental-2023-03-30
  • experimental-2023-03-30-base
  • experimental-2023-03-31
  • experimental-2023-03-31-base
  • experimental-2023-04-01
  • experimental-2023-04-01-base
  • experimental-2023-04-08
  • experimental-2023-04-08-base
  • experimental-2023-04-10
  • experimental-2023-04-10-base
  • experimental-2023-04-13
  • experimental-2023-04-13-base
  • experimental-2023-04-15
  • experimental-2023-04-15-base
  • experimental-2023-04-16
  • experimental-2023-04-16-base
  • experimental-2023-04-18
  • experimental-2023-04-18-base
  • experimental-2023-04-20
  • experimental-2023-04-20-base
  • experimental-2023-04-26
  • experimental-2023-04-26-base
  • experimental-2023-04-28
  • experimental-2023-04-28-base
  • experimental-2023-04-30
  • experimental-2023-04-30-base
  • experimental-2023-05-02
  • experimental-2023-05-02-base
  • experimental-2023-05-03
  • experimental-2023-05-03-base
  • experimental-2023-05-12
  • experimental-2023-05-12-base
  • experimental-2023-05-21
  • experimental-2023-05-21-base
  • experimental-2023-05-25
  • experimental-2023-05-25-base
  • experimental-2023-07-02
  • experimental-2023-07-02-base
  • experimental-2023-07-04
  • experimental-2023-07-04-base
  • experimental-2023-07-12
  • experimental-2023-07-12-base
  • experimental-2023-07-16
  • experimental-2023-07-16-base
  • experimental-2023-08-04
  • experimental-2023-08-04-base
  • experimental-2023-08-10
  • experimental-2023-08-10-base
  • experimental-2023-09-08
  • experimental-2023-09-08-base
  • experimental-2023-09-09
  • experimental-2023-09-09-base
  • experimental-2023-09-10
  • experimental-2023-09-10-base
  • experimental-2023-09-11
  • experimental-2023-09-11-base
  • experimental-2023-09-12
  • experimental-2023-09-12-base
  • experimental-2023-09-13
  • experimental-2023-09-13-base
  • experimental-2023-09-15
  • experimental-2023-09-15-base
  • experimental-2023-09-16
  • experimental-2023-09-16-base
  • experimental-2023-09-18
  • experimental-2023-09-18-base
  • experimental-2023-09-20
  • experimental-2023-09-20-base
  • experimental-2023-09-27
  • experimental-2023-09-27-base
  • experimental-2023-09-28
  • experimental-2023-09-28-base
  • experimental-2023-09-29
  • experimental-2023-09-29-base
  • experimental-2023-10-02
  • experimental-2023-10-02-base
  • experimental-2023-10-13
  • experimental-2023-10-13-base
  • experimental-2023-10-14
  • experimental-2023-10-14-base
  • experimental-2023-10-16
  • experimental-2023-10-16-base
  • experimental-2023-10-23
  • experimental-2023-10-23-base
137 results

Target

Select target project
No results found
Select Git revision
  • 0x4A6F-master
  • 0x4A6F-rpi4
  • 2014.3.x
  • 2014.4.x
  • babel
  • experimental
  • hoodselector
  • master
  • nrb/gluon-master-cpe510
  • nrb/test-radv-filter
  • nrbffs/fastd-remove-delay
  • nrbffs/netgear-ex6120
  • radv-filterd
  • v2015.1.x
  • v2016.1.x
  • v2016.2.4-batmanbug
  • v2016.2.x
  • v2018.2.2-ffs
  • v2018.2.3-ffs
  • v2018.2.x
  • v2019.1-ffs
  • v2019.1.1-ffs
  • v2019.1.2-ffs
  • v2020.1-ffs
  • v2020.1.1-ffs
  • v2020.1.3-ffs
  • v2020.2-ffs
  • v2020.2.1-ffs
  • v2020.2.2-ffs
  • v2020.2.3-ffs
  • v2020.2.x
  • v2021.1-ffs
  • v2021.1.1-ffs
  • v2021.1.2-ffs
  • v2014.1
  • v2014.2
  • v2014.3
  • v2014.3.1
  • v2014.4
  • v2015.1
  • v2015.1.1
  • v2015.1.2
  • v2016.1
  • v2016.1.1
  • v2016.1.2
  • v2016.1.3
  • v2016.1.4
  • v2016.1.5
  • v2016.1.6
  • v2016.2
  • v2016.2.1
  • v2016.2.2
  • v2016.2.3
  • v2016.2.4
  • v2016.2.5
  • v2016.2.6
  • v2016.2.7
  • v2017.1
  • v2017.1.1
  • v2017.1.2
  • v2017.1.3
  • v2017.1.4
  • v2017.1.5
  • v2017.1.6
  • v2017.1.7
  • v2017.1.8
  • v2018.1
  • v2018.1.1
  • v2018.1.2
  • v2018.1.3
  • v2018.1.4
  • v2018.2
  • v2018.2-ffs0.1
  • v2018.2.1
  • v2018.2.1-ffs0.1
  • v2018.2.2-ffs0.1
  • v2018.2.3-ffs0.1
  • v2019.1-ffs0.1
  • v2019.1.1-ffs0.1
  • v2019.1.2-ffs0.1
  • v2020.1-ffs0.1
  • v2020.1.1-ffs0.1
  • v2020.1.3-ffs0.1
  • v2020.2
  • v2020.2-ffs0.1
  • v2020.2.1-ffs0.1
  • v2020.2.2-ffs0.1
  • v2020.2.3-ffs0.1
  • v2020.2.3-ffs0.2
  • v2020.2.3-ffs0.3
  • v2020.2.x-ffs0.1
  • v2021.1-ffs0.1
  • v2021.1.1-ffs0.1
  • v2021.1.1-ffs0.2
  • v2021.1.1-ffs0.3
  • v2021.1.1-ffs0.4
  • v2021.1.2-ffs0.1
  • v2021.1.2-ffs0.2
98 results
Show changes
599 files
+ 16287
15204
Compare changes
  • Side-by-side
  • Inline

Files

.ecrc

0 → 100644
+3 −0
Original line number Original line Diff line number Diff line
{
  "Exclude": ["docs/_build"]
}
+32 −1
Original line number Original line Diff line number Diff line
@@ -7,25 +7,52 @@ insert_final_newline = true
indent_style = tab
indent_style = tab
charset = utf-8
charset = utf-8


[Dockerfile]
indent_style = space
indent_size = 4

[/patches/**]
[/patches/**]
indent_style = unset
indent_style = unset
indent_size = unset
indent_size = unset


[*.c]

[*.css]

[*.dia]
indent_style = space
indent_size = 2

[*.h]

[*.html]

[*.js]

[*{.json,.ecrc}]
[*{.json,.ecrc}]
indent_style = space
indent_style = space
indent_size = 2
indent_size = 2


[*.lua]

[{Makefile,*.mk}]
indent_style = unset

[*.md]
[*.md]
indent_style = space
indent_style = space
indent_size = 4
indent_size = 4


[*.pl]

[*.py]
[*.py]
indent_style = space
indent_style = space
indent_size = 4
indent_size = 4


[*.rst]
[*.rst]
indent_style = space
indent_style = space
indent_size = 3
indent_size = 2

[*.sh]


[*.yml]
[*.yml]
indent_style = space
indent_style = space
@@ -34,3 +61,7 @@ indent_size = 2
[CMakeLists.txt]
[CMakeLists.txt]
indent_style = space
indent_style = space
indent_size = 2
indent_size = 2

[{docs,contrib/ci}/*site*/**/*.conf]
indent_style = space
indent_size = 2
Original line number Original line Diff line number Diff line
@@ -6,7 +6,7 @@ label: bug


<!--
<!--


Please carefully fill out the questionaire below to help improve the
Please carefully fill out the questionnaire below to help improve the
timely triaging of issues. Walk through the questions below and use
timely triaging of issues. Walk through the questions below and use
them as an inspiration for what information you can provide.
them as an inspiration for what information you can provide.


.github/dependabot.yml

0 → 100644
+12 −0
Original line number Original line Diff line number Diff line
# Docs: <https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/customizing-dependency-updates>

version: 2

updates:
  - package-ecosystem: github-actions
    directory: /
    schedule: {interval: monthly}

  - package-ecosystem: pip
    directory: /docs/
    schedule: {interval: monthly}

.github/filters.yml

0 → 100644
+345 −0
Original line number Original line Diff line number Diff line
{
  "armsr-armv7": [
    "targets/armsr-armv7",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/armsr.inc"
  ],
  "armsr-armv8": [
    "targets/armsr-armv8",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/armsr.inc"
  ],
  "ath79-generic": [
    "targets/ath79-generic",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "ath79-nand": [
    "targets/ath79-nand",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "ath79-mikrotik": [
    "targets/ath79-mikrotik",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/mikrotik.inc"
  ],
  "bcm27xx-bcm2708": [
    "targets/bcm27xx-bcm2708",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/bcm27xx.inc"
  ],
  "bcm27xx-bcm2709": [
    "targets/bcm27xx-bcm2709",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/bcm27xx.inc"
  ],
  "ipq40xx-generic": [
    "targets/ipq40xx-generic",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "ipq40xx-mikrotik": [
    "targets/ipq40xx-mikrotik",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/mikrotik.inc"
  ],
  "ipq806x-generic": [
    "targets/ipq806x-generic",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "lantiq-xrx200": [
    "targets/lantiq-xrx200",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "lantiq-xrx200_legacy": [
    "targets/lantiq-xrx200_legacy",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "lantiq-xway": [
    "targets/lantiq-xway",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "mediatek-filogic": [
    "targets/mediatek-filogic",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "mediatek-mt7622": [
    "targets/mediatek-mt7622",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "mvebu-cortexa53": [
    "targets/mvebu-cortexa53",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "mpc85xx-p1010": [
    "targets/mpc85xx-p1010",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "mpc85xx-p1020": [
    "targets/mpc85xx-p1020",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "qualcommax-ipq807x": [
    "targets/qualcommax-ipq807x",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "ramips-mt7620": [
    "targets/ramips-mt7620",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "ramips-mt7621": [
    "targets/ramips-mt7621",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "ramips-mt76x8": [
    "targets/ramips-mt76x8",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "rockchip-armv8": [
    "targets/rockchip-armv8",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "sunxi-cortexa7": [
    "targets/sunxi-cortexa7",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "x86-generic": [
    "targets/x86-generic",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/x86.inc"
  ],
  "x86-geode": [
    "targets/x86-geode",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "x86-legacy": [
    "targets/x86-legacy",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/x86.inc"
  ],
  "x86-64": [
    "targets/x86-64",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/x86.inc",
    "contrib/ci/minimal-site/**",
    "package/**"
  ],
  "bcm27xx-bcm2710": [
    "targets/bcm27xx-bcm2710",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/bcm27xx.inc"
  ],
  "bcm27xx-bcm2711": [
    "targets/bcm27xx-bcm2711",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
    "targets/bcm27xx.inc"
  ],
  "ipq40xx-chromium": [
    "targets/ipq40xx-chromium",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "kirkwood-generic": [
    "targets/kirkwood-generic",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ],
  "mvebu-cortexa9": [
    "targets/mvebu-cortexa9",
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk"
  ]
}
Original line number Original line Diff line number Diff line
---
---
"3. topic: babel":
  - package/gluon-l3roamd/**
  - package/gluon-mesh-babel/**
  - package/gluon-mmfd/**
"3. topic: batman-adv":
"3. topic: batman-adv":
  - changed-files:
    - any-glob-to-any-file:
      - docs/package/gluon-mesh-batman-adv*
      - docs/package/gluon-mesh-batman-adv*
      - package/gluon-alfred/**
      - package/gluon-alfred/**
  - package/gluon-cient-bridge/**
      - package/gluon-client-bridge/**
      - package/gluon-mesh-batman-adv/**
      - package/gluon-mesh-batman-adv/**
      - package/libbatadv/**
      - package/libbatadv/**
"3. topic: build":
"3. topic: build":
  - changed-files:
    - any-glob-to-any-file:
      - Makefile
      - Makefile
      - scripts/**
      - scripts/**
"3. topic: config-mode":
"3. topic: config-mode":
  - changed-files:
    - any-glob-to-any-file:
      - docs/dev/web/config-mode.rst
      - docs/dev/web/config-mode.rst
      - docs/package/gluon-config-mode-*
      - docs/package/gluon-config-mode-*
  - packge/gluon-config-mode-*/**
      - package/gluon-config-mode-*/**
      - package/gluon-web*/**
      - package/gluon-web*/**
"3. topic: continous integration":
"3. topic: continuous integration":
  - changed-files:
    - any-glob-to-any-file:
      - .github/workflows/*
      - .github/workflows/*
      - contrib/actions/**
      - contrib/actions/**
      - contrib/ci/**
      - contrib/ci/**
"3. topic: docs":
"3. topic: docs":
  - changed-files:
    - any-glob-to-any-file:
      - docs/**
      - docs/**
"3. topic: fastd":
"3. topic: fastd":
  - changed-files:
    - any-glob-to-any-file:
      - docs/features/fastd*
      - docs/features/fastd*
      - package/gluon-mesh-vpn-fastd/**
      - package/gluon-mesh-vpn-fastd/**
"3. topic: firewall":
"3. topic: firewall":
  - changed-files:
    - any-glob-to-any-file:
      - package/**/*-firewall
      - package/**/*-firewall
      - package/gluon-ebtables-*/**
      - package/gluon-ebtables-*/**
"3. topic: hardware":
"3. topic: hardware":
  - changed-files:
    - any-glob-to-any-file:
      - package/gluon-core/luasrc/lib/gluon/upgrade/010-primary-mac
      - package/gluon-core/luasrc/lib/gluon/upgrade/010-primary-mac
      - package/gluon-core/luasrc/usr/lib/lua/gluon/platform.lua
      - package/gluon-core/luasrc/usr/lib/lua/gluon/platform.lua
      - targets/*
      - targets/*
"3. topic: multidomain":
"3. topic: multidomain":
  - changed-files:
    - any-glob-to-any-file:
      - docs/features/multidomain*
      - docs/features/multidomain*
      - docs/multidomain-site-example/**
      - docs/multidomain-site-example/**
      - package/gluon-config-mode-domain-select/**
      - package/gluon-config-mode-domain-select/**
      - package/gluon-scheduled-domain-switch/**
      - package/gluon-scheduled-domain-switch/**
"3. topic: olsr":
  - changed-files:
    - any-glob-to-any-file:
      - package/gluon-l3roamd/**
      - package/gluon-mesh-olsrd/**
      - package/gluon-mmfd/**
"3. topic: package":
"3. topic: package":
  - changed-files:
    - any-glob-to-any-file:
      - package/**
      - package/**
"3. topic: respondd":
"3. topic: respondd":
  - changed-files:
    - any-glob-to-any-file:
      - package/**/*respondd*
      - package/**/*respondd*
      - package/gluon-respondd/**
      - package/gluon-respondd/**
"3. topic: status-page":
"3. topic: status-page":
  - changed-files:
    - any-glob-to-any-file:
      - package/gluon-status-page/**
      - package/gluon-status-page/**
"3. topic: tests":
"3. topic: tests":
  - changed-files:
    - any-glob-to-any-file:
      - tests/**
      - tests/**
"3. topic: tunneldigger":
  - package/gluon-mesh-vpn-tunneldigger/**
"3. topic: wireguard":
"3. topic: wireguard":
  - changed-files:
    - any-glob-to-any-file:
      - package/gluon-mesh-vpn-wireguard/**
      - package/gluon-mesh-vpn-wireguard/**
"3. topic: wireless":
"3. topic: wireless":
  - changed-files:
    - any-glob-to-any-file:
      - package/gluon-mesh-wireless-sae/**
      - package/gluon-mesh-wireless-sae/**
      - package/gluon-private-wifi/**
      - package/gluon-private-wifi/**
      - package/gluon-web-private-wifi/**
      - package/gluon-web-private-wifi/**
      - package/gluon-web-wifi-config/**
      - package/gluon-web-wifi-config/**
  - package/gluon-wireless-encryption/**
      - package/gluon-wireless-encryption-wpa3/**
+20 −0
Original line number Original line Diff line number Diff line
name: Backport
on:
  pull_request_target:
    types: [closed, labeled]
permissions:
  contents: write # so it can comment
  pull-requests: write # so it can create pull requests
jobs:
  backport:
    name: Backport Pull Request
    if: github.repository_owner == 'freifunk-gluon' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v5
      - name: Create backport PRs
        uses: korthout/backport-action@v3.3.0
        with:
          # Config README: https://github.com/korthout/backport-action#backport-action
          pull_description: |-
            Automatic backport to `${target_branch}`, triggered by a label in #${pull_number}.
+48 −0
Original line number Original line Diff line number Diff line
# Based on the example from https://docs.github.com/en/actions/publishing-packages/publishing-docker-images
name: Create and publish a Docker image

on:
  push:
    branches:
      - 'main'
      - 'next'
      - 'v202[0-9].[0-9].x'
    tags:
      - 'v*'
  pull_request:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}-build

jobs:
  build-and-push-image:
    runs-on: ubuntu-22.04
    permissions: write-all
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Log in to the Container registry
        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
        if: ${{ github.repository_owner == 'freifunk-gluon' && github.event_name == 'push' }}
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
      - name: Build and push Docker image
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
        with:
          context: ./contrib/docker
          push: ${{ github.repository_owner == 'freifunk-gluon' && github.event_name == 'push' }}
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
Original line number Original line Diff line number Diff line
@@ -9,18 +9,21 @@ on:
    paths:
    paths:
      - 'docs**/'
      - 'docs**/'
      - '.github/workflows/build-docs.yml'
      - '.github/workflows/build-docs.yml'
permissions:
  contents: read

jobs:
jobs:
  build-documentation:
  build-documentation:
    name: docs
    name: docs
    runs-on: ubuntu-latest
    runs-on: ubuntu-24.04
    steps:
    steps:
      - uses: actions/checkout@v1
      - uses: actions/checkout@v5
      - name: Install Dependencies
      - name: Install Dependencies
        run: sudo pip3 install sphinx-rtd-theme
        run: sudo pip3 install -r docs/requirements.txt
      - name: Build documentation
      - name: Build documentation
        run: make -C docs html
        run: make -C docs html
      - name: Archive build output
      - name: Archive build output
        uses: actions/upload-artifact@v1
        uses: actions/upload-artifact@v4
        with:
        with:
          name: docs_output
          name: docs_output
          path: docs/_build/html
          path: docs/_build/html
Original line number Original line Diff line number Diff line

# Update this file after adding/removing/renaming a target by running
# `make list-targets BROKEN=1 | ./contrib/actions/generate-actions.py > ./.github/workflows/build-gluon.yml`

name: Build Gluon
name: Build Gluon
on:
on:
  push:
  push:
    branches:
    branches:
      - master
      - main
      - next*
      - next
      - v20*
      - 'v20[2-9][0-9].[0-9].x'
    paths:
      - "modules"
      - "Makefile"
      - "scripts/**"
      - "package/**"
      - "patches/**"
      - "targets/**"
      - ".github/workflows/build-gluon.yml"
  pull_request:
  pull_request:
    types: [opened, synchronize, reopened]
    types: [opened, synchronize, reopened]
    paths:
  workflow_dispatch:
      - "modules"

      - "Makefile"
permissions:
      - "scripts/**"
  contents: read
      - "package/**"

      - "patches/**"
concurrency:
      - "targets/**"
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ github.event.pull_request.number || github.run_id }}
      - ".github/workflows/build-gluon.yml"
  cancel-in-progress: true

jobs:
jobs:
  changed:
    permissions:
      contents: read  # for dorny/paths-filter to fetch a list of changed files
      pull-requests: read  # for dorny/paths-filter to read pull requests
    runs-on: ubuntu-22.04
    outputs:
      targets: ${{ steps.filter.outputs.changes }}
    steps:
      - uses: actions/checkout@v5

      # Filter targets based on changed files
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: .github/filters.yml

  build_firmware:
  build_firmware:
    needs: changed
    if: ${{ needs.changed.outputs.targets != '[]' && needs.changed.outputs.targets != '' }}
    strategy:
    strategy:
      fail-fast: false
      fail-fast: false
      matrix:
      matrix:
        target: [ar71xx-generic, ar71xx-tiny, ar71xx-nand, ath79-generic, brcm2708-bcm2708, brcm2708-bcm2709, ipq40xx-generic, ipq806x-generic, lantiq-xrx200, lantiq-xway, mpc85xx-generic, mpc85xx-p1020, ramips-mt7620, ramips-mt7621, ramips-mt76x8, ramips-rt305x, sunxi-cortexa7, x86-generic, x86-geode, x86-legacy, x86-64, ar71xx-mikrotik, brcm2708-bcm2710, mvebu-cortexa9]
        # Read back changed targets to create build matrix
    runs-on: ubuntu-latest
        target: ${{ fromJSON(needs.changed.outputs.targets) }}
    runs-on: ubuntu-22.04
    steps:
    steps:
      - uses: actions/checkout@v1
      - uses: actions/checkout@v5
      - name: Install Dependencies

        run: sudo contrib/actions/install-dependencies.sh
      - name: Show system information
      - name: Build
        run: contrib/actions/show-system-info.sh
        run: contrib/actions/run-build.sh ${{ matrix.target }}

      - name: Remove non-required software
        run: contrib/actions/free-runner-space.sh

      - name: Build Docker container
        run: docker build -t gluon-ci-container contrib/docker

      - name: Build Gluon
        run: docker run --rm -v $PWD:/gluon-ci -w /gluon-ci --user "$(id -u):$(id -g)" gluon-ci-container contrib/actions/run-build.sh ${{ matrix.target }}

      - name: Check Image size
        run: contrib/check-image-size.py --github-actions --overhead 256 output/meta/openwrt-profiles/${{ matrix.target }}.json

      - name: Archive build logs
      - name: Archive build logs
        if: ${{ !cancelled() }}
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v1
        uses: actions/upload-artifact@v4
        with:
        with:
          name: ${{ matrix.target }}_logs
          name: ${{ matrix.target }}_logs
          path: openwrt/logs
          path: openwrt/logs

