nodered: settings are files the mesh writes; editor locked with adminAuth; pin 5.0.7

Conversation 1 Commits 3 Files Changed 9

+715 -13

3 Commits

Author	SHA1	Message	Date
jschoubben	3c7aafdc21	nodered: its MQTT broker comes from the mesh Node-RED's one broker node pointed at zurag.be:1884, where nothing listens. nodered now requires mqtt-topic (asking for every topic: flows follow the devices' own) and a run-once `mqtt` step — declared last, restarted when the binding, credential or settings change — points the mesh's broker nodes at the bound broker through Node-RED's admin API with the module's api-token: the node the step makes itself when none is named, or the ones an assignment names in `mqtt.brokers`. Only host, port, TLS and the login change; the broker is asked first whether it takes the login; the deploy is against the revision read ("nodes", so only that node restarts) and a digest makes a rerun a no-op. A broker node nobody named is never touched. settings.js keeps `mqtt` and `topics` out of Node-RED.	2026-09-30 13:01:14 +02:00
jschoubben	c1a65e2354	nodered: the sidecar dials the port it was given The sidecar runs on the host network and dialled 127.0.0.1:1880, the software's port; the mesh publishes nodered on a machine port it assigns, so the tools reached whatever else holds 1880, or nothing (hq 088).	2026-09-29 23:50:11 +02:00
jschoubben	0c91e08bad	nodered: its settings are files the mesh writes, and its editor is locked The catalogue ran the image's defaults: no adminAuth, so a routed Node-RED editor (which runs arbitrary code) was open to anyone who reached it, and the module's own tools had no token to present to an install that was locked. - settings.js (fixed, 0600, uid 1000) carries adminAuth: user admin checked against the admin secret -- a minted password, or the bcrypt hash an existing install held (accepted), so current logins keep working -- and a static bearer token (api-token) the sidecar presents. It loads settings.json beside it, the one mergeable file; endpoints is dropped there, and an optional timeZone sets process.env.TZ (assignments cannot set env). - The sidecar's runtime config is no longer merged; it carries the token. - Directories are placed (state, data), the route binds into state. - Image pinned to 5.0.7 (a649dd71), what ace runs; the old pin was 5.0.6. - deployFlows asks for API v2: v1 answers 204 with no body, which the client tried to parse as JSON. Verified: catalogue tests pass against this tree. A throwaway 5.0.7 container started with the generated files: anonymous /flows 401, bearer api-token 200, bad token 401, password grant 200/403 with a minted password and with a bcrypt-hash-accepted one; endpoints and timeZone do not reach /settings; timeZone Europe/Brussels overrides TZ=Etc/UTC; v1 deploy 204, v2 deploy answers {rev}.	2026-09-29 23:41:18 +02:00

Author

SHA1

Message

Date

jschoubben

3c7aafdc21

nodered: its MQTT broker comes from the mesh

Node-RED's one broker node pointed at zurag.be:1884, where nothing listens. nodered now requires
mqtt-topic (asking for every topic: flows follow the devices' own) and a run-once `mqtt` step —
declared last, restarted when the binding, credential or settings change — points the mesh's broker
nodes at the bound broker through Node-RED's admin API with the module's api-token: the node the
step makes itself when none is named, or the ones an assignment names in `mqtt.brokers`. Only host,
port, TLS and the login change; the broker is asked first whether it takes the login; the deploy is
against the revision read ("nodes", so only that node restarts) and a digest makes a rerun a no-op.
A broker node nobody named is never touched. settings.js keeps `mqtt` and `topics` out of Node-RED.

2026-09-30 13:01:14 +02:00

jschoubben

c1a65e2354

nodered: the sidecar dials the port it was given

The sidecar runs on the host network and dialled 127.0.0.1:1880, the
software's port; the mesh publishes nodered on a machine port it assigns,
so the tools reached whatever else holds 1880, or nothing (hq 088).

2026-09-29 23:50:11 +02:00

jschoubben

0c91e08bad

nodered: its settings are files the mesh writes, and its editor is locked

The catalogue ran the image's defaults: no adminAuth, so a routed Node-RED
editor (which runs arbitrary code) was open to anyone who reached it, and
the module's own tools had no token to present to an install that was locked.

- settings.js (fixed, 0600, uid 1000) carries adminAuth: user admin checked
  against the admin secret -- a minted password, or the bcrypt hash an
  existing install held (accepted), so current logins keep working -- and a
  static bearer token (api-token) the sidecar presents. It loads settings.json
  beside it, the one mergeable file; endpoints is dropped there, and an
  optional timeZone sets process.env.TZ (assignments cannot set env).
- The sidecar's runtime config is no longer merged; it carries the token.
- Directories are placed (state, data), the route binds into state.
- Image pinned to 5.0.7 (a649dd71), what ace runs; the old pin was 5.0.6.
- deployFlows asks for API v2: v1 answers 204 with no body, which the client
  tried to parse as JSON.

Verified: catalogue tests pass against this tree. A throwaway 5.0.7 container
started with the generated files: anonymous /flows 401, bearer api-token 200,
bad token 401, password grant 200/403 with a minted password and with a
bcrypt-hash-accepted one; endpoints and timeZone do not reach /settings;
timeZone Europe/Brussels overrides TZ=Etc/UTC; v1 deploy 204, v2 deploy
answers {rev}.

2026-09-29 23:41:18 +02:00

nodered: settings are files the mesh writes; editor locked with adminAuth; pin 5.0.7 #149