octoturgeandClaude Sonnet 5 ce6a4c3806 Auto-pin certificates on connect; fix Custom TLS mode for real MQTT
connect() now calls ensure_trusted() before opening the MQTT session, so
a newly-added printer with no ca_cert_path configured just works: bundled
CA if it verifies, trust-on-first-connect auto-pin if it doesn't (P1P,
at least) - the same thing examples/auto_connect_bambu.rs already did by
hand, now automatic on every real connect.

Wiring that in immediately surfaced a real, second instance of a bug the
codebase already knew about: build_connector()'s BambuTls::Custom branch
used add_root_certificate on the pinned certificate - but ensure_trusted
pins a *leaf* cert (CN = the printer's serial number, issued by Bambu's
own CA, not a root), for byte-exact fingerprint comparison, not chain
validation. Handing that leaf to add_root_certificate asks OpenSSL to
treat it as its own trust anchor - exactly the "self-signed certificate
in certificate chain" failure test_tls_handshake's doc comment already
described, just not fixed at this second call site (the one the real
MQTT connection actually uses) until now. native_tls has no per-
certificate verification callback hook (unlike rustls), so Custom now
accepts any certificate at the TLS layer instead, relying on
ensure_trusted having already fingerprint-verified this exact printer
moments before - weaker than continuous pinning on every reconnect, but
not a fresh regression: pinning a leaf as a root here never worked.

Verified live: deleted P1P's existing pin entirely, ran the daemon, and
watched it auto-fetch, pin, and connect on the very first attempt - the
freshly-pinned certificate came back byte-identical to the one that was
there before. Both configured printers (P1P forced v1, H2C auto-detected
v2) now connect successfully from a cold start with zero manual steps.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MWQVtBGxHYLkVw2kBupd5g
2026-09-05 21:45:32 +00:00

continuum-proxy

Edge gateway daemon for the Continuum print farm platform. Runs on a Linux SBC on-site, talks to printers over the LAN, and keeps a connection to the cloud control plane (continuum-backend).

This is a learning-stage boilerplate

This repo is deliberately minimal right now - real printer protocol clients (Bambu MQTT+FTPS, PrusaLink REST, Klipper/Moonraker WebSocket) are not implemented yet. Each vendor is a stub that just prints what it would do (src/printer/bambu.rs, prusa.rs, klipper.rs). The idea is to learn Rust's polymorphism pattern (trait + enum, since Rust has no class inheritance) on something simple before adding real networking on top.

Getting started

cp .env.example .env
cargo run                                  # the daemon: cloud uplink + go2rtc watchdog
cargo run --example printer_polymorphism   # standalone demo, no network/env needed

cp printers.example.toml printers.toml     # fill in your real printers (gitignored)
cargo run --example test_bambu_certs       # real TLS handshake test against each Bambu printer

Structure

src/
  main.rs      Runs the uplink and the go2rtc watchdog side by side
  config.rs    Loads settings from environment variables
  fleet.rs     Loads printers.toml into ready-to-use PrinterHandles
  uplink/      WebSocket client to continuum-backend: connect, heartbeat, reconnect on drop
  printer/     GenericPrinter trait + PrinterBase + PrinterHandle enum + one stub per vendor
  go2rtc.rs    Restarts the go2rtc camera-restreaming process if it dies
examples/
  printer_polymorphism.rs   Runs all five printer stubs through one `connect()` call site
  test_bambu_certs.rs       Loads printers.toml, does a real TLS handshake to each Bambu printer

src/printer/ is where the "inheritance" question lives - see that module's doc comment for the trait+enum pattern this project uses instead of class inheritance, and run printer_polymorphism to see it work.

printers.toml (gitignored - copy from printers.example.toml) holds real per-printer connection details: host, access code, and - since not every Bambu printer trusts the same certificate (see certs/README.md) - an optional per-printer CA override. src/fleet.rs loads it; nothing in main.rs uses it yet, but test_bambu_certs does, as a real (if narrow - just the TLS handshake, no MQTT) way to check a printer's certificate without needing the full MQTT client built yet.

What's not here yet (on purpose)

  • Real MQTT/FTPS/HTTP/WebSocket printer clients - src/printer/*.rs has a println! where each of these will go.
  • Local SQLite buffering for telemetry across connectivity gaps.
  • LAN printer discovery (SSDP/mDNS).
  • The mechanical plate-changer interface (serial/GPIO).

Add these back in one at a time as you get comfortable with the Rust underneath them - each is its own small lesson (async I/O, a new crate's API, error handling for a real protocol) rather than something to absorb all at once.

S
Description
Continuum platform: continuum-proxy
Readme
914 KiB
Languages
Rust 100%