      - name: Archive build output
      - name: Archive build output
        uses: actions/upload-artifact@v1
        uses: actions/upload-artifact@v4
        with:
        with:
          name: ${{ matrix.target }}_output
          name: ${{ matrix.target }}_output
          path: output
          path: output


      - name: Archive metadata
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.target }}_metadata
          path: output/meta
+51 −0
Original line number Original line Diff line number Diff line
---
name: "Update OpenWrt base"

on:
  workflow_dispatch:
    inputs:
      branch:
        description: "Branch to create update for"
        required: true
        default: "main"

jobs:
  update-openwrt:
    runs-on: ubuntu-22.04
    env:
      COMMIT_NAME: Gluon CI Bot
      COMMIT_EMAIL: bot@freifunk-gluon.github.io
    steps:
      - name: Clone Gluon
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event.inputs.branch }}
      
      - name: Configure Git User and E-Mail
        run: git config --global user.name "${{ env.COMMIT_NAME }}" && git config --global user.email "${{ env.COMMIT_EMAIL }}"
      
      - name: Get update branch name
        id: branch-name
        run: echo "branch-name=update-openwrt-${{ github.event.inputs.branch }}-$(date +%s)" >> $GITHUB_OUTPUT

      - name: Link example Site
        run: ln -s docs/site-example site
      
      - name: Invoke update-modules
        run: make update-modules
      
      - name: Refresh patches
        run: make refresh-patches
      
      - name: Check if unstaged commits exist
        run: git diff --exit-code || echo "::warning::Patches need a manual refresh"
      
      - name: Checkout individual branch name
        run: git checkout -b ${{ steps.branch-name.outputs.branch-name }}
      
      - name: Push branch
        run: git push origin HEAD

      - name: Emit PR creation message
        run:
          echo "::notice::Create pull-request at https://github.com/${{ github.repository }}/compare/${{ github.event.inputs.branch }}...${{ steps.branch-name.outputs.branch-name }}?quick_pull=1"
+22 −0
Original line number Original line Diff line number Diff line
name: Check generated CI
on:
  push:
  pull_request:
    types: [opened, synchronize, reopened]
permissions:
  contents: read

jobs:
  check-ci:
    name: Check generated CI
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v5
      - name: Install example site
        run: ln -s ./docs/site-example ./site
      - name: Update CI
        run: make update-ci
      - name: Show diff
        run: git status; git diff
      - name: Patch status
        run: git diff-files --quiet
Original line number Original line Diff line number Diff line
@@ -12,12 +12,15 @@ on:
      - 'modules'
      - 'modules'
      - 'patches/**'
      - 'patches/**'
      - '.github/workflows/check-patches.yml'
      - '.github/workflows/check-patches.yml'
permissions:
  contents: read

jobs:
jobs:
  check-patches:
  check-patches:
    name: Check patches
    name: Check patches
    runs-on: ubuntu-latest
    runs-on: ubuntu-22.04
    steps:
    steps:
      - uses: actions/checkout@v1
      - uses: actions/checkout@v5
      - name: Refresh patches
      - name: Refresh patches
        run: make refresh-patches GLUON_SITEDIR="contrib/ci/minimal-site"
        run: make refresh-patches GLUON_SITEDIR="contrib/ci/minimal-site"
      - name: Show diff
      - name: Show diff
Original line number Original line Diff line number Diff line
@@ -4,12 +4,18 @@ on:
  # only execute base branch actions
  # only execute base branch actions
  pull_request_target:
  pull_request_target:


permissions:
  contents: read

jobs:
jobs:
  labels:
  labels:
    runs-on: ubuntu-latest
    permissions:
      contents: read  # for actions/labeler to determine modified files
      pull-requests: write  # for actions/labeler to add labels to PRs
    runs-on: ubuntu-22.04
    if: github.repository_owner == 'freifunk-gluon'
    if: github.repository_owner == 'freifunk-gluon'
    steps:
    steps:
    - uses: actions/labeler@v3
    - uses: actions/labeler@v5
      with:
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        sync-labels: true
        sync-labels: true
Original line number Original line Diff line number Diff line
@@ -3,14 +3,17 @@ on:
  push:
  push:
  pull_request:
  pull_request:
    types: [opened, synchronize, reopened]
    types: [opened, synchronize, reopened]
permissions:
  contents: read

jobs:
jobs:
  lua:
  lua:
    name: Lua
    name: Lua
    runs-on: ubuntu-latest
    runs-on: ubuntu-22.04
    steps:
    steps:
      - uses: actions/checkout@v1
      - uses: actions/checkout@v5
      - name: Install Dependencies
      - name: Install Dependencies
        run: sudo apt install lua-check
        run: sudo apt-get -y update && sudo apt-get -y install lua-check
      - name: Install example site
      - name: Install example site
        run: ln -s ./docs/site-example ./site
        run: ln -s ./docs/site-example ./site
      - name: Lint Lua code
      - name: Lint Lua code
@@ -18,12 +21,34 @@ jobs:


  sh:
  sh:
    name: Shell
    name: Shell
    runs-on: ubuntu-latest
    runs-on: ubuntu-22.04
    steps:
    steps:
      - uses: actions/checkout@v1
      - uses: actions/checkout@v5
      - name: Install Dependencies
      - name: Install Dependencies
        run: sudo apt install shellcheck
        run: sudo apt-get -y update && sudo apt-get -y install shellcheck
      - name: Install example site
      - name: Install example site
        run: ln -s ./docs/site-example ./site
        run: ln -s ./docs/site-example ./site
      - name: Lint shell code
      - name: Lint shell code
        run: make lint-sh
        run: make lint-sh

  editorconfig:
    name: Editorconfig
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v5
      - name: Install Dependencies
        run: sudo apt install curl tar
      - name: Install editorconfig-checker
        env:
          VERSION: 2.7.0
          OS: linux
          ARCH: amd64
        run: |
          curl -O -L -C - https://github.com/editorconfig-checker/editorconfig-checker/releases/download/$VERSION/ec-$OS-$ARCH.tar.gz
          tar xzf ec-$OS-$ARCH.tar.gz
          sudo mv ./bin/ec-$OS-$ARCH /usr/bin/editorconfig-checker
          sudo chmod +x /usr/bin/editorconfig-checker
      - name: Install example site
        run: ln -s ./docs/site-example ./site
      - name: Lint editorconfig
        run: make lint-editorconfig
+1 −0
Original line number Original line Diff line number Diff line
@@ -7,3 +7,4 @@
.bash_history
.bash_history
.subversion
.subversion
.wget-hsts
.wget-hsts
/.scmversion
+4 −0
Original line number Original line Diff line number Diff line
@@ -25,9 +25,11 @@ files["package/**/check_site.lua"] = {
		"extend",
		"extend",
		"in_domain",
		"in_domain",
		"in_site",
		"in_site",
		"value",
		"need",
		"need",
		"need_alphanumeric_key",
		"need_alphanumeric_key",
		"need_array",
		"need_array",
		"need_array_elements_exclusive",
		"need_array_of",
		"need_array_of",
		"need_boolean",
		"need_boolean",
		"need_chanlist",
		"need_chanlist",
@@ -49,6 +51,7 @@ files["package/**/check_site.lua"] = {


files["package/**/luasrc/lib/gluon/config-mode/*"] = {
files["package/**/luasrc/lib/gluon/config-mode/*"] = {
	globals = {
	globals = {
		"MultiListValue",
		"DynamicList",
		"DynamicList",
		"Flag",
		"Flag",
		"Form",
		"Form",
@@ -62,6 +65,7 @@ files["package/**/luasrc/lib/gluon/config-mode/*"] = {
		"translate",
		"translate",
		"translatef",
		"translatef",
		"Value",
		"Value",
		"Element",
	},
	},
}
}


.readthedocs.yaml

0 → 100644
+20 −0
Original line number Original line Diff line number Diff line
# .readthedocs.yaml
# Read the Docs configuration file
# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details

# Required
version: 2

# Build documentation in the docs/ directory with Sphinx
sphinx:
  configuration: docs/conf.py

# Optionally set the version of Python and requirements required to build your docs
python:
   install:
   - requirements: docs/requirements.txt

build:
    os: ubuntu-22.04
    tools:
        python: "3.11"
+7 −7
Original line number Original line Diff line number Diff line
@@ -23,19 +23,19 @@ using other parts or why the proposed change breaks other parts of the system.
They might even refuse the idea altogether - after all, they have to sleep well
They might even refuse the idea altogether - after all, they have to sleep well
after merging the changes, too.
after merging the changes, too.


The preferred way to discuss in the IRC channel ([#gluon] on irc.hackint.org)
The preferred way to discuss is in the IRC channel ([#gluon] on irc.hackint.org)
or on the [mailing list], however, you can also open a new issue on Github to
or on the [mailing list], however, you can also open a new issue on GitHub to
discuss there. We maintain a [list of rejected features] and we'd like to
discuss there. We maintain a [list of rejected features] and we'd like to
kindly ask you to review it first. In general, looking for duplicates may save
kindly ask you to review it first. In general, looking for duplicates may save
you some time.
you some time.


Develop on top of master
Develop on top of main
------------------------
----------------------
If you are not developing something specific to a release (like for example a
If you are not developing something specific to a release (like for example a
security fix to a feature that got completely rewritten since the release),
security fix to a feature that got completely rewritten since the release),
develop it on top of the master branch. New features and even feature changes
develop it on top of the main branch. New features and even feature changes
aren't usually backported to old releases, but will be included in the upcoming
aren't usually backported to old releases, but will be included in the upcoming
release, which will be built from master.
release, which will be built from main.


Use descriptive commit messages
Use descriptive commit messages
-------------------------------
-------------------------------
@@ -48,6 +48,6 @@ existing commit messages to get the idea.




[packages]: https://gluon.readthedocs.io/en/latest/user/site.html#packages
[packages]: https://gluon.readthedocs.io/en/latest/user/site.html#packages
[#gluon]: https://webirc.hackint.org/#gluon
[#gluon]: https://chat.hackint.org/?join=gluon
[mailing list]: mailto:gluon@luebeck.freifunk.net
[mailing list]: mailto:gluon@luebeck.freifunk.net
[list of rejected features]: https://github.com/freifunk-gluon/gluon/issues?q=label%3A%222.+status%3A+rejected%22
[list of rejected features]: https://github.com/freifunk-gluon/gluon/issues?q=label%3A%222.+status%3A+rejected%22
+3 −1
Original line number Original line Diff line number Diff line
BSD 2-Clause License

The code of Project Gluon may be distributed under the following terms, unless
The code of Project Gluon may be distributed under the following terms, unless
noted otherwise in individual files or subtrees.
noted otherwise in individual files or subtrees.


Copyright (c) 2013-2021, Project Gluon
Copyright (c) Project Gluon
All rights reserved.
All rights reserved.


Redistribution and use in source and binary forms, with or without
Redistribution and use in source and binary forms, with or without
+37 −7
Original line number Original line Diff line number Diff line
@@ -19,14 +19,15 @@ escape = '$(subst ','\'',$(1))'
GLUON_SITEDIR ?= site
GLUON_SITEDIR ?= site
$(eval $(call mkabspath,GLUON_SITEDIR))
$(eval $(call mkabspath,GLUON_SITEDIR))


$(GLUON_SITEDIR)/site.mk:
ifeq ($(realpath $(GLUON_SITEDIR)/site.mk),)
$(error No site configuration was found. Please check out a site configuration to $(GLUON_SITEDIR))
$(error No site configuration was found. Please check out a site configuration to $(GLUON_SITEDIR))
endif


include $(GLUON_SITEDIR)/site.mk
include $(GLUON_SITEDIR)/site.mk


GLUON_RELEASE ?= $(error GLUON_RELEASE not set. GLUON_RELEASE can be set in site.mk or on the command line)
GLUON_RELEASE ?= $(error GLUON_RELEASE not set. GLUON_RELEASE can be set in site.mk or on the command line)


GLUON_DEPRECATED ?= $(error GLUON_DEPRECATED not set. Please consult the documentation)
GLUON_DEPRECATED ?= 0


ifneq ($(GLUON_BRANCH),)
ifneq ($(GLUON_BRANCH),)
  $(warning *** Warning: GLUON_BRANCH has been deprecated, please set GLUON_AUTOUPDATER_BRANCH and GLUON_AUTOUPDATER_ENABLED instead.)
  $(warning *** Warning: GLUON_BRANCH has been deprecated, please set GLUON_AUTOUPDATER_BRANCH and GLUON_AUTOUPDATER_ENABLED instead.)
@@ -34,6 +35,14 @@ ifneq ($(GLUON_BRANCH),)
  GLUON_AUTOUPDATER_ENABLED ?= 1
  GLUON_AUTOUPDATER_ENABLED ?= 1
endif
endif


ifneq ($(GLUON_FEATURES)$(GLUON_FEATURES_standard)$(GLUON_FEATURES_tiny),)
  $(error GLUON_FEATURES is obsolete, please use the image-customization.lua file instead)
endif

ifneq ($(GLUON_SITE_PACKAGES)$(GLUON_SITE_PACKAGES_standard)$(GLUON_SITE_PACKAGES_tiny),)
  $(error GLUON_SITE_PACKAGES is obsolete, please use the image-customization.lua file instead)
endif

GLUON_AUTOUPDATER_ENABLED ?= 0
GLUON_AUTOUPDATER_ENABLED ?= 0


# initialize (possibly already user set) directory variables
# initialize (possibly already user set) directory variables
@@ -42,6 +51,7 @@ GLUON_OUTPUTDIR ?= output
GLUON_IMAGEDIR ?= $(GLUON_OUTPUTDIR)/images
GLUON_IMAGEDIR ?= $(GLUON_OUTPUTDIR)/images
GLUON_PACKAGEDIR ?= $(GLUON_OUTPUTDIR)/packages
GLUON_PACKAGEDIR ?= $(GLUON_OUTPUTDIR)/packages
GLUON_DEBUGDIR ?= $(GLUON_OUTPUTDIR)/debug
GLUON_DEBUGDIR ?= $(GLUON_OUTPUTDIR)/debug
GLUON_METADIR ?= $(GLUON_OUTPUTDIR)/meta
GLUON_TARGETSDIR ?= targets
GLUON_TARGETSDIR ?= targets
GLUON_PATCHESDIR ?= patches
GLUON_PATCHESDIR ?= patches


@@ -52,9 +62,14 @@ $(eval $(call mkabspath,GLUON_PACKAGEDIR))
$(eval $(call mkabspath,GLUON_TARGETSDIR))
$(eval $(call mkabspath,GLUON_TARGETSDIR))
$(eval $(call mkabspath,GLUON_PATCHESDIR))
$(eval $(call mkabspath,GLUON_PATCHESDIR))


GLUON_VERSION := $(shell scripts/getversion.sh '.')

# Set default SITE_VERSION if not set by user
GLUON_SITE_VERSION ?= $(shell scripts/getversion.sh '$(GLUON_SITEDIR)')

GLUON_MULTIDOMAIN ?= 0
GLUON_MULTIDOMAIN ?= 0
GLUON_AUTOREMOVE ?= 0
GLUON_AUTOREMOVE ?= 0
GLUON_DEBUG ?= 0
GLUON_DEBUG ?= 1
GLUON_MINIFY ?= 1
GLUON_MINIFY ?= 1


# Can be overridden via environment/command line/... to use the Gluon
# Can be overridden via environment/command line/... to use the Gluon
@@ -64,9 +79,10 @@ src-link gluon_base ../../package
endef
endef


GLUON_VARS = \
GLUON_VARS = \
	GLUON_VERSION GLUON_SITE_VERSION \
	GLUON_RELEASE GLUON_REGION GLUON_MULTIDOMAIN GLUON_AUTOREMOVE GLUON_DEBUG GLUON_MINIFY GLUON_DEPRECATED \
	GLUON_RELEASE GLUON_REGION GLUON_MULTIDOMAIN GLUON_AUTOREMOVE GLUON_DEBUG GLUON_MINIFY GLUON_DEPRECATED \
	GLUON_DEVICES GLUON_TARGETSDIR GLUON_PATCHESDIR GLUON_TMPDIR GLUON_IMAGEDIR GLUON_PACKAGEDIR GLUON_DEBUGDIR \
	GLUON_DEVICES GLUON_TARGETSDIR GLUON_PATCHESDIR GLUON_TMPDIR GLUON_IMAGEDIR GLUON_PACKAGEDIR GLUON_DEBUGDIR \
	GLUON_SITEDIR GLUON_RELEASE GLUON_AUTOUPDATER_BRANCH GLUON_AUTOUPDATER_ENABLED GLUON_LANGS GLUON_BASE_FEEDS \
	GLUON_METADIR GLUON_SITEDIR GLUON_AUTOUPDATER_BRANCH GLUON_AUTOUPDATER_ENABLED GLUON_LANGS GLUON_BASE_FEEDS \
	GLUON_TARGET BOARD SUBTARGET
	GLUON_TARGET BOARD SUBTARGET


unexport $(GLUON_VARS)
unexport $(GLUON_VARS)
@@ -100,6 +116,11 @@ refresh-patches: FORCE
update-feeds: FORCE
update-feeds: FORCE
	@$(GLUON_ENV) scripts/feeds.sh
	@$(GLUON_ENV) scripts/feeds.sh


update-modules: FORCE
	@scripts/update-modules.sh

update-ci: FORCE
	@$(GLUON_ENV) scripts/update-ci.sh


GLUON_TARGETS :=
GLUON_TARGETS :=


@@ -141,7 +162,10 @@ list-targets: FORCE
		echo "$$target"
		echo "$$target"
	done
	done


lint: lint-lua lint-sh
lint: lint-editorconfig lint-lua lint-sh

lint-editorconfig: FORCE
	@scripts/lint-editorconfig.sh


lint-lua: FORCE
lint-lua: FORCE
	@scripts/lint-lua.sh
	@scripts/lint-lua.sh
@@ -157,7 +181,8 @@ $(LUA):


	scripts/module_check.sh
	scripts/module_check.sh


	[ -e openwrt/.config ] || $(OPENWRTMAKE) defconfig
	$(GLUON_ENV) scripts/basic_openwrt_config.sh > openwrt/.config
	$(OPENWRTMAKE) defconfig
	$(OPENWRTMAKE) tools/install
	$(OPENWRTMAKE) tools/install
	$(OPENWRTMAKE) package/lua/host/compile
	$(OPENWRTMAKE) package/lua/host/compile


@@ -171,11 +196,16 @@ config: $(LUA) FORCE
		$(call CheckSite,$(conf)); \
		$(call CheckSite,$(conf)); \
	)
	)


	$(OPENWRTMAKE) prepare-tmpinfo
	$(GLUON_ENV) $(LUA) scripts/target_config.lua > openwrt/.config
	$(GLUON_ENV) $(LUA) scripts/target_config.lua > openwrt/.config
	$(OPENWRTMAKE) defconfig
	$(OPENWRTMAKE) defconfig
	$(GLUON_ENV) $(LUA) scripts/target_config_check.lua
	$(GLUON_ENV) $(LUA) scripts/target_config_check.lua




container: FORCE
	@scripts/container.sh


all: config
all: config
	+@
	+@
	$(GLUON_ENV) $(LUA) scripts/clean_output.lua
	$(GLUON_ENV) $(LUA) scripts/clean_output.lua
+45 −7
Original line number Original line Diff line number Diff line
Documentation (incomplete at this time, contribute if you can!) may be found at
[![Build Gluon](https://github.com/freifunk-gluon/gluon/actions/workflows/build-gluon.yml/badge.svg?branch=main)](https://github.com/freifunk-gluon/gluon/actions/workflows/build-gluon.yml)
https://gluon.readthedocs.io/.
[![License](https://img.shields.io/badge/License-BSD%202--Clause-orange.svg)](https://opensource.org/license/bsd-2-clause/)
[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/freifunk-gluon/gluon?sort=semver)](https://github.com/freifunk-gluon/gluon/releases/latest)

# Gluon

Gluon is a firmware framework to build preconfigured OpenWrt images for public mesh networks.

## Overview

Gluon provides an easy-to-use firmware for a public, decentral WLAN and/or wire based mesh network.
Common network capable devices, like smartphones, laptops or desktop PCs can connect to the mesh network and communicate over it, without the need of passwords for access and without the need of installing special software.
Additionally, internet access and merging mesh clouds can be accomplished over a WAN through VPN connected gateways.

Gluon's features include:

* a decentral mesh network
* easy configuration mode for less techy users
* community-specific technical settings and customizations through a common site.conf and site.mk
* ecdsa signature-based autoupdater
* node status web page
* publication of node information + statistics through respondd
* a variety of preconfigured mesh and VPN protocols:


Supported mesh protocols:

* batman-adv (BATMAN IV fully, BATMAN V partially)
* OLSRv2 (partially)


Supported protocols for node-to-node connections:

* WLAN: 802.11s (with forwarding disabled)
* WAN: VPNs via fastd and Wireguard
* LAN: via VXLAN

## Getting started

We have a huge amount of documentation over at https://gluon.readthedocs.io/.


If you're new to Gluon and ready to get your feet wet, have a look at the
If you're new to Gluon and ready to get your feet wet, have a look at the
[Getting Started Guide](https://gluon.readthedocs.io/en/latest/user/getting_started.html).
[Getting Started Guide](https://gluon.readthedocs.io/en/latest/user/getting_started.html).


Gluon's developers frequent an IRC chatroom at [#gluon](ircs://irc.hackint.org/#gluon)
Gluon's developers frequent an IRC chatroom at [#gluon](ircs://irc.hackint.org/#gluon)
on [hackint](https://hackint.org/). There is also a [webchat](https://webirc.hackint.org/#irc://irc.hackint.org/#gluon)
on [hackint](https://hackint.org/). There is also a [webchat](https://chat.hackint.org/?join=gluon)
that allows for access from within your browser.
that allows for uncomplicated access from within your browser. This channel is also available as a bridged Matrix Room at [#gluon:hackint.org](https://matrix.to/#/#gluon:hackint.org).


## Issues & Feature requests
## Issues & Feature requests


@@ -19,12 +57,12 @@ the future development of Gluon.


