\n```\n\n**Common issues:**\n1. **Port conflicts:** Another service using 8042\n - Solution: Change `WEB_PORT` in `.env`\n2. **Permission errors:** Cannot write to volumes\n - Solution: `chmod` the directories or check Docker volume permissions\n\n### Reset Everything\n\n**Complete reset (deletes all data):**\n```bash\ndocker-compose down -v\nrm -rf data/\ndocker-compose up -d\n```\n\n## Security Considerations\n\n### Production Deployment\n\n1. **Set a strong admin password** via Settings → Admin Password after first login\n2. **Restrict network access:**\n - Use firewall rules to limit who can access port 8042\n - Consider reverse proxy with SSL (nginx, Caddy, Traefik)\n3. **Enable HTTPS** with reverse proxy:\n ```nginx\n server {\n listen 443 ssl;\n server_name network-optimizer.example.com;\n\n ssl_certificate /path/to/cert.pem;\n ssl_certificate_key /path/to/key.pem;\n\n location / {\n proxy_pass http://localhost:8042;\n proxy_http_version 1.1;\n proxy_set_header Upgrade $http_upgrade;\n proxy_set_header Connection \"upgrade\";\n }\n }\n ```\n4. **Backup regularly:** Back up the `./data` directory which contains the SQLite database and credentials.\n\n## Upgrading\n\n### Standard Updates\n\n```bash\ndocker compose down\ndocker compose pull\ndocker compose up -d\n```\n\nData persists in the `./data` volume.\n\n### Migrating from Build-from-Source\n\nIf you've been building locally with `docker compose build` and want to switch to pre-built images, see the [Migration Guide](DEPLOYMENT.md#migrating-from-build-from-source-to-pre-built-images). A simple `docker compose pull` won't work because your locally-built image already has the registry tag.\n\n### Before Major Updates\n\n```bash\n# Backup data first\ntar czf backup-$(date +%Y%m%d).tar.gz data/\n```\n\n## Support\n\nFor issues, feature requests, or questions:\n- GitHub: https://github.com/Ozark-Connect/NetworkOptimizer\n- Documentation: See `docs/` folder in repository\n\n## License\n\nBusiness Source License 1.1. See [LICENSE](../LICENSE) in the repository root.\n\n© 2026 Ozark Connect\n"
},
{
"path": "docker/docker-compose.local.yml",
"content": "# Local Development Configuration\n#\n# Usage:\n# cd docker\n# docker compose -f docker-compose.local.yml build\n# docker compose -f docker-compose.local.yml up -d\n#\n# Access at: http://localhost:8042\n#\n# Note: Uses bridge networking with port mapping.\n# Set HOST_IP in .env to your machine's IP for accurate path analysis.\n\nservices:\n network-optimizer:\n build:\n context: ..\n dockerfile: docker/Dockerfile\n image: ozark-connect/network-optimizer:latest\n container_name: network-optimizer\n restart: unless-stopped\n ports:\n - \"${WEB_PORT:-8042}:8042\" # Blazor web UI\n volumes:\n - ./data:/app/data # SQLite, configs, license\n - ./ssh-keys:/app/ssh-keys # Optional: SSH keys for agent deployment\n - ./logs:/app/logs # Application logs\n environment:\n - TZ=${TZ:-UTC}\n - APP_PASSWORD=${APP_PASSWORD:-}\n - DEMO_MODE_MAPPINGS=${DEMO_MODE_MAPPINGS:-}\n # Host IP/name for path analysis and CORS (required for client speed tests)\n - HOST_IP=${HOST_IP:-}\n - HOST_NAME=${HOST_NAME:-}\n # Reverse proxy hostname (e.g., optimizer.example.com) - overrides HOST_NAME for API URLs\n - REVERSE_PROXIED_HOST_NAME=${REVERSE_PROXIED_HOST_NAME:-}\n # OpenSpeedTest configuration (for UI display and CORS)\n - OPENSPEEDTEST_PORT=${OPENSPEEDTEST_PORT:-3005}\n - OPENSPEEDTEST_HOST=${OPENSPEEDTEST_HOST:-}\n - OPENSPEEDTEST_HTTPS=${OPENSPEEDTEST_HTTPS:-false}\n - OPENSPEEDTEST_HTTPS_PORT=${OPENSPEEDTEST_HTTPS_PORT:-443}\n # iperf3 server mode - enable to accept client-initiated speed tests on port 5201\n - Iperf3Server__Enabled=${IPERF3_SERVER_ENABLED:-false}\n # Logging (Trace, Debug, Information, Warning, Error, Critical)\n - Logging__LogLevel__Default=${LOG_LEVEL:-Information}\n - Logging__LogLevel__NetworkOptimizer=${APP_LOG_LEVEL:-Information}\n healthcheck:\n test: [\"CMD\", \"curl\", \"-f\", \"http://localhost:8042/api/health\"]\n interval: 30s\n timeout: 10s\n retries: 3\n start_period: 40s\n\n # Network Optimizer Speed Test - customized OpenSpeedTest that sends results to Network Optimizer\n # Requires HOST_IP or HOST_NAME to be set in .env for result reporting\n network-optimizer-speedtest:\n build:\n context: ..\n dockerfile: docker/openspeedtest/Dockerfile\n image: ozark-connect/speedtest:latest\n container_name: network-optimizer-speedtest\n restart: unless-stopped\n ports:\n - \"${OPENSPEEDTEST_PORT:-3005}:3000\"\n environment:\n - TZ=${TZ:-UTC}\n # For URL construction and host enforcement redirect\n - HOST_NAME=${HOST_NAME:-}\n - HOST_IP=${HOST_IP:-}\n - OPENSPEEDTEST_PORT=${OPENSPEEDTEST_PORT:-3005}\n - OPENSPEEDTEST_HOST=${OPENSPEEDTEST_HOST:-}\n - OPENSPEEDTEST_HTTPS=${OPENSPEEDTEST_HTTPS:-false}\n - OPENSPEEDTEST_HTTPS_PORT=${OPENSPEEDTEST_HTTPS_PORT:-443}\n # For result reporting URL\n - REVERSE_PROXIED_HOST_NAME=${REVERSE_PROXIED_HOST_NAME:-}\n logging:\n driver: \"json-file\"\n options:\n max-size: \"10m\"\n max-file: \"3\"\n\n # InfluxDB and Grafana available if needed for future monitoring features\n # Uncomment below when time-series metrics are implemented\n\n # influxdb:\n # image: influxdb:2.8\n # container_name: network-optimizer-influxdb\n # restart: unless-stopped\n # ports:\n # - \"${INFLUXDB_PORT:-8086}:8086\"\n # volumes:\n # - influxdb-data:/var/lib/influxdb2\n # - influxdb-config:/etc/influxdb2\n # environment:\n # - DOCKER_INFLUXDB_INIT_MODE=setup\n # - DOCKER_INFLUXDB_INIT_USERNAME=${INFLUXDB_USERNAME:-admin}\n # - DOCKER_INFLUXDB_INIT_PASSWORD=${INFLUXDB_PASSWORD}\n # - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=${INFLUXDB_TOKEN}\n # - DOCKER_INFLUXDB_INIT_ORG=${INFLUXDB_ORG:-network-optimizer}\n # - DOCKER_INFLUXDB_INIT_BUCKET=${INFLUXDB_BUCKET:-network_optimizer}\n # - DOCKER_INFLUXDB_INIT_RETENTION=${INFLUXDB_RETENTION:-30d}\n # - TZ=${TZ:-UTC}\n # networks:\n # - network-optimizer\n # healthcheck:\n # test: [\"CMD\", \"influx\", \"ping\"]\n # interval: 30s\n # timeout: 10s\n # retries: 5\n # start_period: 60s\n\n # grafana:\n # image: grafana/grafana:latest\n # container_name: network-optimizer-grafana\n # restart: unless-stopped\n # ports:\n # - \"${GRAFANA_PORT:-3000}:3000\"\n # volumes:\n # - grafana-data:/var/lib/grafana\n # - ./grafana/provisioning:/etc/grafana/provisioning:ro\n # - ./grafana/dashboards:/var/lib/grafana/dashboards:ro\n # environment:\n # - GF_SECURITY_ADMIN_USER=${GRAFANA_USERNAME:-admin}\n # - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}\n # - GF_USERS_ALLOW_SIGN_UP=false\n # - GF_AUTH_ANONYMOUS_ENABLED=true\n # - GF_AUTH_ANONYMOUS_ORG_ROLE=Viewer\n # - GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH=/var/lib/grafana/dashboards/network-overview.json\n # - TZ=${TZ:-UTC}\n # networks:\n # - network-optimizer\n # depends_on:\n # influxdb:\n # condition: service_healthy\n # healthcheck:\n # test: [\"CMD-SHELL\", \"curl -f http://localhost:3000/api/health || exit 1\"]\n # interval: 30s\n # timeout: 10s\n # retries: 3\n # start_period: 60s\n\n# networks:\n# network-optimizer:\n# driver: bridge\n\n# volumes:\n# influxdb-data:\n# driver: local\n# influxdb-config:\n# driver: local\n# grafana-data:\n# driver: local\n"
},
{
"path": "docker/docker-compose.macos.yml",
"content": "# macOS Development/Testing Configuration\n#\n# Usage:\n# cd docker\n# docker compose -f docker-compose.macos.yml build\n# docker compose -f docker-compose.macos.yml up -d\n#\n# Access at: http://localhost:8042\n#\n# Note: macOS doesn't support network_mode: host, so we use port mapping instead.\n\nservices:\n network-optimizer:\n build:\n context: ..\n dockerfile: docker/Dockerfile\n image: ghcr.io/ozark-connect/network-optimizer:latest\n container_name: network-optimizer\n restart: unless-stopped\n ports:\n - \"8042:8042\" # Blazor web UI\n volumes:\n - ./data:/app/data # SQLite, configs, license\n - ./ssh-keys:/app/ssh-keys # Optional: SSH keys for agent deployment\n - ./logs:/app/logs # Application logs\n environment:\n - TZ=${TZ:-America/Chicago}\n - APP_PASSWORD=${APP_PASSWORD:-}\n - DEMO_MODE_MAPPINGS=${DEMO_MODE_MAPPINGS:-}\n # Host IP/name for path analysis and CORS (required for client speed tests)\n - HOST_IP=${HOST_IP:-}\n - HOST_NAME=${HOST_NAME:-}\n # Reverse proxy hostname (e.g., optimizer.example.com) - overrides HOST_NAME for API URLs\n - REVERSE_PROXIED_HOST_NAME=${REVERSE_PROXIED_HOST_NAME:-}\n # OpenSpeedTest configuration (for UI display and CORS)\n - OPENSPEEDTEST_PORT=${OPENSPEEDTEST_PORT:-3005}\n - OPENSPEEDTEST_HOST=${OPENSPEEDTEST_HOST:-}\n - OPENSPEEDTEST_HTTPS=${OPENSPEEDTEST_HTTPS:-false}\n - OPENSPEEDTEST_HTTPS_PORT=${OPENSPEEDTEST_HTTPS_PORT:-443}\n # iperf3 server mode - enable to accept client-initiated speed tests on port 5201\n - Iperf3Server__Enabled=${IPERF3_SERVER_ENABLED:-false}\n # Logging (Trace, Debug, Information, Warning, Error, Critical)\n - Logging__LogLevel__Default=${LOG_LEVEL:-Information}\n - Logging__LogLevel__NetworkOptimizer=${APP_LOG_LEVEL:-Information}\n healthcheck:\n test: [\"CMD\", \"curl\", \"-f\", \"http://localhost:8042/api/health\"]\n interval: 30s\n timeout: 10s\n retries: 3\n start_period: 40s\n\n # Network Optimizer Speed Test - customized OpenSpeedTest that sends results to Network Optimizer\n # Requires HOST_IP or HOST_NAME to be set in .env for result reporting\n network-optimizer-speedtest:\n build:\n context: ..\n dockerfile: docker/openspeedtest/Dockerfile\n image: ghcr.io/ozark-connect/speedtest:latest\n container_name: network-optimizer-speedtest\n restart: unless-stopped\n ports:\n - \"${OPENSPEEDTEST_PORT:-3005}:3000\"\n environment:\n - TZ=${TZ:-America/Chicago}\n # For URL construction and host enforcement redirect\n - HOST_NAME=${HOST_NAME:-}\n - HOST_IP=${HOST_IP:-}\n - OPENSPEEDTEST_PORT=${OPENSPEEDTEST_PORT:-3005}\n - OPENSPEEDTEST_HOST=${OPENSPEEDTEST_HOST:-}\n - OPENSPEEDTEST_HTTPS=${OPENSPEEDTEST_HTTPS:-false}\n - OPENSPEEDTEST_HTTPS_PORT=${OPENSPEEDTEST_HTTPS_PORT:-443}\n # For result reporting URL\n - REVERSE_PROXIED_HOST_NAME=${REVERSE_PROXIED_HOST_NAME:-}\n logging:\n driver: \"json-file\"\n options:\n max-size: \"10m\"\n max-file: \"3\"\n\n # InfluxDB and Grafana available if needed for monitoring\n # Uncomment below and run: docker compose -f docker-compose.macos.yml up -d\n\n # influxdb:\n # image: influxdb:2.7\n # container_name: network-optimizer-influxdb\n # restart: unless-stopped\n # ports:\n # - \"8086:8086\"\n # volumes:\n # - influxdb-data:/var/lib/influxdb2\n # - influxdb-config:/etc/influxdb2\n # environment:\n # - DOCKER_INFLUXDB_INIT_MODE=setup\n # - DOCKER_INFLUXDB_INIT_USERNAME=${INFLUXDB_USERNAME:-admin}\n # - DOCKER_INFLUXDB_INIT_PASSWORD=${INFLUXDB_PASSWORD}\n # - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=${INFLUXDB_TOKEN}\n # - DOCKER_INFLUXDB_INIT_ORG=${INFLUXDB_ORG:-network-optimizer}\n # - DOCKER_INFLUXDB_INIT_BUCKET=${INFLUXDB_BUCKET:-network_optimizer}\n # - DOCKER_INFLUXDB_INIT_RETENTION=${INFLUXDB_RETENTION:-30d}\n # - TZ=${TZ:-UTC}\n # healthcheck:\n # test: [\"CMD\", \"influx\", \"ping\"]\n # interval: 30s\n # timeout: 10s\n # retries: 5\n # start_period: 60s\n\n # grafana:\n # image: grafana/grafana:latest\n # container_name: network-optimizer-grafana\n # restart: unless-stopped\n # ports:\n # - \"3000:3000\"\n # volumes:\n # - grafana-data:/var/lib/grafana\n # - ./grafana/provisioning:/etc/grafana/provisioning:ro\n # - ./grafana/dashboards:/var/lib/grafana/dashboards:ro\n # environment:\n # - GF_SECURITY_ADMIN_USER=${GRAFANA_USERNAME:-admin}\n # - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}\n # - GF_USERS_ALLOW_SIGN_UP=false\n # - GF_AUTH_ANONYMOUS_ENABLED=true\n # - GF_AUTH_ANONYMOUS_ORG_ROLE=Viewer\n # - TZ=${TZ:-UTC}\n # depends_on:\n # influxdb:\n # condition: service_healthy\n # healthcheck:\n # test: [\"CMD-SHELL\", \"curl -f http://localhost:3000/api/health || exit 1\"]\n # interval: 30s\n # timeout: 10s\n # retries: 3\n # start_period: 60s\n\n# volumes:\n# influxdb-data:\n# driver: local\n# influxdb-config:\n# driver: local\n# grafana-data:\n# driver: local\n"
},
{
"path": "docker/docker-compose.prod.yml",
"content": "services:\n network-optimizer:\n image: ghcr.io/ozark-connect/network-optimizer:latest\n container_name: network-optimizer\n restart: unless-stopped\n network_mode: host\n volumes:\n - ./data:/app/data # SQLite, configs, license\n - ./ssh-keys:/app/ssh-keys # Optional: SSH keys for agent deployment\n - ./logs:/app/logs # Application logs\n environment:\n - TZ=${TZ:-America/Chicago}\n # Bind to localhost only (for reverse proxy) or all interfaces (direct access)\n - BIND_LOCALHOST_ONLY=${BIND_LOCALHOST_ONLY:-false}\n - APP_PASSWORD=${APP_PASSWORD:-}\n - DEMO_MODE_MAPPINGS=${DEMO_MODE_MAPPINGS:-}\n # Host IP/name for path analysis and CORS (required for client speed tests)\n - HOST_IP=${HOST_IP:-}\n - HOST_NAME=${HOST_NAME:-}\n # Reverse proxy hostname (e.g., optimizer.example.com) - overrides HOST_NAME for API URLs\n - REVERSE_PROXIED_HOST_NAME=${REVERSE_PROXIED_HOST_NAME:-}\n # OpenSpeedTest configuration (for UI display and CORS)\n - OPENSPEEDTEST_PORT=${OPENSPEEDTEST_PORT:-3005}\n - OPENSPEEDTEST_HOST=${OPENSPEEDTEST_HOST:-}\n - OPENSPEEDTEST_HTTPS=${OPENSPEEDTEST_HTTPS:-false}\n - OPENSPEEDTEST_HTTPS_PORT=${OPENSPEEDTEST_HTTPS_PORT:-443}\n # iperf3 server mode - enable to accept client-initiated speed tests on port 5201\n - Iperf3Server__Enabled=${IPERF3_SERVER_ENABLED:-false}\n # Logging (Trace, Debug, Information, Warning, Error, Critical)\n - Logging__LogLevel__Default=${LOG_LEVEL:-Information}\n - Logging__LogLevel__NetworkOptimizer=${APP_LOG_LEVEL:-Information}\n # Point to existing InfluxDB if desired (optional)\n # - INFLUXDB_URL=http://localhost:8086\n # - INFLUXDB_TOKEN=${INFLUXDB_TOKEN}\n # - INFLUXDB_ORG=${INFLUXDB_ORG:-network-optimizer}\n # - INFLUXDB_BUCKET=${INFLUXDB_BUCKET:-network_optimizer}\n healthcheck:\n test: [\"CMD\", \"curl\", \"-f\", \"http://localhost:8042/api/health\"]\n interval: 30s\n timeout: 10s\n retries: 3\n start_period: 40s\n\n # Network Optimizer Speed Test - customized OpenSpeedTest that sends results to Network Optimizer\n # Requires HOST_IP or HOST_NAME to be set in .env for result reporting\n network-optimizer-speedtest:\n image: ghcr.io/ozark-connect/speedtest:latest\n container_name: network-optimizer-speedtest\n restart: unless-stopped\n ports:\n - \"${OPENSPEEDTEST_PORT:-3005}:3000\"\n sysctls:\n # Raise TCP autotuning ceiling so long-RTT single-stream speedtests are not rwnd-bound.\n # Container has its own netns; without this the ceiling is the 6MB kernel default,\n # which caps single-stream throughput at ~rwnd/RTT (e.g. ~225 Mbps at 100ms RTT).\n net.ipv4.tcp_rmem: \"4096 131072 33554432\"\n net.ipv4.tcp_wmem: \"4096 65536 33554432\"\n net.ipv4.tcp_mtu_probing: \"1\"\n # tcp_congestion_control is intentionally not set here — it hard-fails\n # container start on kernels without the bbr module loaded (Synology, QNAP,\n # some Proxmox/LXC setups) and compose sysctls are all-or-nothing. The\n # entrypoint reports CC state and tells the operator how to enable bbr on\n # the host if desired.\n environment:\n - TZ=${TZ:-America/Chicago}\n # For URL construction and host enforcement redirect\n - HOST_NAME=${HOST_NAME:-}\n - HOST_IP=${HOST_IP:-}\n - OPENSPEEDTEST_PORT=${OPENSPEEDTEST_PORT:-3005}\n - OPENSPEEDTEST_HOST=${OPENSPEEDTEST_HOST:-}\n - OPENSPEEDTEST_HTTPS=${OPENSPEEDTEST_HTTPS:-false}\n - OPENSPEEDTEST_HTTPS_PORT=${OPENSPEEDTEST_HTTPS_PORT:-443}\n # For result reporting URL\n - REVERSE_PROXIED_HOST_NAME=${REVERSE_PROXIED_HOST_NAME:-}\n logging:\n driver: \"json-file\"\n options:\n max-size: \"10m\"\n max-file: \"3\"\n\n# Production config - pre-built images from GHCR, host network mode\n# For local dev with build from source, use docker-compose.yml\n"
},
{
"path": "docker/docker-compose.yml",
"content": "services:\n network-optimizer:\n build:\n context: ..\n dockerfile: docker/Dockerfile\n image: ghcr.io/ozark-connect/network-optimizer:latest\n container_name: network-optimizer\n restart: unless-stopped\n network_mode: host\n volumes:\n - ./data:/app/data # SQLite, configs, license\n - ./ssh-keys:/app/ssh-keys # Optional: SSH keys for agent deployment\n - ./logs:/app/logs # Application logs\n environment:\n - TZ=${TZ:-America/Chicago}\n # Bind to localhost only (for reverse proxy) or all interfaces (direct access)\n - BIND_LOCALHOST_ONLY=${BIND_LOCALHOST_ONLY:-false}\n - APP_PASSWORD=${APP_PASSWORD:-}\n - DEMO_MODE_MAPPINGS=${DEMO_MODE_MAPPINGS:-}\n # Host IP/name for path analysis and CORS (required for client speed tests)\n - HOST_IP=${HOST_IP:-}\n - HOST_NAME=${HOST_NAME:-}\n # Reverse proxy hostname (e.g., optimizer.example.com) - overrides HOST_NAME for API URLs\n - REVERSE_PROXIED_HOST_NAME=${REVERSE_PROXIED_HOST_NAME:-}\n # OpenSpeedTest configuration (for UI display and CORS)\n - OPENSPEEDTEST_PORT=${OPENSPEEDTEST_PORT:-3005}\n - OPENSPEEDTEST_HOST=${OPENSPEEDTEST_HOST:-}\n - OPENSPEEDTEST_HTTPS=${OPENSPEEDTEST_HTTPS:-false}\n - OPENSPEEDTEST_HTTPS_PORT=${OPENSPEEDTEST_HTTPS_PORT:-443}\n # iperf3 server mode - enable to accept client-initiated speed tests on port 5201\n - Iperf3Server__Enabled=${IPERF3_SERVER_ENABLED:-false}\n # Logging (Trace, Debug, Information, Warning, Error, Critical)\n - Logging__LogLevel__Default=${LOG_LEVEL:-Information}\n - Logging__LogLevel__NetworkOptimizer=${APP_LOG_LEVEL:-Information}\n # Point to existing InfluxDB if desired (optional)\n # - INFLUXDB_URL=http://localhost:8086\n # - INFLUXDB_TOKEN=${INFLUXDB_TOKEN}\n # - INFLUXDB_ORG=${INFLUXDB_ORG:-network-optimizer}\n # - INFLUXDB_BUCKET=${INFLUXDB_BUCKET:-network_optimizer}\n healthcheck:\n test: [\"CMD\", \"curl\", \"-f\", \"http://localhost:8042/api/health\"]\n interval: 30s\n timeout: 10s\n retries: 3\n start_period: 40s\n\n # Network Optimizer Speed Test - customized OpenSpeedTest that sends results to Network Optimizer\n # Requires HOST_IP or HOST_NAME to be set in .env for result reporting\n network-optimizer-speedtest:\n build:\n context: ..\n dockerfile: docker/openspeedtest/Dockerfile\n image: ghcr.io/ozark-connect/speedtest:latest\n container_name: network-optimizer-speedtest\n restart: unless-stopped\n ports:\n - \"${OPENSPEEDTEST_PORT:-3005}:3000\"\n sysctls:\n # Raise TCP autotuning ceiling so long-RTT single-stream speedtests are not rwnd-bound.\n # Container has its own netns; without this the ceiling is the 6MB kernel default,\n # which caps single-stream throughput at ~rwnd/RTT (e.g. ~225 Mbps at 100ms RTT).\n net.ipv4.tcp_rmem: \"4096 131072 33554432\"\n net.ipv4.tcp_wmem: \"4096 65536 33554432\"\n net.ipv4.tcp_mtu_probing: \"1\"\n # tcp_congestion_control is intentionally not set here — it hard-fails\n # container start on kernels without the bbr module loaded (Synology, QNAP,\n # some Proxmox/LXC setups) and compose sysctls are all-or-nothing. The\n # entrypoint reports CC state and tells the operator how to enable bbr on\n # the host if desired.\n environment:\n - TZ=${TZ:-America/Chicago}\n # For URL construction and host enforcement redirect\n - HOST_NAME=${HOST_NAME:-}\n - HOST_IP=${HOST_IP:-}\n - OPENSPEEDTEST_PORT=${OPENSPEEDTEST_PORT:-3005}\n - OPENSPEEDTEST_HOST=${OPENSPEEDTEST_HOST:-}\n - OPENSPEEDTEST_HTTPS=${OPENSPEEDTEST_HTTPS:-false}\n - OPENSPEEDTEST_HTTPS_PORT=${OPENSPEEDTEST_HTTPS_PORT:-443}\n # For result reporting URL\n - REVERSE_PROXIED_HOST_NAME=${REVERSE_PROXIED_HOST_NAME:-}\n logging:\n driver: \"json-file\"\n options:\n max-size: \"10m\"\n max-file: \"3\"\n\n# Production config - host network mode, localhost only (behind Caddy)\n# For local dev with InfluxDB/Grafana, use docker-compose.local.yml\n"
