From f20e64eb96fa4d4fde92db668a050bd1c6fe9a61 Mon Sep 17 00:00:00 2001 From: Peter Woxblom Date: Thu, 13 Aug 2026 23:45:43 +0200 Subject: [PATCH 1/2] confd/board: nanopi-r2s: add gencert keystore entry to factory config Since the HTTPS certificate moved into the ietf-keystore, the Web UI (nginx) is broken on fresh installs: no factory config ships the "gencert" entry, so confd never generates the self-signed certificate, /etc/ssl/certs/self-signed.crt is missing and nginx refuses to start. Add the entry (empty keys, generated on first boot) and reference it from infix-services:web.certificate. Co-authored-by: Jarvis (Hermes Agent) --- .../friendlyarm,nanopi-r2s/etc/factory-config.cfg | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg b/board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg index 1a435d344..b984bdf69 100644 --- a/board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg +++ b/board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg @@ -114,6 +114,14 @@ "ietf-keystore:keystore": { "asymmetric-keys": { "asymmetric-key": [ + { + "name": "gencert", + "public-key-format": "infix-crypto-types:x509-public-key-format", + "public-key": "", + "private-key-format": "infix-crypto-types:rsa-private-key-format", + "cleartext-private-key": "", + "certificates": {} + }, { "name": "genkey", "public-key-format": "infix-crypto-types:ssh-public-key-format", @@ -367,6 +375,7 @@ }, "infix-services:web": { "enabled": true, + "certificate": "gencert", "console": { "enabled": true }, From 26f24edcbc2efc0614dd9d19356b4b9aca8f979e Mon Sep 17 00:00:00 2001 From: Tobias Waldekranz Date: Fri, 14 Aug 2026 14:22:57 +0000 Subject: [PATCH 2/2] board: factory-config.cfg: Add placeholder for generated HTTPS cert --- .../product/acer,connect-vero-w/etc/factory-config.cfg | 9 +++++++++ .../share/product/bananapi,bpi-r3/etc/factory-config.cfg | 9 +++++++++ .../product/bananapi,bpi-r3mini/etc/factory-config.cfg | 9 +++++++++ .../product/bananapi,bpi-r4-2g5/etc/factory-config.cfg | 9 +++++++++ .../share/product/bananapi,bpi-r4/etc/factory-config.cfg | 9 +++++++++ .../product/bananapi,bpi-r64/etc/factory-config.cfg | 9 +++++++++ .../product/raspberrypi,4-model-b/etc/factory-config.cfg | 9 +++++++++ .../share/product/raspberrypi,400/etc/factory-config.cfg | 9 +++++++++ .../product/raspberrypi,2-model-b/etc/factory-config.cfg | 9 +++++++++ 9 files changed, 81 insertions(+) diff --git a/board/aarch64/acer-connect-vero-w6m/rootfs/usr/share/product/acer,connect-vero-w/etc/factory-config.cfg b/board/aarch64/acer-connect-vero-w6m/rootfs/usr/share/product/acer,connect-vero-w/etc/factory-config.cfg index f61ee1ac8..24d75bb9f 100644 --- a/board/aarch64/acer-connect-vero-w6m/rootfs/usr/share/product/acer,connect-vero-w/etc/factory-config.cfg +++ b/board/aarch64/acer-connect-vero-w6m/rootfs/usr/share/product/acer,connect-vero-w/etc/factory-config.cfg @@ -213,6 +213,14 @@ "ietf-keystore:keystore": { "asymmetric-keys": { "asymmetric-key": [ + { + "name": "gencert", + "public-key-format": "infix-crypto-types:x509-public-key-format", + "public-key": "", + "private-key-format": "infix-crypto-types:rsa-private-key-format", + "cleartext-private-key": "", + "certificates": {} + }, { "name": "genkey", "public-key-format": "infix-crypto-types:ssh-public-key-format", @@ -475,6 +483,7 @@ }, "infix-services:web": { "enabled": true, + "certificate": "gencert", "console": { "enabled": true }, diff --git a/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg b/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg index 859333aab..370c27c23 100644 --- a/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg +++ b/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg @@ -205,6 +205,14 @@ "ietf-keystore:keystore": { "asymmetric-keys": { "asymmetric-key": [ + { + "name": "gencert", + "public-key-format": "infix-crypto-types:x509-public-key-format", + "public-key": "", + "private-key-format": "infix-crypto-types:rsa-private-key-format", + "cleartext-private-key": "", + "certificates": {} + }, { "name": "genkey", "public-key-format": "infix-crypto-types:ssh-public-key-format", @@ -467,6 +475,7 @@ }, "infix-services:web": { "enabled": true, + "certificate": "gencert", "console": { "enabled": true }, diff --git a/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3mini/etc/factory-config.cfg b/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3mini/etc/factory-config.cfg index 269e927c1..08dd3bcd1 100644 --- a/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3mini/etc/factory-config.cfg +++ b/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3mini/etc/factory-config.cfg @@ -171,6 +171,14 @@ "ietf-keystore:keystore": { "asymmetric-keys": { "asymmetric-key": [ + { + "name": "gencert", + "public-key-format": "infix-crypto-types:x509-public-key-format", + "public-key": "", + "private-key-format": "infix-crypto-types:rsa-private-key-format", + "cleartext-private-key": "", + "certificates": {} + }, { "name": "genkey", "public-key-format": "infix-crypto-types:ssh-public-key-format", @@ -433,6 +441,7 @@ }, "infix-services:web": { "enabled": true, + "certificate": "gencert", "console": { "enabled": true }, diff --git a/board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4-2g5/etc/factory-config.cfg b/board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4-2g5/etc/factory-config.cfg