## Use a release!
## Use a release!


Please refrain from using the `master` branch for anything else but development purposes!
Please refrain from using the `main` branch for anything else but development purposes!
Use the most recent release instead. You can list all releases by running `git tag`
Use the most recent release instead. You can list all releases by running `git tag`
and switch to one by running `git checkout v2020.2.3 && make update`.
and switch to one by running `git checkout v2023.2.5 && make update`.


If you're using the autoupdater, do not autoupdate nodes with anything but releases.
If you're using the autoupdater, do not autoupdate nodes with anything but releases.
If you upgrade using random master commits the nodes *will break* eventually.
If you upgrade using random main commits the nodes *might break* eventually.


## Mailinglist
## Mailinglist


+23 −0
Original line number Original line Diff line number Diff line
#!/usr/bin/env bash

# For a List of pre-installed packages on the runner image see
# https://github.com/actions/runner-images/tree/main?tab=readme-ov-file#available-images

echo "Disk space before cleanup"
df -h

# Remove packages not required to run the Gluon build CI
sudo apt-get -y remove \
	dotnet-* \
	firefox \
	google-chrome-stable \
	kubectl \
	microsoft-edge-stable \
	temurin-*-jdk

# Remove Android SDK tools
sudo rm -rf /usr/local/lib/android

echo "Disk space after cleanup"
df -h
+0 −67
Original line number Original line Diff line number Diff line
#!/usr/bin/env python3

import sys

ACTIONS_HEAD = """
# Update this file after adding/removing/renaming a target by running
# `make list-targets BROKEN=1 | ./contrib/actions/generate-actions.py > ./.github/workflows/build-gluon.yml`

name: Build Gluon
on:
  push:
    branches:
      - master
      - next*
      - v20*
    paths:
      - "modules"
      - "Makefile"
      - "scripts/**"
      - "package/**"
      - "patches/**"
      - "targets/**"
      - ".github/workflows/build-gluon.yml"
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - "modules"
      - "Makefile"
      - "scripts/**"
      - "package/**"
      - "patches/**"
      - "targets/**"
      - ".github/workflows/build-gluon.yml"
jobs:
  build_firmware:
    strategy:
      fail-fast: false
      matrix:
        target: [{matrix}]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v1
      - name: Install Dependencies
        run: sudo contrib/actions/install-dependencies.sh
      - name: Build
        run: contrib/actions/run-build.sh ${{{{ matrix.target }}}}
      - name: Archive build logs
        if: ${{{{ !cancelled() }}}}
        uses: actions/upload-artifact@v1
        with:
          name: ${{{{ matrix.target }}}}_logs
          path: openwrt/logs
      - name: Archive build output
        uses: actions/upload-artifact@v1
        with:
          name: ${{{{ matrix.target }}}}_output
          path: output
"""

targets = []

for target in sys.stdin:
    targets.append(target.strip())

output = ACTIONS_HEAD.format(matrix=", ".join(targets))

print(output)
Original line number Original line Diff line number Diff line
#!/usr/bin/env python3

# Update target filters using
#   make update-ci

import re
import os
import sys
import json

# these changes trigger rebuilds on all targets
common = [
    ".github/workflows/build-gluon.yml",
    "modules",
    "Makefile",
    "patches/**",
    "scripts/**",
    "targets/generic",
    "targets/targets.mk",
]

# these changes are only built on x86-64
extra = [
    "contrib/ci/minimal-site/**",
    "package/**"
]

_filter = dict()

# INCLUDE_PATTERN matches:
# include '...'
# include "..."
# include("...")
# include('...')
INCLUDE_PATTERN = "^\\s*include *\\(? *[\"']([^\"']+)[\"']"

# construct filters map from stdin
for target in sys.stdin:
    target = target.strip()

    _filter[target] = [
        f"targets/{target}"
    ] + common

    target_file = os.path.join(os.environ['GLUON_TARGETSDIR'], target)
    with open(target_file) as f:
        includes = re.findall(INCLUDE_PATTERN, f.read(), re.MULTILINE)
        _filter[target].extend([f"targets/{i}" for i in includes])

    if target == "x86-64":
        _filter[target].extend(extra)

# print filters to stdout in json format, because json is stdlib and yaml compatible.
print(json.dumps(_filter, indent=2))
+0 −8
Original line number Original line Diff line number Diff line
#!/bin/sh

set -e

apt-get -y update
apt-get -y install git subversion build-essential python gawk unzip libncurses5-dev zlib1g-dev libssl-dev wget time
apt-get -y clean
rm -rf /var/lib/apt/lists/*
Original line number Original line Diff line number Diff line
@@ -6,8 +6,12 @@ export BROKEN=1
export GLUON_AUTOREMOVE=1
export GLUON_AUTOREMOVE=1
export GLUON_DEPRECATED=1
export GLUON_DEPRECATED=1
export GLUON_SITEDIR="contrib/ci/minimal-site"
export GLUON_SITEDIR="contrib/ci/minimal-site"
export GLUON_TARGET=$1
export GLUON_TARGET="$1"
export BUILD_LOG=1
export BUILD_LOG=1


BUILD_THREADS="$(($(nproc) + 1))"

echo "Building Gluon with $BUILD_THREADS threads"

make update
make update
make -j2 V=s
make -j$BUILD_THREADS V=s
+16 −0
Original line number Original line Diff line number Diff line
#!/usr/bin/env bash

echo "-- CPU --"
cat /proc/cpuinfo

echo "-- Memory --"
cat /proc/meminfo

echo "-- Disk --"
df -h

echo "-- Kernel --"
uname -a

echo "-- Network --"
ip addr
+146 −0
Original line number Original line Diff line number Diff line
#!/usr/bin/env python3

import argparse
import json
import sys
from enum import Enum

# Enum Class for checking image size
class ImageSizeCheck(Enum):
    OK = "OK"
    TOO_BIG = "TOO_BIG"
    IGNORED = "IGNORED"
    UNKNOWN = "UNKNOWN"


# Some devices pad their images to IMAGE_SIZE and apply a firmware header.
# Exclude this from the image size check.
excluded_devices = [
    "tplink_cpe210-v1",
    "tplink_cpe210-v2",
    "tplink_cpe210-v3",
    "tplink_cpe220-v3",
    "tplink_cpe510-v1",
    "tplink_cpe510-v2",
    "tplink_cpe510-v3",
    "tplink_cpe710-v1",
    "tplink_wbs210-v1",
    "tplink_wbs210-v2",
    "tplink_wbs510-v1"
]


def open_json(file_path):
    with open(file_path, 'r') as f:
        return json.load(f)


def load_openwrt_profile_json(json_path):
    profiles = []
    profile_json = open_json(json_path)
    for profile_name, profile_data in profile_json["profiles"].items():
        device_profile = {
            "name": profile_name,
        }
        if "image" in profile_data.get("file_size_limits", {}):
            device_profile["max_image_size"] = profile_data["file_size_limits"]["image"]

        for image in profile_data["images"]:
            if image["type"] != "sysupgrade":
                continue
            if "size" in image:
                device_profile["image_size"] = image["size"]
        
        profiles.append(device_profile)
    
    return profiles


def check_image_size_below_limit(profile, overhead=0):
    # Skip devices that pad their images
    if profile["name"] in excluded_devices:
        return ImageSizeCheck.IGNORED

    if "max_image_size" in profile and "image_size" in profile:
        if profile["image_size"] + (overhead * 1024) > profile["max_image_size"]:
            return ImageSizeCheck.TOO_BIG
        else:	
            return ImageSizeCheck.OK
    
    return ImageSizeCheck.UNKNOWN


def print_github_actions_warning(message):
    print('::warning::{}'.format(message))


if __name__ == '__main__':
    parser = argparse.ArgumentParser(description='Check image size of OpenWrt profiles')
    parser.add_argument(
        'profile_json',
        help='Path to profile.json',
        nargs='+'
    )
    parser.add_argument(
        '--github-actions',
        help='Generate warnings for use with GitHub Actions',
        action='store_true'
    )
    parser.add_argument(
        '--overhead',
        type=int,
        help='Additional size to add to the image size in kilobyte',
        default=0
    )
    args = parser.parse_args()

    if args.profile_json is None:
        print('Error: profile.json not specified')
        sys.exit(1)
    
    # Load all profile.json files
    profiles = []
    for profile_file in args.profile_json:
        profiles.extend(load_openwrt_profile_json(profile_file))

    # Initialize results with all available ImageSizeCheck values
    results = {}
    for check_result in ImageSizeCheck:
        results[check_result] = []

    for profile in profiles:
        check_result = check_image_size_below_limit(profile, args.overhead)
        results[check_result].append(profile)
    
    for check_result, profiles in results.items():
        if len(profiles) == 0:
            continue

        # Group by result type for GitHub Actions
        if args.github_actions:
            print('::group::{}'.format(check_result.value))

        for profile in profiles:
            if check_result == ImageSizeCheck.TOO_BIG:
                msg = 'Image size of profile {} is too big ({} > {})'.format(
                    profile["name"],
                    profile["image_size"] + (args.overhead * 1024),
                    profile["max_image_size"])
                if args.github_actions:
                    print_github_actions_warning(msg)
                else:
                    print("Warning: {}".format(msg))
            elif check_result == ImageSizeCheck.UNKNOWN:
                msg = 'Image size of profile {} is unknown'.format(
                    profile["name"])
                print(msg)
            elif check_result == ImageSizeCheck.IGNORED:
                msg = 'Image size of profile {} is ignored (Image size {})'.format(
                    profile["name"], profile.get("image_size", "unknown"))
                print(msg)
            else:
                msg = 'Image size of profile {} is OK ({} < {})'.format(
                    profile["name"], 
                    profile["image_size"] + (args.overhead * 1024),
                    profile["max_image_size"])
                print(msg)

contrib/ci/Jenkinsfile

deleted100644 → 0
+0 −82
Original line number Original line Diff line number Diff line
pipeline {
	agent none
	environment {
		GLUON_SITEDIR = "contrib/ci/minimal-site"
		GLUON_TARGET = "x86-64"
		BUILD_LOG = "1"
	}
	stages {
		stage('lint') {
			parallel {
				stage('lint-lua') {
					agent { label 'gluon-docker' }
					steps {
						sh label: 'Identify runner', script: 'echo $SLAVE_NAME'
						sh 'make lint-lua'
					}
				}
				stage('lint-sh') {
					agent { label 'gluon-docker-v1' }
					steps {
						sh label: 'Identify runner', script: 'echo $SLAVE_NAME'
						sh 'make lint-sh'
					}
				}
			}
		}
		stage('docs') {
			agent { label 'gluon-docker' }
			steps {
				sh label: 'Identify runner', script: 'echo $SLAVE_NAME'
				sh 'make -C docs html'
			}
		}
		stage('build') {
			agent { label 'gluon-docker-v2' }
			steps {
				sh label: 'Identify runner', script: 'echo $SLAVE_NAME'
				sh 'make update'
				sh 'test -d /dl_cache && ln -s /dl_cache openwrt/dl || true'
				timeout(time: 2, unit: "HOURS") {
					sh 'make -j$(nproc) V=s'
				}
				stash includes: '**/output/images/factory/*-x86-64.img.gz', name: 'gluon-x86-64-factory'
			}
		}
		stage('test') {
			agent { label 'gluon-vmx' }
			steps {
				sh label: 'Identify runner', script: 'echo $SLAVE_NAME'
				unstash 'gluon-x86-64-factory'
				sh label: 'Unpack image', script: 'gunzip -cd ./output/images/factory/*x86-64*.img.gz > ./image.img'
				sh label: 'Print python environment', script: 'python3 -m pip freeze'
				script {
					for (f in findFiles(glob: 'tests/*.py')) {
						timeout(time: 10, unit: "MINUTES") {
							sh label: "Test ${f.name}", script: "python3 tests/${f.name} --use-tmp-workdir"
						}
					}
				}
			}
		}
	}
}

/*
 api-history:

 Every time the build dependencies of gluon change, the version
 every container has to be rebuilt. Therefore, we use Jenkins
 labels which intoduce a version number which is documented here.
 As soon, as you properly rebuilt your docker container, you
 can notify lemoer, that you have updated your node.

 - gluon-docker-v1:
   - add shellcheck binary to the build environment
 - gluon-docker-v2:
   - add qemu-testlab testing, requires KVM virtualization support
   - require rsync dependency to be able to build the next branch
 - gluon-vmx
   - splits the qemu testing from the gluon-docker-v2 label to accomodate
     nodes without the vmx cpu flag
*/
+0 −33
Original line number Original line Diff line number Diff line
FROM gluonmesh/build:latest

USER root

# this is needed to install default-jre-headless in debian slim images
RUN mkdir -p /usr/share/man/man1
 
RUN apt-get update && apt-get install -y default-jre-headless curl git netcat-openbsd python3 python3-pip qemu-system-x86 iproute2 openssh-client rsync
RUN python3 -m pip install jenkins-webapi sphinx sphinx_rtd_theme gluon-qemu-testlab==0.0.5
 
# Get docker-compose in the agent container
RUN mkdir -p /home/jenkins
RUN mkdir -p /var/lib/jenkins
RUN mkdir -p /remoting
RUN chown gluon /home/jenkins
RUN chown gluon /var/lib/jenkins
RUN chown gluon /remoting
 
# Start-up script to attach the slave to the master
ADD slave.py /var/lib/jenkins/slave.py

USER gluon
 
WORKDIR /home/jenkins

ENV JENKINS_URL "https://build.ffh.zone/"
ENV JENKINS_SLAVE_ADDRESS ""
ENV SLAVE_EXECUTORS "1"
ENV SLAVE_LABELS "docker"
ENV SLAVE_WORING_DIR ""
ENV CLEAN_WORKING_DIR "true"
 
CMD [ "python3", "-u", "/var/lib/jenkins/slave.py" ]
+0 −41
Original line number Original line Diff line number Diff line
# Gluon CI using Jenkins

## Requirements
- Linux system
  - with docker installed
  - with Hardware Virtualisation (KVM Support)
    - Verify using: `lscpu | grep vmx`
    - If machine is virtualized host needs to load `kvm_intel` with `nested=1` option and cpuflags need to include `vmx`

## Architecture

![Screenshot from 2019-09-24 00-20-32](https://user-images.githubusercontent.com/601153/65468827-9edf2c80-de65-11e9-9fe0-56c3487719c3.png)

## Installation
You can support the gluon CI with your infrastructure:
1. You need to query @lemoer (freifunk@irrelefant.net) for credentials.
2. He will give you a `SLAVE_NAME` and a `SLAVE_SECRET` for your host.
3. Then go to your docker host and substitute the values for  `SLAVE_NAME` and a `SLAVE_SECRET` in the following statements:
``` shell
git clone https://github.com/freifunk-gluon/gluon/
cd gluon/contrib/ci/jenkins-community-slave/
docker build -t gluon-jenkins .
mkdir /var/cache/openwrt_dl_cache/
chown 1000:1000 /var/cache/openwrt_dl_cache
echo "z /dev/kvm 0666 - kvm -" > /etc/tmpfiles.d/kvm.conf
systemd-tmpfiles --create
docker run --detach --restart always \
    --env "SLAVE_NAME=whoareyou" \
    --env "SLAVE_SECRET=changeme" \
    --device /dev/kvm:/dev/kvm \
    --volume /var/cache/openwrt_dl_cache/:/dl_cache \
    gluon-jenkins
```
4. Check whether the instance is running correctly:
   - Your node should appear [here](https://build.ffh.zone/label/gluon-docker/).
   - When clicking on it, Jenkins should state "Agent is connected." like here: 
![Screenshot from 2019-09-24 01-00-52](https://user-images.githubusercontent.com/601153/65469209-dac6c180-de66-11e9-9d62-0d1c3b6b940b.png)
5. **Your docker container needs to be rebuilt, when the build dependencies of gluon change. As soon as build dependencies have changed, the build dependency api level has to be raised.** After you rebuilt your docker container, notify @lemoer, so he can bump the versioning number.

## Backoff
- If @lemoer is not reachable, please be patient at first if possible. Otherwise contact info@hannover.freifunk.net or join the channel `#freifunkh` on hackint.
+0 −103
Original line number Original line Diff line number Diff line
from jenkins import Jenkins, JenkinsError, NodeLaunchMethod
import os
import signal
import sys
import subprocess
import shutil
import requests
import time

slave_jar = '/var/lib/jenkins/slave.jar'
slave_name = os.environ['SLAVE_NAME'] if os.environ['SLAVE_NAME'] != '' else 'docker-slave-' + os.environ['HOSTNAME']
jnlp_url = os.environ['JENKINS_URL'] + '/computer/' + slave_name + '/slave-agent.jnlp'
slave_jar_url = os.environ['JENKINS_URL'] + '/jnlpJars/slave.jar'
print(slave_jar_url)
process = None

def clean_dir(dir):
    for root, dirs, files in os.walk(dir):
        for f in files:
            os.unlink(os.path.join(root, f))
        for d in dirs:
            shutil.rmtree(os.path.join(root, d))

def slave_create(node_name, working_dir, executors, labels):
    j = Jenkins(os.environ['JENKINS_URL'], os.environ['JENKINS_USER'], os.environ['JENKINS_PASS'])
    j.node_create(node_name, working_dir, num_executors = int(executors), labels = labels, launcher = NodeLaunchMethod.JNLP)

def slave_delete(node_name):
    j = Jenkins(os.environ['JENKINS_URL'], os.environ['JENKINS_USER'], os.environ['JENKINS_PASS'])
    j.node_delete(node_name)

def slave_download(target):
    if os.path.isfile(slave_jar):
        os.remove(slave_jar)

    r = requests.get(os.environ['JENKINS_URL'] + '/jnlpJars/slave.jar')
    with open('/var/lib/jenkins/slave.jar', 'wb') as f:
        f.write(r.content)

def slave_run(slave_jar, jnlp_url):
    params = [ 'java', '-jar', slave_jar, '-jnlpUrl', jnlp_url ]
    if os.environ['JENKINS_SLAVE_ADDRESS'] != '':
        params.extend([ '-connectTo', os.environ['JENKINS_SLAVE_ADDRESS' ] ])

    if os.environ['SLAVE_SECRET'] == '':
        params.extend([ '-jnlpCredentials', os.environ['JENKINS_USER'] + ':' + os.environ['JENKINS_PASS'] ])
    else:
        params.extend([ '-secret', os.environ['SLAVE_SECRET'] ])
    return subprocess.Popen(params, stdout=subprocess.PIPE)

def signal_handler(sig, frame):
    if process != None:
        process.send_signal(signal.SIGINT)

signal.signal(signal.SIGINT, signal_handler)
signal.signal(signal.SIGTERM, signal_handler)

def h():
    print("ERROR!: please specify environment variables")
    print("")
    print('docker run -e "SLAVE_NAME=test" -e "SLAVE_SECRET=..." jenkins')

if os.environ.get('SLAVE_NAME') is None:
    h()
    sys.exit(1)

if os.environ.get('SLAVE_SECRET') is None:
    h()
    sys.exit(1)

def master_ready(url):
    try:
        r = requests.head(url, timeout=None)
        return r.status_code == requests.codes.ok
    except:
        return False

while not master_ready(slave_jar_url):
    print("Master not ready yet, sleeping for 10sec!")
    time.sleep(10)

slave_download(slave_jar)
print('Downloaded Jenkins slave jar.')

if os.environ['SLAVE_WORING_DIR']:
    os.setcwd(os.environ['SLAVE_WORING_DIR'])

if os.environ['CLEAN_WORKING_DIR'] == 'true':
    clean_dir(os.getcwd())
    print("Cleaned up working directory.")

if os.environ['SLAVE_NAME'] == '':
    slave_create(slave_name, os.getcwd(), os.environ['SLAVE_EXECUTORS'], os.environ['SLAVE_LABELS'])
    print('Created temporary Jenkins slave.')

process = slave_run(slave_jar, jnlp_url)
print('Started Jenkins slave with name "' + slave_name + '" and labels [' + os.environ['SLAVE_LABELS'] + '].')
process.wait()

print('Jenkins slave stopped.')
if os.environ['SLAVE_NAME'] == '':
    slave_delete(slave_name)
    print('Removed temporary Jenkins slave.')
Original line number Original line Diff line number Diff line
features {
	'autoupdater',
	'ebtables-filter-multicast',
	'ebtables-filter-ra-dhcp',
	'ebtables-limit-arp',
	'mesh-batman-adv-15',
	'mesh-vpn-fastd',
	'respondd',
	'status-page',
	'web-advanced',
	'web-wizard',
}

if not device_class('tiny') then
	features {'wireless-encryption-wpa3'}
end
Original line number Original line Diff line number Diff line
-- This is an example site configuration for Gluon v2018.2+
-- This is an example site configuration
--
--
-- Take a look at the documentation located at
-- Take a look at the documentation located at
-- https://gluon.readthedocs.io/ for details.
-- https://gluon.readthedocs.io/ for details.
@@ -10,7 +10,7 @@
  -- hostname_prefix = 'freifunk-',
  -- hostname_prefix = 'freifunk-',


  -- Name of the community.
  -- Name of the community.
  site_name = 'Continious Integration',
  site_name = 'Continuous Integration',


  -- Shorthand of the community.
  -- Shorthand of the community.
  site_code = 'ci',
  site_code = 'ci',
@@ -42,10 +42,14 @@
    -- Wireless channel.
    -- Wireless channel.
    channel = 1,
    channel = 1,


    -- ESSID used for client network.
    -- ESSIDs used for client network.
    ap = {
    ap = {
      ssid = 'gluon-ci-ssid',
      ssid = 'gluon-ci-ssid',
      -- disabled = true, -- (optional)
      -- disabled = true, -- (optional)

      -- Configuration for a backward compatible OWE network below.
      owe_ssid = 'owe.gluon-ci-ssid', -- (optional - SSID for OWE client network)
      owe_transition_mode = true, -- (optional - enables transition-mode - requires ssid as well as owe_ssid)
    },
    },


    mesh = {
    mesh = {
@@ -72,6 +76,12 @@
    },
    },
  },
  },


  mesh = {
    vxlan = true,
    batman_adv = {
      routing_algo = 'BATMAN_IV',
    },
  },