},
{
"path": "docker/entrypoint.sh",
"content": "#!/bin/bash\nset -e\n\n# Set container timezone from TZ env var so .NET TimeZoneInfo.Local is correct\nif [ -n \"$TZ\" ] && [ -f \"/usr/share/zoneinfo/$TZ\" ]; then\n ln -sf \"/usr/share/zoneinfo/$TZ\" /etc/localtime\n echo \"$TZ\" > /etc/timezone\nfi\n\n# Fix ownership of mounted volumes (they may be created as root by Docker)\n# This runs as root before dropping to the app user\nchown -R app:app /app/data /app/logs /app/ssh-keys 2>/dev/null || true\n\n# Set bind address based on BIND_LOCALHOST_ONLY\n# Default: false (bind to all interfaces for direct network access)\n# Set to true when behind a reverse proxy on the same host\nif [ \"${BIND_LOCALHOST_ONLY,,}\" = \"true\" ]; then\n export ASPNETCORE_URLS=\"http://127.0.0.1:8042\"\n echo \"Binding to localhost only (127.0.0.1:8042)\"\nelse\n export ASPNETCORE_URLS=\"http://0.0.0.0:8042\"\n echo \"Binding to all interfaces (0.0.0.0:8042)\"\nfi\n\n# Drop to app user and run the application\nexec gosu app dotnet NetworkOptimizer.Web.dll \"$@\"\n"
},
{
"path": "docker/grafana/dashboards/network-overview.json",
"content": "{\n \"annotations\": {\n \"list\": [\n {\n \"builtIn\": 1,\n \"datasource\": {\n \"type\": \"grafana\",\n \"uid\": \"-- Grafana --\"\n },\n \"enable\": true,\n \"hide\": true,\n \"iconColor\": \"rgba(0, 211, 255, 1)\",\n \"name\": \"Annotations & Alerts\",\n \"type\": \"dashboard\"\n }\n ]\n },\n \"editable\": true,\n \"fiscalYearStartMonth\": 0,\n \"graphTooltip\": 1,\n \"id\": null,\n \"links\": [],\n \"liveNow\": false,\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"gridPos\": {\n \"h\": 3,\n \"w\": 24,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 1,\n \"options\": {\n \"code\": {\n \"language\": \"plaintext\",\n \"showLineNumbers\": false,\n \"showMiniMap\": false\n },\n \"content\": \"\\n Network Optimizer - Overview Dashboard
\\n Real-time network health and performance monitoring\\n
\",\n \"mode\": \"html\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"title\": \"Dashboard Header\",\n \"type\": \"text\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 6,\n \"w\": 4,\n \"x\": 0,\n \"y\": 3\n },\n \"id\": 2,\n \"options\": {\n \"colorMode\": \"value\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"device_metrics\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"uptime\\\")\\n |> group()\\n |> count()\\n |> yield(name: \\\"device_count\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Total Devices\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"0\": {\n \"color\": \"red\",\n \"index\": 1,\n \"text\": \"Offline\"\n },\n \"1\": {\n \"color\": \"green\",\n \"index\": 0,\n \"text\": \"Online\"\n }\n },\n \"type\": \"value\"\n }\n ],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"red\",\n \"value\": 0\n },\n {\n \"color\": \"green\",\n \"value\": 1\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 6,\n \"w\": 4,\n \"x\": 4,\n \"y\": 3\n },\n \"id\": 3,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"value_and_name\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"rate\\\")\\n |> last()\\n |> map(fn: (r) => ({ r with _value: if exists r._value then 1 else 0 }))\\n |> yield(name: \\\"sqm_status\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"SQM Status\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"max\": 100,\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"red\",\n \"value\": null\n },\n {\n \"color\": \"orange\",\n \"value\": 50\n },\n {\n \"color\": \"yellow\",\n \"value\": 70\n },\n {\n \"color\": \"green\",\n \"value\": 85\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 6,\n \"w\": 4,\n \"x\": 8,\n \"y\": 3\n },\n \"id\": 4,\n \"options\": {\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showThresholdLabels\": false,\n \"showThresholdMarkers\": true\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_score\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"score\\\")\\n |> last()\\n |> yield(name: \\\"security_score\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Security Score\",\n \"type\": \"gauge\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 1\n },\n {\n \"color\": \"orange\",\n \"value\": 3\n },\n {\n \"color\": \"red\",\n \"value\": 5\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 6,\n \"w\": 4,\n \"x\": 12,\n \"y\": 3\n },\n \"id\": 5,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_issues\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"count\\\")\\n |> filter(fn: (r) => r[\\\"severity\\\"] == \\\"critical\\\")\\n |> last()\\n |> yield(name: \\\"critical_issues\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Critical Issues\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 20,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 2,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"never\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"Mbits\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 6,\n \"w\": 8,\n \"x\": 16,\n \"y\": 3\n },\n \"id\": 6,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"rate\\\" or r[\\\"_field\\\"] == \\\"baseline\\\")\\n |> aggregateWindow(every: 1m, fn: mean, createEmpty: false)\\n |> yield(name: \\\"bandwidth\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"WAN Bandwidth (Current vs Baseline)\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"custom\": {\n \"align\": \"auto\",\n \"cellOptions\": {\n \"type\": \"auto\"\n },\n \"inspect\": false\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"Status\"\n },\n \"properties\": [\n {\n \"id\": \"mappings\",\n \"value\": [\n {\n \"options\": {\n \"1\": {\n \"color\": \"green\",\n \"index\": 0,\n \"text\": \"Online\"\n },\n \"0\": {\n \"color\": \"red\",\n \"index\": 1,\n \"text\": \"Offline\"\n }\n },\n \"type\": \"value\"\n }\n ]\n },\n {\n \"id\": \"custom.cellOptions\",\n \"value\": {\n \"mode\": \"basic\",\n \"type\": \"color-background\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 9\n },\n \"id\": 7,\n \"options\": {\n \"cellHeight\": \"sm\",\n \"footer\": {\n \"countRows\": false,\n \"fields\": \"\",\n \"reducer\": [\n \"sum\"\n ],\n \"show\": false\n },\n \"showHeader\": true,\n \"sortBy\": []\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"device_metrics\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"cpu\\\" or r[\\\"_field\\\"] == \\\"memory_used\\\" or r[\\\"_field\\\"] == \\\"uptime\\\")\\n |> last()\\n |> pivot(rowKey:[\\\"device\\\", \\\"type\\\"], columnKey: [\\\"_field\\\"], valueColumn: \\\"_value\\\")\\n |> map(fn: (r) => ({ r with status: if exists r.uptime and r.uptime > 0 then 1 else 0 }))\\n |> yield(name: \\\"device_status\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Device Status\",\n \"type\": \"table\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 20,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 2,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"never\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"ms\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 12,\n \"y\": 9\n },\n \"id\": 8,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"latency\\\")\\n |> aggregateWindow(every: 1m, fn: mean, createEmpty: false)\\n |> yield(name: \\\"latency\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"WAN Latency\",\n \"type\": \"timeseries\"\n }\n ],\n \"refresh\": \"30s\",\n \"schemaVersion\": 38,\n \"style\": \"dark\",\n \"tags\": [\n \"network-optimizer\",\n \"overview\"\n ],\n \"templating\": {\n \"list\": [\n {\n \"current\": {\n \"selected\": false,\n \"text\": \"InfluxDB-NetworkOptimizer\",\n \"value\": \"InfluxDB-NetworkOptimizer\"\n },\n \"hide\": 0,\n \"includeAll\": false,\n \"label\": \"Data Source\",\n \"multi\": false,\n \"name\": \"DS_INFLUXDB\",\n \"options\": [],\n \"query\": \"influxdb\",\n \"refresh\": 1,\n \"regex\": \"\",\n \"skipUrlSync\": false,\n \"type\": \"datasource\"\n }\n ]\n },\n \"time\": {\n \"from\": \"now-6h\",\n \"to\": \"now\"\n },\n \"timepicker\": {\n \"refresh_intervals\": [\n \"10s\",\n \"30s\",\n \"1m\",\n \"5m\",\n \"15m\",\n \"30m\",\n \"1h\"\n ]\n },\n \"timezone\": \"\",\n \"title\": \"Network Overview\",\n \"uid\": \"network-overview\",\n \"version\": 1,\n \"weekStart\": \"\"\n}\n"
},
{
"path": "docker/grafana/dashboards/security-posture.json",
"content": "{\n \"annotations\": {\n \"list\": [\n {\n \"builtIn\": 1,\n \"datasource\": {\n \"type\": \"grafana\",\n \"uid\": \"-- Grafana --\"\n },\n \"enable\": true,\n \"hide\": true,\n \"iconColor\": \"rgba(0, 211, 255, 1)\",\n \"name\": \"Annotations & Alerts\",\n \"type\": \"dashboard\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"enable\": true,\n \"iconColor\": \"red\",\n \"name\": \"Audit Events\",\n \"target\": {\n \"limit\": 100,\n \"matchAny\": false,\n \"tags\": [],\n \"type\": \"dashboard\"\n }\n }\n ]\n },\n \"editable\": true,\n \"fiscalYearStartMonth\": 0,\n \"graphTooltip\": 1,\n \"id\": null,\n \"links\": [],\n \"liveNow\": false,\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"gridPos\": {\n \"h\": 2,\n \"w\": 24,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 1,\n \"options\": {\n \"code\": {\n \"language\": \"plaintext\",\n \"showLineNumbers\": false,\n \"showMiniMap\": false\n },\n \"content\": \"\\n Security Posture Dashboard
\\n Configuration audit scores, security issues, and compliance trends\\n
\",\n \"mode\": \"html\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"title\": \"Dashboard Header\",\n \"type\": \"text\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"from\": 0,\n \"result\": {\n \"color\": \"red\",\n \"index\": 3,\n \"text\": \"NEEDS WORK\"\n },\n \"to\": 49\n },\n \"type\": \"range\"\n },\n {\n \"options\": {\n \"from\": 50,\n \"result\": {\n \"color\": \"orange\",\n \"index\": 2,\n \"text\": \"FAIR\"\n },\n \"to\": 69\n },\n \"type\": \"range\"\n },\n {\n \"options\": {\n \"from\": 70,\n \"result\": {\n \"color\": \"yellow\",\n \"index\": 1,\n \"text\": \"GOOD\"\n },\n \"to\": 84\n },\n \"type\": \"range\"\n },\n {\n \"options\": {\n \"from\": 85,\n \"result\": {\n \"color\": \"green\",\n \"index\": 0,\n \"text\": \"EXCELLENT\"\n },\n \"to\": 100\n },\n \"type\": \"range\"\n }\n ],\n \"max\": 100,\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"red\",\n \"value\": null\n },\n {\n \"color\": \"orange\",\n \"value\": 50\n },\n {\n \"color\": \"yellow\",\n \"value\": 70\n },\n {\n \"color\": \"green\",\n \"value\": 85\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 8,\n \"x\": 0,\n \"y\": 2\n },\n \"id\": 2,\n \"options\": {\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showThresholdLabels\": true,\n \"showThresholdMarkers\": true\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_score\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"score\\\")\\n |> last()\\n |> yield(name: \\\"security_score\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Overall Security Score\",\n \"type\": \"gauge\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 1\n },\n {\n \"color\": \"orange\",\n \"value\": 3\n },\n {\n \"color\": \"red\",\n \"value\": 5\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 4,\n \"w\": 4,\n \"x\": 8,\n \"y\": 2\n },\n \"id\": 3,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"value_and_name\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_issues\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"count\\\")\\n |> filter(fn: (r) => r[\\\"severity\\\"] == \\\"critical\\\")\\n |> last()\\n |> yield(name: \\\"critical_issues\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Critical Issues\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 5\n },\n {\n \"color\": \"orange\",\n \"value\": 10\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 4,\n \"w\": 4,\n \"x\": 12,\n \"y\": 2\n },\n \"id\": 4,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"value_and_name\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_issues\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"count\\\")\\n |> filter(fn: (r) => r[\\\"severity\\\"] == \\\"warning\\\")\\n |> last()\\n |> yield(name: \\\"warnings\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Warnings\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 4,\n \"w\": 4,\n \"x\": 16,\n \"y\": 2\n },\n \"id\": 5,\n \"options\": {\n \"colorMode\": \"value\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"value_and_name\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_issues\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"count\\\")\\n |> filter(fn: (r) => r[\\\"severity\\\"] == \\\"info\\\")\\n |> last()\\n |> yield(name: \\\"info\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Info Items\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"dateTimeAsIso\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 4,\n \"w\": 4,\n \"x\": 20,\n \"y\": 2\n },\n \"id\": 6,\n \"options\": {\n \"colorMode\": \"value\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"value_and_name\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_score\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"score\\\")\\n |> last()\\n |> map(fn: (r) => ({ r with _value: uint(v: r._time) }))\\n |> yield(name: \\\"last_audit\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Last Audit\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 20,\n \"gradientMode\": \"opacity\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 3,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"line\"\n }\n },\n \"mappings\": [],\n \"max\": 100,\n \"min\": 0,\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"transparent\",\n \"value\": null\n },\n {\n \"color\": \"red\",\n \"value\": 50\n },\n {\n \"color\": \"yellow\",\n \"value\": 70\n },\n {\n \"color\": \"green\",\n \"value\": 85\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 16,\n \"x\": 8,\n \"y\": 6\n },\n \"id\": 7,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\",\n \"min\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_score\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"score\\\")\\n |> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)\\n |> yield(name: \\\"score_trend\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Security Score Trend\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 20,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"stepAfter\",\n \"lineWidth\": 2,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"normal\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"critical\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Critical\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"red\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"warning\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Warnings\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"orange\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"info\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Info\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"blue\",\n \"mode\": \"fixed\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 10\n },\n \"id\": 8,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_issues\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"count\\\")\\n |> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)\\n |> yield(name: \\\"issues_by_severity\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Issues by Severity Over Time\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 5\n },\n {\n \"color\": \"red\",\n \"value\": 10\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 12,\n \"y\": 14\n },\n \"id\": 9,\n \"options\": {\n \"displayMode\": \"gradient\",\n \"minVizHeight\": 10,\n \"minVizWidth\": 0,\n \"orientation\": \"horizontal\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showUnfilled\": true\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_issues\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"count\\\")\\n |> group(columns: [\\\"category\\\"])\\n |> sum()\\n |> yield(name: \\\"issues_by_category\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Issues by Category\",\n \"type\": \"bargauge\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"custom\": {\n \"align\": \"auto\",\n \"cellOptions\": {\n \"type\": \"auto\"\n },\n \"inspect\": false\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n }\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"severity\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Severity\"\n },\n {\n \"id\": \"mappings\",\n \"value\": [\n {\n \"options\": {\n \"critical\": {\n \"color\": \"red\",\n \"index\": 0,\n \"text\": \"CRITICAL\"\n },\n \"warning\": {\n \"color\": \"orange\",\n \"index\": 1,\n \"text\": \"WARNING\"\n },\n \"info\": {\n \"color\": \"blue\",\n \"index\": 2,\n \"text\": \"INFO\"\n }\n },\n \"type\": \"value\"\n }\n ]\n },\n {\n \"id\": \"custom.cellOptions\",\n \"value\": {\n \"mode\": \"basic\",\n \"type\": \"color-background\"\n }\n },\n {\n \"id\": \"custom.width\",\n \"value\": 100\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"category\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Category\"\n },\n {\n \"id\": \"custom.width\",\n \"value\": 150\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"issue_type\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Issue Type\"\n },\n {\n \"id\": \"custom.width\",\n \"value\": 200\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"description\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Description\"\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 10,\n \"w\": 24,\n \"x\": 0,\n \"y\": 18\n },\n \"id\": 10,\n \"options\": {\n \"cellHeight\": \"sm\",\n \"footer\": {\n \"countRows\": false,\n \"fields\": \"\",\n \"reducer\": [\n \"sum\"\n ],\n \"show\": false\n },\n \"showHeader\": true,\n \"sortBy\": [\n {\n \"desc\": false,\n \"displayName\": \"severity\"\n }\n ]\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_issues\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"description\\\")\\n |> last()\\n |> keep(columns: [\\\"severity\\\", \\\"category\\\", \\\"issue_type\\\", \\\"_value\\\", \\\"device\\\", \\\"_time\\\"])\\n |> rename(columns: {_value: \\\"description\\\"})\\n |> sort(columns: [\\\"severity\\\", \\\"category\\\"])\\n |> yield(name: \\\"issue_details\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Current Security Issues\",\n \"type\": \"table\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"hideFrom\": {\n \"legend\": false,\n \"tooltip\": false,\n \"viz\": false\n }\n },\n \"mappings\": []\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"firewall\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Firewall Rules\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"red\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"vlan\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"VLAN