octoturge
b4948076a0
Windows discovery tool / windows (push) Successful in 1m24s
The proxy put its configured gateway_token straight into the upgrade's Authorization header, but the backend only accepts a one-hour edge JWT (scope "edge") there, minted by POST /auth/edge-token from the farm's edge proxy token. Nothing in the proxy ever made that call, so a gateway configured with the token the console hands out could not connect at all, and one given a hand-minted JWT (which is what every test did) would have been locked out an hour later on its first reconnect. Each connection attempt now starts by trading gateway_token for a fresh JWT, at an address derived from the socket URL so there is one to configure. A 401 is reported as what it means (token rotated or wrong), since retrying will not fix it. Config's Debug no longer prints the token. tests/uplink_late_result.rs now plays the cloud's exchange endpoint and asserts the socket opens with the minted JWT, not the configured token. .env.example and continuum.example.toml say what the token is.
80 lines
3.5 KiB
TOML
80 lines
3.5 KiB
TOML
# The proxy's OWN settings - not the printers (that is printers.toml, which
|
|
# holds per-site secrets and is never shipped on a pendrive). See
|
|
# src/config.rs for how this file layers with CONTINUUM_* environment
|
|
# variables: this file is the base, an env var overrides the same key.
|
|
#
|
|
# PC / server: copy to continuum.toml next to the proxy and edit it. Nothing
|
|
# else is needed; removable media is never read.
|
|
# Proxy Box: this file is NOT written by hand. Continuum Cloud's
|
|
# configurator produces continuum-config.zip: config.toml,
|
|
# config.toml.sha256 and config.toml.sig (an Ed25519 signature
|
|
# naming this box and a config_version), every entry
|
|
# AES-256-encrypted under the box's own key. A Box refuses
|
|
# plaintext, unsigned, other-box and older-version bundles.
|
|
# See the module docs of src/config_import.rs for the exact
|
|
# format the cloud must produce.
|
|
#
|
|
# Unknown keys are rejected on purpose, so a typo cannot silently fall back to
|
|
# a default. On a Proxy Box the file must be complete by itself.
|
|
|
|
gateway_id = "REPLACE_ME"
|
|
farm_id = "REPLACE_ME"
|
|
# The farm's edge proxy token from the console (Setup page). Traded for a
|
|
# short-lived edge JWT on every connection - see src/uplink/auth.rs.
|
|
gateway_token = "REPLACE_ME"
|
|
|
|
# uplink_url = "wss://api.continuum.local/ws/edge/v1"
|
|
# go2rtc_bin = "go2rtc"
|
|
# go2rtc_config = "./go2rtc.yaml"
|
|
# go2rtc_api_listen = ":1984"
|
|
# stream_base_url = "https://proxy.example/"
|
|
# printers_path = "/var/lib/continuum/printers.toml" # absolute on a box
|
|
|
|
# Proxy Box only. PARSED AND VALIDATED, NOT APPLIED - this build never
|
|
# touches the OS network configuration.
|
|
# [network]
|
|
# mode = "static" # or "dhcp"
|
|
# ip = "192.168.1.60"
|
|
# prefix_len = 24
|
|
# gateway = "192.168.1.1"
|
|
# dns = ["1.1.1.1"]
|
|
# [network.wifi]
|
|
# ssid = "farm"
|
|
# psk = "REPLACE_ME"
|
|
|
|
# Printer discovery: look for printers nobody has configured and report them
|
|
# to the cloud, so adding one in the web console does not start with walking
|
|
# to a machine to read its IP address off the screen.
|
|
#
|
|
# OFF by default, and the whole block is commented out here for that reason.
|
|
# A sweep is unsolicited traffic on someone else's network - 254 TLS
|
|
# handshakes and up to three HTTP requests per host, which nothing watching
|
|
# can distinguish from a port scan. Switch it on only for a network you are
|
|
# responsible for.
|
|
#
|
|
# Discovery never supplies a credential, because nothing can: a Bambu access
|
|
# code is displayed on the printer and a PrusaLink API key is in its web UI.
|
|
# It supplies the address, the serial and the vendor - the parts you would
|
|
# otherwise have to look up.
|
|
#
|
|
# `subnets` is explicit and never derived from this host's interfaces, so a
|
|
# second NIC, a VPN or a container bridge cannot widen what gets swept.
|
|
# Anything wider than a /24 is refused.
|
|
#
|
|
# `serial` reads USB descriptors from sysfs and opens nothing. It will never
|
|
# send an `M115` handshake: opening a serial port toggles DTR, which reboots
|
|
# an Arduino-based board, and on a printer mid-job that ruins the print. Use
|
|
# `cargo run --example discover_printers -- serial-probe <port>` when you want
|
|
# the handshake and are standing in front of the machine.
|
|
#
|
|
# `ssdp` listens passively for Bambu announcements. It sends nothing, but
|
|
# multicast does not cross a router, so on a real farm network a sweep is
|
|
# what actually works.
|
|
#
|
|
# [discovery]
|
|
# enabled = true
|
|
# subnets = ["192.168.0.0/24"]
|
|
# ssdp = false
|
|
# serial = false
|
|
# interval_minutes = 30
|