  -- The next node feature allows clients to always reach the node it is
  -- The next node feature allows clients to always reach the node it is
  -- connected to using a known IP address.
  -- connected to using a known IP address.
@@ -82,16 +92,19 @@
    ip6 = 'fd::1',
    ip6 = 'fd::1',
  },
  },


  mesh = {
  -- Options specific to routing protocols (optional)
    vxlan = true,
  -- mesh = {
    batman_adv = {
    -- Options specific to the batman-adv routing protocol (optional)
      routing_algo = 'BATMAN_IV'
    -- batman_adv = {
    }
      -- Gateway selection class (optional)
  },
      -- The default class 20 is based on the link quality (TQ) only,
      -- class 1 is calculated from both the TQ and the announced bandwidth
      -- gw_sel_class = 1,
    -- },
  -- },


  mesh_vpn = {
  mesh_vpn = {
    -- enabled = true,
    -- enabled = true,
    mtu = 1312,


    fastd = {
    fastd = {
      -- Refer to https://fastd.readthedocs.io/en/latest/ to better understand
      -- Refer to https://fastd.readthedocs.io/en/latest/ to better understand
@@ -99,6 +112,7 @@


      -- List of crypto-methods to use.
      -- List of crypto-methods to use.
      methods = {'salsa2012+umac'},
      methods = {'salsa2012+umac'},
      mtu = 1312,
      -- configurable = true,
      -- configurable = true,
      -- syslog_level = 'warn',
      -- syslog_level = 'warn',


@@ -111,7 +125,18 @@
          peers = {
          peers = {
          },
          },


          -- Optional: nested peer groups
          -- groups = {
            -- backbone_sub = {
              -- ...
            -- },
          -- ...
          -- },
        },
        },
        -- Optional: additional peer groups, possibly with other limits
        -- backbone2 = {
          -- ...
        -- },
      },
      },
    },
    },


@@ -128,7 +153,8 @@
  },
  },


  autoupdater = {
  autoupdater = {
    -- Default branch. Don't forget to set GLUON_BRANCH when building!
    -- Default branch (optional), can be overridden by setting GLUON_AUTOUPDATER_BRANCH when building.
    -- Set GLUON_AUTOUPDATER_ENABLED to enable the autoupdater by default for newly installed nodes.
    branch = 'stable',
    branch = 'stable',


    -- List of branches. You may define multiple branches.
    -- List of branches. You may define multiple branches.
@@ -143,7 +169,7 @@
        -- Have multiple maintainers sign your build and only
        -- Have multiple maintainers sign your build and only
        -- accept it when a sufficient number of them have
        -- accept it when a sufficient number of them have
        -- signed it.
        -- signed it.
        good_signatures = 2,
        good_signatures = 0,


        -- List of public keys of maintainers.
        -- List of public keys of maintainers.
        pubkeys = {
        pubkeys = {
+1 −0
Original line number Original line Diff line number Diff line
../minimal-site/i18n
 No newline at end of file
Original line number Original line Diff line number Diff line
features {
	'autoupdater',
	'ebtables-filter-multicast',
	'ebtables-filter-ra-dhcp',
	'ebtables-limit-arp',
	'mesh-olsrd',
	'mesh-vpn-fastd',
	'respondd',
	'status-page',
	'web-advanced',
	'web-wizard',
}

packages {
	'iwinfo',
}

if not device_class('tiny') then
	features {'wireless-encryption-wpa3'}
end
+1 −0
Original line number Original line Diff line number Diff line
../minimal-site/modules
 No newline at end of file
+176 −0
Original line number Original line Diff line number Diff line
-- This is an example site configuration
--
-- Take a look at the documentation located at
-- https://gluon.readthedocs.io/ for details.
--
-- This configuration will not work as is. You're required to make
-- community specific changes to it!
{
  -- Used for generated hostnames, e.g. freifunk-abcdef123456. (optional)
  -- hostname_prefix = 'freifunk-',

  -- Name of the community.
  site_name = 'Continuous Integration',

  -- Shorthand of the community.
  site_code = 'ci',

  -- 32 bytes of random data, encoded in hexadecimal
  -- This data must be unique among all sites and domains!
  -- Can be generated using: echo $(hexdump -v -n 32 -e '1/1 "%02x"' </dev/urandom)
  domain_seed = 'e9608c4ff338b920992d629190e9ff11049de1dfc3f299eac07792dfbcda341c',

  -- Prefixes used by clients within the mesh.
  -- prefix6 is required, prefix4 can be omitted if next_node.ip4
  -- is not set.
  prefix6 = 'fdff:cafe:cafe:cafe::/64',

  -- Prefixes used by nodes within the mesh
  node_prefix6 = 'fdff:cafe:cafe:cafe::/64',

  -- Timezone of your community.
  -- See https://openwrt.org/docs/guide-user/base-system/system_configuration#time_zones
  timezone = 'CET-1CEST,M3.5.0,M10.5.0/3',

  -- List of NTP servers in your community.
  -- Must be reachable using IPv6!
  --  ntp_servers = {'1.ntp.services.ffxx'},

  -- Wireless regulatory domain of your community.
  regdom = 'DE',

  -- Wireless configuration for 2.4 GHz interfaces.
  wifi24 = {
    -- Wireless channel.
    channel = 1,

    -- ESSIDs used for client network.
    ap = {
      ssid = 'gluon-ci-ssid',
      -- disabled = true, -- (optional)

      -- Configuration for a backward compatible OWE network below.
      owe_ssid = 'owe.gluon-ci-ssid', -- (optional - SSID for OWE client network)
      owe_transition_mode = true, -- (optional - enables transition-mode - requires ssid as well as owe_ssid)
    },

    mesh = {
      -- Adjust these values!
      id = 'ueH3uXjdp', -- usually you don't want users to connect to this mesh-SSID, so use a cryptic id that no one will accidentally mistake for the client WiFi
      mcast_rate = 12000,
      -- disabled = true, -- (optional)
    },
  },

  -- Wireless configuration for 5 GHz interfaces.
  -- This should be equal to the 2.4 GHz variant, except
  -- for channel.
  wifi5 = {
    channel = 44,
    outdoor_chanlist = '100-140',
    ap = {
      ssid = 'gluon-ci-ssid',
      -- disabled = true, -- (optional)

      -- Configuration for a backward compatible OWE network below.
      owe_ssid = 'owe.gluon-ci-ssid', -- (optional - SSID for OWE client network)
      owe_transition_mode = true, -- (optional - enables transition-mode - requires ssid as well as owe_ssid)
    },
    mesh = {
      -- Adjust these values!
      id = 'ueH3uXjdp',
      mcast_rate = 12000,
    },
  },


  -- The next node feature allows clients to always reach the node it is
  -- connected to using a known IP address.
  next_node = {
    -- anycast IPs of all nodes
    name = { 'nextnode.location.community.example.org', 'nextnode', 'nn' },
    ip4 = '10.0.0.1',
    ip6 = 'fd::1',
  },

  -- Options specific to routing protocols (optional)
  mesh = {
    vxlan = true,
    olsrd = {},
  },

  mesh_vpn = {
    -- enabled = true,

    fastd = {
      -- Refer to https://fastd.readthedocs.io/en/latest/ to better understand
      -- what these options do.

      -- List of crypto-methods to use.
      methods = {'salsa2012+umac'},
      mtu = 1312,
      -- configurable = true,
      -- syslog_level = 'warn',

      groups = {
        backbone = {
          -- Limit number of connected peers to reduce bandwidth.
          limit = 1,

          -- List of peers.
          peers = {
          },

          -- Optional: nested peer groups
          -- groups = {
            -- backbone_sub = {
              -- ...
            -- },
          -- ...
          -- },
        },
        -- Optional: additional peer groups, possibly with other limits
        -- backbone2 = {
          -- ...
        -- },
      },
    },

    bandwidth_limit = {
      -- The bandwidth limit can be enabled by default here.
      enabled = false,

      -- Default upload limit (kbit/s).
      egress = 200,

      -- Default download limit (kbit/s).
      ingress = 3000,
    },
  },

  autoupdater = {
    -- Default branch (optional), can be overridden by setting GLUON_AUTOUPDATER_BRANCH when building.
    -- Set GLUON_AUTOUPDATER_ENABLED to enable the autoupdater by default for newly installed nodes.
    branch = 'stable',

    -- List of branches. You may define multiple branches.
    branches = {
      stable = {
        name = 'stable',

        -- List of mirrors to fetch images from. IPv6 required!
        mirrors = {'http://1.updates.services.ffhl/stable/sysupgrade'},

        -- Number of good signatures required.
        -- Have multiple maintainers sign your build and only
        -- accept it when a sufficient number of them have
        -- signed it.
        good_signatures = 0,

        -- List of public keys of maintainers.
        pubkeys = {
        },
      },
    },
  },
}
+29 −0
Original line number Original line Diff line number Diff line
##	gluon site.mk makefile example

##	DEFAULT_GLUON_RELEASE
#		version string to use for images
#		gluon relies on
#			opkg compare-versions "$1" '>>' "$2"
#		to decide if a version is newer or not.

DEFAULT_GLUON_RELEASE := 0.6+exp$(shell date '+%Y%m%d')

# Variables set with ?= can be overwritten from the command line

##	GLUON_RELEASE
#		call make with custom GLUON_RELEASE flag, to use your own release version scheme.
#		e.g.:
#			$ make images GLUON_RELEASE=23.42+5
#		would generate images named like this:
#			gluon-ff%site_code%-23.42+5-%router_model%.bin

GLUON_RELEASE ?= $(DEFAULT_GLUON_RELEASE)

# Default priority for updates.
GLUON_PRIORITY ?= 0

# Region code required for some images; supported values: us eu
GLUON_REGION ?= eu

# Languages to include
GLUON_LANGS ?= en de
+25 −11
Original line number Original line Diff line number Diff line
#!/bin/bash
#!/usr/bin/env bash


# Script to output the dependency graph of Gluon's packages
# Script to output the dependency graph of Gluon's packages
# Limitations:
# Limitations:
#  * Works only if directory names and package names are the same (true for all Gluon packages)
#  * Doesn't show dependencies through virtual packages correctly
#  * Doesn't show dependencies through virtual packages correctly


set -e
set -e
@@ -24,19 +23,34 @@ print_dep() {
	echo "$(escape_name "$1") -> $(escape_name "$2");"
	echo "$(escape_name "$1") -> $(escape_name "$2");"
}
}


echo 'digraph G {'
print_package() {

	local package="$1" depends="$2"
for makefile in ./package/*/Makefile; do
	# shellcheck disable=SC2086
	dir="$(dirname "$makefile")"
	set -- $depends
	package="$(basename "$dir")"

	deps=$(grep -w DEPENDS "$makefile" | cut -d= -f2 | tr -d +)


	print_node "$package"
	print_node "$package"
	for dep in $deps; do
	for dep in "$@"; do
		print_node "$dep"
		print_node "$dep"
		print_dep "$package" "$dep"
		print_dep "$package" "$dep"
	done
	done
}

make -C openwrt -s prepare-tmpinfo

echo 'digraph G {'

cat ./openwrt/tmp/info/.packageinfo-feeds_gluon_base_* | while read -r key value; do
	case "$key" in
	'Package:')
		package="$value"
		;;
	'Depends:')
		depends="${value//+/}"
		;;
	'@@')
		print_package "$package" "$depends"
		;;
	esac
done | sort -u
done | sort -u


popd >/dev/null
popd >/dev/null
Original line number Original line Diff line number Diff line
FROM debian:buster-slim
FROM debian:bookworm-slim

ARG TARGETOS
ARG TARGETARCH


ARG DEBIAN_FRONTEND=noninteractive
ARG DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y --no-install-recommends \
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    ca-certificates \
    ca-certificates \
    clang \
    ecdsautils \
    file \
    file \
    git \
    subversion \
    python \
    build-essential \
    gawk \
    gawk \
    unzip \
    git \
    libelf-dev \
    libncurses5-dev \
    libncurses5-dev \
    zlib1g-dev \
    libnss-unknown \
    libssl-dev \
    libssl-dev \
    libelf-dev \
    llvm \
    wget \
    time \
    ecdsautils \
    lua-check \
    lua-check \
    openssh-client \
    python3 \
    python3-dev \
    python3-pyelftools \
    python3-setuptools \
    qemu-utils \
    rsync \
    shellcheck \
    shellcheck \
    swig \
    time \
    unzip \
    wget \
    zlib1g-dev \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*
    && rm -rf /var/lib/apt/lists/*


RUN useradd -d /gluon gluon
RUN mkdir /tmp/ec &&\
    wget -O /tmp/ec/ec-${TARGETOS}-${TARGETARCH}.tar.gz https://github.com/editorconfig-checker/editorconfig-checker/releases/download/2.7.0/ec-${TARGETOS}-${TARGETARCH}.tar.gz &&\
    tar -xvzf /tmp/ec/ec-${TARGETOS}-${TARGETARCH}.tar.gz &&\
    mv bin/ec-${TARGETOS}-${TARGETARCH} /usr/local/bin/editorconfig-checker &&\
    rm -rf /tmp/ec

RUN useradd -m -d /gluon -u 100 -g 100 -o gluon
USER gluon
USER gluon


VOLUME /gluon
VOLUME /gluon
Original line number Original line Diff line number Diff line
@@ -4,7 +4,7 @@ use strict;
use warnings;
use warnings;
use Text::Balanced qw(extract_bracketed extract_delimited extract_tagged);
use Text::Balanced qw(extract_bracketed extract_delimited extract_tagged);


@ARGV >= 1 || die "Usage: $0 <source direcory>\n";
@ARGV >= 1 || die "Usage: $0 <source directory>\n";




my %stringtable;
my %stringtable;
Original line number Original line Diff line number Diff line
#!/bin/bash
#!/usr/bin/env bash


set -e
set -e
# Script to list all upgrade scripts in a clear manner
# Script to list all upgrade scripts in a clear manner
@@ -28,7 +28,7 @@ fi


pushd "$(dirname "$0")/.." >/dev/null
pushd "$(dirname "$0")/.." >/dev/null


find ./package packages -name Makefile | while read -r makefile; do
find ./package packages -name Makefile | grep -v '^packages/packages/' | while read -r makefile; do
	dir="$(dirname "$makefile")"
	dir="$(dirname "$makefile")"


	pushd "$dir" >/dev/null
	pushd "$dir" >/dev/null
@@ -37,13 +37,12 @@ find ./package packages -name Makefile | while read -r makefile; do
	dirname="$(dirname "$dir" | cut -d/ -f 3-)"
	dirname="$(dirname "$dir" | cut -d/ -f 3-)"
	package="$(basename "$dir")"
	package="$(basename "$dir")"


	for file in "${SUFFIX1}"/*; do
	for file in "${SUFFIX1}"/* "${SUFFIX2}"/*; do
		echo "${GREEN}$(basename "${file}")${RESET}" "(${BLUE}${repo}${RESET}/${dirname}${dirname:+/}${RED}${package}${RESET}/${SUFFIX1})"
		basename="$(basename "${file}")"
	done
		suffix="$(dirname "${file}")"
	for file in "${SUFFIX2}"/*; do
		printf "%s\t%s\n" "${basename}" "${BLUE}${repo}${RESET}/${dirname}${dirname:+/}${RED}${package}${RESET}/${suffix}/${GREEN}${basename}${RESET}"
		echo "${GREEN}$(basename "${file}")${RESET}" "(${BLUE}${repo}${RESET}/${dirname}${dirname:+/}${RED}${package}${RESET}/${SUFFIX2})"
	done
	done
	popd >/dev/null
	popd >/dev/null
done | sort
done | sort | cut -f2-


popd >/dev/null
popd >/dev/null

contrib/push_pkg.sh

0 → 100755
+149 −0
Original line number Original line Diff line number Diff line
#!/bin/sh

set -e

topdir="$(realpath "$(dirname "${0}")/../openwrt")"

# defaults to qemu run script
ssh_host=localhost
build_only=0
preserve_config=1

print_help() {
	echo "$0 [OPTIONS] PACKAGE_DIR [PACKAGE_DIR] ..."
	echo ""
	echo " -h          print this help"
	echo " -r HOST     use a remote machine as target machine. By default if this"
	echo "             option is not given, push_pkg.sh will use a locally"
	echo "             running qemu instance started by run_qemu.sh."
	echo " -p PORT     use PORT as ssh port (default is 22)"
	echo " -b          build only, do not push"
	echo " -P          do not preserve /etc/config. By default, if a package"
	echo "             defines a config file in /etc/config, this config file"
	echo "             will be preserved. If you specify this flag, the package"
	echo "             default will be installed instead."
	echo ""
	echo ' To change gluon variables, run e.g. "make config GLUON_MINIFY=0"'
	echo ' because then the gluon logic will be triggered, and openwrt/.config'
	echo ' will be regenerated. The variables from openwrt/.config are already'
	echo ' automatically used for this script.'
	echo
}

while getopts "p:r:hbP" opt
do
	case $opt in
		P) preserve_config=0;;
		p) ssh_port="${OPTARG}";;
		r) ssh_host="${OPTARG}"; [ -z "$ssh_port" ] && ssh_port=22;;
		b) build_only=1;;
		h) print_help; exit 0;;
		*) ;;
	esac
done
shift $(( OPTIND - 1 ))

[ -z "$ssh_port" ] && ssh_port=2223

if [ "$build_only" -eq 0 ]; then
	remote_info=$(ssh -p "${ssh_port}" "root@${ssh_host}" '
		source /etc/os-release
		printf "%s\\t%s\\n" "$OPENWRT_BOARD" "$OPENWRT_ARCH"
	')
	REMOTE_OPENWRT_BOARD="$(echo "$remote_info" | cut -f 1)"
	REMOTE_OPENWRT_ARCH="$(echo "$remote_info" | cut -f 2)"

	# check target
	if ! grep -q "CONFIG_TARGET_ARCH_PACKAGES=\"${REMOTE_OPENWRT_ARCH}\"" "${topdir}/.config"; then
		echo "Configured OpenWrt Target is not matching with the target machine!" 1>&2
		echo
		printf "%s" "    Configured architecture: " 1>&2
		grep "CONFIG_TARGET_ARCH_PACKAGES" "${topdir}/.config" 1>&2
		echo "Target machine architecture: ${REMOTE_OPENWRT_ARCH}" 1>&2
		echo 1>&2
		echo "To switch the local with the run with the corresponding GLUON_TARGET:"  1>&2
		echo "  make GLUON_TARGET=... config" 1>&2
		exit 1
	fi
fi

if [ $# -lt 1 ]; then
	echo ERROR: Please specify a PACKAGE_DIR. For example:
	echo
	echo " \$ $0 package/gluon-core"
	exit 1
fi

while [ $# -gt 0 ]; do

	pkgdir="$1"; shift
	echo "Package: ${pkgdir}"

	if ! [ -f "${pkgdir}/Makefile" ]; then
		echo "ERROR: ${pkgdir} does not contain a Makefile"
		exit 1
	fi

	if ! grep -q BuildPackage "${pkgdir}/Makefile"; then
		echo "ERROR: ${pkgdir}/Makefile does not contain a BuildPackage command"
		exit 1
	fi

	opkg_packages="$(make TOPDIR="${topdir}" -C "${pkgdir}" DUMP=1 | awk '/^Package: / { print $2 }')"

	search_package() {
		find "$2" -name "$1_*.ipk" -printf '%f\n'
	}

	make TOPDIR="${topdir}" -C "${pkgdir}" clean
	make TOPDIR="${topdir}" -C "${pkgdir}" compile

	if [ "$build_only" -eq 1 ]; then
		continue
	fi

	# IPv6 addresses need brackets around the ${ssh_host} for scp!
	if echo "${ssh_host}" | grep -q :; then
		BL=[
		BR=]
	fi

	for pkg in ${opkg_packages}; do

		for feed in "${topdir}/bin/packages/${REMOTE_OPENWRT_ARCH}/"*/ "${topdir}/bin/targets/${REMOTE_OPENWRT_BOARD}/packages/"; do
			printf "%s" "searching ${pkg} in ${feed}: "
			filename=$(search_package "${pkg}" "${feed}")
			if [ -n "${filename}" ]; then
				echo found!
				break
			else
				echo not found
			fi
		done

		if [ "$preserve_config" -eq 0 ]; then
			opkg_flags=" --force-maintainer"
		fi

		# shellcheck disable=SC2029
		if [ -n "$filename" ]; then
			scp -O -P "${ssh_port}" "$feed/$filename" "root@${BL}${ssh_host}${BR}:/tmp/${filename}"
			ssh -p "${ssh_port}" "root@${ssh_host}" "
				set -e
				echo Running opkg:
				opkg install --force-reinstall ${opkg_flags} '/tmp/${filename}'
				rm '/tmp/${filename}'
				gluon-reconfigure
			"
		else
			# Some packages (e.g. procd-seccomp) seem to contain BuildPackage commands
			# which do not generate *.ipk files. Till this point, I am not aware why
			# this is happening. However, dropping a warning if the corresponding
			# *.ipk is not found (maybe due to other reasons as well), seems to
			# be more reasonable than aborting. Before this commit, the command
			# has failed.
			echo "Warning: ${pkg}*.ipk not found! Ignoring." 1>&2
		fi

	done
done

contrib/run_qemu.sh

0 → 100755
+15 −0
Original line number Original line Diff line number Diff line
#!/bin/sh

# Note: You can exit the qemu instance by first pressing "CTRL + a" then "c".
#       Then you enter the command mode of qemu and can exit by typing "quit".

qemu-system-x86_64 \
	-d 'cpu_reset' \
	-enable-kvm \
	-gdb tcp::1234 \
	-nographic \
	-netdev user,id=wan,hostfwd=tcp::2223-10.0.2.15:22 \
	-device virtio-net-pci,netdev=wan,addr=0x06,id=nic1 \
	-netdev user,id=lan,hostfwd=tcp::6080-192.168.1.1:80,hostfwd=tcp::2222-192.168.1.1:22,net=192.168.1.100/24 \
	-device virtio-net-pci,netdev=lan,addr=0x05,id=nic2 \
	"$@"
+16 −5
Original line number Original line Diff line number Diff line
@@ -29,11 +29,22 @@ lower="$(mktemp)"


trap 'rm -f "$upper" "$lower"' EXIT
trap 'rm -f "$upper" "$lower"' EXIT


awk 'BEGIN    { sep=0 }
awk 'BEGIN    {
     /^---$/ { sep=1; next }
	sep = 0
              { if(sep==0) print > "'"$upper"'";
}
                else       print > "'"$lower"'"}' \

    "$manifest"
/^---$/ {
	sep = 1;
	next
}

{
	if(sep == 0) {
		print > "'"$upper"'"
	} else {
		print > "'"$lower"'"
	}
}' "$manifest"


ecdsasign "$upper" < "$SECRET" >> "$lower"
ecdsasign "$upper" < "$SECRET" >> "$lower"


+22 −11
Original line number Original line Diff line number Diff line
@@ -21,11 +21,22 @@ upper="$(mktemp)"
lower="$(mktemp)"
lower="$(mktemp)"
ret=1
ret=1


awk "BEGIN    { sep=0 }
awk 'BEGIN    {
    /^---\$/ { sep=1; next }
	sep = 0
              { if(sep==0) print > \"$upper\";
}
                else       print > \"$lower\"}" \

    "$manifest"
/^---$/ {
	sep = 1;
	next
}

{
	if(sep == 0) {
		print > "'"$upper"'"
	} else {
		print > "'"$lower"'"
	}
}' "$manifest"


while read -r line
while read -r line
do
do
Original line number Original line Diff line number Diff line
/*
.strike {
  This fixes the vertical position of list markers when the first
	text-decoration: line-through;
  element in the <li> is a <pre> block

  Scrolling inside the <pre> block is still working as expected
*/
.rst-content pre.literal-block,
.rst-content div[class^='highlight'] pre {
	overflow: visible;
}


/*
  This fixes the bottom margin of paragraphs inside lists, where margins inside
  a single list item would incorrectly be displayed larger than margins between
  the list items.