Security\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"orange\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"port\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Port Security\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"yellow\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"dns\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"DNS Leak\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"blue\",\n \"mode\": \"fixed\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 28\n },\n \"id\": 11,\n \"options\": {\n \"legend\": {\n \"displayMode\": \"table\",\n \"placement\": \"right\",\n \"showLegend\": true,\n \"values\": [\n \"value\"\n ]\n },\n \"pieType\": \"pie\",\n \"tooltip\": {\n \"mode\": \"single\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_issues\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"count\\\")\\n |> group(columns: [\\\"category\\\"])\\n |> sum()\\n |> yield(name: \\\"category_distribution\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Issue Distribution by Category\",\n \"type\": \"piechart\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"custom\": {\n \"align\": \"auto\",\n \"cellOptions\": {\n \"type\": \"auto\"\n },\n \"inspect\": false\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n }\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"score_change\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Change\"\n },\n {\n \"id\": \"custom.cellOptions\",\n \"value\": {\n \"mode\": \"gradient\",\n \"type\": \"color-background\"\n }\n },\n {\n \"id\": \"thresholds\",\n \"value\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"red\",\n \"value\": null\n },\n {\n \"color\": \"green\",\n \"value\": 0\n }\n ]\n }\n },\n {\n \"id\": \"custom.width\",\n \"value\": 100\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 12,\n \"y\": 28\n },\n \"id\": 12,\n \"options\": {\n \"cellHeight\": \"sm\",\n \"footer\": {\n \"countRows\": false,\n \"fields\": \"\",\n \"reducer\": [\n \"sum\"\n ],\n \"show\": false\n },\n \"showHeader\": true,\n \"sortBy\": [\n {\n \"desc\": true,\n \"displayName\": \"_time\"\n }\n ]\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"audit_score\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"score\\\")\\n |> sort(columns: [\\\"_time\\\"], desc: true)\\n |> limit(n: 20)\\n |> difference()\\n |> rename(columns: {_value: \\\"score_change\\\"})\\n |> yield(name: \\\"audit_history\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Audit History\",\n \"type\": \"table\"\n }\n ],\n \"refresh\": \"1m\",\n \"schemaVersion\": 38,\n \"style\": \"dark\",\n \"tags\": [\n \"network-optimizer\",\n \"security\",\n \"audit\"\n ],\n \"templating\": {\n \"list\": [\n {\n \"current\": {\n \"selected\": false,\n \"text\": \"InfluxDB-NetworkOptimizer\",\n \"value\": \"InfluxDB-NetworkOptimizer\"\n },\n \"hide\": 0,\n \"includeAll\": false,\n \"label\": \"Data Source\",\n \"multi\": false,\n \"name\": \"DS_INFLUXDB\",\n \"options\": [],\n \"query\": \"influxdb\",\n \"refresh\": 1,\n \"regex\": \"\",\n \"skipUrlSync\": false,\n \"type\": \"datasource\"\n }\n ]\n },\n \"time\": {\n \"from\": \"now-7d\",\n \"to\": \"now\"\n },\n \"timepicker\": {\n \"refresh_intervals\": [\n \"30s\",\n \"1m\",\n \"5m\",\n \"15m\",\n \"30m\",\n \"1h\",\n \"2h\"\n ]\n },\n \"timezone\": \"\",\n \"title\": \"Security Posture\",\n \"uid\": \"security-posture\",\n \"version\": 1,\n \"weekStart\": \"\"\n}\n"
},
{
"path": "docker/grafana/dashboards/sqm-performance.json",
"content": "{\n \"annotations\": {\n \"list\": [\n {\n \"builtIn\": 1,\n \"datasource\": {\n \"type\": \"grafana\",\n \"uid\": \"-- Grafana --\"\n },\n \"enable\": true,\n \"hide\": true,\n \"iconColor\": \"rgba(0, 211, 255, 1)\",\n \"name\": \"Annotations & Alerts\",\n \"type\": \"dashboard\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"enable\": true,\n \"iconColor\": \"red\",\n \"name\": \"Speedtest Events\",\n \"target\": {\n \"limit\": 100,\n \"matchAny\": false,\n \"tags\": [],\n \"type\": \"dashboard\"\n }\n }\n ]\n },\n \"editable\": true,\n \"fiscalYearStartMonth\": 0,\n \"graphTooltip\": 1,\n \"id\": null,\n \"links\": [],\n \"liveNow\": false,\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"gridPos\": {\n \"h\": 2,\n \"w\": 24,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 1,\n \"options\": {\n \"code\": {\n \"language\": \"plaintext\",\n \"showLineNumbers\": false,\n \"showMiniMap\": false\n },\n \"content\": \"\\n SQM Performance Dashboard
\\n Adaptive bandwidth management and bufferbloat prevention\\n
\",\n \"mode\": \"html\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"title\": \"Dashboard Header\",\n \"type\": \"text\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"Mbits\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 5,\n \"w\": 6,\n \"x\": 0,\n \"y\": 2\n },\n \"id\": 2,\n \"options\": {\n \"colorMode\": \"value\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"rate\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> filter(fn: (r) => r[\\\"interface\\\"] == \\\"${interface}\\\")\\n |> last()\\n |> yield(name: \\\"current_rate\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Current Rate\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"blue\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"Mbits\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 5,\n \"w\": 6,\n \"x\": 6,\n \"y\": 2\n },\n \"id\": 3,\n \"options\": {\n \"colorMode\": \"value\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"baseline\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> filter(fn: (r) => r[\\\"interface\\\"] == \\\"${interface}\\\")\\n |> last()\\n |> yield(name: \\\"baseline\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Baseline Rate\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 20\n },\n {\n \"color\": \"orange\",\n \"value\": 50\n },\n {\n \"color\": \"red\",\n \"value\": 100\n }\n ]\n },\n \"unit\": \"ms\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 5,\n \"w\": 6,\n \"x\": 12,\n \"y\": 2\n },\n \"id\": 4,\n \"options\": {\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showThresholdLabels\": false,\n \"showThresholdMarkers\": true\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"latency\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> filter(fn: (r) => r[\\\"interface\\\"] == \\\"${interface}\\\")\\n |> last()\\n |> yield(name: \\\"latency\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Current Latency\",\n \"type\": \"gauge\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"none\": {\n \"color\": \"green\",\n \"index\": 0,\n \"text\": \"Stable\"\n },\n \"increase\": {\n \"color\": \"blue\",\n \"index\": 1,\n \"text\": \"Increased\"\n },\n \"decrease\": {\n \"color\": \"orange\",\n \"index\": 2,\n \"text\": \"Decreased\"\n }\n },\n \"type\": \"value\"\n }\n ],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n }\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 5,\n \"w\": 6,\n \"x\": 18,\n \"y\": 2\n },\n \"id\": 5,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"value_and_name\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"adjustment\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> filter(fn: (r) => r[\\\"interface\\\"] == \\\"${interface}\\\")\\n |> last()\\n |> yield(name: \\\"adjustment\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Last Adjustment\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 20,\n \"gradientMode\": \"opacity\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 2,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"never\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"Mbits\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"rate\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Current Rate\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"green\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"baseline\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Baseline\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"blue\",\n \"mode\": \"fixed\"\n }\n },\n {\n \"id\": \"custom.lineStyle\",\n \"value\": {\n \"dash\": [10, 10],\n \"fill\": \"dash\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 10,\n \"w\": 24,\n \"x\": 0,\n \"y\": 7\n },\n \"id\": 6,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\",\n \"min\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"rate\\\" or r[\\\"_field\\\"] == \\\"baseline\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> filter(fn: (r) => r[\\\"interface\\\"] == \\\"${interface}\\\")\\n |> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)\\n |> yield(name: \\\"bandwidth_over_time\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Rate vs Baseline Over Time\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 20,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 2,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"auto\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"line\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 20\n },\n {\n \"color\": \"red\",\n \"value\": 50\n }\n ]\n },\n \"unit\": \"ms\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 10,\n \"w\": 12,\n \"x\": 0,\n \"y\": 17\n },\n \"id\": 7,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\",\n \"min\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"latency\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> filter(fn: (r) => r[\\\"interface\\\"] == \\\"${interface}\\\")\\n |> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)\\n |> yield(name: \\\"latency\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Latency Over Time\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"bars\",\n \"fillOpacity\": 80,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"never\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 10,\n \"w\": 12,\n \"x\": 12,\n \"y\": 17\n },\n \"id\": 8,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"count\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"adjustment\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> filter(fn: (r) => r[\\\"interface\\\"] == \\\"${interface}\\\")\\n |> filter(fn: (r) => r[\\\"_value\\\"] != \\\"none\\\")\\n |> aggregateWindow(every: 1h, fn: count, createEmpty: false)\\n |> yield(name: \\\"adjustments\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"SQM Adjustments (Hourly Count)\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"points\",\n \"fillOpacity\": 10,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 1,\n \"pointSize\": 8,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"always\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"Mbits\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"download\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Download\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"green\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"upload\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Upload\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"blue\",\n \"mode\": \"fixed\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 10,\n \"w\": 24,\n \"x\": 0,\n \"y\": 27\n },\n \"id\": 9,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\",\n \"min\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"speedtest\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"download\\\" or r[\\\"_field\\\"] == \\\"upload\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> filter(fn: (r) => r[\\\"interface\\\"] == \\\"${interface}\\\")\\n |> yield(name: \\\"speedtest_history\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Speedtest History\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"custom\": {\n \"align\": \"auto\",\n \"cellOptions\": {\n \"type\": \"auto\"\n },\n \"inspect\": false\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n }\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"latency\"\n },\n \"properties\": [\n {\n \"id\": \"unit\",\n \"value\": \"ms\"\n },\n {\n \"id\": \"thresholds\",\n \"value\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 20\n },\n {\n \"color\": \"red\",\n \"value\": 50\n }\n ]\n }\n },\n {\n \"id\": \"custom.cellOptions\",\n \"value\": {\n \"mode\": \"gradient\",\n \"type\": \"color-background\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"download\"\n },\n \"properties\": [\n {\n \"id\": \"unit\",\n \"value\": \"Mbits\"\n },\n {\n \"id\": \"displayName\",\n \"value\": \"Download\"\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"upload\"\n },\n \"properties\": [\n {\n \"id\": \"unit\",\n \"value\": \"Mbits\"\n },\n {\n \"id\": \"displayName\",\n \"value\": \"Upload\"\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 24,\n \"x\": 0,\n \"y\": 37\n },\n \"id\": 10,\n \"options\": {\n \"cellHeight\": \"sm\",\n \"footer\": {\n \"countRows\": false,\n \"fields\": \"\",\n \"reducer\": [\n \"sum\"\n ],\n \"show\": false\n },\n \"showHeader\": true,\n \"sortBy\": [\n {\n \"desc\": true,\n \"displayName\": \"_time\"\n }\n ]\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"speedtest\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"download\\\" or r[\\\"_field\\\"] == \\\"upload\\\" or r[\\\"_field\\\"] == \\\"latency\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> filter(fn: (r) => r[\\\"interface\\\"] == \\\"${interface}\\\")\\n |> pivot(rowKey:[\\\"_time\\\"], columnKey: [\\\"_field\\\"], valueColumn: \\\"_value\\\")\\n |> sort(columns: [\\\"_time\\\"], desc: true)\\n |> limit(n: 50)\\n |> yield(name: \\\"recent_speedtests\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Recent Speedtest Results\",\n \"type\": \"table\"\n }\n ],\n \"refresh\": \"30s\",\n \"schemaVersion\": 38,\n \"style\": \"dark\",\n \"tags\": [\n \"network-optimizer\",\n \"sqm\"\n ],\n \"templating\": {\n \"list\": [\n {\n \"current\": {\n \"selected\": false,\n \"text\": \"InfluxDB-NetworkOptimizer\",\n \"value\": \"InfluxDB-NetworkOptimizer\"\n },\n \"hide\": 0,\n \"includeAll\": false,\n \"label\": \"Data Source\",\n \"multi\": false,\n \"name\": \"DS_INFLUXDB\",\n \"options\": [],\n \"query\": \"influxdb\",\n \"refresh\": 1,\n \"regex\": \"\",\n \"skipUrlSync\": false,\n \"type\": \"datasource\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"definition\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: -7d)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> keep(columns: [\\\"device\\\"])\\n |> distinct(column: \\\"device\\\")\",\n \"hide\": 0,\n \"includeAll\": false,\n \"label\": \"Device\",\n \"multi\": false,\n \"name\": \"device\",\n \"options\": [],\n \"query\": {\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: -7d)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> keep(columns: [\\\"device\\\"])\\n |> distinct(column: \\\"device\\\")\",\n \"refId\": \"InfluxVariableQueryEditor-VariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"skipUrlSync\": false,\n \"sort\": 0,\n \"type\": \"query\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"definition\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: -7d)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> keep(columns: [\\\"interface\\\"])\\n |> distinct(column: \\\"interface\\\")\",\n \"hide\": 0,\n \"includeAll\": false,\n \"label\": \"Interface\",\n \"multi\": false,\n \"name\": \"interface\",\n \"options\": [],\n \"query\": {\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: -7d)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"sqm_stats\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${device}\\\")\\n |> keep(columns: [\\\"interface\\\"])\\n |> distinct(column: \\\"interface\\\")\",\n \"refId\": \"InfluxVariableQueryEditor-VariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"skipUrlSync\": false,\n \"sort\": 0,\n \"type\": \"query\"\n }\n ]\n },\n \"time\": {\n \"from\": \"now-24h\",\n \"to\": \"now\"\n },\n \"timepicker\": {\n \"refresh_intervals\": [\n \"10s\",\n \"30s\",\n \"1m\",\n \"5m\",\n \"15m\",\n \"30m\",\n \"1h\"\n ]\n },\n \"timezone\": \"\",\n \"title\": \"SQM Performance\",\n \"uid\": \"sqm-performance\",\n \"version\": 1,\n \"weekStart\": \"\"\n}\n"
},
{
"path": "docker/grafana/dashboards/switch-deep-dive.json",
"content": "{\n \"annotations\": {\n \"list\": [\n {\n \"builtIn\": 1,\n \"datasource\": {\n \"type\": \"grafana\",\n \"uid\": \"-- Grafana --\"\n },\n \"enable\": true,\n \"hide\": true,\n \"iconColor\": \"rgba(0, 211, 255, 1)\",\n \"name\": \"Annotations & Alerts\",\n \"type\": \"dashboard\"\n }\n ]\n },\n \"editable\": true,\n \"fiscalYearStartMonth\": 0,\n \"graphTooltip\": 1,\n \"id\": null,\n \"links\": [],\n \"liveNow\": false,\n \"panels\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"gridPos\": {\n \"h\": 2,\n \"w\": 24,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 1,\n \"options\": {\n \"code\": {\n \"language\": \"plaintext\",\n \"showLineNumbers\": false,\n \"showMiniMap\": false\n },\n \"content\": \"\\n Switch Deep-Dive Dashboard
\\n Per-port utilization, PoE, errors, and traffic analysis\\n
