Reflash blub with a current Debian (12+) image, with Tailscale #10

New issue

Open

opened 2026-10-28 10:52:53 +01:00 by pti · 0 comments

pti commented

2026-10-28 10:52:53 +01:00

Owner

Why

Blub runs the BeagleBoard.org Debian image of 2018-10-07: Debian 10 "buster" (10.13), kernel 4.14.108-ti-r144, OpenSSH 7.9.

No security updates: Debian 10 long-term support ended in mid-2024, so nothing on the board has received security fixes since then.
Post-quantum warning: OpenSSH 7.9 has no post-quantum key exchange, so every ssh/scp from a current client warns. deploy.sh alone triggers it 4 times. It is silenced client-side for now with WarnWeakCrypto no. Debian 12 (OpenSSH 9.2, sntrup761) or 13 (OpenSSH 10, mlkem768) fixes it properly.
Disk nearly full: the 3.5 GB eMMC is 94% full (229 MB free). The image carries unused software, e.g. /opt/cloud9 209 MB, /opt/node-red 169 MB, /opt/source 56 MB, /opt/cloud9_support 33 MB. The database is 107 MB and growing, because retention cleanup is not wired up.

Plan

Reflash with a current BeagleBoard.org Debian 12 (or 13) image for the BeagleBone Black, preferably a minimal/IoT image without desktop or IDE extras. An in-place upgrade across two Debian releases on this board is slow and fragile.

Tailscale

Install Tailscale on the new image, from Tailscale's own apt repository for Debian (not a hand-installed binary), so apt upgrade keeps it patched.

Remote access: blub becomes reachable from anywhere on the tailnet (e.g. the web UI and deploys from Geel), without opening ports.
Smaller attack surface: once ssh blub over the tailnet works, restrict OpenSSH to the tailnet (and/or use Tailscale SSH). The web UI on :8000 can then be limited to the tailnet as well. Keep a LAN fallback until it's proven.
Name: give it the same name blub, so deploy.sh (ssh debian@blub) keeps working. The MQTT broker at 192.168.1.2 stays on the LAN.
Not before the reflash: the current 2018 image has 229 MB free, kernel 4.14 and no security updates. A static binary install there would be hard to keep current.

What blub needs (current setup)

Thermostat: the static binary ~/thermostat-arm and ~/configs/config.yaml, both installed by ./deploy.sh.
Data: ~/data/thermostat.db, history since 2019. It includes January–February 2026 winter data that is useful for #8. Back it up first, stopping the service so the WAL is checkpointed.
Service: supervisor program thermostat (/etc/supervisor/conf.d/). The sudo rule lets debian run /usr/bin/supervisorctl (used by deploy.sh). Settings:
```
[program:thermostat]
user=debian
directory=/home/debian
command=/home/debian/thermostat-arm
autorestart=true
redirect_stderr=true
stdout_logfile_maxbytes=10000000
```
Consider a systemd unit instead. CLAUDE.md lists "systemd service and deployment scripts" as still to do. deploy.sh would then call systemctl.
1-Wire: U-Boot overlay uboot_overlay_addr0=/lib/firmware/BB-W1-P9.12-00A0.dtbo in /boot/uEnv.txt, modules w1_gpio and w1_therm. DS1820 28-051680f7b2ff (Badkamer) is on P9_12. Check that the new image's kernel ships the same overlay.
Relay: GPIO 50 (P9_14), via sysfs /sys/class/gpio. Newer kernels deprecate the sysfs GPIO interface. Check it is still enabled in the image's kernel, otherwise the relay adapter needs the GPIO character device (/dev/gpiochipN).
Port 80 redirect: Apache only redirects port 80 to the thermostat:
```
<VirtualHost *:80>
    Redirect "/" "http://blub.snamellit.com:8000/"
</VirtualHost>
```
A full Apache is heavy for this. Alternatives are a tiny redirect elsewhere, or the thermostat listening on port 80 itself (needs CAP_NET_BIND_SERVICE, easy with a systemd unit).
Network: hostname blub / blub.snamellit.com, user debian, SSH key login. MQTT broker at 192.168.1.2 (credentials come from .envrc.local via deploy.sh).

Steps

Stop the thermostat and copy ~/data/thermostat.db (and ~/configs/config.yaml) off the board
Flash the new image to the eMMC; set the hostname, the debian user and the SSH key
Enable the 1-Wire overlay on P9_12; check /sys/bus/w1/devices/28-051680f7b2ff
Check GPIO 50 via sysfs (or plan the chardev adapter)
Service: supervisor as before, or a systemd unit (update deploy.sh to match)
Port 80 redirect
Restore thermostat.db, run ./deploy.sh, check readings, relay and the web UI
ssh -V on the board shows OpenSSH ≥ 9.2; remove WarnWeakCrypto no from the client's ssh config
Install Tailscale from its apt repository, tailscale up, name the machine blub; check ssh debian@blub and the web UI over the tailnet
Then restrict SSH (and optionally :8000) to the tailnet, keeping a LAN fallback until it's proven

Note

CLAUDE.md still lists the heating relay as GPIO 60 (P9_12) and the DS1820 on P9_42. Blub's actual wiring is relay GPIO 50 (P9_14) and 1-Wire on P9_12. Correct CLAUDE.md/README when doing this.

