Go to file
John Crispin b499eceebe cloud_discovery: add CAA DNS-based EST server discovery
Implement EST server discovery via CAA DNS records for air-gapped
deployments. When DHCP Option 224 provides a controller FQDN, query
CAA records to determine the appropriate EST server endpoint.

The discovery flow:
1. Read controller FQDN from /tmp/cloud.json (set by DHCP handler)
2. Query CAA records for the controller domain
3. Use EST server from CAA 'issue' tag if present
4. Fall back to certificate issuer-based selection if CAA lookup fails

This allows network administrators to configure local EST servers via
DNS rather than relying on hardcoded public endpoints. Air-gapped
deployments can now specify private EST servers through standard DNS
infrastructure.

Example DNS configuration:
  controller.local. IN CAA 0 issue "est.local:8001"

When an AP receives controller.local via DHCP Option 224, it will
query CAA records and use est.local:8001 for certificate enrollment
instead of the public est.certificates.open-lan.org endpoint.

Signed-off-by: John Crispin <john@phrozen.org>
2025-12-04 12:31:17 +01:00
.github .github/workflows/build-dev.yml: add cig_wf660a 2025-06-26 11:38:08 +02:00
docker
feeds cloud_discovery: add CAA DNS-based EST server discovery 2025-12-04 12:31:17 +01:00
patches mediatek: Add emplus,wap588m to support kernel 6.6 at staging-upstream-mediatek 2025-11-03 09:48:00 +01:00
patches-24.10 patches: update MT7981 WiFi firmware to optimize scanning time (0062) 2025-11-24 06:28:34 +01:00
profiles qca-wifi-7: Add Zyxel NWA210BE model 2025-12-04 12:30:45 +01:00
.gitignore
build.sh
config.yml
dock-run.sh
LICENSE
Makefile
README.md
setup.py update setup.py: make the profiles symlink relative instead of absolute 2025-10-01 07:44:35 +02:00

OpenWiFi AP NOS

OpenWrt-based access point network operating system (AP NOS) for TIP OpenWiFi. Read more at openwifi.tip.build.

Building

Setting up your build machine

Building requires a recent Linux installation. Older systems without Python 3.7 will have trouble. See this guide for details: https://openwrt.org/docs/guide-developer/toolchain/beginners-build-guide

Install build packages on Debian/Ubuntu (or see above guide for other systems):

sudo apt install build-essential libncurses5-dev gawk git libssl-dev gettext zlib1g-dev swig unzip time rsync python3 python3-setuptools python3-yaml

Doing a native build on Linux

Use ./build.sh <target>, or follow the manual steps below:

  1. Clone and set up the tree. This will create an openwrt/ directory.
./setup.py --setup    # for subsequent builds, use --rebase instead
  1. Select the profile and base package selection. This setup will install the feeds and packages and generate the .config file.
cd openwrt
./scripts/gen_config.py linksys_ea8300
  1. Build the tree (replace -j 8 with the number of cores to use).
make -j 8 V=s

Build output

The build results are located in the openwrt/bin/ directory:

Type Path
Firmware images openwrt/bin/targets/<target>/<subtarget>/
Kernel modules openwrt/bin/targets/<target>/<subtarget>/packages/
Package binaries openwrt/bin/packages/<platform>/<feed>/

Developer Notes

Branching model

  • main - Stable dev branch
  • next - Integration branch
  • staging-* - Feature/bug branches
  • release/v#.#.# - Release branches (major.minor.patch)

Repository structure

Build files:

  • Makefile - Calls Docker environment per target
  • dock-run.sh - Dockerized build environment
  • docker/Dockerfile - Dockerfile for build image
  • build.sh - Build script
  • setup.py - Clone and set up the tree
  • config.yml - Specifies OpenWrt version and patches to apply

Directories:

  • feeds/ - OpenWiFi feeds
  • patches/ - OpenWiFi patches applied during builds
  • profiles/ - Per-target kernel configs, packages, and feeds

uCentral packages

AP-NOS packages implementing the uCentral protocol include the following repositories (refer to the ucentral feed for a full list):