\",\n \"mode\": \"html\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"title\": \"Dashboard Header\",\n \"type\": \"text\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"short\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 4,\n \"w\": 6,\n \"x\": 0,\n \"y\": 2\n },\n \"id\": 2,\n \"options\": {\n \"colorMode\": \"value\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"port_enabled\\\")\\n |> filter(fn: (r) => r[\\\"_value\\\"] == 1)\\n |> group()\\n |> count()\\n |> yield(name: \\\"active_ports\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Active Ports\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 50\n },\n {\n \"color\": \"orange\",\n \"value\": 75\n },\n {\n \"color\": \"red\",\n \"value\": 90\n }\n ]\n },\n \"unit\": \"percent\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 4,\n \"w\": 6,\n \"x\": 6,\n \"y\": 2\n },\n \"id\": 3,\n \"options\": {\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showThresholdLabels\": false,\n \"showThresholdMarkers\": true\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"device_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"cpu\\\")\\n |> last()\\n |> yield(name: \\\"cpu_usage\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Switch CPU Usage\",\n \"type\": \"gauge\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 50\n },\n {\n \"color\": \"orange\",\n \"value\": 75\n },\n {\n \"color\": \"red\",\n \"value\": 90\n }\n ]\n },\n \"unit\": \"percent\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 4,\n \"w\": 6,\n \"x\": 12,\n \"y\": 2\n },\n \"id\": 4,\n \"options\": {\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showThresholdLabels\": false,\n \"showThresholdMarkers\": true\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"device_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"memory_used\\\")\\n |> last()\\n |> yield(name: \\\"memory_usage\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Switch Memory Usage\",\n \"type\": \"gauge\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"watt\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 4,\n \"w\": 6,\n \"x\": 18,\n \"y\": 2\n },\n \"id\": 5,\n \"options\": {\n \"colorMode\": \"value\",\n \"graphMode\": \"area\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"poe_power\\\")\\n |> group()\\n |> sum()\\n |> yield(name: \\\"total_poe\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Total PoE Power\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"custom\": {\n \"align\": \"auto\",\n \"cellOptions\": {\n \"type\": \"auto\"\n },\n \"inspect\": false\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n }\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"rx_rate\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"RX Rate\"\n },\n {\n \"id\": \"unit\",\n \"value\": \"bps\"\n },\n {\n \"id\": \"custom.cellOptions\",\n \"value\": {\n \"mode\": \"gradient\",\n \"type\": \"color-background\"\n }\n },\n {\n \"id\": \"thresholds\",\n \"value\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 500000000\n },\n {\n \"color\": \"orange\",\n \"value\": 750000000\n },\n {\n \"color\": \"red\",\n \"value\": 900000000\n }\n ]\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"tx_rate\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"TX Rate\"\n },\n {\n \"id\": \"unit\",\n \"value\": \"bps\"\n },\n {\n \"id\": \"custom.cellOptions\",\n \"value\": {\n \"mode\": \"gradient\",\n \"type\": \"color-background\"\n }\n },\n {\n \"id\": \"thresholds\",\n \"value\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"yellow\",\n \"value\": 500000000\n },\n {\n \"color\": \"orange\",\n \"value\": 750000000\n },\n {\n \"color\": \"red\",\n \"value\": 900000000\n }\n ]\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"poe_power\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"PoE (W)\"\n },\n {\n \"id\": \"unit\",\n \"value\": \"watt\"\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"port_enabled\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"Status\"\n },\n {\n \"id\": \"mappings\",\n \"value\": [\n {\n \"options\": {\n \"0\": {\n \"color\": \"red\",\n \"index\": 1,\n \"text\": \"Down\"\n },\n \"1\": {\n \"color\": \"green\",\n \"index\": 0,\n \"text\": \"Up\"\n }\n },\n \"type\": \"value\"\n }\n ]\n },\n {\n \"id\": \"custom.cellOptions\",\n \"value\": {\n \"mode\": \"basic\",\n \"type\": \"color-background\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 10,\n \"w\": 24,\n \"x\": 0,\n \"y\": 6\n },\n \"id\": 6,\n \"options\": {\n \"cellHeight\": \"sm\",\n \"footer\": {\n \"countRows\": false,\n \"fields\": \"\",\n \"reducer\": [\n \"sum\"\n ],\n \"show\": false\n },\n \"showHeader\": true,\n \"sortBy\": [\n {\n \"desc\": false,\n \"displayName\": \"port\"\n }\n ]\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"in_octets\\\" or r[\\\"_field\\\"] == \\\"out_octets\\\" or r[\\\"_field\\\"] == \\\"poe_power\\\" or r[\\\"_field\\\"] == \\\"port_enabled\\\")\\n |> last()\\n |> pivot(rowKey:[\\\"port\\\", \\\"port_name\\\"], columnKey: [\\\"_field\\\"], valueColumn: \\\"_value\\\")\\n |> map(fn: (r) => ({ r with \\n rx_rate: if exists r.in_octets then r.in_octets * 8 else 0,\\n tx_rate: if exists r.out_octets then r.out_octets * 8 else 0\\n }))\\n |> sort(columns: [\\\"port\\\"])\\n |> yield(name: \\\"port_status\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Port Status and Utilization\",\n \"type\": \"table\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 20,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 2,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"never\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"bps\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 10,\n \"w\": 12,\n \"x\": 0,\n \"y\": 16\n },\n \"id\": 7,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> filter(fn: (r) => r[\\\"port\\\"] == \\\"${port}\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"in_octets\\\")\\n |> derivative(unit: 1s, nonNegative: true)\\n |> map(fn: (r) => ({ r with _value: r._value * 8.0 }))\\n |> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)\\n |> yield(name: \\\"rx_rate\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Port ${port} - RX Rate\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 20,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 2,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"never\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"bps\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 10,\n \"w\": 12,\n \"x\": 12,\n \"y\": 16\n },\n \"id\": 8,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> filter(fn: (r) => r[\\\"port\\\"] == \\\"${port}\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"out_octets\\\")\\n |> derivative(unit: 1s, nonNegative: true)\\n |> map(fn: (r) => ({ r with _value: r._value * 8.0 }))\\n |> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)\\n |> yield(name: \\\"tx_rate\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Port ${port} - TX Rate\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 20,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"linear\",\n \"lineWidth\": 2,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"never\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"normal\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"cps\"\n },\n \"overrides\": [\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"in_errors\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"RX Errors\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"red\",\n \"mode\": \"fixed\"\n }\n }\n ]\n },\n {\n \"matcher\": {\n \"id\": \"byName\",\n \"options\": \"out_errors\"\n },\n \"properties\": [\n {\n \"id\": \"displayName\",\n \"value\": \"TX Errors\"\n },\n {\n \"id\": \"color\",\n \"value\": {\n \"fixedColor\": \"orange\",\n \"mode\": \"fixed\"\n }\n }\n ]\n }\n ]\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 26\n },\n \"id\": 9,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> filter(fn: (r) => r[\\\"port\\\"] == \\\"${port}\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"in_errors\\\" or r[\\\"_field\\\"] == \\\"out_errors\\\")\\n |> derivative(unit: 1s, nonNegative: true)\\n |> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)\\n |> yield(name: \\\"errors\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Port ${port} - Errors\",\n \"type\": \"timeseries\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"palette-classic\"\n },\n \"custom\": {\n \"axisCenteredZero\": false,\n \"axisColorMode\": \"text\",\n \"axisLabel\": \"\",\n \"axisPlacement\": \"auto\",\n \"barAlignment\": 0,\n \"drawStyle\": \"line\",\n \"fillOpacity\": 20,\n \"gradientMode\": \"none\",\n \"hideFrom\": {\n \"tooltip\": false,\n \"viz\": false,\n \"legend\": false\n },\n \"lineInterpolation\": \"smooth\",\n \"lineWidth\": 2,\n \"pointSize\": 5,\n \"scaleDistribution\": {\n \"type\": \"linear\"\n },\n \"showPoints\": \"never\",\n \"spanNulls\": false,\n \"stacking\": {\n \"group\": \"A\",\n \"mode\": \"none\"\n },\n \"thresholdsStyle\": {\n \"mode\": \"off\"\n }\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"watt\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 12,\n \"y\": 26\n },\n \"id\": 10,\n \"options\": {\n \"legend\": {\n \"calcs\": [\n \"mean\",\n \"lastNotNull\",\n \"max\"\n ],\n \"displayMode\": \"table\",\n \"placement\": \"bottom\",\n \"showLegend\": true\n },\n \"tooltip\": {\n \"mode\": \"multi\",\n \"sort\": \"none\"\n }\n },\n \"pluginVersion\": \"10.0.0\",\n \"targets\": [\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> filter(fn: (r) => r[\\\"_field\\\"] == \\\"poe_power\\\")\\n |> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)\\n |> yield(name: \\\"poe_power\\\")\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"PoE Power Consumption Over Time\",\n \"type\": \"timeseries\"\n }\n ],\n \"refresh\": \"30s\",\n \"schemaVersion\": 38,\n \"style\": \"dark\",\n \"tags\": [\n \"network-optimizer\",\n \"switch\"\n ],\n \"templating\": {\n \"list\": [\n {\n \"current\": {\n \"selected\": false,\n \"text\": \"InfluxDB-NetworkOptimizer\",\n \"value\": \"InfluxDB-NetworkOptimizer\"\n },\n \"hide\": 0,\n \"includeAll\": false,\n \"label\": \"Data Source\",\n \"multi\": false,\n \"name\": \"DS_INFLUXDB\",\n \"options\": [],\n \"query\": \"influxdb\",\n \"refresh\": 1,\n \"regex\": \"\",\n \"skipUrlSync\": false,\n \"type\": \"datasource\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"definition\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: -7d)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"type\\\"] == \\\"switch\\\")\\n |> keep(columns: [\\\"device\\\"])\\n |> distinct(column: \\\"device\\\")\",\n \"hide\": 0,\n \"includeAll\": false,\n \"label\": \"Switch\",\n \"multi\": false,\n \"name\": \"switch\",\n \"options\": [],\n \"query\": {\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: -7d)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"type\\\"] == \\\"switch\\\")\\n |> keep(columns: [\\\"device\\\"])\\n |> distinct(column: \\\"device\\\")\",\n \"refId\": \"InfluxVariableQueryEditor-VariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"skipUrlSync\": false,\n \"sort\": 0,\n \"type\": \"query\"\n },\n {\n \"datasource\": {\n \"type\": \"influxdb\",\n \"uid\": \"${DS_INFLUXDB}\"\n },\n \"definition\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: -7d)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> keep(columns: [\\\"port\\\"])\\n |> distinct(column: \\\"port\\\")\",\n \"hide\": 0,\n \"includeAll\": false,\n \"label\": \"Port\",\n \"multi\": false,\n \"name\": \"port\",\n \"options\": [],\n \"query\": {\n \"query\": \"from(bucket: \\\"network_optimizer\\\")\\n |> range(start: -7d)\\n |> filter(fn: (r) => r[\\\"_measurement\\\"] == \\\"interface_metrics\\\")\\n |> filter(fn: (r) => r[\\\"device\\\"] == \\\"${switch}\\\")\\n |> keep(columns: [\\\"port\\\"])\\n |> distinct(column: \\\"port\\\")\",\n \"refId\": \"InfluxVariableQueryEditor-VariableQuery\"\n },\n \"refresh\": 1,\n \"regex\": \"\",\n \"skipUrlSync\": false,\n \"sort\": 1,\n \"type\": \"query\"\n }\n ]\n },\n \"time\": {\n \"from\": \"now-6h\",\n \"to\": \"now\"\n },\n \"timepicker\": {\n \"refresh_intervals\": [\n \"10s\",\n \"30s\",\n \"1m\",\n \"5m\",\n \"15m\",\n \"30m\",\n \"1h\"\n ]\n },\n \"timezone\": \"\",\n \"title\": \"Switch Deep-Dive\",\n \"uid\": \"switch-deep-dive\",\n \"version\": 1,\n \"weekStart\": \"\"\n}\n"
},
{
"path": "docker/grafana/provisioning/dashboards/dashboards.yml",
"content": "apiVersion: 1\n\nproviders:\n - name: 'Network Optimizer Dashboards'\n orgId: 1\n folder: 'Network Optimizer'\n type: file\n disableDeletion: false\n updateIntervalSeconds: 30\n allowUiUpdates: true\n options:\n path: /var/lib/grafana/dashboards\n foldersFromFilesStructure: false\n"
},
{
"path": "docker/grafana/provisioning/datasources/influxdb.yml",
"content": "apiVersion: 1\n\ndatasources:\n - name: InfluxDB-NetworkOptimizer\n type: influxdb\n access: proxy\n url: http://influxdb:8086\n jsonData:\n version: Flux\n organization: network-optimizer\n defaultBucket: network_optimizer\n tlsSkipVerify: true\n secureJsonData:\n token: ${INFLUXDB_TOKEN}\n isDefault: true\n editable: true\n"
},
{
"path": "docker/openspeedtest/Dockerfile",
"content": "# Ozark Connect Speed Test - based on OpenSpeedTest\n# Built from local customized source instead of upstream image\n# Pin to nginx 1.26 to match OpenSpeedTest (1.29+ has caching behavior changes)\nFROM nginx:1.26-alpine\n\n# Copy our customized OpenSpeedTest files\nCOPY src/OpenSpeedTest/ /usr/share/nginx/html/\n\n# Copy nginx configuration\nCOPY docker/openspeedtest/nginx.conf /etc/nginx/conf.d/default.conf\n\n# Copy entrypoint script\nCOPY docker/openspeedtest/entrypoint.sh /docker-entrypoint.sh\nRUN chmod +x /docker-entrypoint.sh\n\nEXPOSE 3000\n\nENTRYPOINT [\"/docker-entrypoint.sh\"]\nCMD [\"nginx\", \"-g\", \"daemon off;\"]\n"
},
{
"path": "docker/openspeedtest/entrypoint.sh",
"content": "#!/bin/sh\n# Ozark Connect Speed Test - Entrypoint\n# Injects runtime configuration into config.js\n\n# Report TCP congestion control state. We can't set it from inside the container\n# (/proc/sys is mounted read-only except for sysctls explicitly declared in the\n# compose sysctls: block, and we can't put tcp_congestion_control there because it\n# hard-fails container start on kernels without bbr — Synology, QNAP, some Proxmox\n# setups). The container inherits whatever the host's default CC is, so we just\n# surface the state and point users at the fix if bbr is available but not active.\nCC_FILE=\"/proc/sys/net/ipv4/tcp_congestion_control\"\nAVAIL_FILE=\"/proc/sys/net/ipv4/tcp_available_congestion_control\"\nif [ -r \"$CC_FILE\" ]; then\n CURRENT_CC=$(cat \"$CC_FILE\")\n AVAIL_CC=$(cat \"$AVAIL_FILE\" 2>/dev/null || echo \"unknown\")\n echo \"TCP congestion control: $CURRENT_CC (available: $AVAIL_CC)\"\n case \" $AVAIL_CC \" in\n *\" bbr \"*)\n if [ \"$CURRENT_CC\" != \"bbr\" ]; then\n echo \"NOTE: bbr is loaded on the host but not the default. For best speedtest accuracy on shallow-policer WAN paths, set it as default on the host: sysctl -w net.ipv4.tcp_congestion_control=bbr\"\n fi\n ;;\n *)\n echo \"NOTE: bbr kernel module is not loaded on the host. For best speedtest accuracy on shallow-policer WAN paths, load it on the host: modprobe tcp_bbr (and persist via /etc/modules-load.d/bbr.conf)\"\n ;;\n esac\nfi\n\n# API endpoint path (single source of truth)\nAPI_PATH=\"/api/public/speedtest/results\"\n\n# Construct the save URL from environment variables\n# Priority: REVERSE_PROXIED_HOST_NAME > HOST_NAME > HOST_IP\n# IMPORTANT: Keep this logic in sync with NginxHostedService.cs:ConstructSaveDataUrl() (Windows installer)\nif [ -n \"$REVERSE_PROXIED_HOST_NAME\" ]; then\n # Behind reverse proxy - use https and no port (proxy handles it)\n SAVE_DATA_URL=\"https://${REVERSE_PROXIED_HOST_NAME}${API_PATH}\"\nelif [ -n \"$HOST_NAME\" ]; then\n SAVE_DATA_URL=\"http://${HOST_NAME}:8042${API_PATH}\"\nelif [ -n \"$HOST_IP\" ]; then\n SAVE_DATA_URL=\"http://${HOST_IP}:8042${API_PATH}\"\nelse\n # No explicit host configured - use dynamic URL (constructed client-side from browser location)\n SAVE_DATA_URL=\"__DYNAMIC__\"\nfi\n\n# Inject configuration into config.js\nCONFIG_FILE=\"/usr/share/nginx/html/assets/js/config.js\"\n\nif [ -f \"$CONFIG_FILE\" ]; then\n echo \"Configuring speed test...\"\n\n # saveData is always enabled - URL is either explicit or dynamic\n SAVE_DATA_VALUE=\"true\"\n if [ \"$SAVE_DATA_URL\" = \"__DYNAMIC__\" ]; then\n echo \"Results will be sent to: (dynamic - based on browser location):8042\"\n else\n echo \"Results will be sent to: $SAVE_DATA_URL\"\n fi\n\n # External server ID (set for WAN speed test servers, empty for LAN)\n EXTERNAL_ID=\"${EXTERNAL_SERVER_ID:-}\"\n\n # Replace placeholders with actual values\n sed -i \"s|__SAVE_DATA__|$SAVE_DATA_VALUE|g\" \"$CONFIG_FILE\"\n sed -i \"s|__SAVE_DATA_URL__|$SAVE_DATA_URL|g\" \"$CONFIG_FILE\"\n sed -i \"s|__API_PATH__|$API_PATH|g\" \"$CONFIG_FILE\"\n sed -i \"s|__EXTERNAL_SERVER_ID__|$EXTERNAL_ID|g\" \"$CONFIG_FILE\"\n\n if [ -n \"$EXTERNAL_ID\" ]; then\n echo \"External server ID: $EXTERNAL_ID (WAN speed test mode)\"\n fi\n\n echo \"Configuration complete\"\nelse\n echo \"Warning: config.js not found at $CONFIG_FILE\"\nfi\n\n# Enforce canonical URL via 302 redirect (matches UI logic exactly)\n# Prevents browser caching issues on mobile\nNGINX_CONF=\"/etc/nginx/conf.d/default.conf\"\nOST_PORT=\"${OPENSPEEDTEST_PORT:-3005}\"\nOST_HTTPS_PORT=\"${OPENSPEEDTEST_HTTPS_PORT:-443}\"\n\n# Match UI: OPENSPEEDTEST_HOST defaults to HOST_NAME\nOST_HOST=\"${OPENSPEEDTEST_HOST:-$HOST_NAME}\"\n\n# Build canonical URL (same logic as ClientSpeedTest.razor)\n# \"true\" = HTTPS via proxy, \"false\"/unset = HTTP direct\nCANONICAL_URL=\"\"\nCANONICAL_HOST=\"\"\nif [ -n \"$OST_HOST\" ]; then\n CANONICAL_HOST=\"$OST_HOST\"\n if [ \"$OPENSPEEDTEST_HTTPS\" = \"true\" ]; then\n if [ \"$OST_HTTPS_PORT\" = \"443\" ]; then\n CANONICAL_URL=\"https://$OST_HOST\"\n else\n CANONICAL_URL=\"https://$OST_HOST:$OST_HTTPS_PORT\"\n fi\n else\n CANONICAL_URL=\"http://$OST_HOST:$OST_PORT\"\n fi\nelif [ -n \"$HOST_IP\" ]; then\n CANONICAL_HOST=\"$HOST_IP\"\n CANONICAL_URL=\"http://$HOST_IP:$OST_PORT\"\nfi\n\nif [ -n \"$CANONICAL_HOST\" ] && [ -f \"$NGINX_CONF\" ]; then\n echo \"Enforcing canonical URL: $CANONICAL_URL\"\n\n # Redirect HTTP to HTTPS when behind a TLS proxy\n if [ \"$OPENSPEEDTEST_HTTPS\" = \"true\" ]; then\n sed -i \"/server_name/a\\\\\n # Redirect HTTP to HTTPS\\\\\n if (\\$http_x_forwarded_proto != \\\"https\\\") {\\\\\n return 302 $CANONICAL_URL\\$request_uri;\\\\\n }\" \"$NGINX_CONF\"\n echo \"Added HTTP->HTTPS redirect rule\"\n else\n # Host enforcement only (no scheme redirect)\n sed -i \"/server_name/a\\\\\n # Enforce canonical host - prevents browser caching issues on mobile\\\\\n if (\\$host != \\\"$CANONICAL_HOST\\\") {\\\\\n return 302 $CANONICAL_URL\\$request_uri;\\\\\n }\" \"$NGINX_CONF\"\n echo \"Added host redirect rule\"\n fi\nfi\n\n# Start nginx\nexec \"$@\"\n"
},
{
"path": "docker/openspeedtest/nginx.conf",
"content": "server {\n server_name _;\n listen 3000 reuseport;\n listen [::]:3000 reuseport;\n\n root /usr/share/nginx/html;\n index index.html;\n client_max_body_size 50m;\n error_page 405 =200 $uri;\n access_log off;\n gzip off;\n fastcgi_read_timeout 999;\n log_not_found off;\n server_tokens off;\n error_log /dev/null;\n tcp_nodelay on;\n tcp_nopush on;\n sendfile on;\n open_file_cache max=200000 inactive=20s;\n open_file_cache_valid 30s;\n open_file_cache_min_uses 2;\n open_file_cache_errors off;\n\n # Upload endpoint - reads entire POST body before responding.\n # Without this, the error_page 405 hack responds before the body is\n # fully received, causing ERR_CONNECTION_RESET behind reverse proxies.\n location = /upload {\n add_header 'Access-Control-Allow-Origin' \"*\" always;\n add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With' always;\n add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;\n add_header Cache-Control 'no-store, no-cache, max-age=0, no-transform';\n\n client_body_buffer_size 35m;\n client_max_body_size 50m;\n\n proxy_pass http://127.0.0.1:3000/upload-sink;\n proxy_set_header Host $host;\n }\n\n location = /upload-sink {\n add_header 'Access-Control-Allow-Origin' \"*\" always;\n return 200;\n }\n\n location / {\n add_header 'Access-Control-Allow-Origin' \"*\" always;\n add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With' always;\n add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;\n add_header Cache-Control 'no-store, no-cache, max-age=0, no-transform';\n add_header Last-Modified $date_gmt;\n if_modified_since off;\n expires off;\n etag off;\n\n if ($request_method = OPTIONS) {\n add_header 'Access-Control-Allow-Credentials' \"true\";\n add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With' always;\n add_header 'Access-Control-Allow-Origin' \"$http_origin\" always;\n add_header 'Access-Control-Allow-Methods' \"GET, POST, OPTIONS\" always;\n return 200;\n }\n }\n\n # Static assets - match OpenSpeedTest config exactly\n location ~* ^.+\\.(?:css|cur|js|jpe?g|gif|htc|ico|png|html|xml|otf|ttf|eot|woff|woff2|svg)$ {\n access_log off;\n expires -1;\n add_header Cache-Control \"no-cache, no-store, must-revalidate\";\n add_header Vary Accept-Encoding;\n tcp_nodelay off;\n open_file_cache max=3000 inactive=120s;\n open_file_cache_valid 45s;\n open_file_cache_min_uses 2;\n open_file_cache_errors off;\n gzip on;\n gzip_disable \"msie6\";\n gzip_vary on;\n gzip_proxied any;\n gzip_comp_level 6;\n gzip_buffers 16 8k;\n gzip_http_version 1.1;\n gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;\n }\n}\n"