## Why Blub runs the **BeagleBoard.org Debian image of 2018-10-07**: Debian 10 "buster" (10.13), kernel 4.14.108-ti-r144, OpenSSH 7.9. - **No security updates:** Debian 10 long-term support ended in mid-2024, so nothing on the board has received security fixes since then. - **Post-quantum warning:** OpenSSH 7.9 has no post-quantum key exchange, so every `ssh`/`scp` from a current client warns. `deploy.sh` alone triggers it 4 times. It is silenced client-side for now with `WarnWeakCrypto no`. Debian 12 (OpenSSH 9.2, `sntrup761`) or 13 (OpenSSH 10, `mlkem768`) fixes it properly. - **Disk nearly full:** the 3.5 GB eMMC is 94% full (229 MB free). The image carries unused software, e.g. `/opt/cloud9` 209 MB, `/opt/node-red` 169 MB, `/opt/source` 56 MB, `/opt/cloud9_support` 33 MB. The database is 107 MB and growing, because retention cleanup is not wired up. ## Plan Reflash with a current BeagleBoard.org Debian 12 (or 13) image for the BeagleBone Black, preferably a minimal/IoT image without desktop or IDE extras. An in-place upgrade across two Debian releases on this board is slow and fragile. ## Tailscale Install Tailscale on the new image, from Tailscale's own apt repository for Debian (not a hand-installed binary), so `apt upgrade` keeps it patched. - **Remote access:** blub becomes reachable from anywhere on the tailnet (e.g. the web UI and deploys from Geel), without opening ports. - **Smaller attack surface:** once `ssh blub` over the tailnet works, restrict OpenSSH to the tailnet (and/or use Tailscale SSH). The web UI on :8000 can then be limited to the tailnet as well. Keep a LAN fallback until it's proven. - **Name:** give it the same name `blub`, so `deploy.sh` (`ssh debian@blub`) keeps working. The MQTT broker at 192.168.1.2 stays on the LAN. - **Not before the reflash:** the current 2018 image has 229 MB free, kernel 4.14 and no security updates. A static binary install there would be hard to keep current. ## What blub needs (current setup) - **Thermostat:** the static binary `~/thermostat-arm` and `~/configs/config.yaml`, both installed by `./deploy.sh`. - **Data:** `~/data/thermostat.db`, history since 2019. It includes January–February 2026 winter data that is useful for #8. **Back it up first**, stopping the service so the WAL is checkpointed. - **Service:** supervisor program `thermostat` (`/etc/supervisor/conf.d/`). The sudo rule lets `debian` run `/usr/bin/supervisorctl` (used by `deploy.sh`). Settings: ```ini [program:thermostat] user=debian directory=/home/debian command=/home/debian/thermostat-arm autorestart=true redirect_stderr=true stdout_logfile_maxbytes=10000000 ``` Consider a systemd unit instead. CLAUDE.md lists "systemd service and deployment scripts" as still to do. `deploy.sh` would then call `systemctl`. - **1-Wire:** U-Boot overlay `uboot_overlay_addr0=/lib/firmware/BB-W1-P9.12-00A0.dtbo` in `/boot/uEnv.txt`, modules `w1_gpio` and `w1_therm`. DS1820 `28-051680f7b2ff` (Badkamer) is on **P9_12**. Check that the new image's kernel ships the same overlay. - **Relay:** GPIO 50 (**P9_14**), via sysfs `/sys/class/gpio`. Newer kernels deprecate the sysfs GPIO interface. Check it is still enabled in the image's kernel, otherwise the relay adapter needs the GPIO character device (`/dev/gpiochipN`). - **Port 80 redirect:** Apache only redirects port 80 to the thermostat: ```apache <VirtualHost *:80> Redirect "/" "http://blub.snamellit.com:8000/" </VirtualHost> ``` A full Apache is heavy for this. Alternatives are a tiny redirect elsewhere, or the thermostat listening on port 80 itself (needs `CAP_NET_BIND_SERVICE`, easy with a systemd unit). - **Network:** hostname `blub` / `blub.snamellit.com`, user `debian`, SSH key login. MQTT broker at 192.168.1.2 (credentials come from `.envrc.local` via `deploy.sh`). ## Steps - [ ] Stop the thermostat and copy `~/data/thermostat.db` (and `~/configs/config.yaml`) off the board - [ ] Flash the new image to the eMMC; set the hostname, the `debian` user and the SSH key - [ ] Enable the 1-Wire overlay on P9_12; check `/sys/bus/w1/devices/28-051680f7b2ff` - [ ] Check GPIO 50 via sysfs (or plan the chardev adapter) - [ ] Service: supervisor as before, or a systemd unit (update `deploy.sh` to match) - [ ] Port 80 redirect - [ ] Restore `thermostat.db`, run `./deploy.sh`, check readings, relay and the web UI - [ ] `ssh -V` on the board shows OpenSSH ≥ 9.2; remove `WarnWeakCrypto no` from the client's ssh config - [ ] Install Tailscale from its apt repository, `tailscale up`, name the machine `blub`; check `ssh debian@blub` and the web UI over the tailnet - [ ] Then restrict SSH (and optionally :8000) to the tailnet, keeping a LAN fallback until it's proven ## Note CLAUDE.md still lists the heating relay as GPIO 60 (P9_12) and the DS1820 on P9_42. Blub's actual wiring is relay GPIO 50 (P9_14) and 1-Wire on P9_12. Correct CLAUDE.md/README when doing this.

pti changed title from ~~Reflash blub with a current Debian (12+) image~~ to Reflash blub with a current Debian (12+) image, with Tailscale

2026-10-28 13:35:31 +01:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

pti/blubgo#10

No description provided.

Rows
Columns