  Upstream fix (not fixed on readthedocs.io yet):
  https://github.com/readthedocs/sphinx_rtd_theme/commit/ac20ce75d426efeb40fe2af1f89ea9bad285a45b
*/
.rst-content .section ol li > p,
.rst-content .section ol li > p:last-child,
.rst-content .section ul li > p,
.rst-content .section ul li > p:last-child {
	margin-bottom: 12px;
}
.rst-content .section ol li > p:only-child,
.rst-content .section ol li > p:only-child:last-child,
.rst-content .section ul li > p:only-child,
.rst-content .section ul li > p:only-child:last-child {
	margin-bottom: 0rem;
}

/*
  This fixes the bottom margin of nested lists

  Based on upstream fix (not on readthedocs.io yet):
  https://github.com/readthedocs/sphinx_rtd_theme/commit/6f0de13baff93f25204aa2cdf0308aae47d71312
*/
.rst-content .section ul li > ul,
.rst-content .section ul li > ol,
.rst-content .section ol li > ul,
.rst-content .section ol li > ol {
	margin-bottom: 12px;
}
}
+15 −8
Original line number Original line Diff line number Diff line
@@ -20,11 +20,11 @@
# -- Project information -----------------------------------------------------
# -- Project information -----------------------------------------------------


project = 'Gluon'
project = 'Gluon'
copyright = '2015-2020, Project Gluon'
copyright = 'Project Gluon'
author = 'Project Gluon'
author = 'Project Gluon'


# The short X.Y version
# The short X.Y version
version = '2020.2+'
version = '2023.2.5'
# The full version, including alpha/beta/rc tags
# The full version, including alpha/beta/rc tags
release = version
release = version


@@ -48,7 +48,7 @@ templates_path = ['_templates']
# You can specify multiple suffix as a list of string:
# You can specify multiple suffix as a list of string:
#
#
# source_suffix = ['.rst', '.md']
# source_suffix = ['.rst', '.md']
source_suffix = '.rst'
source_suffix = {'.rst': 'restructuredtext'}


# The master toctree document.
# The master toctree document.
master_doc = 'index'
master_doc = 'index'
@@ -58,7 +58,7 @@ master_doc = 'index'
#
#
# This is also used if you do content translation via gettext catalogs.
# This is also used if you do content translation via gettext catalogs.
# Usually you set "language" from the command line for these cases.
# Usually you set "language" from the command line for these cases.
language = None
language = 'en'


# List of patterns, relative to source directory, that match files and
# List of patterns, relative to source directory, that match files and
# directories to ignore when looking for source files.
# directories to ignore when looking for source files.
@@ -71,6 +71,13 @@ pygments_style = None
# Don't highlight code blocks unless requested explicitly
# Don't highlight code blocks unless requested explicitly
highlight_language = 'none'
highlight_language = 'none'


# Ignore links to the config mode, as well as anchors on on hackint, which are
# used to mark channel names and do not exist. Regular links are not effected.
linkcheck_ignore = [
    'http://192.168.1.1',
    'https://chat.hackint.org'
]



# -- Options for HTML output -------------------------------------------------
# -- Options for HTML output -------------------------------------------------


Original line number Original line Diff line number Diff line
@@ -21,8 +21,9 @@ webbrowser. You're welcome to join us!


.. _#gluon: ircs://irc.hackint.org/#gluon
.. _#gluon: ircs://irc.hackint.org/#gluon
.. _hackint: https://hackint.org/
.. _hackint: https://hackint.org/
.. _webchat: https://webirc.hackint.org/#irc://irc.hackint.org/#gluon
.. _webchat: https://chat.hackint.org/?join=gluon


.. _working-with-repositories:


Working with repositories
Working with repositories
-------------------------
-------------------------
@@ -74,9 +75,9 @@ the code in the project is formatted in the same way. The following basic rules
apply:
apply:


- use tabs instead of spaces
- use tabs instead of spaces
- trailing whitespaces must be eliminated
- trailing whitespace characters must be eliminated
- files need to end with a final newline
- files need to end with a final newline
- newlines need to have unix line endings (lf)
- newlines need to have Unix line endings (lf)


To that end we provide a ``.editorconfig`` configuration, which is supported by most
To that end we provide a ``.editorconfig`` configuration, which is supported by most
of the editors out there.
of the editors out there.
Original line number Original line Diff line number Diff line
@@ -88,3 +88,17 @@ update.sh
    source and installs it into *packages/* directory. It simply tries to set the *base*
    source and installs it into *packages/* directory. It simply tries to set the *base*
    branch of the cloned repo to the correct commit. If this fails it fetches the
    branch of the cloned repo to the correct commit. If this fails it fetches the
    upstream branch and tries again to set the local *base* branch.
    upstream branch and tries again to set the local *base* branch.

getversion.sh
    Used to determine the version numbers of the repositories of Gluon and the
    site configuration, to be included in the built firmware images as
    */lib/gluon/gluon-version* and */lib/gluon/site-version*.

    By default, this uses ``git describe`` to generate a version number based
    on the last git tag. This can be overridden by putting a file called
    *.scmversion* into the root of the respective repositories.

    A command like ``rm -f .scmversion; echo "$(./scripts/getversion.sh .)" > .scmversion``
    can be used before applying local patches to ensure that the reported
    version numbers refer to an upstream commit ID rather than an arbitrary
    local one after ``git am``.
+210 −136
Original line number Original line Diff line number Diff line
Adding support for new hardware
Adding hardware support
===============================
=======================
This page will give a short overview on how to add support
This page will give a short overview on how to add support
for new hardware to Gluon.
for new hardware to Gluon.


@@ -7,158 +7,232 @@ Hardware requirements
---------------------
---------------------
Having an ath9k, ath10k or mt76 based WLAN adapter is highly recommended,
Having an ath9k, ath10k or mt76 based WLAN adapter is highly recommended,
although other chipsets may also work. VAP (multiple SSID) support
although other chipsets may also work. VAP (multiple SSID) support
is a requirement.
with simultaneous AP + Mesh Point (802.11s) operation is required.

.. _device-class-definition:


Device checklist
Device checklist
----------------
----------------
Pull requests adding device support must have the device checklist
The description of pull requests adding device support must include the
included in their description. The checklist assures core functionality
`device integration checklist
of Gluon is well supported on the device.
<https://github.com/freifunk-gluon/gluon/wiki/Device-Integration-checklist>`_.
The checklist ensures that core functionality of Gluon is well supported on the
device.


The checklist can be found in the `wiki <https://github.com/freifunk-gluon/gluon/wiki/Device-Integration-checklist>`_.
.. _device-class-definition:


Device classes
Device classes
--------------
--------------
Gluon currently is aware of two device classes. Depending on the device class, different
All supported hardware is categorized into "device classes". This allows to
features can be installed onto the device.
adjust the feature set of Gluon to the different hardware's capabilities via

``site.mk`` without having to list individual devices.
The ``tiny`` device-class contains devices with the following limitations:

* All devices with less than 64 MB of system memory
* All devices with less than 7 MB of usable firmware space
* Devices using a single ath10k radio and less than 128MB of system memory

.. _hardware-adding-profiles:

Adding profiles
---------------
The vast majority of devices with ath9k WLAN is based on the ar71xx target of OpenWrt.
If the hardware you want to add support for is ar71xx, adding a new profile
is sufficient.

Profiles are defined in ``targets/*`` in a shell-based DSL (so common shell
command syntax like ``if`` can be used).


The ``device`` command is used to define an image build for a device. It takes
There are currently two devices classes defined: "standard" and "tiny". The
two or three parameters.
"tiny" class contains all devices that do not meet the following requirements:

The first parameter defines the Gluon profile name, which is used to refer to the
device and is part of the generated image name. The profile name must be same as
the output of the following command (on the target device), so the autoupdater
can work::

    lua -e 'print(require("platform_info").get_image_name())'

While porting Gluon to a new device, it might happen that the profile name is
unknown. Best practise is to generate an image first by using an arbitrary value
and then executing the lua command on the device and use its output from then on.

The second parameter defines the name of the image files generated by OpenWrt. Usually,
it is also the OpenWrt profile name; for devices that still use the old image build
code, a third parameter with the OpenWrt profile name can be passed. The profile names
can be found in the image Makefiles in ``openwrt/target/linux/<target>/image/Makefile``.

Examples::

    device tp-link-tl-wr1043n-nd-v1 tl-wr1043nd-v1
    device alfa-network-hornet-ub hornet-ub HORNETUB

Suffixes and extensions
'''''''''''''''''''''''


By default, image files are expected to have the extension ``.bin``. In addition,
- At least 7 MiB of usable firmware space
the images generated by OpenWrt have a suffix before the extension that defaults to
- At least 64 MiB of RAM (128MiB for devices with ath10k radio)
``-squashfs-factory`` and ``-squashfs-sysupgrade``.


This can be changed using the ``factory`` and ``sysupgrade`` commands, either at
Target configuration
the top of the file to set the defaults for all images, or for a single image. There
--------------------
are three forms with 0 to 2 arguments (all work with ``sysupgrade`` as well)::
Gluon's hardware support is based on OpenWrt's. For each supported target,
a configuration file exists at ``targets/<target>-<subtarget>`` (or just
``target/<target>`` for targets without subtargets) that contains all
Gluon-specific settings for the target. The generic configuration
``targets/generic`` contains settings that affect all targets.


    factory SUFFIX .EXT
All targets must be listed in ``target/targets.mk``.
    factory .EXT
    factory


When only an extension is given, the default suffix is retained. When no arguments
The target configuration language is based on Lua, so Lua's syntax for variables
are given, this signals that no factory (or sysupgrade) image exists.
and control structures can be used.


Aliases
Device definitions
'''''''
~~~~~~~~~~~~~~~~~~
To configure a device to be built for Gluon, the ``device`` function is used.
In the simplest case, only two arguments are passed, for example:


Sometimes multiple models use the same OpenWrt images. In this case, the ``alias``
.. code-block:: lua
command can be used to create symlinks and additional entries in the autoupdater
manifest for the alternative models.


Standalone images
  device('tp-link-tl-wdr3600-v1', 'tplink_tl-wdr3600-v1')
'''''''''''''''''


On targets without *per-device rootfs* support in OpenWrt, the commands described above
The first argument is the device name in Gluon, which is part of the output
can't be used. Instead, ``factory_image`` and ``sysupgrade_image`` are used::
image filename, and must correspond to the model string looked up by the
autoupdater. The second argument is the corresponding device profile name in
OpenWrt, as found in ``openwrt/target/linux/<target>/image/*``.


    factory_image PROFILE IMAGE .EXT
A table of additional settings can be passed as a third argument:
    sysupgrade_image PROFILE IMAGE .EXT


Again, the profile name must match the value printed by the aforementioned Lua
.. code-block:: lua
command. The image name must match the part between the target name and the extension
as generated by OpenWrt and is to be omitted when no such part exists.


Packages
  device('ubiquiti-edgerouter-x', 'ubnt_edgerouter-x', {
''''''''
    factory = false,
    packages = {'-hostapd-mini'},
    manifest_aliases = {
      'ubnt-erx',
    },
  })


The ``packages`` command takes an arbitrary number of arguments. Each argument
The supported additional settings are described in the following sections.
defines an additional package to include in the images in addition to the default
package sets defined by OpenWrt. When a package name is prefixed by a minus sign, the
packages are excluded instead.


The ``packages`` command may be used at the top of a target definition to modify
Suffixes and extensions
the default package list for all images, or just for a single device (when the
~~~~~~~~~~~~~~~~~~~~~~~
target supports *per-default rootfs*).
For many targets, OpenWrt generates images with the suffixes

``-squashfs-factory.bin`` and ``-squashfs-sysupgrade.bin``. For devices with

different image names, is it possible to override the suffixes and extensions
Configuration
using the settings ``factory``, ``factory_ext``, ``sysupgrade`` and
'''''''''''''
``sysupgrade_ext``, for example:


The ``config`` command allows to add arbitrary target-specific OpenWrt configuration
.. code-block:: lua
to be emitted to ``.config``.


  {
Notes
    factory = '-squashfs-combined',
'''''
    factory_ext = '.img.gz',

    sysupgrade = '-squashfs-combined',
On devices with multiple WLAN adapters, care must also be taken that the primary MAC address is
    sysupgrade_ext = '.img.gz',
configured correctly. ``/lib/gluon/core/sysconfig/primary_mac`` should contain the MAC address which
  }
can be found on a label on most hardware; if it does not, ``/lib/gluon/upgrade/010-primary-mac``

in ``gluon-core`` might need a fix. (There have also been cases in which the address was incorrect
Only settings that differ from the defaults need to be passed. ``factory`` and
even on devices with only one WLAN adapter, in these cases a OpenWrt bug was the cause).
``sysupgrade`` can be set to ``false`` when no such images exist.



For some device types, there are multiple factory images with different
Adding support for new hardware targets
extensions. ``factory_ext`` can be set to a table of strings to account for this
---------------------------------------
case:


Adding a new target is much more complex than adding a new profile. There are two basic steps
.. code-block:: lua
required for adding a new target:


  {
Package adjustments
    factory_ext = {'.img.gz', '.vmdk', '.vdi'},
'''''''''''''''''''
  }


One package that may need adjustments for new targets is ``libplatforminfo`` (to be found in
TODO: Extra images
`packages/gluon/libs/libplatforminfo <https://github.com/freifunk-gluon/packages/tree/master/libs/libplatforminfo>`_).

If the new platform works fine with the definitions found in ``default.c``, nothing needs to be done. Otherwise,
Aliases and manifest aliases
create a definition for the added target or subtarget, either by symlinking one of the files in the ``templates``
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
directory, or adding a new source file.
Sometimes multiple devices exist that use the same OpenWrt images. To make it

easier to find these images, the ``aliases`` setting can be used to define
On many targets, Gluon's network setup scripts (mainly in the package ``gluon-core``)
additional device names. Gluon will create symlinks for these names in the
won't run correctly without some adjustments, so better double check that everything is fine there (and the files
image output directory.
``primary_mac``, ``lan_ifname`` and ``wan_ifname`` in ``/lib/gluon/core/sysconfig/`` contain sensible values).


.. code-block:: lua
Build system support

''''''''''''''''''''
  device('aruba-ap-303', 'aruba_ap-303', {

    factory = false,
A definition for the new target must be created under ``targets``, and it must be added
    aliases = {'aruba-instant-on-ap11'},
to ``targets/targets.mk``. The ``GluonTarget`` macro takes one to three arguments:
  })
the target name, the Gluon subtarget name (if the target has subtargets), and the

OpenWrt subtarget name (if it differs from the Gluon subtarget). The third argument
The aliased name will also be added to the autoupdater manifest, allowing upgrade
can be used to define multiple Gluon targets with different configuration for the
images to be found under the different name on targets that perform model name
same OpenWrt target, like it is done for the ``ar71xx-tiny`` target.
detection at runtime.


After this, is should be sufficient to call ``make GLUON_TARGET=<target>`` to build the images for the new target.
It is also possible to add alternative names to the autoupdater manifest without
creating a symlink by using ``manifest_aliases`` instead of ``aliases``, which
should be done when the alternative name does not refer to a separate device.
This is particularly useful to allow the autoupdater to work when the model name
changed between Gluon versions.

Package lists
~~~~~~~~~~~~~
Gluon generates lists of packages that are installed in all images based on a
default list and the features and packages specified in the site configuration.

In addition, OpenWrt defines additional per-device package lists. These lists
may be modified in Gluon's device definitions, for example to include additional
drivers and firmware, or to remove unneeded software. Packages to remove are
prefixed with a ``-`` character.

For many ath10k-based devices, this is used to replace the "CT" variant of
ath10k with the mainline-based version:

.. code-block:: lua

  local ATH10K_PACKAGES_QCA9880 = {
    'kmod-ath10k',
    '-kmod-ath10k-ct',
    '-kmod-ath10k-ct-smallbuffers',
    'ath10k-firmware-qca988x',
    '-ath10k-firmware-qca988x-ct',
  }
  device('openmesh-a40', 'openmesh_a40', {
    packages = ATH10K_PACKAGES_QCA9880,
    factory = false,
  })

This example also shows how to define a local variable, allowing the package
list to be reused for multiple devices.

Device flags
~~~~~~~~~~~~

The settings ``class``, ``deprecated`` or ``broken`` should be set according to
the device support status. The default values are as follows:

.. code-block:: lua

  {
    class = 'standard',
    deprecated = false,
    broken = false,
  }

- Device classes are described in :ref:`device-class-definition`
- Broken devices are untested or do not meet our requirements as given by the
  device checklist
- Deprecated devices are slated for removal in a future Gluon version due to
  hardware constraints

Global settings
~~~~~~~~~~~~~~~
There is a number of directives that can be used outside of a ``device()``
definition:

- ``include('filename')``: Include another file with global settings
- ``config(key, value)``: Set a config symbol in OpenWrt's ``.config``. Value
  may be a string, number, boolean, or nil. Booleans and nil are used for
  tristate symbols, where nil sets the symbol to ``m``.
- ``try_config(key, value)``: Like ``config()``, but do not fail if setting
  the symbol is not possible (usually because its dependencies are not met)
- ``packages { 'package1', '-package2', ... }``: Define a list of packages to
  add or remove for all devices of a target. Package lists passed to multiple
  calls of ``packages`` will be aggregated.
- ``defaults { key = value, ... }``: Set default values for any of the
  additional settings that can be passed to ``device()``.

Helper functions
~~~~~~~~~~~~~~~~
The following helpers can be used in the target configuration:

- ``env.KEY`` allows to access environment variables
- ``istrue(value)`` returns true if the passed string is a positive number
  (often used with ``env``, for example ``if istrue(env.GLUON_DEBUG) then ...``)

Hardware support in packages
----------------------------
In addition to the target configuration files, some device-specific changes may
be required in packages.

gluon-core
~~~~~~~~~~
- ``/lib/gluon/upgrade/010-primary-mac``: Override primary MAC address selection

  Usually, the primary (label) MAC address is defined in OpenWrt's Device Trees.
  For devices or targets where this is not the case, it is possible to specify
  what interface to take the primary MAC address from in ``010-primary-mac``.

- ``/lib/gluon/upgrade/020-interfaces``: Override LAN/WAN interface assignment

  On PoE-powered devices, the PoE input port should be "WAN".

- ``/usr/lib/lua/gluon/platform.lua``: Contains a list of outdoor devices

gluon-setup-mode
~~~~~~~~~~~~~~~~
- ``/lib/gluon/upgrade/320-setup-ifname``: Contains a list of devices that use
  the WAN port for the config mode

  On PoE-powered devices, the PoE input port should be used for the config
  mode. This is handled correctly by default for outdoor devices listed in
  ``platform.lua``.