},
{
"path": "docs/MACOS-INSTALLATION.md",
"content": "# macOS Native Installation\n\nInstall Network Optimizer natively on macOS for maximum performance. Native installation is recommended over Docker Desktop, which limits network throughput to ~1.8 Gbps.\n\n## Quick Start\n\n```bash\ngit clone https://github.com/Ozark-Connect/NetworkOptimizer.git\ncd NetworkOptimizer\n./scripts/install-macos-native.sh\n```\n\nThe script will:\n1. Install prerequisites via Homebrew (iperf3, nginx, .NET SDK)\n2. Build the application from source\n3. Sign binaries for macOS\n4. Set up OpenSpeedTest with nginx for browser-based speed testing\n5. Create a launchd service for auto-start\n\n## Configuration\n\nAfter installation, edit `~/network-optimizer/start.sh` to configure environment variables:\n\n```bash\n# Timezone\nexport TZ=\"America/Chicago\"\n\n# Optional: Set admin password (auto-generated on first run if not set)\n# export APP_PASSWORD=\"your-secure-password\"\n```\n\nAdditional environment variables can be added to `start.sh` - see [docker/.env.example](../docker/.env.example) for all available options including:\n- `HOST_NAME` - Hostname for canonical URL enforcement\n- `REVERSE_PROXIED_HOST_NAME` - Hostname when behind a reverse proxy (enables HTTPS)\n- `OPENSPEEDTEST_HTTPS` - Enable HTTPS for speed tests (required for geolocation)\n- `Logging__LogLevel__NetworkOptimizer` / `Logging__LogLevel__Default` - Logging verbosity (see [Enable Debug Logging](#enable-debug-logging))\n\nNote: The app auto-detects its IP address, so `HOST_IP` is not required for native installations.\n\nAfter editing, restart the service:\n\n```bash\nlaunchctl unload ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\nlaunchctl load ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\n```\n\n## Access\n\n- **Web UI**: http://localhost:8042 or http://\\:8042\n- **SpeedTest**: http://localhost:3005 or http://\\:3005\n\nOn first run, check the logs for the auto-generated admin password:\n\n```bash\ngrep -A5 'AUTO-GENERATED' ~/network-optimizer/logs/stdout.log\n```\n\n## Service Management\n\n```bash\n# Stop\nlaunchctl unload ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\n\n# Start\nlaunchctl load ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\n\n# View logs\ntail -f ~/network-optimizer/logs/stdout.log\n```\n\n## Upgrading\n\nTo upgrade to a newer version:\n\n```bash\ncd NetworkOptimizer\ngit pull\n./scripts/install-macos-native.sh\n```\n\nThe install script preserves your database, encryption keys, and `start.sh` configuration by backing them up before reinstalling.\n\n## Logs and Debugging\n\nApplication logs are in `~/network-optimizer/logs/`:\n\n```bash\n# Follow live logs\ntail -f ~/network-optimizer/logs/stdout.log\n\n# View errors\ntail -f ~/network-optimizer/logs/stderr.log\n\n# Search for specific events\ngrep \"UniFi\" ~/network-optimizer/logs/stdout.log | tail -20\n```\n\n### Enable Debug Logging\n\nFor more detailed logs, edit `~/network-optimizer/start.sh` and add:\n\n```bash\n# Debug logging for Network Optimizer application code only (recommended):\nexport Logging__LogLevel__NetworkOptimizer=Debug\n\n# Or debug everything (verbose - includes framework/EF Core noise):\nexport Logging__LogLevel__Default=Debug\n```\n\nThen restart the service:\n\n```bash\nlaunchctl unload ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\nlaunchctl load ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\n```\n\nRemember to set it back to `Information` when done - debug logging is verbose.\n\n### Log Rotation\n\nLogs are not rotated automatically. To clear them:\n\n```bash\n# Truncate without restarting\n: > ~/network-optimizer/logs/stdout.log\n: > ~/network-optimizer/logs/stderr.log\n```\n\n## Troubleshooting\n\n### Previous sudo Installation\n\nIf you previously ran the install script with `sudo`, files and processes end up owned by root, which breaks future installs and upgrades. The install script detects this automatically and offers to fix it. Just run the script normally (without sudo):\n\n```bash\n./scripts/install-macos-native.sh\n```\n\nIt will prompt for your password once to clean up root-owned files and kill root-owned processes, then continue the installation as your regular user.\n\n**Never run the install script with sudo.** Everything installs to your home directory and does not need root access.\n\n### Reset Admin Password\n\nIf you forget the admin password, use the reset script:\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/reset-password.sh | bash\n```\n\nThe script auto-detects the macOS native installation, clears the password, restarts the service, and displays the new temporary password.\n\n**Manual fallback:**\n\n```bash\n# Stop the service\nlaunchctl unload ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\n\n# Clear the password\nsqlite3 ~/Library/Application\\ Support/NetworkOptimizer/network_optimizer.db \\\n \"UPDATE AdminSettings SET Password = NULL, Enabled = 0;\"\n\n# Restart\nlaunchctl load ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\n\n# View the new password\ngrep \"Password:\" ~/network-optimizer/logs/stdout.log | tail -1\n```\n\n## Uninstalling\n\n```bash\n# Stop and remove the service\nlaunchctl unload ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\nrm ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\n\n# Remove application files\nrm -rf ~/network-optimizer\n\n# Remove data (database, keys) - optional\nrm -rf ~/Library/Application\\ Support/NetworkOptimizer\n```\n"
},
{
"path": "docs/PLAN-unifi-api-abstraction.md",
"content": "# Plan: UniFi API Abstraction Layer\n\n## Background\n\nCurrently, the Network Optimizer \"hijacks\" the UniFi Controller's internal web UI API endpoints. This works but:\n- API endpoints can change between UniFi versions without notice\n- No official documentation or stability guarantees\n- Rate limiting and session management mimic browser behavior\n- Device data structure may change unexpectedly\n\nWhen/if Ubiquiti provides a proper documented API, we need to easily swap implementations.\n\n## Objective\n\nCreate an abstraction layer that:\n1. Decouples business logic from UniFi API implementation details\n2. Enables easy swap to official API when available\n3. Maintains backward compatibility with current \"web UI\" approach\n4. Provides a clean interface for device/client/network data\n\n## Current Architecture\n\n```\n┌─────────────────────┐ ┌──────────────────────┐\n│ ConfigAuditEngine │────>│ SecurityAuditEngine │\n└─────────────────────┘ └──────────────────────┘\n │ │\n v v\n┌─────────────────────────────────────────────────┐\n│ UniFiApiClient │\n│ (Direct HTTP calls to controller endpoints) │\n└─────────────────────────────────────────────────┘\n │\n v\n┌─────────────────────────────────────────────────┐\n│ UniFi Controller (Web UI API) │\n└─────────────────────────────────────────────────┘\n```\n\n## Proposed Architecture\n\n```\n┌─────────────────────┐ ┌──────────────────────┐\n│ ConfigAuditEngine │────>│ SecurityAuditEngine │\n└─────────────────────┘ └──────────────────────┘\n │ │\n v v\n┌─────────────────────────────────────────────────┐\n│ IUniFiDataProvider │\n│ (Abstract interface for UniFi data) │\n└─────────────────────────────────────────────────┘\n │\n ├──────────────────┐\n │ │\n v v\n┌───────────────────┐ ┌─────────────────────┐\n│ WebUIDataProvider │ │ OfficialAPIProvider │\n│ (Current impl) │ │ (Future impl) │\n└───────────────────┘ └─────────────────────┘\n │ │\n v v\n┌─────────────────┐ ┌────────────────────────┐\n│ Controller │ │ UniFi Official API │\n│ (Web UI API) │ │ (When available) │\n└─────────────────┘ └────────────────────────┘\n```\n\n## Implementation Steps\n\n### Phase 1: Define Core Interfaces\n\n**File: `src/NetworkOptimizer.UniFi/Abstractions/IUniFiDataProvider.cs`**\n\n```csharp\npublic interface IUniFiDataProvider\n{\n // Connection\n Task ConnectAsync(string host, string username, string password);\n Task DisconnectAsync();\n bool IsConnected { get; }\n\n // Site discovery\n Task> GetSitesAsync();\n\n // Device data\n Task> GetDevicesAsync(string siteId);\n Task> GetClientsAsync(string siteId);\n Task> GetNetworksAsync(string siteId);\n\n // Fingerprint database\n Task GetFingerprintDatabaseAsync();\n}\n```\n\n### Phase 2: Define Domain Models\n\nCreate clean domain models separate from JSON response DTOs:\n\n**File: `src/NetworkOptimizer.UniFi/Domain/`**\n\n- `UniFiDevice.cs` - Normalized device info (switches, APs, gateways)\n- `UniFiClient.cs` - Normalized client info (wired/wireless)\n- `UniFiNetwork.cs` - Normalized network/VLAN info\n- `UniFiSite.cs` - Site info\n\n### Phase 3: Refactor Current Implementation\n\n1. Move current `UniFiApiClient` logic into `WebUIDataProvider`\n2. Have it implement `IUniFiDataProvider`\n3. Map JSON responses to domain models internally\n\n### Phase 4: Update Consumers\n\n1. Update `ConfigAuditEngine` to use `IUniFiDataProvider`\n2. Update `SecurityAuditEngine` to work with domain models\n3. Remove direct JSON parsing from audit logic\n\n### Phase 5: Dependency Injection\n\n```csharp\n// Program.cs\nservices.AddScoped();\n\n// Future:\n// services.AddScoped();\n```\n\n## Key Domain Models\n\n### UniFiDevice\n```csharp\npublic class UniFiDevice\n{\n public string Id { get; set; }\n public string Mac { get; set; }\n public string Name { get; set; }\n public string Model { get; set; }\n public DeviceType Type { get; set; } // Gateway, Switch, AP\n public string IpAddress { get; set; }\n public bool IsOnline { get; set; }\n\n // For switches/gateways\n public List? Ports { get; set; }\n\n // For APs\n public bool IsAccessPoint { get; set; }\n}\n```\n\n### UniFiClient\n```csharp\npublic class UniFiClient\n{\n public string Mac { get; set; }\n public string? Name { get; set; }\n public string? Hostname { get; set; }\n public bool IsWired { get; set; }\n\n // Wired client info\n public string? SwitchMac { get; set; }\n public int? SwitchPort { get; set; }\n\n // Wireless client info\n public string? AccessPointMac { get; set; }\n\n // Network assignment\n public string? NetworkId { get; set; }\n\n // Fingerprint data\n public int? DeviceCategory { get; set; }\n public int? DeviceFamily { get; set; }\n public int? DeviceIdOverride { get; set; }\n public string? Oui { get; set; }\n}\n```\n\n## Migration Strategy\n\n1. **Phase 1-2**: Define interfaces and domain models (non-breaking)\n2. **Phase 3**: Create `WebUIDataProvider` alongside existing code\n3. **Phase 4**: Gradually migrate consumers one at a time\n4. **Phase 5**: Remove old direct API code when migration complete\n\n## Benefits\n\n- **Testability**: Mock `IUniFiDataProvider` for unit tests\n- **Flexibility**: Swap implementations without code changes\n- **Maintainability**: API-specific quirks isolated in providers\n- **Future-proof**: Ready for official API when available\n\n## Open Questions\n\n1. Should we support multiple providers simultaneously? (e.g., different controllers)\n2. How to handle provider-specific features not in interface?\n3. Caching strategy - at provider or consumer level?\n\n## Timeline Estimate\n\n| Phase | Description | Effort |\n|-------|-------------|--------|\n| 1 | Define interfaces | 2-4 hours |\n| 2 | Create domain models | 4-6 hours |\n| 3 | Implement WebUIDataProvider | 8-12 hours |\n| 4 | Migrate consumers | 8-12 hours |\n| 5 | DI setup and testing | 4-6 hours |\n\n**Total: 26-40 hours**\n"
},
{
"path": "docs/features/speed-test-roadmap.md",
"content": "# Speed Test & Network Trace - Future Enhancements\n\n## Current State (Jan 2026)\n- Network path visualization with device icons\n- Wireless link indicators on mesh hops\n- Bottleneck detection and highlighting\n- Efficiency grades (% of theoretical max)\n- Inter-VLAN routing detection\n- LocalIp parsing from iperf3 for accurate server positioning\n- Path analysis persistence as snapshot\n- Test history with expandable details\n\n## Proposed Enhancements\n\n### Low Effort / High Impact\n\n**1. Latency & Jitter Display**\n- iperf3 already outputs latency/jitter data - just need to parse and display\n- Critical for VoIP, video conferencing, gaming users\n- Show alongside throughput in results\n\n**2. Bottleneck Recommendations**\n- We already detect bottlenecks - add actionable suggestions\n- Examples:\n - \"Upgrade 1G link to 2.5G for estimated 2.5x improvement\"\n - \"Wireless mesh is limiting - consider wired backhaul\"\n - \"This switch port supports 2.5G but is negotiating at 1G\"\n\n**3. Wireless Signal Quality on Path**\n- Show RSSI/SNR for wireless hops (data available from UniFi API)\n- Correlate signal quality with throughput\n- Help identify weak wireless links\n\n### Medium Effort / High Impact\n\n**4. Scheduled Tests + Trend Graphs**\n- Configure recurring tests (e.g., every 6 hours)\n- Track performance over time per device/path\n- Answer: \"Is my AP degrading over time?\"\n- Detect intermittent issues\n\n**5. Performance Alerts**\n- Threshold-based notifications\n- \"Alert me if throughput drops below 500 Mbps\"\n- \"Alert if efficiency drops below 70%\"\n- Integration with notification system\n\n**6. PDF Export of Path Analysis**\n- Export current path analysis to PDF\n- Useful for documentation, client reports, troubleshooting\n- Leverage existing PDF infrastructure\n\n### Higher Effort / Differentiating\n\n**7. Live Path Monitoring**\n- Real-time visualization during test execution\n- Show per-second throughput on each hop\n- Animated data flow through path\n\n**8. Multi-Device Comparison**\n- Side-by-side comparison of multiple devices/paths\n- \"Which AP has the best backhaul?\"\n- Identify network-wide patterns\n\n**9. Historical Path Change Detection**\n- Detect when network topology changes\n- \"Your path now goes through an additional switch\"\n- Track infrastructure changes over time\n\n## Notes\n- Architecture: Network Optimizer acts as iperf3 client, SSHs to target to start iperf3 server\n- Path analysis uses LocalIp from iperf3 output for accurate server detection\n- Device icons resolved via UniFi product database shortname lookup\n"
},
{
"path": "nuget.config",
"content": "\n\n \n \n \n \n\n"
},
{
"path": "renovate.json",
"content": "{\n \"$schema\": \"https://docs.renovatebot.com/renovate-schema.json\",\n \"extends\": [\n \"config:base\",\n \":semanticCommits\"\n ],\n \"nuget\": {\n \"enabled\": true\n },\n \"dockerfile\": {\n \"enabled\": true\n },\n \"customManagers\": [\n {\n \"customType\": \"regex\",\n \"fileMatch\": [\"^docker/Dockerfile$\"],\n \"matchStrings\": [\"ARG IPERF3_VERSION=(?\\\\d+\\\\.\\\\d+)\"],\n \"datasourceTemplate\": \"github-releases\",\n \"depNameTemplate\": \"esnet/iperf\",\n \"extractVersionTemplate\": \"^(?\\\\d+\\\\.\\\\d+)$\"\n }\n ],\n \"packageRules\": [\n {\n \"matchPackageNames\": [\"esnet/iperf\"],\n \"description\": \"iperf3 updates\",\n \"groupName\": \"iperf3\"\n },\n {\n \"matchDatasources\": [\"docker\"],\n \"matchPackagePatterns\": [\"mcr.microsoft.com/dotnet/*\"],\n \"description\": \".NET Docker images\",\n \"groupName\": \"dotnet-docker\"\n },\n {\n \"matchDatasources\": [\"nuget\"],\n \"matchPackagePatterns\": [\"Microsoft.*\", \"System.*\"],\n \"description\": \"Microsoft NuGet packages\",\n \"groupName\": \"microsoft-nuget\"\n },\n {\n \"matchDatasources\": [\"nuget\"],\n \"excludePackagePatterns\": [\"Microsoft.*\", \"System.*\"],\n \"description\": \"Third-party NuGet packages\",\n \"groupName\": \"nuget-dependencies\"\n },\n {\n \"matchUpdateTypes\": [\"major\"],\n \"labels\": [\"major-update\"],\n \"automerge\": false\n },\n {\n \"matchUpdateTypes\": [\"minor\", \"patch\"],\n \"matchDatasources\": [\"nuget\"],\n \"automerge\": false\n }\n ],\n \"labels\": [\"dependencies\"],\n \"prHourlyLimit\": 5,\n \"prConcurrentLimit\": 10\n}\n"
},
{
"path": "scripts/README.md",
"content": "# Development Scripts\n\nBash scripts for common development tasks. Works with Git Bash on Windows or native bash on macOS/Linux.\n\n## Usage\n\n```bash\n# Make scripts executable (first time only)\nchmod +x scripts/*.sh\n\n# Run a script\n./scripts/test.sh\n```\n\n## Available Scripts\n\n| Script | Description |\n|--------|-------------|\n| `build.sh [Debug\\|Release]` | Build the project |\n| `test.sh` | Run all tests |\n| `coverage.sh` | Run tests with code coverage report |\n| `watch.sh` | Run web app with hot reload |\n| `clean.sh` | Clean build artifacts and coverage |\n| `publish.sh [output-dir]` | Publish for production |\n| `docker-build.sh` | Build Docker image |\n| `docker-run.sh` | Run container locally (port 8042) |\n| `docker-stop.sh` | Stop container |\n| `build-installer.ps1` | Build Windows MSI installer (PowerShell) |\n| `install-macos-native.sh` | Install natively on macOS |\n\n## Windows Installer\n\nBuild the MSI installer for Windows:\n\n```powershell\npowershell -ExecutionPolicy Bypass -File scripts/build-installer.ps1\n```\n\nOutput: `publish/NetworkOptimizer-{version}-win-x64.msi`\n\nThe installer creates a single-file executable (~67 MB) with all dependencies embedded.\n\n## macOS Native Installation\n\nInstall Network Optimizer natively on macOS (no Docker required):\n\n```bash\n# Clone the repository\ngit clone https://github.com/Ozark-Connect/NetworkOptimizer.git\ncd NetworkOptimizer\n\n# Run the installer\n./scripts/install-macos-native.sh\n```\n\nThe script:\n1. Installs prerequisites via Homebrew (iperf3, nginx, .NET SDK)\n2. Builds a single-file executable (~58 MB)\n3. Sets up OpenSpeedTest with nginx\n4. Creates a launchd service for auto-start\n\nInstall location: `~/network-optimizer/`\n\nService management:\n```bash\n# Stop\nlaunchctl unload ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\n\n# Start\nlaunchctl load ~/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\n\n# Logs\ntail -f ~/network-optimizer/logs/stdout.log\n```\n\n## Code Coverage\n\nThe `coverage.sh` script generates a coverage report:\n\n```bash\n./scripts/coverage.sh\n```\n\nCoverage results are saved to `./coverage/`. To get an HTML report, install ReportGenerator:\n\n```bash\ndotnet tool install -g dotnet-reportgenerator-globaltool\n```\n\nThen run `coverage.sh` again - it will automatically generate the HTML report.\n"
},
{
"path": "scripts/build-installer.ps1",