index 5571d3200..05b176573 100644 --- a/board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4-2g5/etc/factory-config.cfg +++ b/board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4-2g5/etc/factory-config.cfg @@ -138,6 +138,14 @@ "ietf-keystore:keystore": { "asymmetric-keys": { "asymmetric-key": [ + { + "name": "gencert", + "public-key-format": "infix-crypto-types:x509-public-key-format", + "public-key": "", + "private-key-format": "infix-crypto-types:rsa-private-key-format", + "cleartext-private-key": "", + "certificates": {} + }, { "name": "genkey", "public-key-format": "infix-crypto-types:ssh-public-key-format", @@ -391,6 +399,7 @@ }, "infix-services:web": { "enabled": true, + "certificate": "gencert", "console": { "enabled": true }, diff --git a/board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4/etc/factory-config.cfg b/board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4/etc/factory-config.cfg index 13a22c9ba..6f6d9fe4d 100644 --- a/board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4/etc/factory-config.cfg +++ b/board/aarch64/bananapi-bpi-r4/rootfs/usr/share/product/bananapi,bpi-r4/etc/factory-config.cfg @@ -130,6 +130,14 @@ "ietf-keystore:keystore": { "asymmetric-keys": { "asymmetric-key": [ + { + "name": "gencert", + "public-key-format": "infix-crypto-types:x509-public-key-format", + "public-key": "", + "private-key-format": "infix-crypto-types:rsa-private-key-format", + "cleartext-private-key": "", + "certificates": {} + }, { "name": "genkey", "public-key-format": "infix-crypto-types:ssh-public-key-format", @@ -383,6 +391,7 @@ }, "infix-services:web": { "enabled": true, + "certificate": "gencert", "console": { "enabled": true }, diff --git a/board/aarch64/bananapi-bpi-r64/rootfs/usr/share/product/bananapi,bpi-r64/etc/factory-config.cfg b/board/aarch64/bananapi-bpi-r64/rootfs/usr/share/product/bananapi,bpi-r64/etc/factory-config.cfg index 6f4c19399..95c23b9a5 100644 --- a/board/aarch64/bananapi-bpi-r64/rootfs/usr/share/product/bananapi,bpi-r64/etc/factory-config.cfg +++ b/board/aarch64/bananapi-bpi-r64/rootfs/usr/share/product/bananapi,bpi-r64/etc/factory-config.cfg @@ -163,6 +163,14 @@ "ietf-keystore:keystore": { "asymmetric-keys": { "asymmetric-key": [ + { + "name": "gencert", + "public-key-format": "infix-crypto-types:x509-public-key-format", + "public-key": "", + "private-key-format": "infix-crypto-types:rsa-private-key-format", + "cleartext-private-key": "", + "certificates": {} + }, { "name": "genkey", "public-key-format": "infix-crypto-types:ssh-public-key-format", @@ -425,6 +433,7 @@ }, "infix-services:web": { "enabled": true, + "certificate": "gencert", "console": { "enabled": true }, diff --git a/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg b/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg index 365ae1110..8ee44c5ee 100644 --- a/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg +++ b/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg @@ -91,6 +91,14 @@ "ietf-keystore:keystore": { "asymmetric-keys": { "asymmetric-key": [ + { + "name": "gencert", + "public-key-format": "infix-crypto-types:x509-public-key-format", + "public-key": "", + "private-key-format": "infix-crypto-types:rsa-private-key-format", + "cleartext-private-key": "", + "certificates": {} + }, { "name": "genkey", "public-key-format": "infix-crypto-types:ssh-public-key-format", @@ -268,6 +276,7 @@ }, "infix-services:web": { "enabled": true, + "certificate": "gencert", "console": { "enabled": true }, diff --git a/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,400/etc/factory-config.cfg b/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,400/etc/factory-config.cfg index 886486f3b..cc5b13e43 100644 --- a/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,400/etc/factory-config.cfg +++ b/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,400/etc/factory-config.cfg @@ -105,6 +105,14 @@ "ietf-keystore:keystore": { "asymmetric-keys": { "asymmetric-key": [ + { + "name": "gencert", + "public-key-format": "infix-crypto-types:x509-public-key-format", + "public-key": "", + "private-key-format": "infix-crypto-types:rsa-private-key-format", + "cleartext-private-key": "", + "certificates": {} + }, { "name": "genkey", "public-key-format": "infix-crypto-types:ssh-public-key-format", @@ -282,6 +290,7 @@ }, "infix-services:web": { "enabled": true, + "certificate": "gencert", "console": { "enabled": true }, diff --git a/board/arm/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg b/board/arm/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg index e13897acf..04d3da85c 100644 --- a/board/arm/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg +++ b/board/arm/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg @@ -76,6 +76,14 @@ "ietf-keystore:keystore": { "asymmetric-keys": { "asymmetric-key": [ + { + "name": "gencert", + "public-key-format": "infix-crypto-types:x509-public-key-format", + "public-key": "", + "private-key-format": "infix-crypto-types:rsa-private-key-format", + "cleartext-private-key": "", + "certificates": {} + }, { "name": "genkey", "public-key-format": "infix-crypto-types:ssh-public-key-format", @@ -253,6 +261,7 @@ }, "infix-services:web": { "enabled": true, + "certificate": "gencert", "console": { "enabled": true },