libplatforminfo
~~~~~~~~~~~~~~~
When adding support for a new target to Gluon, it may be necessary to adjust
libplatforminfo to define how autoupdater image names are derived from the
model name.
Original line number Original line Diff line number Diff line
@@ -3,6 +3,88 @@ Package development


Gluon packages are OpenWrt packages and follow the same rules described at https://openwrt.org/docs/guide-developer/packages.
Gluon packages are OpenWrt packages and follow the same rules described at https://openwrt.org/docs/guide-developer/packages.


Development workflow
====================

When you are developing packages, it often happens that you iteratively want to deploy
and verify the state your development. There are two ways to verify your changes:

1)
  One way is to rebuild the complete firmware, flash it, configure it and verify your
  development then. This usually takes at least a few minutes to get your changes
  working so you can test them. Especially if you iterate a lot, this becomes tedious.

2)
  Another way is to rebuild only the package you are currently working on and
  to deploy this package to your test system. Here not even a reboot is required.
  This makes iterating relatively fast. Your test system could be real hardware or
  even a qemu in most cases.

Gluon provides scripts to enhance workflow 2). Here is an example illustrating
the workflow using these scripts:

.. code-block:: shell

  # start a local qemu instance
  contrib/run_qemu.sh output/images/factory/[...]-x86-64.img

  # apply changes to the desired package
  vi package/gluon-ebtables/files/etc/init.d/gluon-ebtables

  # rebuild and push the package to the qemu instance
  contrib/push_pkg.sh package/gluon-ebtables/

  # test your changes
  ...

  # do more changes
  ...

  # rebuild and push the package to the qemu instance
  contrib/push_pkg.sh package/gluon-ebtables/

  # test your changes
  ...

  (and so on...)

  # see help of the script for more information
  contrib/push_pkg.sh -h
  ...

Features of ``push_pkg.sh``:

* Works with compiled and non-compiled packages.

  * This means it can be used in the development of C-code, Lua-Code and mostly any other code.

* Works with native OpenWrt and Gluon packages.
* Pushes to remote machines or local qemu instances.
* Pushes multiple packages in one call if desired.
* Performs site.conf checks.

Implementation details of ``push_pkg.sh``:

* First, the script builds an opkg package using the OpenWrt build system.
* This package is pushed to a *target machine* using scp:

  * By default the *target machine* is a locally running x86 qemu started using ``run_qemu.sh``.
  * The *target machine* can also be remote machine. (See the cli switch ``-r``)
  * Remote machines are not limited to a specific architecture. All architectures supported by gluon can be used as remote machines.

* Finally opkg is used to install/update the packages in the target machine.

  * While doing this, it will not override ``/etc/config`` with package defaults by default. (See the cli switch ``-P``).
  * While doing this, opkg calls the ``check_site.lua`` from the package as post_install script to validate the ``site.conf``. This means that the ``site.conf`` of the target machine is used for this validation.

Note that:

* ``push_pkg.sh`` does neither build nor push dependencies of the packages automatically. If you want to update dependencies, you must explicitly specify them to be pushed.
* If you add new packages, you must run ``make update config GLUON_TARGET=...``.
* You can change the gluon target of the target machine via ``make config GLUON_TARGET=...``.
* If you want to update the ``site.conf`` of the target machine, use ``push_pkg.sh package/gluon-site/``.
* Sometimes when things break, you can heal them by compiling a package with its dependencies: ``cd openwrt; make package/gluon-ebtables/clean; make package/gluon-ebtables/compile; cd ..``.
* You can exit qemu by pressing ``CTRL + a`` and ``c`` afterwards.


Gluon package makefiles
Gluon package makefiles
=======================
=======================
@@ -72,7 +154,8 @@ Feature flags


Feature flags provide a convenient way to define package selections without
Feature flags provide a convenient way to define package selections without
making it necessary to list each package explicitly. The list of features to
making it necessary to list each package explicitly. The list of features to
enable for a Gluon build is set by the *GLUON_FEATURES* variable in *site.mk*.
enable for a Gluon build is determined by the evaluated image-customization.lua file
in the root-directory of the Site repository.


The main feature flag definition file is ``package/features``, but each package
The main feature flag definition file is ``package/features``, but each package
feed can provide additional definitions in a file called ``features`` at the root
feed can provide additional definitions in a file called ``features`` at the root
@@ -113,7 +196,7 @@ Example::
      'gluon-config-mode-outdoor',
      'gluon-config-mode-outdoor',
    })
    })


    when(_'web-wizard' and (_'mesh-vpn-fastd' or _'mesh-vpn-tunneldigger'), {
    when(_'web-wizard' and _'mesh-vpn-fastd' or _'mesh-vpn-wireguard'), {
      'gluon-config-mode-mesh-vpn',
      'gluon-config-mode-mesh-vpn',
    })
    })


@@ -125,8 +208,8 @@ Example::
This will
This will


* disable the inclusion of the (non-existent) packages *gluon-web-wizard* and *gluon-no-radvd* when their
* disable the inclusion of the (non-existent) packages *gluon-web-wizard* and *gluon-no-radvd* when their
  corresponding feature flags appear in *GLUON_FEATURES*
  corresponding feature flags are evaluated as selected in the image-customization.lua file
* enable four additional config mode packages when the *web-wizard* feature is enabled
* enable four additional config mode packages when the *web-wizard* feature is enabled
* enable *gluon-config-mode-mesh-vpn* when both *web-wizard* and one
* enable *gluon-config-mode-mesh-vpn* when both *web-wizard* and one
  of *mesh-vpn-fastd* and *mesh-vpn-tunneldigger* are enabled
  of *mesh-vpn-fastd* and *mesh-vpn-wireguard* are enabled
* disable the *gluon-radvd* package when *gluon-no-radvd* is enabled
* disable the *gluon-radvd* package when *gluon-no-radvd* is enabled
Original line number Original line Diff line number Diff line
WAN support
Uplink support
===========
==============


As the WAN port of a node will be connected to a user's private network, it
As the WAN port of a node will be connected to a user's private network, it
is essential that the node only uses the WAN when it is absolutely necessary.
is essential that the node only uses the WAN when it is absolutely necessary.
@@ -11,11 +11,12 @@ There are two cases in which the WAN port is used:
After the VPN connection has been established, the node should be able to reach
After the VPN connection has been established, the node should be able to reach
the mesh's DNS servers and use these for all other name resolution.
the mesh's DNS servers and use these for all other name resolution.


If the device does not feature a WAN port, the LAN port is configured as WAN port.
If a device has only a single Ethernet port (or group of ports), it will be
In case such a device has multiple LAN ports, all these can be used as WAN.
used as an uplink port even when it is not labeled as "WAN" by default. This
Devices, which feature a "hybrid" port (labelled as WAN/LAN), this port is used as WAN.
behavior can be controlled using the ``interfaces.single.default_roles``

site.conf option. It is also possible to alter the interface assignment after
This behavior can be reversed using the ``single_as_lan`` site.conf option.
installation by modifying ``/etc/config/gluon`` and running
``gluon-reconfigure``.


Routing tables
Routing tables
~~~~~~~~~~~~~~
~~~~~~~~~~~~~~
Original line number Original line Diff line number Diff line
@@ -11,18 +11,28 @@ gluon-config-mode-core
gluon-config-mode-hostname
gluon-config-mode-hostname
    Provides a hostname field.
    Provides a hostname field.


gluon-config-mode-autoupdater
:doc:`gluon-config-mode-autoupdater <../../features/autoupdater>`
    Informs whether the autoupdater is enabled.
    Informs whether the autoupdater is enabled.


gluon-config-mode-mesh-vpn
:doc:`gluon-config-mode-mesh-vpn <../../features/vpn>`
    Allows toggling of mesh-vpn-fastd and setting a bandwidth limit.
    Allows toggling of installed mesh-vpn technology and setting a bandwidth limit.


gluon-config-mode-geo-location
gluon-config-mode-geo-location
    Enables the user to set the geographical location of the node.
    Enables the user to set the geographical location of the node.


:doc:`../../package/gluon-config-mode-geo-location-osm`
    Lets the user click on a map to select the geographical location through a OSM map

gluon-config-mode-contact-info
gluon-config-mode-contact-info
    Adds a field where the user can provide contact information.
    Adds a field where the user can provide contact information.


:doc:`../../package/gluon-web-cellular`
    Adds advanced options to enter WWAN config.

:doc:`../../package/gluon-web-network`
    Adds option to configure used role on interfaces

Most of the configuration options are described in :ref:`user-site-config_mode`


Writing Config Mode modules
Writing Config Mode modules
~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Original line number Original line Diff line number Diff line
@@ -74,8 +74,7 @@ Useful functions:
  - *header* (*key*, *value*): Adds an HTTP header to the reply to be sent to
  - *header* (*key*, *value*): Adds an HTTP header to the reply to be sent to
    the client. Has no effect when non-header data has already been written.
    the client. Has no effect when non-header data has already been written.
  - *prepare_content* (*mime*): Sets the *Content-Type* header to the given MIME
  - *prepare_content* (*mime*): Sets the *Content-Type* header to the given MIME
    type, potentially setting additional headers or modifying the MIME type to
    type
    accommodate browser quirks
  - *write* (*data*, ...): Sends the given data to the client. If headers have not
  - *write* (*data*, ...): Sends the given data to the client. If headers have not
    been sent, it will be done before the data is written.
    been sent, it will be done before the data is written.


Original line number Original line Diff line number Diff line
@@ -26,7 +26,7 @@ Let's start with an example:


  return f
  return f


The toplevel element of a model is always a *Form*, but it is also possible for
The top-level element of a model is always a *Form*, but it is also possible for
a model to return multiple forms, which are displayed one below the other.
a model to return multiple forms, which are displayed one below the other.


A *Form* has one or more *Sections*, and each *Section* has different types
A *Form* has one or more *Sections*, and each *Section* has different types
Original line number Original line Diff line number Diff line
@@ -31,7 +31,7 @@ as otherwise the generated manifest will be incomplete.




Manifest format
Manifest format
------------------------
---------------


The manifest starts with a short header, followed by the list of firmwares and signatures.
The manifest starts with a short header, followed by the list of firmwares and signatures.
The header contains the following information:
The header contains the following information:
@@ -50,6 +50,32 @@ The header contains the following information:
  the number of days over which the update should be stretched out after ``DATE``. Nodes will calculate a probability
  the number of days over which the update should be stretched out after ``DATE``. Nodes will calculate a probability
  based on the time left to determine when to update.
  based on the time left to determine when to update.


Signing images
--------------

As noted above, manifest files can be signed by an arbitrary amount of ECDSA keys.
The amount of valid signatures required to have the autoupdater accept an image is configured using the :ref:`site.conf <user-site-autoupdater>`.

A secret key (that like an SSH private key must never be shared) can be generated like this:

.. code-block:: sh

    mkdir ~/.ecdsa/
    ( umask 077 && ecdsautil generate-key > ~/.ecdsa/id_y25519 )

This is then used to derive a public key, meant to be placed in the ``site.conf``.

.. code-block:: sh

    ( umask 033 && ecdsautil show-key < ~/.ecdsa/id_y25519 > ~/.ecdsa/id_y25519.pub )

A manifest can then be signed using the helper in gluons `contrib` directory.

.. code-block:: sh

    ./contrib/sign.sh ~/.ecdsa/id_y25519 output/images/sysupgrade/stable.manifest

In the manifest file only the content above the three dashes is signed, not other signatures that might exist.


Automated nightly builds
Automated nightly builds
------------------------
------------------------
@@ -61,9 +87,9 @@ A fully automated nightly build could use the following commands:
    git pull
    git pull
    # git -C site pull
    # git -C site pull
    make update
    make update
    make clean GLUON_TARGET=ar71xx-generic
    make clean GLUON_TARGET=ath79-generic
    NUM_CORES_PLUS_ONE=$(expr $(nproc) + 1)
    NUM_CORES_PLUS_ONE=$(expr $(nproc) + 1)
    make -j$NUM_CORES_PLUS_ONE GLUON_TARGET=ar71xx-generic GLUON_RELEASE=$GLUON_RELEASE \
    make -j$NUM_CORES_PLUS_ONE GLUON_TARGET=ath79-generic GLUON_RELEASE=$GLUON_RELEASE \
        GLUON_AUTOUPDATER_BRANCH=experimental GLUON_AUTOUPDATER_ENABLED=1
        GLUON_AUTOUPDATER_BRANCH=experimental GLUON_AUTOUPDATER_ENABLED=1
    make manifest GLUON_RELEASE=$GLUON_RELEASE GLUON_AUTOUPDATER_BRANCH=experimental
    make manifest GLUON_RELEASE=$GLUON_RELEASE GLUON_AUTOUPDATER_BRANCH=experimental
    contrib/sign.sh $SECRETKEY output/images/sysupgrade/experimental.manifest
    contrib/sign.sh $SECRETKEY output/images/sysupgrade/experimental.manifest
Original line number Original line Diff line number Diff line
@@ -18,6 +18,9 @@ Config Mode by pressing and holding the RESET/WPS/DECT button for about three
seconds. The device should reboot (all LEDs will turn off briefly) and
seconds. The device should reboot (all LEDs will turn off briefly) and
Config Mode will be available.
Config Mode will be available.


If you have access to the console of the node, there is the
``gluon-enter-setup-mode`` command, which reboots a node into Config Mode.



Port Configuration
Port Configuration
------------------
------------------
@@ -35,3 +38,17 @@ Accessing Config Mode
Config Mode can be accessed at http://192.168.1.1. The node will offer DHCP
Config Mode can be accessed at http://192.168.1.1. The node will offer DHCP
to clients. Should this fail, you may assign an IP from 192.168.1.0/24 to
to clients. Should this fail, you may assign an IP from 192.168.1.0/24 to
your computer manually.
your computer manually.

.. image:: configmode.png

Advanced Config Options
-----------------------

Depending on the installed packages, the advanced config mode allows to configure packages further.

* :doc:`gluon-web-wifi-config enable <wlan-configuration>` radios used for wifi and mesh as well as outdoor mode
* :doc:`../package/gluon-web-network` allows to configure the used roles (uplink, mesh, client) on each interface
* :doc:`../package/gluon-web-admin` allows to enter SSH keys or set a password in the `Remote access` section
* :doc:`../package/gluon-web-cellular` allows to configure SIM card / WWAN settings on supported cellular devices

The advanced config does also allow to upload a sysupgrade file to update the firmware to a different version.
+53 −0
Original line number Original line Diff line number Diff line
.. _dns-caching:

DNS caching
===========

User experience may be greatly improved when dns is accelerated. Also, it
seems like a good idea to keep the number of packages being exchanged
between node and gateway as small as possible. In order to do this, a
DNS cache may be used on a node. The dnsmasq instance listening on port
53 on the node will be reconfigured to answer requests, use a list of
upstream servers and a specific cache size if the options listed below are
added to site.conf. Upstream servers are the DNS servers which are normally
used by the nodes to resolve hostnames (e.g. gateways/supernodes).

There are the following settings:
    servers
    cacheentries

To use the node's DNS server, both options should be set. The node will cache at
most 'cacheentries' many DNS records in RAM. The 'servers' list will be used to
resolve the received DNS queries if the request cannot be answered from
cache. Gateways should announce the "next node" address via DHCP and RDNSS (if
any). Note that not setting 'servers' here will lead to DNS not working: Once
the gateways all announce the "next node" address for DNS, there is no way for
nodes to automatically determine DNS servers. They have to be baked into the
firmware.

If these settings do not exist, the cache is not initialized and RAM usage will
not increase.

When next_node.name is set, an A record and an AAAA record for the
next-node IP address are placed in the dnsmasq configuration. This means that
the content of next_node.name may be resolved even without upstream connectivity.
It is suggested to use the same name as the DNS server provides:
e.g. nextnode.location.community.example.org (This way the name also works if a
client uses static DNS Servers). Hint: If next_node.name does not contain a dot
some browsers would open the searchpage instead.

::

  dns = {
    cacheentries = 5000,
    servers = { '2001:4860:4860::8888', '2001:4860:4860::8844' },
  },

  next_node = {
    name = { 'nextnode.location.community.example.org', 'nextnode', 'nn' },
    ip6 = '2001:db8:8::1',
    ip4 = '198.51.100.1',
  }


Each cache entry will occupy about 90 bytes of RAM.

docs/features/dns-forwarder.rst

deleted100644 → 0
+0 −26
Original line number Original line Diff line number Diff line
DNS forwarder
=============

A Gluon node can be configured to act as a DNS forwarder. Requests for the
next-node hostname(s) can be answered locally, without querying the upstream
resolver.

**Note:** While this reduces answer time and allows to use the next-node
hostname without upstream connectivity, this feature should not be used for
next-node hostnames that are FQDN when the zone uses DNSSEC.

One or more upstream resolvers can be configured in the *dns.servers* setting.
When *next_node.name* is set, A and/or AAAA records for the next-node IP
addresses are placed in the dnsmasq configuration.

::

  dns = {
    servers = { '2001:db8::1', },
  },

  next_node = {
    name = { 'nextnode.location.community.example.org', 'nextnode', 'nn' },
    ip6 = '2001:db8:8::1',
    ip4 = '198.51.100.1',
  }
Original line number Original line Diff line number Diff line
@@ -135,5 +135,5 @@ Adding a data provider
----------------------
----------------------


To add a provider, you need to install a shared object into ``/lib/gluon/respondd``.
To add a provider, you need to install a shared object into ``/lib/gluon/respondd``.
For more information, refer to the `respondd README <https://github.com/freifunk-gluon/packages/blob/master/net/respondd/README.md>`_
For more information, refer to the `respondd README <https://github.com/freifunk-gluon/packages/blob/main/net/respondd/README.md>`_
and have a look the existing providers.
and have a look the existing providers.
Original line number Original line Diff line number Diff line
@@ -106,7 +106,7 @@ Via config mode
^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^


To allow switching the domain via config mode, add ``config-mode-domain-select``
To allow switching the domain via config mode, add ``config-mode-domain-select``
to GLUON_FEATURES in site.mk.
to the enabled features in the image-customization.lua file.


|image0|
|image0|


@@ -130,13 +130,10 @@ site.conf only variables
  - authorized_keys
  - authorized_keys
  - default_domain
  - default_domain
  - poe_passthrough
  - poe_passthrough
   -  mesh_on_wan
  - interfaces.*.default_roles
   -  mesh_on_lan
   -  single_as_lan
  - setup_mode.skip
  - setup_mode.skip
  - autoupdater.branch
  - autoupdater.branch
  - mesh_vpn.enabled
  - mesh_vpn.enabled
   -  mesh_vpn.pubkey_privacy
  - mesh_vpn.bandwidth_limit
  - mesh_vpn.bandwidth_limit
  - mesh_vpn.bandwidth_limit.enabled
  - mesh_vpn.bandwidth_limit.enabled
  - mesh_vpn.bandwidth_limit.ingress
  - mesh_vpn.bandwidth_limit.ingress
@@ -188,7 +185,7 @@ domain.conf only variables
      - ``true``, ``false``
      - ``true``, ``false``
      - ``{ 'foo', 'bar' }``
      - ``{ 'foo', 'bar' }``


-  Because each domain is considered as an own layer 2 network, these
- Because each domain is considered a separate layer 2 network, these
  values should be different in each domain:
  values should be different in each domain:


  - next_node.ip4
  - next_node.ip4
@@ -208,7 +205,6 @@ domain.conf only variables
  - wifi*.mesh.id
  - wifi*.mesh.id
  - mesh_vpn.fastd.groups.*.peers.remotes
  - mesh_vpn.fastd.groups.*.peers.remotes
  - mesh_vpn.fastd.groups.*.peers.key
  - mesh_vpn.fastd.groups.*.peers.key
   -  mesh_vpn.tunneldigger.brokers


- Clients consider WiFi networks sharing the same ESSID as if they were
- Clients consider WiFi networks sharing the same ESSID as if they were
  the same L2 network and try to reconfirm and reuse previous
  the same L2 network and try to reconfirm and reuse previous
Original line number Original line Diff line number Diff line
Private WLAN
Private WLAN
============
============


It is possible to set up a private WLAN that bridges the WAN port and is separated from the mesh network.
It is possible to set up a private WLAN that bridges the uplink port and is separated from the mesh network.
Please note that you should not enable ``mesh_on_wan`` simultaneously.
Please note that you should not enable Wired Mesh on the uplink port at the same time.


The private WLAN is encrypted using WPA2 by default. On devices with enough flash and a supported radio,
The private WLAN is encrypted using WPA2 by default. On devices with enough flash and a supported radio,
WPA3 or WPA2/WPA3 mixed-mode can be used instead of WPA2. For this to work, the ``wireless-encryption-wpa3``
WPA3 or WPA2/WPA3 mixed-mode can be used instead of WPA2. For this to work, the ``wireless-encryption-wpa3``
feature has to be added to ``GLUON_FEATURES``.
feature has to be enabled as a feature.


It is recommended to enable IEEE 802.11w management frame protection for WPA2/WPA3 networks, however this
It is recommended to enable IEEE 802.11w management frame protection for WPA2/WPA3 networks, however this
can lead to connectivity problems for older clients. In this case, management frame protection can be
can lead to connectivity problems for older clients. In this case, management frame protection can be
@@ -27,7 +27,7 @@ You may also enable a private WLAN using the command line::
  uci set wireless.wan_radio$RID.ssid="$SSID"
  uci set wireless.wan_radio$RID.ssid="$SSID"
  uci set wireless.wan_radio$RID.key="$KEY"
  uci set wireless.wan_radio$RID.key="$KEY"
  uci set wireless.wan_radio$RID.disabled=0
  uci set wireless.wan_radio$RID.disabled=0
  uci set wireless.wan_radio$RID.macaddr=$(lua -e "print(require('gluon.util').generate_mac(3+4*$RID))")
  uci set wireless.wan_radio$RID.macaddr=$(lua -e "print(require('gluon.wireless').get_wlan_mac('wan_radio', $RID))")
  uci commit
  uci commit
  wifi
  wifi


+30 −0
Original line number Original line Diff line number Diff line
Status-Page
===========

When the feature ``gluon-status-page`` is enabled, Gluon nodes run a HTTP server with status information on all IP addresses of ``br-client``.
This makes it possible to check information of the node in realtime.

If the mesh protocol ``gluon-mesh-batman-adv`` is installed too, the package ``gluon-status-page-mesh-batman-adv`` is added too according to the :ref:`user-site-feature-flags`

.. _status-page-example-picture:

Example Picture
---------------

The left side of the status page contains Overview information.
In the middle, current monitoring information abut the system, number of clients, radios, amount of traffic and connected mesh-vpn if any are shown.
The right side of the Status-Page contains information about Neighbours to this node through :doc:`wired-mesh` as well as wireless mesh.

.. image:: status-page.png

Mesh Graphs
-----------

When wireless mesh is enabled, the mesh interfaces show realtime Graphs about the received signal strength (RSSI) in dBm.

Neighbours
----------

The list of neighbours at first shows the mac-address of the neighbour it sees.
The status-page sends a second request to ``http://[ipv6]/cgi-bin/dyn/neighbours-nodeinfo?mesh-vpn`` which triggers the lookup of neighbour information on the node itself.
Through this, the actual nodenames of the neighbours are shown on the status-page as can be seen in the :ref:`status-page-example-picture`.

docs/features/tls.rst

0 → 100644
+10 −0
Original line number Original line Diff line number Diff line
TLS support
===========

The generic TLS implementation which is currently used by OpenWRT can be installed or added as dependency through the package ``gluon-tls``.
This removes the need for community packages to depend on a specific TLS implementation (like mbedtls, OpenSSL or WolfSSL).

This package is an alias for the current TLS implementation used.
To allow for easy usage of communicating through HTTPS from the node, typical Certificate Authorities (CAs) are included through the package ``ca-bundle`` .

* Starting with OpenWRT 23.05, mbedtls is the default TLS layer - this is reflected in Gluon :ref:`v2023.2 <releases-v2023.2-minor-changes>`. HTTPS is used by default to communicate with OpenWRT opkg servers.
Original line number Original line Diff line number Diff line
Mesh-VPN
.. _mesh-vpn:

Mesh VPN
========
========


Gluon integrates several OSI-Layer 2 tunneling protocols to
Gluon integrates several layer 2 tunneling protocols to
enable interconnects between local meshes and provide
allow connections between local meshes through the internet.
internetwork access. Available protocols currently are:

Protocols overview
^^^^^^^^^^^^^^^^^^

For a comprehensive comparison and evaluation of the supported and formerly supported VPN methods that best suit your needs, refer to the following table (Be sure to scroll to the right):

+---------------------------------------+------+----------+----------------+----------------------------+------------------------+------------------+----------------+--------------------------+
| Gluon VPN method                      | IPv4 | IPv6     | Authentication | Encryption                 | Kernelspace forwarding | MTU overhead     | Multithreading | Single interface for all |
|                                       |      |          |                | (no→faster,insecure [1]_)  | (yes→faster)           | (bytes @v4) [7]_ |                | peers                    |
+=======================================+======+==========+================+============================+========================+==================+================+==========================+
| fastd, encrypted                      | yes  | yes      | optional [2]_  | yes                        | no                     | low (98)         | no             | optional                 |
+---------------------------------------+------+----------+----------------+----------------------------+------------------------+------------------+----------------+--------------------------+
| fastd, null                           | yes  | yes      | optional [2]_, | no                         | no                     | low (98)         | no             | optional                 |
|                                       |      |          | partial [3]_   |                            |                        |                  |                |                          |
+---------------------------------------+------+----------+----------------+----------------------------+------------------------+------------------+----------------+--------------------------+
| fastd, ``null@l2tp``, with offloading | yes  | yes      | optional [2]_, | no                         | yes                    | low (82)         |                | optional                 |
|                                       |      |          | partial [3]_   |                            |                        |                  |                |                          |
+---------------------------------------+------+----------+----------------+----------------------------+------------------------+------------------+----------------+--------------------------+
| fastd, ``null@l2tp``, no offloading   | yes  | yes      | optional [2]_, | no                         | no                     | low (82)         | no             | optional                 |
|                                       |      |          | partial [3]_   |                            |                        |                  |                |                          |
+---------------------------------------+------+----------+----------------+----------------------------+------------------------+------------------+----------------+--------------------------+
| Tunneldigger (L2TP - deprecated) [6]_ | yes  | no [4]_  | no             | no                         | yes                    | low (82)         |                | no                       |
+---------------------------------------+------+----------+----------------+----------------------------+------------------------+------------------+----------------+--------------------------+
| WireGuard + VXLAN                     | yes  | yes      | yes            | yes                        | yes                    | high (162)       | yes [5]_       | yes                      |
+---------------------------------------+------+----------+----------------+----------------------------+------------------------+------------------+----------------+--------------------------+

.. [1] No encryption allows internet providers to read and alter mesh traffic.
.. [2] The Gateway can ignore authentication for the initial connection request, via ``"on verify 'true'"``. However, a node→gateway handshake authentication with valid fastd keys in the site.conf is still required.
.. [3] Initial connection request can be authenticated, however, payload data is not authenticated afterward.


.. [4] https://github.com/wlanslovenija/tunneldigger/issues/75
.. [5] https://www.wireguard.com/performance/
.. [6] https://github.com/ffac/community-packages/tree/master/ff-mesh-vpn-tunneldigger
.. [7] :ref:`mtu`

Additional, notable compatibility features
""""""""""""""""""""""""""""""""""""""""""

* fastd: multiple encrypted and unencrypted methods can be handled by one daemon
* fastd: a ``null@l2tp`` peer with offloading is fully compatible with a peer with ``null@l2tp`` without offloading
* fastd+WireGuard: a single secret can be used for both fastd and WireGuard via :ref:`gluon-mesh-vpn-key-translate <gluon-mesh-vpn-key-translate>`, so no need for a node owner switching to (or from) Wireguard from (or to) fastd to submit a new key


Core Protocol handlers
^^^^^^^^^^^^^^^^^^^^^^


- fastd
There are currently two supported protocol handlers which
- L2TPv3 (via tunneldigger)
can be selected as a feature:


fastd is a lightweight userspace tunneling daemon, that
mesh-vpn-fastd
""""""""""""""

fastd is a lightweight userspace tunneling daemon that
implements cipher suites that are specifically designed
implements cipher suites that are specifically designed
to work well on embedded devices. It offers encryption
to work well on embedded devices. It offers encryption
and authentication. Its primary drawback are the necessary
and authentication.
context-switches when forwarding packets.
The primary drawback of fastd's encrypted connection modes
is the necessary context switches when forwarding packets.
A kernel-supported L2TPv3 offloading option is available to
work around the context-switching bottleneck, but it comes
at the cost of losing the ability to protect tunnel connections
against eavesdropping or manipulation.

mesh-vpn-wireguard
""""""""""""""""""


L2TPv3 is an in-kernel tunneling protocol that performs well,
WireGuard is an encrypted in-kernel tunneling protocol that
but offers no security properties by itself.
provides encrypted transmission and at the same time offers
The brokering of the tunnel happens through tunneldigger,
high throughput.
its primary drawback being the lack of IPv6 support.


fastd
fastd
-----
^^^^^


Configurable Cipher
.. _VPN fastd methods:
^^^^^^^^^^^^^^^^^^^


Methods
"""""""


From the site configuration fastd can be allowed to offer
fastd offers various different connection "methods" with different
toggleable encryption in the config mode with the intent to
security properties that can be configured in the site configuration.
increase throughput, although in practice the gain is minimal.


**Site configuration:**
The following methods are currently recommended:


1) Add the feature ``web-mesh-vpn-fastd`` in ``site.mk``
- ``salsa2012+umac``: Encrypted + authenticated
2) Set ``mesh_vpn.fastd.configurable = true`` in ``site.conf``
- ``null+salsa2012+umac``: Unencrypted, authenticated
3) Optionally add ``null`` to the ``mesh_vpn.fastd.methods`` table if you want "Performance mode" as default (not recommended)
- ``null@l2tp``: Unencrypted, unauthenticated


**Gateway configuration:**
Multiple methods can be listed in ``site.conf``. The first listed method
supported by both the node and its peer will be used.


1) Prepend the ``null`` cipher in fastd's method list
The use of the ``null@l2tp`` method with offloading enabled can provide a
considerable performance gain, especially on weaker embedded hardware.
For L2TP offloading, the ``mesh-vpn-fastd-l2tp`` feature needs to be enabled in
``site.mk``.




**Config Mode:**
.. _vpn-gateway-configuration:
The resulting firmware will allow users to choose between secure (encrypted) and fast (unencrypted) transport.


.. image:: fastd_mode.gif
Gateway / Supernode Configuration
"""""""""""""""""""""""""""""""""

When only using the ``null`` or ``null@l2tp`` methods without offloading,
simply add these methods to the front of the method list. ``null@l2tp``
should always appear before ``null`` in the configuration when both are enabled.
fastd v22 or newer is needed for the ``null@l2tp`` method.

It is often not necessary to enable L2TP offloading on supernodes for
performance reasons. Nodes using offloading can communicate with supernodes that
don't use offloading as long as both use the ``null@l2tp`` method.


.. _vpn-gateway-configuration-offloading:

Offloading on Gateways / Supernodes
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


**Unix socket:**
To enable L2TP offloading on the supernodes, it is recommended to study the
To confirm whether the correct cipher is being used, fastd's unix
fastd documentation section pertaining to the `offload configuration option
socket can be interrogated, after installing for example `socat`.
<https://fastd.readthedocs.io/en/stable/manual/config.html#option-offload>`_.


::
However, the important changes to the fastd config on your Supernode are:

    - | Set ``mode multitap;``
      | Every peer gets their own interface.

    - | Replace ``interface "foo":`` with ``interface "peer-%k";``
      | ``%k`` is substituted for a portion of the peers public key.

    - | Set ``offload l2tp yes;``
      | This tells fastd to use the l2tp kernel module.

    - | Set ``persist interface no;``
      | This tells fastd to only keep interfaces around while the connection is active.

Note that in ``multitap`` mode, which is required when using L2TP offloading,
fastd will create one interface per peer on the supernode's. This allows
offloading the L2TP forwarding into the kernel space. But this also means added
complexity with regards to handling those interfaces.

There are two main options on how you can handle this:

    -  create ``on up`` and ``on down`` hooks

        - to handle interface setup and destruction
        - preferably using the async keyword, so hooks are not blocking fastd

    - use a daemon like systemd-networkd

Examples for both options can be found in the
`Wiki <https://github.com/freifunk-gluon/gluon/wiki/fastd-l2tp-offloading-on-supernodes>`_.

Configurable Method
"""""""""""""""""""

From the site configuration, fastd can be allowed to offer
toggleable encryption in the config mode with the intent to
increase throughput.

There is also an older unprotected method ``null``. Use of the newer
``null@l2tp`` method is generally recommended over ``null``, as the
performance gains provided by the latter (compared to the encrypted
and authenticated methods) are very small.

Site configuration
~~~~~~~~~~~~~~~~~~