"content": "# Build Network Optimizer Windows Installer\n# Creates a self-contained MSI package\n\nparam(\n [string]$Configuration = \"Release\",\n [string]$OutputDir = \"$PSScriptRoot\\..\\publish\"\n)\n\n$ErrorActionPreference = \"Stop\"\n\n$RepoRoot = Split-Path -Parent $PSScriptRoot\n$WebProject = Join-Path $RepoRoot \"src\\NetworkOptimizer.Web\\NetworkOptimizer.Web.csproj\"\n$InstallerProject = Join-Path $RepoRoot \"src\\NetworkOptimizer.Installer\\NetworkOptimizer.Installer.wixproj\"\n$PublishDir = Join-Path $RepoRoot \"src\\NetworkOptimizer.Web\\bin\\Release\\net10.0\\win-x64\\publish\"\n\n# Get version from git tags (MinVer style)\nPush-Location $RepoRoot\ntry {\n $gitDescribe = git describe --tags --abbrev=0 2>$null\n if ($gitDescribe) {\n $Version = $gitDescribe -replace '^v', ''\n } else {\n # Fallback: count commits for version\n $commitCount = git rev-list --count HEAD 2>$null\n $Version = \"0.0.$commitCount\"\n }\n} catch {\n $Version = \"0.0.0\"\n}\nPop-Location\n\nWrite-Host \"=== Building Network Optimizer Windows Installer ===\" -ForegroundColor Cyan\nWrite-Host \"\"\nWrite-Host \"Version: $Version\"\nWrite-Host \"Configuration: $Configuration\"\nWrite-Host \"\"\n\n# Step 1: Publish self-contained single-file application\nWrite-Host \"[1/5] Publishing self-contained single-file application for win-x64...\" -ForegroundColor Yellow\ndotnet publish $WebProject `\n -c $Configuration `\n -r win-x64 `\n --self-contained `\n -p:PublishSingleFile=true `\n -p:IncludeNativeLibrariesForSelfExtract=true `\n -p:EnableCompressionInSingleFile=true `\n -p:DebugType=None `\n -p:MinVerVersionOverride=$Version `\n -p:Version=$Version `\n -p:FileVersion=$Version `\n -p:AssemblyVersion=$Version `\n -p:IncludeSourceRevisionInInformationalVersion=false `\n /nodeReuse:false\n\nif ($LASTEXITCODE -ne 0) {\n Write-Error \"Publish failed!\"\n exit 1\n}\n\nWrite-Host \"Published to: $PublishDir\" -ForegroundColor Green\nWrite-Host \"\"\n\n# Step 2: Build uwnspeedtest binaries\nWrite-Host \"[2/5] Building uwnspeedtest binaries...\" -ForegroundColor Yellow\n$UwnSpeedTestSrc = Join-Path $RepoRoot \"src\\uwnspeedtest\"\n$ToolsDir = Join-Path $PublishDir \"tools\"\n\nif (-not (Test-Path $ToolsDir)) { New-Item -ItemType Directory -Path $ToolsDir | Out-Null }\n\n$GoCmd = Get-Command go -ErrorAction SilentlyContinue\nif ($GoCmd) {\n Push-Location $UwnSpeedTestSrc\n\n # Build targets: local Windows binary + gateway linux/arm64 binary\n $targets = @(\n @{ GOOS = \"windows\"; GOARCH = \"amd64\"; Output = \"uwnspeedtest-windows-amd64.exe\"; Label = \"windows/amd64\" },\n @{ GOOS = \"windows\"; GOARCH = \"arm64\"; Output = \"uwnspeedtest-windows-arm64.exe\"; Label = \"windows/arm64\" },\n @{ GOOS = \"windows\"; GOARCH = \"386\"; Output = \"uwnspeedtest-windows-386.exe\"; Label = \"windows/386\" },\n @{ GOOS = \"linux\"; GOARCH = \"arm64\"; Output = \"uwnspeedtest-linux-arm64\"; Label = \"linux/arm64 (gateway)\" }\n )\n\n foreach ($target in $targets) {\n $env:CGO_ENABLED = \"0\"\n $env:GOOS = $target.GOOS\n $env:GOARCH = $target.GOARCH\n go build -trimpath -ldflags \"-s -w -X main.version=$Version\" -o \"$ToolsDir\\$($target.Output)\" .\n\n if ($LASTEXITCODE -ne 0) {\n Write-Warning \"uwnspeedtest build failed for $($target.Label)\"\n } else {\n Write-Host \"Built uwnspeedtest for $($target.Label)\" -ForegroundColor Green\n }\n }\n\n $env:CGO_ENABLED = $null\n $env:GOOS = $null\n $env:GOARCH = $null\n Pop-Location\n} else {\n Write-Warning \"Go not installed - uwnspeedtest binaries will not be available in this installer\"\n}\nWrite-Host \"\"\n\n# Step 3: Build wansteer binary (gateway-only, deployed via SSH to UniFi gateways)\nWrite-Host \"[3/5] Building wansteer binary...\" -ForegroundColor Yellow\n$WanSteerSrc = Join-Path $RepoRoot \"src\\wansteer\"\n\nif (-not (Test-Path $ToolsDir)) { New-Item -ItemType Directory -Path $ToolsDir | Out-Null }\n\nif ($GoCmd) {\n Push-Location $WanSteerSrc\n\n $env:CGO_ENABLED = \"0\"\n $env:GOOS = \"linux\"\n $env:GOARCH = \"arm64\"\n go build -trimpath -ldflags \"-s -w -X main.version=$Version\" -o \"$ToolsDir\\wansteer-linux-arm64\" .\n\n if ($LASTEXITCODE -ne 0) {\n Write-Warning \"wansteer build failed for linux/arm64\"\n } else {\n Write-Host \"Built wansteer for linux/arm64 (gateway)\" -ForegroundColor Green\n }\n\n $env:CGO_ENABLED = $null\n $env:GOOS = $null\n $env:GOARCH = $null\n Pop-Location\n} else {\n Write-Warning \"Go not installed - wansteer binary will not be available in this installer\"\n}\nWrite-Host \"\"\n\n# Step 4: Build WiX installer\nWrite-Host \"[4/5] Building MSI installer with WiX...\" -ForegroundColor Yellow\ndotnet build $InstallerProject -c $Configuration /nodeReuse:false\n\nif ($LASTEXITCODE -ne 0) {\n Write-Error \"WiX build failed!\"\n exit 1\n}\n\nWrite-Host \"\"\n\n# Step 5: Copy to output\nWrite-Host \"[5/5] Copying installer to publish folder...\" -ForegroundColor Yellow\n\nif (-not (Test-Path $OutputDir)) {\n New-Item -ItemType Directory -Path $OutputDir | Out-Null\n}\n\n$InstallerBin = Join-Path $RepoRoot \"src\\NetworkOptimizer.Installer\\bin\\$Configuration\"\n$MsiFile = Get-ChildItem -Path $InstallerBin -Filter \"*.msi\" -Recurse | Select-Object -First 1\n\nif ($MsiFile) {\n $OutputName = \"NetworkOptimizer-$Version-win-x64.msi\"\n $OutputPath = Join-Path $OutputDir $OutputName\n Copy-Item $MsiFile.FullName $OutputPath -Force\n\n $SizeMB = [math]::Round((Get-Item $OutputPath).Length / 1MB, 2)\n\n Write-Host \"\"\n Write-Host \"=== Build Complete ===\" -ForegroundColor Green\n Write-Host \"Installer: $OutputPath\"\n Write-Host \"Size: $SizeMB MB\"\n}\nelse {\n Write-Error \"MSI file not found in $InstallerBin\"\n exit 1\n}\n"
},
{
"path": "scripts/build.sh",
"content": "#!/bin/bash\n# Build the project\nset -e\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nPROJECT_ROOT=\"$(dirname \"$SCRIPT_DIR\")\"\n\ncd \"$PROJECT_ROOT\"\n\nCONFIG=\"${1:-Debug}\"\n\necho \"Building ($CONFIG)...\"\ndotnet build -c \"$CONFIG\"\n\necho \"\"\necho \"Build complete!\"\n"
},
{
"path": "scripts/clean.sh",
"content": "#!/bin/bash\n# Clean build artifacts and coverage\nset -e\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nPROJECT_ROOT=\"$(dirname \"$SCRIPT_DIR\")\"\n\ncd \"$PROJECT_ROOT\"\n\necho \"Cleaning build artifacts...\"\ndotnet clean -v q\n\necho \"Removing bin/obj directories...\"\nfind . -type d \\( -name \"bin\" -o -name \"obj\" \\) -not -path \"./node_modules/*\" -exec rm -rf {} + 2>/dev/null || true\n\necho \"Removing coverage directory...\"\nrm -rf \"$PROJECT_ROOT/coverage\"\n\necho \"\"\necho \"Clean complete!\"\n"
},
{
"path": "scripts/coverage.runsettings",
"content": "\n\n \n \n \n \n cobertura\n [*Tests*]*,[*]*.Migrations.*\n Obsolete,GeneratedCodeAttribute,CompilerGeneratedAttribute\n false\n true\n \n \n \n \n\n"
},
{
"path": "scripts/coverage.sh",
"content": "#!/bin/bash\n# Run tests with code coverage and generate HTML report\nset -e\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nPROJECT_ROOT=\"$(dirname \"$SCRIPT_DIR\")\"\nCOVERAGE_DIR=\"$PROJECT_ROOT/coverage\"\n\ncd \"$PROJECT_ROOT\"\n\n# Clean previous coverage\nrm -rf \"$COVERAGE_DIR\"\nmkdir -p \"$COVERAGE_DIR\"\n\necho \"Running tests with coverage...\"\ndotnet test \\\n --collect:\"XPlat Code Coverage\" \\\n --results-directory \"$COVERAGE_DIR\" \\\n --settings \"$SCRIPT_DIR/coverage.runsettings\"\n\n# Find all coverage files\nCOVERAGE_FILES=$(find \"$COVERAGE_DIR\" -name \"coverage.cobertura.xml\" | tr '\\n' ';' | sed 's/;$//')\n\nif [ -z \"$COVERAGE_FILES\" ]; then\n echo \"Error: No coverage files generated\"\n exit 1\nfi\n\necho \"\"\necho \"Coverage files found:\"\nfind \"$COVERAGE_DIR\" -name \"coverage.cobertura.xml\"\n\n# Try to generate HTML report if reportgenerator is available\nif command -v reportgenerator &> /dev/null; then\n echo \"\"\n echo \"Generating HTML report...\"\n reportgenerator \\\n -reports:\"$COVERAGE_FILES\" \\\n -targetdir:\"$COVERAGE_DIR/report\" \\\n -reporttypes:\"Html;TextSummary\"\n\n echo \"\"\n echo \"=== Coverage Summary ===\"\n cat \"$COVERAGE_DIR/report/Summary.txt\" 2>/dev/null || true\n echo \"\"\n echo \"HTML report: $COVERAGE_DIR/report/index.html\"\nelse\n echo \"\"\n echo \"=== Coverage Summary (first file) ===\"\n FIRST_FILE=$(find \"$COVERAGE_DIR\" -name \"coverage.cobertura.xml\" | head -1)\n grep -E \"line-rate|branch-rate\" \"$FIRST_FILE\" | head -1 | \\\n sed 's/.*line-rate=\"\\([^\"]*\\)\".*branch-rate=\"\\([^\"]*\\)\".*/Line: \\1, Branch: \\2/' | \\\n awk -F',' '{\n split($1, l, \": \");\n split($2, b, \": \");\n printf \"Line Coverage: %.1f%%\\n\", l[2] * 100;\n printf \"Branch Coverage: %.1f%%\\n\", b[2] * 100;\n }'\n\n echo \"\"\n echo \"To get a merged report, install ReportGenerator:\"\n echo \" dotnet tool install -g dotnet-reportgenerator-globaltool\"\nfi\n"
},
{
"path": "scripts/deploy-external-speedtest.sh",
"content": "#!/bin/bash\n# Deploy or update an external OpenSpeedTest server for WAN speed testing\n# This fetches only the speedtest files needed - not the full repo\n#\n# Usage:\n# Fresh install (interactive):\n# ./deploy-external-speedtest.sh\n#\n# Fresh install (from Settings-generated command):\n# ./deploy-external-speedtest.sh [port]\n#\n# Update existing installation:\n# ./deploy-external-speedtest.sh --update\n#\n# Prerequisites: Docker and Docker Compose on the target machine\n\nset -e\n\nINSTALL_DIR=\"/opt/netopt-speed-test\"\nBRANCH=\"${BRANCH:-main}\"\nGITHUB_REPO=\"Ozark-Connect/NetworkOptimizer\"\n\n# --- Slug generation (must match C# ExternalSpeedTestServer.GenerateServerId) ---\ngenerate_server_id() {\n echo \"$1\" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//'\n}\n\n# --- Download all required files from GitHub via tarball ---\n# Uses the GitHub API to download a tarball of the repo, then extracts only\n# the files needed for the speed test container. No file list to maintain.\ndownload_files() {\n local TARBALL_URL=\"https://github.com/$GITHUB_REPO/archive/refs/heads/$BRANCH.tar.gz\"\n local TEMP_TAR=$(mktemp)\n local TEMP_DIR=$(mktemp -d)\n\n curl -sL \"$TARBALL_URL\" -o \"$TEMP_TAR\"\n\n # Extract only the directories we need\n # Tarball root is NetworkOptimizer-/\n local STRIP=1 # strip the root directory\n # Extract only the directories we need\n # --wildcards is needed on GNU tar (Linux), but errors on BSD tar (macOS)\n if tar --version 2>&1 | grep -q GNU; then\n tar -xzf \"$TEMP_TAR\" -C \"$TEMP_DIR\" --strip-components=$STRIP --wildcards \\\n \"*/src/OpenSpeedTest/\" \\\n \"*/docker/openspeedtest/\"\n else\n tar -xzf \"$TEMP_TAR\" -C \"$TEMP_DIR\" --strip-components=$STRIP \\\n \"*/src/OpenSpeedTest/\" \\\n \"*/docker/openspeedtest/\"\n fi\n\n # Copy into install directory\n mkdir -p docker/openspeedtest src/OpenSpeedTest\n cp -r \"$TEMP_DIR/docker/openspeedtest/\"* docker/openspeedtest/\n cp -r \"$TEMP_DIR/src/OpenSpeedTest/\"* src/OpenSpeedTest/\n\n rm -rf \"$TEMP_TAR\" \"$TEMP_DIR\"\n}\n\n# --- Update mode ---\nif [ \"${1}\" = \"--update\" ]; then\n if [ ! -f \"$INSTALL_DIR/docker-compose.yml\" ]; then\n echo \"Error: No existing installation found at $INSTALL_DIR\"\n echo \"Run without --update to do a fresh install.\"\n exit 1\n fi\n\n cd \"$INSTALL_DIR\"\n\n echo \"=== Updating External Speed Test Server ===\"\n echo \"\"\n echo \"Downloading latest files...\"\n\n download_files\n\n echo \"Rebuilding container...\"\n docker compose build\n docker compose up -d\n\n echo \"\"\n echo \"=== Update Complete ===\"\n exit 0\nfi\n\n# --- Fresh install ---\n\n# Check Docker first\nif ! command -v docker &> /dev/null; then\n echo \"Error: Docker is not installed\"\n exit 1\nfi\n\nif ! docker compose version &> /dev/null; then\n echo \"Error: Docker Compose is not installed\"\n exit 1\nfi\n\n# If args provided, use them (non-interactive / Settings-generated command)\nif [ -n \"$1\" ]; then\n OPTIMIZER_URL=\"$1\"\n SERVER_ID=\"${2:-external}\"\n PORT=\"${3:-3005}\"\nelse\n # Interactive mode\n echo \"=== Network Optimizer - External Speed Test Server Setup ===\"\n echo \"\"\n echo \"This sets up a remote speed test server that your network clients can use\"\n echo \"to measure their real internet (WAN) speed. Results are posted back to your\"\n echo \"Network Optimizer instance automatically.\"\n echo \"\"\n\n # Optimizer URL\n echo \"What is the URL of your Network Optimizer instance?\"\n echo \" This is the address your browser uses to access Network Optimizer.\"\n echo \" Examples: https://optimizer.example.com, http://192.168.1.100:8042\"\n echo \"\"\n read -rp \"Optimizer URL: \" OPTIMIZER_URL < /dev/tty\n if [ -z \"$OPTIMIZER_URL\" ]; then\n echo \"Error: Optimizer URL is required.\"\n exit 1\n fi\n\n echo \"\"\n\n # Server ID\n echo \"If you've already configured this server in Network Optimizer Settings,\"\n echo \"enter the Server ID shown there. Otherwise, enter a friendly name and\"\n echo \"we'll generate the ID for you.\"\n echo \"\"\n read -rp \"Server ID or name (e.g. vps-chicago or VPS Chicago): \" SERVER_INPUT < /dev/tty\n if [ -z \"$SERVER_INPUT\" ]; then\n echo \"Error: Server ID or name is required.\"\n exit 1\n fi\n\n # Check if it looks like a slug already (lowercase, hyphens, numbers only) or a display name\n if echo \"$SERVER_INPUT\" | grep -qE '^[a-z0-9][a-z0-9-]*[a-z0-9]$'; then\n SERVER_ID=\"$SERVER_INPUT\"\n else\n SERVER_ID=$(generate_server_id \"$SERVER_INPUT\")\n echo \"\"\n echo \" Generated Server ID: $SERVER_ID\"\n echo \"\"\n echo \" Important: When you configure this server in Network Optimizer Settings,\"\n echo \" use the name \\\"$SERVER_INPUT\\\" so the Server IDs match.\"\n fi\n\n echo \"\"\n\n # Port\n read -rp \"Port [3005]: \" PORT < /dev/tty\n PORT=\"${PORT:-3005}\"\n\n echo \"\"\nfi\n\necho \"=== Network Optimizer - External Speed Test Server ===\"\necho \"Optimizer URL: $OPTIMIZER_URL\"\necho \"Server ID: $SERVER_ID\"\necho \"Port: $PORT\"\necho \"Install Dir: $INSTALL_DIR\"\necho \"\"\n\n# Create install directory\nmkdir -p \"$INSTALL_DIR\"\ncd \"$INSTALL_DIR\"\n\necho \"Downloading speed test files...\"\ndownload_files\n\n# Create .dockerignore\ncat > .dockerignore << 'EOF'\n.git\n*.md\ntests/\nscripts/\nresearch/\nplans/\nEOF\n\n# Create docker-compose.yml\ncat > docker-compose.yml << COMPOSE_EOF\nservices:\n speedtest:\n build:\n context: .\n dockerfile: docker/openspeedtest/Dockerfile\n container_name: netopt-wan-speedtest\n restart: unless-stopped\n ports:\n - \"${PORT}:3000\"\n environment:\n - TZ=\\${TZ:-UTC}\n - REVERSE_PROXIED_HOST_NAME=$(echo \"$OPTIMIZER_URL\" | sed 's|https\\?://||' | sed 's|/.*||')\n - EXTERNAL_SERVER_ID=${SERVER_ID}\nCOMPOSE_EOF\n\necho \"Building and starting speed test server...\"\ndocker compose build\ndocker compose up -d\n\necho \"\"\necho \"=== Deployment Complete ===\"\necho \"Speed test URL: http://$(hostname -I 2>/dev/null | awk '{print $1}' || echo 'localhost'):$PORT\"\necho \"\"\necho \"IMPORTANT: HTTPS is strongly recommended. Chrome and Edge block speed test\"\necho \"results from posting back when the page is served over HTTP (Private Network\"\necho \"Access). Firefox and Safari don't currently enforce this, but HTTPS is still\"\necho \"recommended. Set up a reverse proxy with TLS and HTTP/1.1.\"\necho \"See DEPLOYMENT.md for setup instructions.\"\necho \"\"\necho \"Then configure Network Optimizer Settings -> External Speed Test Server:\"\necho \" - Name: (use the same name you entered here so the Server IDs match)\"\necho \" - Host: speedtest.yourdomain.com\"\necho \" - Port: 443\"\necho \" - Scheme: HTTPS\"\necho \"\"\necho \"To update in the future, run:\"\necho \" curl -fsSL https://raw.githubusercontent.com/$GITHUB_REPO/main/scripts/deploy-external-speedtest.sh | bash -s -- --update\"\n"
},
{
"path": "scripts/docker-build.sh",
"content": "#!/bin/bash\n# Build Docker image locally\nset -e\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nPROJECT_ROOT=\"$(dirname \"$SCRIPT_DIR\")\"\n\ncd \"$PROJECT_ROOT/docker\"\n\nIMAGE_NAME=\"${1:-network-optimizer}\"\nTAG=\"${2:-latest}\"\n\necho \"Building Docker image: $IMAGE_NAME:$TAG\"\n\ndocker compose build network-optimizer\n\necho \"\"\necho \"Image built: $IMAGE_NAME:$TAG\"\n"
},
{
"path": "scripts/docker-run.sh",
"content": "#!/bin/bash\n# Run Docker container locally (macOS compatible)\nset -e\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nPROJECT_ROOT=\"$(dirname \"$SCRIPT_DIR\")\"\n\ncd \"$PROJECT_ROOT/docker\"\n\necho \"Starting container...\"\necho \"Access at http://localhost:8042\"\necho \"\"\n\ndocker compose -f docker-compose.macos.yml up -d\n\necho \"\"\necho \"Container started. View logs with: docker logs -f network-optimizer\"\n"
},
{
"path": "scripts/docker-stop.sh",
"content": "#!/bin/bash\n# Stop Docker container\nset -e\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nPROJECT_ROOT=\"$(dirname \"$SCRIPT_DIR\")\"\n\ncd \"$PROJECT_ROOT/docker\"\n\necho \"Stopping container...\"\n\ndocker compose -f docker-compose.macos.yml down\n\necho \"Container stopped.\"\n"
},
{
"path": "scripts/extract-elevation0-from-images.py",
"content": "\"\"\"\nExtract Elevation 0 deg antenna pattern data from Ubiquiti reference images.\n\nUses Elevation 90 deg plots (column 2) as ground truth to calibrate extraction.\nThe .ant files have el90 data, so we extract el90 from the image, compare to .ant,\nand use the match quality to validate center detection, radius, and angular mapping.\n\nUsage:\n python scripts/extract-elevation0-from-images.py --db-max 15 --db-min -20 [--debug]\n\nFor images with multiple antenna variants (e.g., E7-Audience narrow + wide):\n python scripts/extract-elevation0-from-images.py --db-max 10 --variants narrow,wide\n\nTo correct center detection offset (positive = move center down on page):\n python scripts/extract-elevation0-from-images.py --db-max 10 --cy-shift 15\n\nFor images where row detection merges adjacent rows (e.g., E7 Summary with 7 bands):\n python scripts/extract-elevation0-from-images.py --db-max 10 --n-bands 7\n\"\"\"\n\nimport sys\nimport json\nimport math\nfrom pathlib import Path\nfrom PIL import Image, ImageDraw, ImageFont\nimport numpy as np\n\n\n# ── Color detection ──────────────────────────────────────────────────────────\n\ndef is_pattern_line(r, g, b):\n \"\"\"Blue pattern line: R~11, G~11, B~253.\"\"\"\n return int(r) < 50 and int(g) < 50 and int(b) > 200\n\n\ndef is_grid_pixel(r, g, b):\n \"\"\"Grid lines have a distinct blue tint (B significantly > R and G).\n Excludes pure gray pixels from AP product images and text.\"\"\"\n ri, gi, bi = int(r), int(g), int(b)\n return (130 < bi < 255 and\n bi > ri + 15 and bi > gi + 15 and\n not is_pattern_line(r, g, b))\n\n\n# ── Plot detection ───────────────────────────────────────────────────────────\n\ndef find_row_spans(arr, col_start, col_end, n_expected=None):\n \"\"\"Find vertical spans containing blue pattern pixels in a column range.\n\n If n_expected is given, adaptively merges the closest spans until\n exactly n_expected remain. Otherwise uses a 20px gap threshold.\n \"\"\"\n h = arr.shape[0]\n\n # Build mask of blue pattern pixels\n mask = np.zeros((h, col_end - col_start), dtype=bool)\n for y in range(h):\n for x in range(col_start, col_end):\n r, g, b = arr[y, x, :3]\n if is_pattern_line(r, g, b):\n mask[y, x - col_start] = True\n\n # Find row spans with blue pixels\n row_has_blue = mask.any(axis=1)\n spans = []\n in_span = False\n start = 0\n for y in range(h):\n if row_has_blue[y] and not in_span:\n start = y\n in_span = True\n elif not row_has_blue[y] and in_span:\n if y - start > 30:\n spans.append((start, y))\n in_span = False\n if in_span and h - start > 30:\n spans.append((start, h))\n\n # Merge spans with < 20px gap (within-plot pixel noise)\n merged = [spans[0]] if spans else []\n for s, e in spans[1:]:\n if s - merged[-1][1] < 20:\n merged[-1] = (merged[-1][0], e)\n else:\n merged.append((s, e))\n\n return merged, mask\n\n\ndef find_grid_center(arr, y_start, y_end, col_start, col_end, rough_cx, rough_cy, pat_r):\n \"\"\"Find true plot center using grid pixel centroid.\n\n Grid circles are symmetric around the center, unlike the pattern which\n is asymmetric for directional antennas. The centroid of grid pixels\n gives us the actual polar plot origin.\n \"\"\"\n h = arr.shape[0]\n margin = int(pat_r * 0.3)\n scan_y0 = max(0, rough_cy - int(pat_r) - margin)\n scan_y1 = min(h, rough_cy + int(pat_r) + margin)\n scan_x0 = max(col_start, rough_cx - int(pat_r) - margin)\n scan_x1 = min(col_end, rough_cx + int(pat_r) + margin)\n\n grid_xs, grid_ys = [], []\n for y in range(scan_y0, scan_y1):\n for x in range(scan_x0, scan_x1):\n r, g, b = arr[y, x, :3]\n if is_grid_pixel(r, g, b):\n grid_xs.append(x)\n grid_ys.append(y)\n\n if len(grid_xs) > 100:\n return int(np.mean(grid_xs)), int(np.mean(grid_ys)), len(grid_xs)\n return rough_cx, rough_cy, len(grid_xs)\n\n\ndef is_grid_tinted(r, g, b):\n \"\"\"Relaxed grid pixel test for faint crosshair/ring lines.\n\n The standard is_grid_pixel requires B > R+15 and B > G+15 and B > 130,\n which misses faint grid lines (e.g., U7-Outdoor where B≈121, R≈105).\n This uses a gentler threshold: B > R+8 and B > G+8 with brightness check.\n \"\"\"\n ri, gi, bi = int(r), int(g), int(b)\n brightness = (ri + gi + bi) / 3\n if brightness > 215 or brightness < 30:\n return False\n if ri < 50 and gi < 50 and bi > 200: # pattern line\n return False\n return bi > ri + 8 and bi > gi + 8\n\n\ndef trace_crosshair_extent(arr, cx, cy, col_start, col_end):\n \"\"\"Find the outer radius by tracing both horizontal and vertical crosshairs.\n\n Each crosshair line (horizontal 90-270 and vertical 0-180) extends from\n center to the edge of the grid. We trace each line outward from center\n and find where it definitively ends (last non-white pixel before sustained\n white background). The maximum extent across all 4 directions gives the\n radius.\n\n This works regardless of whether the plot has a blue-tinted background.\n \"\"\"\n icx = int(round(cx))\n icy = int(round(cy))\n h, w = arr.shape[:2]\n\n def trace_line(start, step, get_pixel):\n \"\"\"Trace a crosshair line outward from center.\n Only tracks blue-tinted pixels (the grid/crosshair always has blue tint).\n Gray text labels (R≈G≈B) are ignored so they don't inflate the extent.\n Returns distance from center to the last blue-tinted pixel.\"\"\"\n pos = start\n last_tinted = 0\n white_run = 0\n\n while True:\n pixel = get_pixel(pos)\n if pixel is None:\n break # out of bounds\n\n r, g, b = pixel\n ri, gi, bi = int(r), int(g), int(b)\n brightness = (ri + gi + bi) / 3\n\n dist = abs(pos - start) + 20 # +20 because we start 20px from center\n\n # Only count pixels with blue tint (crosshair/grid always has it)\n # This skips gray text labels where R≈G≈B\n has_tint = (bi > ri + 3 and bi > gi + 3) and brightness < 240\n if has_tint:\n last_tinted = dist\n white_run = 0\n elif brightness >= 245:\n white_run += 1\n if white_run > 30:\n break # line has ended\n\n pos += step\n\n return last_tinted\n\n def get_h_pixel(x):\n if col_start <= x < col_end:\n return arr[icy, x, :3]\n return None\n\n def get_v_pixel(y):\n if 0 <= y < h:\n return arr[y, icx, :3]\n return None\n\n # Trace all 4 directions, starting 20px from center to skip AP image\n left_r = trace_line(icx - 20, -1, get_h_pixel)\n right_r = trace_line(icx + 20, 1, get_h_pixel)\n down_r = trace_line(icy + 20, 1, get_v_pixel)\n up_r = trace_line(icy - 20, -1, get_v_pixel)\n\n best = max(left_r, right_r, down_r, up_r)\n print(f\" crosshair_trace: L={left_r} R={right_r} \"\n f\"U={up_r} D={down_r} -> best={best}\")\n\n return best if best > 40 else None\n\n\ndef find_horizontal_crosshairs(arr, col_start, col_end):\n \"\"\"Find plot centers and approximate radii by scanning for horizontal crosshairs.\n\n Each polar plot has a horizontal crosshair (the 90-270 degree line) that\n spans the full grid diameter. For each row in the column, we measure the\n extent (leftmost to rightmost) of blue-tinted pixels. The crosshair row\n has the widest extent for each plot.\n\n Returns list of (cy, cx, half_diameter, min_x, max_x) sorted by cy.\n The min_x/max_x are the horizontal extent endpoints for later refinement.\n \"\"\"\n h = arr.shape[0]\n\n # For each row, find the extent of blue-tinted pixels\n row_data = [] # (y, min_x, max_x, extent)\n for y in range(h):\n min_x = None\n max_x = None\n for x in range(col_start, col_end):\n r, g, b = arr[y, x, :3]\n if is_grid_tinted(r, g, b) or is_grid_pixel(r, g, b):\n if min_x is None:\n min_x = x\n max_x = x\n\n if min_x is not None:\n extent = max_x - min_x\n if extent > 40: # minimum plausible plot diameter\n row_data.append((y, min_x, max_x, extent))\n\n if not row_data:\n return []\n\n # Group into vertical clusters separated by gaps > 30px\n clusters = [[row_data[0]]]\n for i in range(1, len(row_data)):\n if row_data[i][0] - row_data[i - 1][0] > 30:\n clusters.append([row_data[i]])\n else:\n clusters[-1].append(row_data[i])\n\n # For each cluster, find the row with the widest extent = crosshair row\n results = []\n for cluster in clusters:\n if len(cluster) < 10:\n continue # too small to be a plot\n\n best = max(cluster, key=lambda r: r[3])\n y, min_x, max_x, extent = best\n cx = (min_x + max_x) / 2\n half_r = extent / 2\n\n results.append((y, cx, half_r, min_x, max_x))\n\n return results\n\n\ndef compute_outer_ring_radius(blue_half_span, n_rings):\n \"\"\"Compute the outer ring radius from the crosshair blue-tinted extent.\n\n The blue-tinted crosshair gradient extends to the second-to-outermost\n grid ring. The outer ring (at db_max) is one ring-spacing further out:\n outer_r = blue_half_span * (n_rings - 1) / (n_rings - 2)\n\n For 7 rings (30 dB range, 5 dB spacing): outer_r = half_span * 6/5\n \"\"\"\n n_intervals = n_rings - 1\n return blue_half_span * n_intervals / (n_intervals - 1)\n\n\ndef _trace_vertical_crosshair(arr, cx, cy):\n \"\"\"Trace the vertical crosshair (0-180 degree line) up and down from center.\n\n Uses the same blue-tint-only logic as horizontal crosshair tracing.\n Returns max(up_extent, down_extent), or None if no tinted pixels found.\n \"\"\"\n h = arr.shape[0]\n icx = int(round(cx))\n icy = int(round(cy))\n\n def trace_v(start_y, step):\n pos = start_y\n last_tinted = 0\n white_run = 0\n while True:\n if pos < 0 or pos >= h:\n break\n r, g, b = arr[pos, icx, :3]\n ri, gi, bi = int(r), int(g), int(b)\n brightness = (ri + gi + bi) / 3\n dist = abs(pos - icy)\n has_tint = (bi > ri + 3 and bi > gi + 3) and brightness < 240\n if has_tint:\n last_tinted = dist\n white_run = 0\n elif brightness >= 245:\n white_run += 1\n if white_run > 30:\n break\n pos += step\n return last_tinted\n\n up_r = trace_v(icy - 20, -1)\n down_r = trace_v(icy + 20, 1)\n\n best = max(up_r, down_r)\n print(f\" vertical_trace: U={up_r} D={down_r} -> best={best}\")\n return best if best > 40 else None\n\n\ndef _find_ring_spacing_from_crosshair(arr, cx, cy, current_radius):\n \"\"\"Refine center and outer ring radius by detecting ring crossings on the crosshair row.\n\n Scans LEFT from center along the horizontal crosshair, detecting brightness\n dips where concentric grid rings cross the line. If 3+ consecutive dips have\n consistent spacing:\n 1. Snaps current_radius to the nearest ring boundary\n 2. Computes a refined center from the ring positions (each dip should be\n at an integer multiple of spacing from the true center)\n\n Returns (outer_radius, refined_cx) or (None, None) if not detected.\n \"\"\"\n icx = int(round(cx))\n icy = int(round(cy))\n\n # Scan LEFT from center, collecting brightness dips\n start_dist = 80 # skip center area\n max_dist = int(current_radius * 1.3)\n\n dips = []\n in_dip = False\n dip_min_bright = 999\n dip_min_dist = 0\n\n for dist in range(start_dist, max_dist):\n x = icx - dist\n if x < 0:\n break\n r, g, b = arr[icy, x, :3]\n bright = (int(r) + int(g) + int(b)) / 3\n\n if bright < 95:\n if not in_dip:\n in_dip = True\n dip_min_bright = bright\n dip_min_dist = dist\n elif bright < dip_min_bright:\n dip_min_bright = bright\n dip_min_dist = dist\n else:\n if in_dip:\n dips.append(dip_min_dist)\n in_dip = False\n dip_min_bright = 999\n\n # Cluster dips within 4px\n if not dips:\n return None, None\n clustered = [dips[0]]\n for d in dips[1:]:\n if d - clustered[-1] < 4:\n clustered[-1] = (clustered[-1] + d) // 2\n else:\n clustered.append(d)\n\n print(f\" ring_dips LEFT: {clustered}\")\n\n # Find 3+ consecutive dips with consistent spacing\n spacing = _find_consistent_spacing(clustered, tol=5)\n if spacing is None or spacing < 15:\n print(f\" no consistent ring spacing found\"\n f\"{f' (spacing={spacing:.1f} too small)' if spacing else ''}\")\n return None, None\n\n # Snap current_radius to nearest ring boundary\n n_intervals = round(current_radius / spacing)\n outer_r = n_intervals * spacing\n\n # Refine center: each dip at distance d from icx should be at\n # ring_n * spacing from true center. Compute true_cx from each dip\n # using the consistent-spacing dips only.\n # Dip at distance d (going left) means ring is at x = icx - d.\n # Ring number n (from center) satisfies: true_cx - (icx - d) = n * spacing\n # So true_cx = icx - d + n * spacing, where n = round(d / spacing).\n cx_estimates = []\n for d in clustered:\n n = round(d / spacing)\n if n >= 1:\n est_cx = icx - d + n * spacing\n cx_estimates.append(est_cx)\n\n if cx_estimates:\n import statistics\n refined_cx = statistics.median(cx_estimates)\n else:\n refined_cx = cx\n\n print(f\" ring_spacing={spacing:.1f}, snap {current_radius:.0f} \"\n f\"-> {n_intervals} intervals -> outer_r={outer_r:.0f}, \"\n f\"cx {cx:.0f}->{refined_cx:.1f}\")\n return outer_r, refined_cx\n\n\ndef _find_consistent_spacing(dips, tol=5):\n \"\"\"Find consistent spacing among 3+ consecutive dips.\n\n Returns the median spacing if found, None otherwise.\n \"\"\"\n if len(dips) < 3:\n return None\n\n for i in range(len(dips) - 2):\n spacings = []\n for j in range(i, len(dips) - 1):\n spacings.append(dips[j + 1] - dips[j])\n\n # Check for 3+ consecutive spacings within tolerance\n for start in range(len(spacings) - 1):\n consistent = [spacings[start]]\n for k in range(start + 1, len(spacings)):\n if abs(spacings[k] - spacings[start]) <= tol:\n consistent.append(spacings[k])\n else:\n break\n if len(consistent) >= 2: # 2 spacings = 3 dips\n import statistics\n return statistics.median(consistent)\n\n return None\n\n\ndef find_plots_in_column(arr, col_start, col_end, n_expected=None, n_rings=7):\n \"\"\"Find polar plot centers in a column range.\n\n Primary method: scan for horizontal crosshair lines. Each plot's crosshair\n (the 90-270 degree line) spans the full grid diameter. The widest row of\n grid-tinted pixels per plot gives both center and radius.\n\n Falls back to blue-pixel span detection if horizontal line scan finds\n fewer plots than the blue-pixel detection.\n \"\"\"\n h = arr.shape[0]\n\n # Primary: find plots via horizontal crosshair lines\n crosshairs = find_horizontal_crosshairs(arr, col_start, col_end)\n\n # Also find blue pattern spans (for pattern_radius and fallback)\n merged, mask = find_row_spans(arr, col_start, col_end, n_expected=n_expected)\n\n # Match each crosshair to its nearest blue pattern span\n plots = []\n for ch_cy, ch_cx, ch_half_r, ch_min_x, ch_max_x in crosshairs:\n cx = int(round(ch_cx))\n cy = ch_cy\n radius = ch_half_r\n\n print(f\" horiz_line: cy={cy} cx={cx} half_diameter={ch_half_r:.0f}\"\n f\" min_x={ch_min_x} max_x={ch_max_x}\")\n\n # Find the blue pattern span containing this crosshair\n blue_xs, blue_ys = [], []\n best_span = None\n for y_start, y_end in merged:\n if y_start - 30 <= cy <= y_end + 30:\n best_span = (y_start, y_end)\n for y in range(y_start, y_end):\n for x in range(col_start, col_end):\n if mask[y, x - col_start]:\n blue_xs.append(x)\n blue_ys.append(y)\n break\n\n if blue_xs:\n rough_cx = (min(blue_xs) + max(blue_xs)) // 2\n rough_cy = (min(blue_ys) + max(blue_ys)) // 2\n dists = [math.sqrt((bx - cx) ** 2 + (by - cy) ** 2)\n for bx, by in zip(blue_xs, blue_ys)]\n dists.sort()\n pat_r = dists[int(len(dists) * 0.95)]\n else:\n rough_cx, rough_cy = cx, cy\n pat_r = radius * 0.8\n\n plots.append({\n \"cx\": cx, \"cy\": cy,\n \"blue_cx\": rough_cx, \"blue_cy\": rough_cy,\n \"pattern_radius\": pat_r,\n \"radius\": radius,\n \"h_min_x\": ch_min_x, \"h_max_x\": ch_max_x,\n \"y_range\": best_span or (cy - int(radius), cy + int(radius)),\n \"n_grid_pixels\": 0,\n })\n\n # Deduplicate: if two plots are within 150px vertically, keep wider one\n plots.sort(key=lambda p: p[\"cy\"])\n deduped = []\n i = 0\n while i < len(plots):\n if i + 1 < len(plots) and abs(plots[i + 1][\"cy\"] - plots[i][\"cy\"]) < 150:\n deduped.append(plots[i] if plots[i][\"radius\"] >= plots[i + 1][\"radius\"]\n else plots[i + 1])\n i += 2\n else:\n deduped.append(plots[i])\n i += 1\n plots = deduped\n\n # Enforce consistent cx across plots with similar centers.\n # Plots with very different raw centers (e.g., 2.4 GHz vs 5 GHz rows with\n # different plot sizes) keep their own center to avoid offset errors.\n if len(plots) > 1:\n median_cx = int(sorted(p[\"cx\"] for p in plots)[len(plots) // 2])\n for p in plots:\n old_cx = p[\"cx\"]\n if abs(old_cx - median_cx) <= 8:\n p[\"cx\"] = median_cx\n print(f\" enforce cx {old_cx}->{median_cx}\")\n else:\n print(f\" keep raw cx {old_cx} (median={median_cx}, \"\n f\"diff={abs(old_cx - median_cx)})\")\n\n # Recompute radius from (possibly enforced) center using endpoints\n left_r = p[\"cx\"] - p[\"h_min_x\"]\n right_r = p[\"h_max_x\"] - p[\"cx\"]\n h_radius = max(left_r, right_r)\n print(f\" H left_r={left_r} right_r={right_r} -> \"\n f\"h_radius={h_radius}\")\n p[\"radius\"] = h_radius\n\n # Compute scan y_range for each plot: midpoint to adjacent plots (or image edge)\n h = arr.shape[0]\n for i, p in enumerate(plots):\n top = plots[i - 1][\"cy\"] if i > 0 else 0\n bot = plots[i + 1][\"cy\"] if i < len(plots) - 1 else h\n mid_top = (top + p[\"cy\"]) // 2 if i > 0 else 0\n mid_bot = (p[\"cy\"] + bot) // 2 if i < len(plots) - 1 else h\n p[\"scan_y_range\"] = (mid_top, mid_bot)\n\n # Refine radius using vertical crosshair trace and ring spacing snap\n for p in plots:\n # Vertical crosshair trace (blue-tint-only)\n v_radius = _trace_vertical_crosshair(arr, p[\"cx\"], p[\"cy\"])\n if v_radius is not None:\n p[\"radius\"] = max(p[\"radius\"], v_radius)\n\n # Ring spacing snap: detect ring crossings on crosshair row, then\n # snap the current radius to the nearest ring boundary and refine cx.\n ring_r, refined_cx = _find_ring_spacing_from_crosshair(\n arr, p[\"cx\"], p[\"cy\"], p[\"radius\"])\n if ring_r is not None:\n old_r = p[\"radius\"]\n old_cx = p[\"cx\"]\n if ring_r != old_r:\n p[\"radius\"] = int(round(ring_r))\n if abs(refined_cx - old_cx) > 1:\n p[\"cx\"] = int(round(refined_cx))\n if p[\"radius\"] != old_r or p[\"cx\"] != old_cx:\n print(f\" ring_snap refined cy={p['cy']}: \"\n f\"cx {old_cx}->{p['cx']} r {old_r:.0f}->{p['radius']}\")\n\n return plots\n\n\ndef detect_outer_from_crosshair_extent(arr, cx, cy, col_start, col_end):\n \"\"\"Find outer ring radius by scanning along crosshair lines.\n\n The horizontal and vertical crosshairs are continuous lines of grid-colored\n pixels that extend from center to the outer ring. The last grid pixel in\n each direction is on the outer ring.\n\n Scans 4 directions (right, left, up, down), takes the median to handle\n edges or occlusion, and verifies there's a clear gap beyond (white background,\n not stray grid-colored pixels).\n\n Returns the computed outer ring radius, or None if detection fails.\n \"\"\"\n h, w = arr.shape[:2]\n extents = []\n\n # Scan right along horizontal crosshair\n last_grid = None\n gap_after = 0\n for x in range(cx + 5, min(col_end, cx + 400)):\n r, g, b = arr[cy, x, :3]\n if is_grid_pixel(r, g, b):\n last_grid = x\n gap_after = 0\n else:\n gap_after += 1\n if gap_after > 15 and last_grid is not None:\n break # clear gap after last grid pixel = beyond outer ring\n if last_grid is not None:\n extents.append((\"right\", last_grid - cx))\n\n # Scan left\n last_grid = None\n gap_after = 0\n for x in range(cx - 5, max(col_start, cx - 400), -1):\n r, g, b = arr[cy, x, :3]\n if is_grid_pixel(r, g, b):\n last_grid = x\n gap_after = 0\n else:\n gap_after += 1\n if gap_after > 15 and last_grid is not None:\n break\n if last_grid is not None:\n extents.append((\"left\", cx - last_grid))\n\n # Scan up along vertical crosshair\n last_grid = None\n gap_after = 0\n for y in range(cy - 5, max(0, cy - 400), -1):\n r, g, b = arr[y, cx, :3]\n if is_grid_pixel(r, g, b):\n last_grid = y\n gap_after = 0\n else:\n gap_after += 1\n if gap_after > 15 and last_grid is not None:\n break\n if last_grid is not None:\n extents.append((\"up\", cy - last_grid))\n\n # Scan down\n last_grid = None\n gap_after = 0\n for y in range(cy + 5, min(h, cy + 400)):\n r, g, b = arr[y, cx, :3]\n if is_grid_pixel(r, g, b):\n last_grid = y\n gap_after = 0\n else:\n gap_after += 1\n if gap_after > 15 and last_grid is not None:\n break\n if last_grid is not None:\n extents.append((\"down\", last_grid - cy))\n\n if not extents:\n return None\n\n # Take median of all valid extents\n values = sorted(v for _, v in extents)\n if len(values) >= 3:\n outer_r = values[len(values) // 2]\n else:\n outer_r = int(sum(values) / len(values))\n\n labels = \", \".join(f\"{d}={v}\" for d, v in extents)\n print(f\" crosshair_extent: {labels} -> outer_r={outer_r}\")\n\n return outer_r\n\n\ndef detect_grid_boundary(arr, cx, cy, pattern_radius, col_start, col_end):\n \"\"\"Find outermost grid ring using distance histogram of grid pixels.\n\n Collects distances from center to all grid pixels, builds a histogram,\n and finds peaks. Grid rings create peaks; scattered label pixels don't.\n The outermost clear peak is the outer grid ring.\n \"\"\"\n h = arr.shape[0]\n margin = int(pattern_radius * 0.5)\n scan_r = int(pattern_radius) + margin\n\n # Scan region around center for grid pixels and record their distance\n scan_y0 = max(0, cy - scan_r)\n scan_y1 = min(h, cy + scan_r)\n scan_x0 = max(col_start, cx - scan_r)\n scan_x1 = min(col_end, cx + scan_r)\n\n dist_hist = [0] * (scan_r + 1)\n for y in range(scan_y0, scan_y1):\n for x in range(scan_x0, scan_x1):\n rv, gv, bv = arr[y, x, :3]\n if is_grid_pixel(rv, gv, bv):\n d = int(math.sqrt((x - cx) ** 2 + (y - cy) ** 2))\n if d <= scan_r:\n dist_hist[d] += 1\n\n # Smooth histogram (5px window) to find ring peaks\n smoothed = [0] * len(dist_hist)\n for i in range(2, len(dist_hist) - 2):\n smoothed[i] = sum(dist_hist[i - 2:i + 3]) / 5\n\n # Find peaks: local maxima above a threshold.\n # Grid rings should have more pixels than inter-ring areas.\n threshold = max(smoothed[10:]) * 0.3 if max(smoothed[10:]) > 0 else 1\n peaks = []\n for r in range(10, len(smoothed) - 3):\n if (smoothed[r] >= threshold and\n smoothed[r] >= smoothed[r - 3] and\n smoothed[r] >= smoothed[r + 3]):\n peaks.append((r, smoothed[r]))\n\n # Deduplicate peaks within 5px of each other (keep highest)\n deduped = []\n for r, v in peaks:\n if deduped and r - deduped[-1][0] < 5:\n if v > deduped[-1][1]:\n deduped[-1] = (r, v)\n else:\n deduped.append((r, v))\n\n if deduped:\n # The outermost peak is the outer grid ring.