1)
  Add the feature ``web-mesh-vpn-fastd`` in ``site.mk``
2)
  Set ``mesh_vpn.fastd.configurable = true`` in ``site.conf``
3)
  Optionally, add ``null@l2tp`` to the ``mesh_vpn.fastd.methods`` table if you want
  "Performance mode" as default (not recommended)

Config Mode
~~~~~~~~~~~

The resulting firmware will allow users to choose between secure (encrypted) and fast (unencrypted) transport.

.. image:: fastd_mode.gif


       opkg update
To confirm whether the correct cipher is being used, the log output
       opkg install socat
of fastd can be checked using ``logread``.
       socat - UNIX-CONNECT:/var/run/fastd.mesh_vpn.socket

WireGuard
^^^^^^^^^

In order to support WireGuard in Gluon, a few technologies are glued together.

**VXLAN:** As Gluon typically relies on batman-adv, the Mesh VPN has to provide
OSI Layer 2 transport. But WireGuard is an OSI Layer 3 tunneling protocol, so
additional technology is necessary here. For this, we use VXLAN. In short, VXLAN
is a well-known technology to encapsulate ethernet packages into IP packages.
You can think of it as kind of similar to VLAN, but on a different layer. Here,
we use VXLAN to transport batman-adv traffic over WireGuard.

**wgpeerselector**: To connect all gluon nodes to each other, it is common to
create a topology where each gluon node is connected to one of the available
gateways via Mesh VPN respectively. To achieve this, the gluon node should be
able to select a random gateway to connect to. But such "random selection of a
peer" is not implemented in WireGuard by default. WireGuard only knows static
peers. Therefore the *wgpeerselector* has been developed. It randomly selects a
gateway, tries to establish a connection, and if it fails, tries to connect
to the next gateway. This approach has several advantages, such as load
balancing VPN connection attempts and avoiding problems with offline gateways.
More information about the wgpeerselector and its algorithm can be found
`here <https://github.com/freifunk-gluon/packages/blob/main/net/wgpeerselector/README.md>`__.

On the gluon node both VXLAN and the wgpeerselector are well integrated and no
explicit configuration of those tools is necessary, once the general WireGuard
support has been configured.

Attention must by paid to time synchronization. As WireGuard
performs checks on timestamps in order to avoid replay attacks, time must
be synchronized before the Mesh VPN connection is established. This means that
the NTP servers specified in your site.conf must be publicly available (and not
only through the mesh). Be aware that if you fail this, you may not directly see
negative effects. Only when a previously connected node reboots the effect
comes into play, as the gateway still knows about the old timestamp of the gluon
node.

.. _gluon-mesh-vpn-key-translate:

gluon-mesh-vpn-key-translate
""""""""""""""""""""""""""""

Many communities already possess a collection of active fastd-keys when they
plan migrating their community to WireGuard.
These public keys known on the server-side can be derived into their WireGuard
equivalent using `gluon-mesh-vpn-key-translate <https://github.com/AiyionPrime/gluon-mesh-vpn-key-translate>`__.
The routers do the necessary reencoding of the private key seamlessly
when updating firmware from fastd to the WireGuard variant.

Gateway / Supernode Configuration
"""""""""""""""""""""""""""""""""

On the gateway side, a software called *wireguard-vxlan-glue* is necessary. It
is a small daemon that dynamically adds and removes forwarding rules for VXLAN
interfaces, so traffic is sent correctly into the WireGuard interface. Thereby
the forwarding rules are only installed if a client is connected, so
unnecessary traffic in the kernel is avoided. The source can be found
`here <https://github.com/freifunkh/wireguard-vxlan-glue/>`__.
Original line number Original line Diff line number Diff line
@@ -50,38 +50,84 @@ Configuration
Both Mesh-on-WAN and Mesh-on-LAN can be configured on the "Network" page
Both Mesh-on-WAN and Mesh-on-LAN can be configured on the "Network" page
of the *Advanced settings* (if the package ``gluon-web-network`` is installed).
of the *Advanced settings* (if the package ``gluon-web-network`` is installed).


It is also possible to enable Mesh-on-WAN and Mesh-on-LAN by default by
It is also possible to enable Mesh-on-WAN and Mesh-on-LAN by default by adding
adding ``mesh_on_wan = true`` and ``mesh_on_lan = true`` to ``site.conf``.
the ``mesh`` role to the ``interfaces.*.default_roles`` options in your
:ref:`site.conf<user-site-interfaces>`.


.. _wired-mesh-commandline:


Commandline
Commandline
===========
===========


Starting with release 2022.1, the wired network configuration is rebuilt from ``/etc/config/gluon``
upon each ``gluon-reconfigure``.
Therefore the network configuration is overwritten at least with every firmware upgrade.

Every interface has a list of roles assigned to it which can be ``client``, ``mesh`` or ``uplink``.

When the client role is assigned to an interface in combination with other roles
(like 'client', 'mesh' in the Mesh-on-LAN example below), the other roles take
precedence, enabling mesh but not client in the previous example.

The setup/config-mode interface is every interface with the role ``client`` which makes removing
it from interfaces not only unnecessary, but generally unrecommended.

In order to make persistent changes to the router's configuration it's necessary to:

* change the sections in ``/etc/config/gluon`` e.g. using uci (see examples below)
* call ``gluon-reconfigure`` to re-generate ``/etc/config/network``
* apply the networking changes, either through executing ``service network restart`` or by performing a ``reboot``

Enable Mesh-on-WAN::
Enable Mesh-on-WAN::


  uci set network.mesh_wan.disabled=0
  uci add_list gluon.iface_wan.role='mesh'
  uci commit network
  uci commit gluon


Disable Mesh-on-WAN::
Disable Mesh-on-WAN::


  uci set network.mesh_wan.disabled=1
  uci del_list gluon.iface_wan.role='mesh'
  uci commit network
  uci commit gluon


Enable Mesh-on-LAN::
Enable Mesh-on-LAN::


  uci set network.mesh_lan.disabled=0
  uci add_list gluon.iface_lan.role='mesh'
  for ifname in $(cat /lib/gluon/core/sysconfig/lan_ifname); do
  uci commit gluon
    uci del_list network.client.ifname=$ifname
  done
  uci commit network


Disable Mesh-on-LAN::
Disable Mesh-on-LAN::


  uci set network.mesh_lan.disabled=1
  uci del_list gluon.iface_lan.role='mesh'
  for ifname in $(cat /lib/gluon/core/sysconfig/lan_ifname); do
  uci commit gluon
    uci add_list network.client.ifname=$ifname

  done
For devices with a single interface, instead of `iface_lan` and `iface_wan` configuration is
  uci commit network
done with `iface_single`.

Enable Mesh-on-Single::

  uci add_list gluon.iface_single.role='mesh'
  uci commit gluon

Disable Mesh-on-Single::

  uci del_list gluon.iface_single.role='mesh'
  uci commit gluon

Furthermore it is possible to make use of 802.1Q VLAN.
The following statements would create a VLAN with id 8 on ``eth0`` and join the mesh network with it::

  uci set gluon.iface_lan_vlan8=interface
  uci set gluon.iface_lan_vlan8.name='eth0.8'
  uci add_list gluon.iface_lan_vlan8.role='mesh'
  uci commit gluon

Other VLAN-interfaces could be configured on the same parent interface in order to have
all three roles available on ``eth0`` without having them interfere with each other.
This feature comes in especially handy for the persistent configuration of virtual machines
as offloader for bigger installations.

A ``reboot`` is not sufficient to apply an altered configuration; calling ``gluon-reconfigure`` before is
mandatory in order for changes to take effect.


Please note that this configuration has changed in Gluon 2016.1. Using
Please note that this configuration has changed in Gluon 2022.1. Using
the old commands on 2016.1 and later will break the corresponding options
the old commands on 2022.1 and later will break the corresponding options
in the *Advanced settings*.
in the *Advanced settings*.
Original line number Original line Diff line number Diff line
@@ -6,6 +6,13 @@ may include one or both of the two networks "client" (AP mode) and "mesh" (802.1
mode), which can be used simultaneously. See :doc:`../user/site` for details on the
mode), which can be used simultaneously. See :doc:`../user/site` for details on the
configuration.
configuration.


Outdoor mode
------------

Configuring the node for outdoor use tunes the 5 GHz radio to a frequency and transmission power that conforms with the local regulatory requirements. 
It also enables dynamic frequency selection (DFS; radar detection).
At the same time, mesh functionality is disabled as it requires neighbouring nodes to stay on the same channel permanently.

Upgrade behaviour
Upgrade behaviour
-----------------
-----------------


@@ -16,10 +23,10 @@ by the user). This means that it is not possible to enable or disable an existin
configurations during upgrades.
configurations during upgrades.


During upgrades the wifi channel of the 2.4GHz and 5GHz radio will be restored to the channel
During upgrades the wifi channel of the 2.4GHz and 5GHz radio will be restored to the channel
configured in the site.conf. If you need to preserve a user defined wifi channel during upgrades
configured in the site.conf. The channel width will be reset to Gluon's default. If you need to preserve
you can configure this via the uci section ``gluon-core.wireless``::
these settings during upgrades you can configure this via the uci section ``gluon-core.wireless``::


  uci set gluon-core.@wireless[0].preserve_channels='1'
  uci set gluon.wireless.preserve_channels='1'


When channels should be preserved, toggling the outdoor mode will have no effect on the channel settings.
When channels should be preserved, toggling the outdoor mode will have no effect on the channel settings.
Therefore, the Outdoor mode settings won't be displayed in config mode.
Therefore, the Outdoor mode settings won't be displayed in config mode.
+71 −114
Original line number Original line Diff line number Diff line
@@ -14,6 +14,7 @@ Several Freifunk communities in Germany use Gluon as the foundation of their Fre
  user/supported_devices
  user/supported_devices
  user/x86
  user/x86
  user/faq
  user/faq
  user/mtu


.. toctree::
.. toctree::
  :caption: Features
  :caption: Features
@@ -24,12 +25,14 @@ Several Freifunk communities in Germany use Gluon as the foundation of their Fre
  features/wlan-configuration
  features/wlan-configuration
  features/private-wlan
  features/private-wlan
  features/wired-mesh
  features/wired-mesh
   features/dns-forwarder
  features/tls
  features/dns-cache
  features/monitoring
  features/monitoring
  features/multidomain
  features/multidomain
  features/authorized-keys
  features/authorized-keys
  features/roles
  features/roles
  features/vpn
  features/vpn
  features/status-page


.. toctree::
.. toctree::
  :caption: Developer Documentation
  :caption: Developer Documentation
@@ -39,7 +42,7 @@ Several Freifunk communities in Germany use Gluon as the foundation of their Fre
  dev/hardware
  dev/hardware
  dev/packages
  dev/packages
  dev/upgrade
  dev/upgrade
   dev/wan
  dev/uplink
  dev/mac_addresses
  dev/mac_addresses
  dev/site_library
  dev/site_library
  dev/build
  dev/build
@@ -61,83 +64,37 @@ Several Freifunk communities in Germany use Gluon as the foundation of their Fre


  package/gluon-client-bridge
  package/gluon-client-bridge
  package/gluon-config-mode-domain-select
  package/gluon-config-mode-domain-select
  package/gluon-config-mode-geo-location-osm
  package/gluon-ebtables-filter-multicast
  package/gluon-ebtables-filter-multicast
  package/gluon-ebtables-filter-ra-dhcp
  package/gluon-ebtables-filter-ra-dhcp
  package/gluon-ebtables-limit-arp
  package/gluon-ebtables-limit-arp
  package/gluon-ebtables-source-filter
  package/gluon-ebtables-source-filter
  package/gluon-harden-dropbear
  package/gluon-hoodselector
  package/gluon-hoodselector
  package/gluon-logging
  package/gluon-logging
  package/gluon-mesh-batman-adv
  package/gluon-mesh-batman-adv
  package/gluon-mesh-wireless-sae
  package/gluon-mesh-wireless-sae
  package/gluon-radvd
  package/gluon-radv-filterd
  package/gluon-radv-filterd
  package/gluon-scheduled-domain-switch
  package/gluon-scheduled-domain-switch
  package/gluon-state-check
  package/gluon-web-admin
  package/gluon-web-admin
  package/gluon-web-cellular
  package/gluon-web-network
  package/gluon-web-logging
  package/gluon-web-logging


.. toctree::
.. toctree::
  :caption: Releases
  :caption: Releases
  :maxdepth: 1
  :maxdepth: 1


   releases/v2020.2.3
  releases/index
   releases/v2020.2.2
   releases/v2020.2.1
   releases/v2020.2
   releases/v2020.1.4
   releases/v2020.1.3
   releases/v2020.1.2
   releases/v2020.1.1
   releases/v2020.1
   releases/v2019.1.3
   releases/v2019.1.2
   releases/v2019.1.1
   releases/v2019.1
   releases/v2018.2.4
   releases/v2018.2.3
   releases/v2018.2.2
   releases/v2018.2.1
   releases/v2018.2
   releases/v2018.1.4
   releases/v2018.1.3
   releases/v2018.1.2
   releases/v2018.1.1
   releases/v2018.1
   releases/v2017.1.8
   releases/v2017.1.7
   releases/v2017.1.6
   releases/v2017.1.5
   releases/v2017.1.4
   releases/v2017.1.3
   releases/v2017.1.2
   releases/v2017.1.1
   releases/v2017.1
   releases/v2016.2.7
   releases/v2016.2.6
   releases/v2016.2.5
   releases/v2016.2.4
   releases/v2016.2.3
   releases/v2016.2.2
   releases/v2016.2.1
   releases/v2016.2
   releases/v2016.1.6
   releases/v2016.1.5
   releases/v2016.1.4
   releases/v2016.1.3
   releases/v2016.1.2
   releases/v2016.1.1
   releases/v2016.1
   releases/v2015.1.2
   releases/v2015.1.1
   releases/v2015.1
   releases/v2014.4
   releases/v2014.3.1
   releases/v2014.3


License
License
-------
-------


See LICENCE_
See LICENCE_


.. _LICENCE: https://github.com/freifunk-gluon/gluon/blob/master/LICENSE
.. _LICENCE: https://github.com/freifunk-gluon/gluon/blob/main/LICENSE


Indices and tables
Indices and tables
==================
==================
Original line number Original line Diff line number Diff line
@@ -22,9 +22,9 @@
  },
  },


  wifi24 = {
  wifi24 = {
    channel = 1,
    ap = {
    ap = {
      ssid = "alpha-centauri.example.org",
      ssid = "alpha-centauri.example.org",
      channel = 1,
    },
    },
    mesh = {
    mesh = {
      id = 'ueH3uXjdp', -- usually you don't want users to connect to this mesh-SSID, so use a cryptic id that no one will accidentally mistake for the client WiFi
      id = 'ueH3uXjdp', -- usually you don't want users to connect to this mesh-SSID, so use a cryptic id that no one will accidentally mistake for the client WiFi
@@ -32,9 +32,9 @@
  },
  },


  wifi5 = {
  wifi5 = {
    channel = 44,
    ap = {
    ap = {
      ssid = "alpha-centauri.example.org",
      ssid = "alpha-centauri.example.org",
      channel = 44,
    },
    },
    mesh = {
    mesh = {
      id = 'ueH3uXjdp',
      id = 'ueH3uXjdp',
Original line number Original line Diff line number Diff line
features {
	'autoupdater',
	'ebtables-filter-multicast',
	'ebtables-filter-ra-dhcp',
	'ebtables-limit-arp',
	'mesh-batman-adv-15',
	'mesh-vpn-fastd',
	'respondd',
	'status-page',
	'web-advanced',
	'web-wizard',
}

packages {
	'iwinfo',
}

if not device_class('tiny') then
	features {'wireless-encryption-wpa3'}
end
Original line number Original line Diff line number Diff line
@@ -20,10 +20,10 @@
  },
  },


  mesh_vpn = {
  mesh_vpn = {
    mtu = 1312,


    fastd = {
    fastd = {
      methods = {'salsa2012+umac'},
      methods = {'salsa2012+umac'},
      mtu = 1312,
    },
    },


    bandwidth_limit = {
    bandwidth_limit = {
@@ -39,7 +39,15 @@
    branches = {
    branches = {
      stable = {
      stable = {
        name = 'stable',
        name = 'stable',
        mirrors = {'http://update.example.org/stable/sysupgrade'},
        mirrors = {
          'http://1.updates.example.org/stable/sysupgrade',

          -- Requires the tls feature in image-customization.lua
          -- 'https://2.updates.example.org/stable/sysupgrade',

          -- Uses http or https depending on the tls feature in image-customization.lua
          '//3.updates.example.org/stable/sysupgrade',
        },
        good_signatures = 2,
        good_signatures = 2,
        pubkeys = {
        pubkeys = {
          'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx', -- Alice
          'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx', -- Alice
Original line number Original line Diff line number Diff line
##	gluon site.mk makefile example
##	gluon site.mk makefile example


##	GLUON_FEATURES
#		Specify Gluon features/packages to enable;
#		Gluon will automatically enable a set of packages
#		depending on the combination of features listed

GLUON_FEATURES := \
	autoupdater \
	ebtables-filter-multicast \
	ebtables-filter-ra-dhcp \
	ebtables-limit-arp \
	mesh-batman-adv-15 \
	mesh-vpn-fastd \
	respondd \
	status-page \
	web-advanced \
	web-wizard

##	GLUON_MULTIDOMAIN
##	GLUON_MULTIDOMAIN
#		Build gluon with multidomain support.
#		Build gluon with multidomain support.


GLUON_MULTIDOMAIN=1
GLUON_MULTIDOMAIN=1


##	GLUON_SITE_PACKAGES
#		Specify additional Gluon/LEDE packages to include here;
#		A minus sign may be prepended to remove a packages from the
#		selection that would be enabled by default or due to the
#		chosen feature flags


GLUON_SITE_PACKAGES := iwinfo

##	DEFAULT_GLUON_RELEASE
##	DEFAULT_GLUON_RELEASE
#		version string to use for images
#		version string to use for images
#		gluon relies on
#		gluon relies on
@@ -58,6 +32,3 @@ GLUON_REGION ?= eu


# Languages to include
# Languages to include
GLUON_LANGS ?= en de
GLUON_LANGS ?= en de

# Do not build images for deprecated devices
GLUON_DEPRECATED ?= 0
Original line number Original line Diff line number Diff line
.. _package-gluon-config-mode-geo-location-osm:

gluon-config-mode-geo-location-osm
==================================

When package *gluon-config-mode-geo-location-osm* is enabled, the configuration wizard will
try to load an OSM-based map to allow the user to specify the node location.
Loading the map requires a working internet connection, for example via WLAN
(while connected to the Gluon node via Ethernet).

.. image:: gluon-config-mode-geo-location-osm.png
Original line number Original line Diff line number Diff line
@@ -25,5 +25,6 @@ This package is installed by default if the selected routing
feature is *mesh-batman-adv-15*.
feature is *mesh-batman-adv-15*.
It can be unselected via::
It can be unselected via::


    GLUON_SITE_PACKAGES := \
    packages {
      -gluon-ebtables-limit-arp
      '-gluon-ebtables-limit-arp',
    }
+30 −0
Original line number Original line Diff line number Diff line
gluon-harden-dropbear
=====================

This package reduces the attack surface of dropbear, the SSH server on the router.

If the root account either has no password configured or is locked,
password authorization is disabled in dropbear's settings.

If furthermore no SSH key is authorized to login, the ``dropbear`` service is disabled.

Changing the password or updating authorized keys
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Via console
"""""""""""

Upon editing */etc/dropbear/authorized_keys* or changing root's password,
a call to *gluon-reconfigure* as well as a reboot might be needed in order to have dropbear launched conditionally upon boot.

.. code-block:: bash

  passwd
  gluon-reconfigure
  reboot


In setup-mode
"""""""""""""

As *gluon-reconfigure* is run when rebooting from the setup-mode web interface, no further steps are required.
Original line number Original line Diff line number Diff line
@@ -168,3 +168,32 @@ or to at least manually mark the port to the Gluon router as a
Alternatively, the filtering of IGMP/MLD reports can be disabled via
Alternatively, the filtering of IGMP/MLD reports can be disabled via
the site.conf (which is not recommended in large meshes though).
the site.conf (which is not recommended in large meshes though).
See :ref:`site.conf mesh section <user-site-mesh>` for details.
See :ref:`site.conf mesh section <user-site-mesh>` for details.

Tweaking Hop Penalty
^^^^^^^^^^^^^^^^^^^^

In general, the usage of a directly connected uplink is preferred over a faster more distant connection.
In situations where the uplink of a device should only be used as a fallback (e.g. metered connection or slower encryption), this can be tweaked using a hop_penalty in gluon.
Examples of this are shown below:

.. code-block:: sh

  # use mesh-vpn as fallback only
  uci set gluon.mesh_vpn.batadv_hop_penalty='120'
  # optional penalty for wired mesh
  uci set gluon.iface_lan.batadv_hop_penalty=10
  # optional for mesh on wan
  uci set gluon.iface_wan.batadv_hop_penalty=10
  # don't forget to commit changes
  uci commit gluon

To apply the changes, run the following commands:

.. code-block:: sh

  gluon-reconfigure
  reboot

Further documentation of the hop penalty can be found here:

https://www.open-mesh.org/doc/batman-adv/Tweaking.html#hop-penalty
Original line number Original line Diff line number Diff line
@@ -34,7 +34,7 @@ wifi.mesh.sae_passphrase \: optional
  - sets a shared secret used to authenticate any two mesh nodes,
  - sets a shared secret used to authenticate any two mesh nodes,
    crucial for private mesh networks
    crucial for private mesh networks
  - should not be set, if the shared secret is shared with untrusted
  - should not be set, if the shared secret is shared with untrusted
    third parties, like in a publish mesh network
    third parties, like in a public mesh network
  - defaults to an autogenerated value derived from ``prefix6``
  - defaults to an autogenerated value derived from ``prefix6``




+34 −0
Original line number Original line Diff line number Diff line
gluon-radvd
===========

This package provides service files and configuration endpoints for the IPv6
router advertisement daemon.

Arguments
---------

This package provides skeleton service files for ``uradvd``.
It requires another package to provide the arguments ``uradvd`` is supposed to
be launched with.

:doc:`gluon-mesh-batman-adv` and ``gluon-mesh-layer3-common`` are two packages
providing such arguments in order to announce default routes for Layer 3 meshes,
while only announcing prefixes for Layer 2 meshes.

site.conf
---------

radvd.preferred_lifetime : optional
    - the span of time during which the address can be freely used as a source
      and destination for traffic. Should be less or equal valid-lifetime.
    - defaults to ``14400`` seconds => 4h
radvd.valid_lifetime : optional
    - the total time the prefix remains available before becoming unusable
    - defaults to ``86400`` seconds => one day

Example::

  radvd = {
    preferred_lifetime = 150,
    valid_lifetime = 300,
  },
Original line number Original line Diff line number Diff line
@@ -10,6 +10,9 @@ powered off while this was supposed to happen, it might not be able to acquire t
correct time. In this case, the node will switch after it has not seen any gateway
correct time. In this case, the node will switch after it has not seen any gateway
for a given period of time.
for a given period of time.


In older versions ping was used against an array of endpoints to determine mesh-connectivity.
Nowadays *gluon-state-check* is used for this and evaluates mesh-(VPN) connectivity and NTP states.

site.conf
site.conf
---------
---------
All those settings have to be defined exclusively in the domain, not the site.
All those settings have to be defined exclusively in the domain, not the site.
@@ -21,9 +24,6 @@ domain_switch : optional (needed for domains to switch)
    - amount of time without reachable gateway to switch unconditionally
    - amount of time without reachable gateway to switch unconditionally
  switch_time :
  switch_time :
    - UNIX epoch after which domain will be switched
    - UNIX epoch after which domain will be switched
    connection_check_targets :
        - array of IPv6 addresses which are probed to determine if the node is
	  connected to the mesh


Example::
Example::


@@ -31,8 +31,4 @@ Example::
    target_domain = 'new_domain',
    target_domain = 'new_domain',
    switch_after_offline_mins = 120,
    switch_after_offline_mins = 120,
    switch_time = 1546344000, -- 01.01.2019 - 12:00 UTC
    switch_time = 1546344000, -- 01.01.2019 - 12:00 UTC
    connection_check_targets = {
      '2001:4860:4860::8888',
      '2001:4860:4860::8844',
    },
  },
  },
+28 −0
Original line number Original line Diff line number Diff line
gluon-state-check
=================

This package provides a result cache for the routers state during runtime.

This allows for packages to use recent check results, which might be costly
or are otherwise hard to obtain.

gluon-state-check executes checks in `/lib/gluon/state/check.d/` and provides
a flag file for each check in `/var/gluon/state` depending on the return code
of the check. A flag file is created (or "touched") if the corresponding check
exits cleanly and gets removed otherwise. If the flags are "touched", they
are only accessed, but not modified. In this way, the atime of a flag file
reflects when the last check was performed and the mtime reflects when
when the state was last changed.

This package provides the following checks:
- `has_default_gw6` - check whether the router has a default IPv6-route on br-client.
- `has_ntp_sync` - check whether the last stratum event of busybox ntpd was <16
- `has_lost_ntp_sync` - check whether the last stratum event of busybox was 16

The checks are executed once every minute (by micron.d).
The two NTP checks are hotplug results of ntpd and as a result not available
in the first 11 minutes of uptime.

Lastly this package provides a helper called `gluon-ntp-info`,
which acts as a reference on how to interpret the modification and creation times of
state check files.
+14 −0
Original line number Original line Diff line number Diff line
.. _package-gluon-web-cellular:

gluon-web-cellular
==================

This package allows to configure WWAN for capable cellular devices.

This works by creating an abstraction layer into Gluon which takes common options (SIM PIN / APN) and translates it to modem-specific settings based on the specific device using. 
Doing so limits the use-case onto specific models (no LTE sticks possible) but provides a common interface.

The WWAN is assigned the WAN firewall zone and wired WAN can still be used, however without prioritization.
The traffic path is not configured to prefer one uplink source or the other.

.. image:: gluon-web-cellular.png
+20 −0
Original line number Original line Diff line number Diff line
gluon-web-network
=================

The package *gluon-web-network* is part of :ref:`Feature Flag <user-site-feature-flags>` web-advanced.
It allows to configure the network interfaces roles of the gluon node in config mode through checkboxes.

It is a user-friendly way to configure what otherwise would need the :ref:`wired-mesh-commandline`.

.. image:: gluon-web-network.png

configuration options
---------------------

The following roles can be assigned to the interfaces:

* `Uplink` - interface is used for WAN connection, which is used for the VPN if `mesh-vpn` checkbox is enabled in basic config mode
* `Mesh` - interface is used for :doc:`../features/wired-mesh`. Using this on the WAN interface is also known as "Mesh-on-WAN"
* `Client` - interface is used as client network - connected devices to this interface should get a working internet configuration through DHCP

The roles `Uplink`/`Mesh` and `Client` are mutually exclusive.
+148 −0
Original line number Original line Diff line number Diff line
Release Notes
=============

.. toctree::
  :caption: Gluon 2023.2
  :maxdepth: 2

  v2023.2.5
  v2023.2.4
  v2023.2.3
  v2023.2.2
  v2023.2.1
  v2023.2

.. toctree::
  :caption: Gluon 2023.1
  :maxdepth: 2

  v2023.1.2
  v2023.1.1
  v2023.1

.. toctree::
  :caption: Gluon 2022.1
  :maxdepth: 2

  v2022.1.4
  v2022.1.3
  v2022.1.2
  v2022.1.1
  v2022.1

.. toctree::
  :caption: Gluon 2021.1
  :maxdepth: 2

  v2021.1.2
  v2021.1.1
  v2021.1

.. toctree::
  :caption: Gluon 2020.2
  :maxdepth: 2

  v2020.2.3
  v2020.2.2
  v2020.2.1
  v2020.2

.. toctree::
  :caption: Gluon 2020.1
  :maxdepth: 2

  v2020.1.4
  v2020.1.3
  v2020.1.2
  v2020.1.1
  v2020.1

.. toctree::
  :caption: Gluon 2019.1
  :maxdepth: 2

  v2019.1.3
  v2019.1.2
  v2019.1.1
  v2019.1

.. toctree::
  :caption: Gluon 2018.2
  :maxdepth: 2

  v2018.2.4
  v2018.2.3
  v2018.2.2
  v2018.2.1
  v2018.2

.. toctree::
  :caption: Gluon 2018.1
  :maxdepth: 2

  v2018.1.4
  v2018.1.3
  v2018.1.2
  v2018.1.1
  v2018.1

.. toctree::
  :caption: Gluon 2017.1
  :maxdepth: 2

  v2017.1.8
  v2017.1.7
  v2017.1.6
  v2017.1.5
  v2017.1.4
  v2017.1.3
  v2017.1.2
  v2017.1.1
  v2017.1

.. toctree::
  :caption: Gluon 2016.2
  :maxdepth: 2

  v2016.2.7
  v2016.2.6
  v2016.2.5
  v2016.2.4
  v2016.2.3
  v2016.2.2
  v2016.2.1
  v2016.2

.. toctree::
  :caption: Gluon 2016.1
  :maxdepth: 2

  v2016.1.6
  v2016.1.5
  v2016.1.4
  v2016.1.3
  v2016.1.2
  v2016.1.1
  v2016.1

.. toctree::
  :caption: Gluon 2015.1
  :maxdepth: 2

  v2015.1.2
  v2015.1.1
  v2015.1

.. toctree::
  :caption: Gluon 2014.4
  :maxdepth: 2

  v2014.4

.. toctree::
  :caption: Gluon 2014.3
  :maxdepth: 2

  v2014.3.1
  v2014.3
Original line number Original line Diff line number Diff line
@@ -146,7 +146,7 @@ Ignored tx-power offset on Ubiquiti AirMax devices


https://github.com/freifunk-gluon/gluon/issues/94
https://github.com/freifunk-gluon/gluon/issues/94


There is still no OpenWRT support for determining the transmission
There is still no OpenWrt support for determining the transmission
power offsets on Ubiquiti AirMax devices (Bullet M2, Picostation
power offsets on Ubiquiti AirMax devices (Bullet M2, Picostation
M2, Nanostation (loco) M2, ...). Use Gluon with caution on these
M2, Nanostation (loco) M2, ...). Use Gluon with caution on these
devices! Manual adjustment may be required.
devices! Manual adjustment may be required.
Original line number Original line Diff line number Diff line
@@ -88,6 +88,8 @@ New features
* Add support for making nodes a DNS cache for clients
* Add support for making nodes a DNS cache for clients
  (`#1000 <https://github.com/freifunk-gluon/gluon/pull/1000>`_)
  (`#1000 <https://github.com/freifunk-gluon/gluon/pull/1000>`_)


  See also: :doc:`../features/dns-cache`

* Add L2TP via tunneldigger as an alternative VPN system
* Add L2TP via tunneldigger as an alternative VPN system
  (`#978 <https://github.com/freifunk-gluon/gluon/pull/978>`_)
  (`#978 <https://github.com/freifunk-gluon/gluon/pull/978>`_)


Original line number Original line Diff line number Diff line
@@ -28,7 +28,7 @@ Bugfixes
  As the path to both config mode and status page were changed between versions
  As the path to both config mode and status page were changed between versions
  users could be affected by a redirect to a no more valid URL. 
  users could be affected by a redirect to a no more valid URL. 


* batman-adv has received two bugfixes, which were `backported <https://github.com/openwrt-routing/packages/commit/7bf62cc8b556b5046f9bbd37687376fe9ea175bb>`_ from v2018.4
* batman-adv has received two bugfixes, which were `backported <https://github.com/openwrt/routing/commit/7bf62cc8b556b5046f9bbd37687376fe9ea175bb>`_ from v2018.4


Other changes
Other changes
~~~~~~~~~~~~~
~~~~~~~~~~~~~
Original line number Original line Diff line number Diff line
@@ -61,7 +61,7 @@ Bugfixes


  This affects the following devices:
  This affects the following devices:


  * GL.iNet GL-AR150, 
  * GL.iNet GL-AR150
  * GL.iNet GL-AR300M
  * GL.iNet GL-AR300M
  * GL.iNet GL-AR750
  * GL.iNet GL-AR750
  * Raspberry Pi Model B+ Rev 1.2
  * Raspberry Pi Model B+ Rev 1.2

File changed.

Preview size limit exceeded, changes collapsed.

+25 −71

File changed.

Preview size limit exceeded, changes collapsed.

docs/user/mtu.rst

0 → 100644
+225 −0

File added.

Preview size limit exceeded, changes collapsed.

+670 −504

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

+11 −11

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

scripts/container.sh

0 → 100755
+24 −0

File added.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

scripts/getversion.sh

0 → 100755
+13 −0

File added.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

scripts/update-ci.sh

0 → 100755
+3 −0

File added.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

targets/ar71xx-generic

deleted100644 → 0
+0 −523

File deleted.

Preview size limit exceeded, changes collapsed.

targets/ar71xx-mikrotik

deleted100644 → 0
+0 −12

File deleted.

Preview size limit exceeded, changes collapsed.

targets/ar71xx-nand

deleted100644 → 0
+0 −33

File deleted.

Preview size limit exceeded, changes collapsed.

targets/ar71xx-tiny

deleted100644 → 0
+0 −133

File deleted.

Preview size limit exceeded, changes collapsed.

targets/armsr-armv7

0 → 100644
+3 −0

File added.

Preview size limit exceeded, changes collapsed.

targets/armsr-armv8

0 → 100644
+3 −0

File added.

Preview size limit exceeded, changes collapsed.

targets/armsr.inc

0 → 100644
+9 −0

File added.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

targets/ath79-mikrotik

0 → 100644
+5 −0

File added.

Preview size limit exceeded, changes collapsed.

targets/ath79-nand

0 → 100644
+71 −0

File added.

Preview size limit exceeded, changes collapsed.

+11 −0

File added.

Preview size limit exceeded, changes collapsed.

+60 −9

File changed.

Preview size limit exceeded, changes collapsed.

+5 −0

File added.

Preview size limit exceeded, changes collapsed.

+12 −0

File added.

Preview size limit exceeded, changes collapsed.

+9 −0

File added.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

+100 −0

File added.

Preview size limit exceeded, changes collapsed.

+15 −0

File added.

Preview size limit exceeded, changes collapsed.

targets/mikrotik.inc

0 → 100644
+7 −0

File added.

Preview size limit exceeded, changes collapsed.

targets/mpc85xx-generic

deleted100644 → 0
+0 −1

File deleted.

Preview size limit exceeded, changes collapsed.

targets/mpc85xx-p1010

0 → 100644
+17 −0

File added.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

+5 −0

File added.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

targets/ramips-rt305x

deleted100644 → 0
+0 −52

File deleted.

Preview size limit exceeded, changes collapsed.

targets/rockchip-armv8

0 → 100644
+8 −0

File added.

Preview size limit exceeded, changes collapsed.

+19 −12

File changed.

Preview size limit exceeded, changes collapsed.

+12 −4

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

File changed.

Preview size limit exceeded, changes collapsed.

+14 −5

File changed.

Preview size limit exceeded, changes collapsed.