\n # But check: if the outermost peak is much weaker than inner peaks,\n # it might be a label artifact. Use the outermost \"strong\" peak.\n max_val = max(v for _, v in deduped)\n strong_peaks = [(r, v) for r, v in deduped if v > max_val * 0.2]\n outer_r = max(r for r, v in strong_peaks)\n return outer_r\n\n return int(pattern_radius)\n\n\ndef _kasa_circle_fit(points):\n \"\"\"Algebraic circle fit (Kasa method) for a list of (x, y) points.\n\n Returns (cx, cy, radius).\n \"\"\"\n xs = np.array([p[0] for p in points], dtype=float)\n ys = np.array([p[1] for p in points], dtype=float)\n\n A = np.column_stack([xs, ys, np.ones(len(xs))])\n b_vec = xs ** 2 + ys ** 2\n result, _, _, _ = np.linalg.lstsq(A, b_vec, rcond=None)\n\n fit_cx = result[0] / 2\n fit_cy = result[1] / 2\n fit_r = math.sqrt(abs(result[2] + fit_cx ** 2 + fit_cy ** 2))\n\n return fit_cx, fit_cy, fit_r\n\n\ndef fit_outer_ring(arr, rough_cx, rough_cy, pattern_radius, col_start, col_end):\n \"\"\"Find the outer grid ring by scanning from outside inward at many angles.\n\n The AP product image can occlude inner rings, but the outer ring is always\n visible. Scans from well outside the plot inward, looking for the first\n non-white pixel (brightness-based, since grid rings may be gray without\n blue tint). Uses iterative outlier removal to reject text label hits.\n\n Returns (fit_cx, fit_cy, fit_radius) or None if insufficient data.\n \"\"\"\n h, w = arr.shape[:2]\n scan_start = int(pattern_radius) + 30 # well outside plot\n\n def is_pattern_line_local(r, g, b):\n return int(r) < 50 and int(g) < 50 and int(b) > 200\n\n # Scan from outside inward at many angles.\n # To distinguish ring pixels (thin line, 1-3px) from text (multi-pixel blocks),\n # we require a \"thin line\" pattern: the hit pixel should have white within\n # a few pixels on the inner side (ring is thin, text is thick).\n ring_points = []\n for angle_deg in range(0, 360, 2): # every 2 degrees\n angle_rad = math.radians(angle_deg)\n cos_a = math.cos(angle_rad)\n sin_a = math.sin(angle_rad)\n\n for r in range(scan_start, 40, -1):\n x = int(rough_cx + r * cos_a)\n y = int(rough_cy + r * sin_a)\n if not (0 <= x < w and 0 <= y < h):\n continue\n rv, gv, bv = arr[y, x, :3]\n brightness = (int(rv) + int(gv) + int(bv)) / 3\n if brightness >= 230 or is_pattern_line_local(rv, gv, bv):\n continue\n\n # Check that this is a thin line: within 5px inward there should be\n # a white pixel (ring lines are 1-3px wide, text is wider)\n is_thin = False\n for dr in range(1, 6):\n ix = int(rough_cx + (r - dr) * cos_a)\n iy = int(rough_cy + (r - dr) * sin_a)\n if 0 <= ix < w and 0 <= iy < h:\n irv, igv, ibv = arr[iy, ix, :3]\n ib = (int(irv) + int(igv) + int(ibv)) / 3\n if ib > 240:\n is_thin = True\n break\n\n if is_thin:\n ring_points.append((x, y))\n break\n\n if len(ring_points) < 30:\n return None\n\n # First pass: use median radius from rough center to reject gross outliers\n radii = [math.sqrt((x - rough_cx) ** 2 + (y - rough_cy) ** 2)\n for x, y in ring_points]\n median_r = sorted(radii)[len(radii) // 2]\n points = [p for p, r in zip(ring_points, radii) if abs(r - median_r) < 10]\n\n if len(points) < 20:\n return None\n\n # Iterative circle fit with outlier removal\n for _ in range(3):\n if len(points) < 15:\n break\n\n fit_cx, fit_cy, fit_r = _kasa_circle_fit(points)\n\n residuals = []\n for px, py in points:\n d = math.sqrt((px - fit_cx) ** 2 + (py - fit_cy) ** 2)\n residuals.append(abs(d - fit_r))\n\n median_res = sorted(residuals)[len(residuals) // 2]\n threshold = max(median_res * 2.5, 3.0)\n points = [p for p, res in zip(points, residuals) if res < threshold]\n\n if len(points) < 15:\n return None\n\n return _kasa_circle_fit(points)\n\n\n# ── Pattern extraction ───────────────────────────────────────────────────────\n\ndef extract_polar_pattern(arr, cx, cy, outer_radius, db_max, db_range,\n search_start=None):\n \"\"\"Extract gain values by ray casting from center outward.\n\n outer_radius: radius that maps to db_max (the outer grid ring) for dB calculation.\n search_start: outermost radius to scan from (default: outer_radius + 5).\n Set to pattern_radius + margin to avoid hitting legend markers\n or other artifacts outside the actual pattern.\n\n Returns 359 values (0-358 degrees) in absolute dBi.\n Convention: 0 deg at top of polar plot, clockwise.\n \"\"\"\n h, w = arr.shape[:2]\n db_min = db_max - db_range\n if search_start is None:\n search_start = int(outer_radius) + 5\n\n gains = []\n for angle_deg in range(359):\n # 0 deg at top (north), clockwise\n angle_rad = math.radians(-angle_deg - 90) # CCW from 12 o'clock\n cos_a = math.cos(angle_rad)\n sin_a = math.sin(angle_rad)\n\n # Cast ray from search_start inward, find outermost blue pixel.\n # Use wider perpendicular band near horizontal crosshair angles\n # (85-95° and 265-275°) where the crosshair gradient occludes pattern.\n near_horizontal = ((85 <= angle_deg <= 95) or (265 <= angle_deg <= 275))\n offsets = [-3, -2, -1, 0, 1, 2, 3] if near_horizontal else [-1, 0, 1]\n\n found_r = 0\n for r in range(search_start, 2, -1):\n hit = False\n for offset in offsets:\n # Perpendicular offset\n x = int(cx + r * cos_a + offset * sin_a)\n y = int(cy + r * sin_a - offset * cos_a)\n if 0 <= x < w and 0 <= y < h:\n rv, gv, bv = arr[y, x, :3]\n if is_pattern_line(rv, gv, bv):\n hit = True\n break\n if hit:\n found_r = r\n break\n\n # Map radius to dB (linear: center=db_min, outer=db_max)\n if found_r > 0:\n gain = db_min + (found_r / outer_radius) * db_range\n else:\n gain = db_min\n\n gains.append(round(gain, 1))\n\n # Despike: replace single/double-degree nulls caused by ray-casting misses.\n # The pattern line is 1-2px wide; at certain angles the 3px-wide ray can\n # slip through, producing a sudden deep null surrounded by normal values.\n gains = despike(gains)\n\n return gains\n\n\ndef despike(gains, threshold=4.0):\n \"\"\"Remove spike artifacts from extracted pattern data.\n\n Detects points that dip sharply below their wider neighborhood\n (grid lines, text labels, crosshair artifacts). Uses median of\n multiple neighbor distances to avoid paired artifacts shielding\n each other. Runs 4 passes to progressively clean.\n \"\"\"\n n = len(gains)\n for _ in range(4):\n smoothed = list(gains)\n for i in range(n):\n # Median of neighbors at distances 3, 5, 7 to resist paired artifacts\n neighbors = []\n for d in (3, 5, 7):\n neighbors.append(gains[(i - d) % n])\n neighbors.append(gains[(i + d) % n])\n neighbors.sort()\n median = (neighbors[2] + neighbors[3]) / 2 # median of 6\n if gains[i] - median < -threshold:\n smoothed[i] = round(median, 1)\n gains = smoothed\n return gains\n\n\n# ── Calibration ──────────────────────────────────────────────────────────────\n\ndef cross_correlate(extracted, reference):\n \"\"\"Find angular rotation that best aligns extracted with reference.\n\n Uses Pearson correlation coefficient instead of RMSE to handle cases where\n the extracted dynamic range is compressed (pattern doesn't reach grid edge).\n Returns (best_offset, best_corr, rmse_at_best).\n \"\"\"\n n = len(extracted)\n best_offset = 0\n best_corr = -2.0\n\n # Pre-compute reference stats\n ref_mean = sum(reference[:n]) / n\n ref_dev = [b - ref_mean for b in reference[:n]]\n den_b = math.sqrt(sum(d * d for d in ref_dev))\n if den_b == 0:\n return 0, 0.0, 99.0\n\n for offset in range(n):\n rotated = extracted[offset:] + extracted[:offset]\n a_mean = sum(rotated) / n\n a_dev = [a - a_mean for a in rotated]\n den_a = math.sqrt(sum(d * d for d in a_dev))\n\n if den_a > 0:\n corr = sum(a * b for a, b in zip(a_dev, ref_dev)) / (den_a * den_b)\n if corr > best_corr:\n best_corr = corr\n best_offset = offset\n\n # Compute RMSE at best offset for reporting\n rotated = extracted[best_offset:] + extracted[:best_offset]\n rmse = math.sqrt(sum((a - b) ** 2 for a, b in zip(rotated, reference[:n])) / n)\n\n return best_offset, best_corr, rmse\n\n\ndef validate_with_el90(arr, el0_plots, ant_data, model, bands, db_max, db_range,\n debug=False):\n \"\"\"Validate extraction parameters using el90 from column 2 vs .ant reference.\n\n Extracts el90 from the image using the detected grid_r, compares with .ant\n reference data, and reports match quality. This is purely validation - the\n grid_r and angles come from physical detection in the image, not from fitting.\n\n Returns (detected_grid_r, el90_plots).\n \"\"\"\n h, w = arr.shape[:2]\n col2_start = w // 4\n col2_end = w // 2\n\n print(f\"\\n === Validating with Elevation 90 (column 2) ===\")\n\n n_rings = int(db_range / 5) + 1\n el90_plots = find_plots_in_column(arr, col2_start, col2_end, n_rings=n_rings)\n print(f\" Found {len(el90_plots)} el90 plots in column 2\")\n\n if not el90_plots:\n print(\" WARNING: No el90 plots found!\")\n return None, []\n\n if len(el90_plots) != len(el0_plots):\n print(f\" WARNING: el90 count ({len(el90_plots)}) != el0 count ({len(el0_plots)})\")\n\n # Map sub-bands to .ant band keys\n band_map = {\n \"2.4\": \"2.4\", \"2.45\": \"2.4\",\n \"5.15\": \"5\", \"5.5\": \"5\", \"5.85\": \"5\",\n \"6.0\": \"6\", \"6.5\": \"6\", \"6.5b\": \"6\", \"7.0\": \"6\",\n }\n\n # Extract el90 for each band and compare with .ant reference\n for i, band in enumerate(bands):\n if i >= len(el90_plots):\n break\n\n plot = el90_plots[i]\n cx, cy = plot[\"cx\"], plot[\"cy\"]\n detected_r = plot.get(\"radius\", plot[\"pattern_radius\"])\n\n ant_band = band_map.get(band, band)\n if model not in ant_data or ant_band not in ant_data[model]:\n print(f\" {band}: no .ant ref for '{ant_band}', skip\")\n continue\n\n ref_el90 = ant_data[model][ant_band].get(\"elevation\", [])\n if not ref_el90:\n continue\n\n pat_r = plot[\"pattern_radius\"]\n search_r = int(pat_r) + 10\n\n extracted = extract_polar_pattern(arr, cx, cy, detected_r, db_max, db_range,\n search_start=search_r)\n\n ext_peak_val = max(extracted)\n ext_peak = extracted.index(ext_peak_val)\n ref_peak_val = max(ref_el90) if ref_el90 else 0\n ref_peak = ref_el90.index(ref_peak_val) if ref_el90 else \"?\"\n\n # Compute RMSE\n n = min(len(extracted), len(ref_el90))\n rmse = math.sqrt(sum((a - b) ** 2 for a, b in zip(extracted[:n], ref_el90[:n])) / n)\n\n shift = math.sqrt((cx - plot[\"blue_cx\"]) ** 2 +\n (cy - plot[\"blue_cy\"]) ** 2)\n\n print(f\" {band}: center=({cx},{cy}) shift={shift:.0f}px \"\n f\"det_r={detected_r:.0f}\")\n print(f\" ext_peak@{ext_peak}deg ref_peak@{ref_peak}deg \"\n f\"RMSE={rmse:.1f}dB\")\n\n grid_r = int(el90_plots[0].get(\"radius\", el90_plots[0][\"pattern_radius\"]))\n print(f\"\\n Grid radius (detected): {grid_r}px\")\n\n return grid_r, el90_plots\n\n\n# ── Debug image ──────────────────────────────────────────────────────────────\n\ndef extract_pattern_with_radii(arr, cx, cy, outer_radius, db_max, db_range,\n search_start=None):\n \"\"\"Extract pattern AND return the raw found_r for each angle (for visualization).\"\"\"\n h, w = arr.shape[:2]\n db_min = db_max - db_range\n if search_start is None:\n search_start = int(outer_radius) + 5\n gains = []\n radii = []\n\n for angle_deg in range(359):\n angle_rad = math.radians(-angle_deg - 90) # CCW from 12 o'clock\n cos_a = math.cos(angle_rad)\n sin_a = math.sin(angle_rad)\n\n near_horizontal = ((85 <= angle_deg <= 95) or (265 <= angle_deg <= 275))\n offsets = [-3, -2, -1, 0, 1, 2, 3] if near_horizontal else [-1, 0, 1]\n\n found_r = 0\n for r in range(search_start, 2, -1):\n hit = False\n for offset in offsets:\n x = int(cx + r * cos_a + offset * sin_a)\n y = int(cy + r * sin_a - offset * cos_a)\n if 0 <= x < w and 0 <= y < h:\n rv, gv, bv = arr[y, x, :3]\n if is_pattern_line(rv, gv, bv):\n hit = True\n break\n if hit:\n found_r = r\n break\n\n if found_r > 0:\n gain = db_min + (found_r / outer_radius) * db_range\n else:\n gain = db_min\n gains.append(round(gain, 1))\n radii.append(found_r)\n\n gains = despike(gains)\n return gains, radii\n\n\ndef save_debug_image(arr, img, el0_plots, el90_plots, calibrated_radius, bands,\n db_max, db_range, out_path):\n \"\"\"Save annotated image with detected centers, radii, and extracted patterns.\"\"\"\n debug_img = img.copy()\n draw = ImageDraw.Draw(debug_img)\n\n for plots, col_label, color, dot_color in [\n (el0_plots, \"EL0\", \"red\", \"yellow\"),\n ]:\n for i, p in enumerate(plots):\n cx, cy = p[\"cx\"], p[\"cy\"]\n if isinstance(calibrated_radius, list):\n r = calibrated_radius[i] if i < len(calibrated_radius) else calibrated_radius[-1]\n elif calibrated_radius:\n r = calibrated_radius\n else:\n r = p.get(\"radius\", p[\"pattern_radius\"])\n band = bands[i] if i < len(bands) else f\"#{i}\"\n\n # Crosshair at grid center (large)\n draw.line([(cx - 12, cy), (cx + 12, cy)], fill=color, width=2)\n draw.line([(cx, cy - 12), (cx, cy + 12)], fill=color, width=2)\n\n # Circle at grid_r\n draw.ellipse([(cx - r, cy - r), (cx + r, cy + r)],\n outline=color, width=1)\n\n # Blue center marker (bounding box center)\n bcx, bcy = p[\"blue_cx\"], p[\"blue_cy\"]\n draw.line([(bcx - 5, bcy), (bcx + 5, bcy)], fill=\"cyan\", width=1)\n draw.line([(bcx, bcy - 5), (bcx, bcy + 5)], fill=\"cyan\", width=1)\n\n # Extract pattern and draw detected points\n pat_r = p[\"pattern_radius\"]\n sr = max(int(pat_r) + 10, int(r) + 5)\n _, radii = extract_pattern_with_radii(arr, cx, cy, r, db_max, db_range,\n search_start=sr)\n for angle_deg in range(359):\n found_r = radii[angle_deg]\n if found_r > 0:\n angle_rad = math.radians(-angle_deg - 90) # CCW from 12 o'clock\n px = int(cx + found_r * math.cos(angle_rad))\n py = int(cy + found_r * math.sin(angle_rad))\n # Draw small dot\n draw.rectangle([(px, py), (px + 1, py + 1)], fill=dot_color)\n\n # Label\n label = f\"{col_label} {band}\"\n draw.text((cx + 15, cy - 15), label, fill=color)\n\n debug_img.save(out_path)\n print(f\" Debug image: {out_path}\")\n\n\n# ── Band assignment ──────────────────────────────────────────────────────────\n\ndef assign_bands(n_plots, filename=\"\"):\n \"\"\"Assign band labels to plots based on count and filename hints.\"\"\"\n fname = filename.lower()\n\n if n_plots == 3:\n # 3 plots: detect from filename\n if \"6ghz\" in fname or \"6 ghz\" in fname:\n return [\"6.0\", \"6.5\", \"7.0\"]\n elif \"5ghz\" in fname or \"5 ghz\" in fname:\n return [\"5.15\", \"5.5\", \"5.85\"]\n elif \"2.4\" in fname or \"2_4\" in fname:\n return [\"2.4\", \"2.4b\", \"2.4c\"]\n return [\"2.4\", \"5\", \"6\"]\n elif n_plots == 8:\n return [\"2.4\", \"5.15\", \"5.5\", \"5.85\", \"6.0\", \"6.5\", \"6.5b\", \"7.0\"]\n elif n_plots == 7:\n return [\"2.4\", \"5.15\", \"5.5\", \"5.85\", \"6.0\", \"6.5\", \"7.0\"]\n elif n_plots == 4:\n return [\"2.4\", \"5.15\", \"5.5\", \"5.85\"]\n elif n_plots == 2:\n return [\"2.4\", \"5\"]\n return [f\"band{i}\" for i in range(n_plots)]\n\n\ndef extract_model_name(filename):\n \"\"\"Extract model name from image filename, stripping suffixes.\"\"\"\n name = filename.replace(\" Total\", \"\").replace(\" \", \"-\")\n # Strip -Summary-XGHz suffixes\n import re\n name = re.sub(r'-Summary-\\d+(\\.\\d+)?GHz$', '', name, flags=re.IGNORECASE)\n return name\n\n\n# ── Per-variant processing ──────────────────────────────────────────────────\n\ndef process_variant(arr, plots, bands, model_key, ant_data, db_max, db_range,\n debug=False, grid_radius_override=None):\n \"\"\"Extract el0 patterns for a set of plots (one variant).\n\n Returns dict of {band: gains}.\n \"\"\"\n if not plots:\n return {}\n\n print(f\"\\n === Extracting Elevation 0 for {model_key} ===\")\n print(f\" {len(plots)} plots\")\n\n results = {}\n for i, (plot, band) in enumerate(zip(plots, bands)):\n cx, cy = plot[\"cx\"], plot[\"cy\"]\n pat_r = plot[\"pattern_radius\"]\n\n # Use per-band radius (from crosshair/histogram detection)\n # or override if specified (can be single value or list)\n if grid_radius_override:\n if isinstance(grid_radius_override, list):\n use_radius = grid_radius_override[i] if i < len(grid_radius_override) else grid_radius_override[-1]\n else:\n use_radius = grid_radius_override\n else:\n use_radius = plot.get(\"radius\", pat_r)\n\n search_r = max(int(pat_r) + 10, int(use_radius) + 5)\n gains = extract_polar_pattern(arr, cx, cy, use_radius, db_max, db_range,\n search_start=search_r)\n\n # Mirror for \"from above\" convention\n gains = [gains[0]] + gains[1:][::-1]\n\n peak_val = max(gains)\n peak_idx = gains.index(peak_val)\n min_val = min(gains)\n print(f\" {band}: center=({cx},{cy}) r={use_radius:.0f} \"\n f\"peak={peak_val:.1f}dBi@{peak_idx}deg min={min_val:.1f}dBi\")\n\n if debug:\n for d in range(0, 359, 15):\n print(f\" [{d:3d}] = {gains[d]:6.1f} dB\")\n\n results[band] = gains\n\n # Validation against .ant data\n band_map = {\n \"2.4\": \"2.4\", \"2.45\": \"2.4\",\n \"5.15\": \"5\", \"5.5\": \"5\", \"5.85\": \"5\",\n \"6.0\": \"6\", \"6.5\": \"6\", \"6.5b\": \"6\", \"7.0\": \"6\",\n }\n\n if model_key in ant_data:\n print(f\"\\n === Validation: el0 vs el90 for {model_key} ===\")\n for band in results:\n ant_band = band_map.get(band, band)\n if ant_band in ant_data.get(model_key, {}):\n ref_el90 = ant_data[model_key][ant_band].get(\"elevation\", [])\n if ref_el90:\n el0 = results[band]\n total = 0\n close = 0\n for a, b in zip(el0, ref_el90):\n if a > -25 and b > -25:\n total += 1\n if abs(a - b) < db_range * 0.25:\n close += 1\n pct = (close / total * 100) if total > 0 else 0\n print(f\" {band} -> {ant_band}: {close}/{total} points \"\n f\"within 25% ({pct:.0f}%)\")\n for d in [0, 90, 180, 270]:\n diff = el0[d] - ref_el90[d]\n print(f\" [{d:3d}] el0={el0[d]:6.1f} el90={ref_el90[d]:6.1f} \"\n f\"diff={diff:+.1f}\")\n\n return results\n\n\n# ── Main ─────────────────────────────────────────────────────────────────────\n\ndef main():\n debug = \"--debug\" in sys.argv\n args = [a for a in sys.argv[1:] if not a.startswith(\"--\")]\n\n # Parse named arguments\n db_max = None\n db_min = -20.0\n variants = None\n cx_shift = 0\n cy_shift = None\n n_bands = None\n grid_radius_override = None\n cx_override = None\n cy_override = None\n for i, a in enumerate(sys.argv):\n if a == \"--db-max\" and i + 1 < len(sys.argv):\n db_max = float(sys.argv[i + 1])\n if a == \"--db-min\" and i + 1 < len(sys.argv):\n db_min = float(sys.argv[i + 1])\n if a == \"--variants\" and i + 1 < len(sys.argv):\n variants = [v.strip() for v in sys.argv[i + 1].split(\",\")]\n if a == \"--cx-shift\" and i + 1 < len(sys.argv):\n cx_shift = int(sys.argv[i + 1])\n if a == \"--cy-shift\" and i + 1 < len(sys.argv):\n val = sys.argv[i + 1]\n if \",\" in val:\n cy_shift = [int(v) for v in val.split(\",\")]\n else:\n cy_shift = int(val)\n if a == \"--n-bands\" and i + 1 < len(sys.argv):\n n_bands = int(sys.argv[i + 1])\n if a == \"--grid-radius\" and i + 1 < len(sys.argv):\n val = sys.argv[i + 1]\n if \",\" in val:\n grid_radius_override = [int(v) for v in val.split(\",\")]\n else:\n grid_radius_override = int(val)\n if a == \"--cx\" and i + 1 < len(sys.argv):\n cx_override = int(sys.argv[i + 1])\n if a == \"--cy\" and i + 1 < len(sys.argv):\n cy_override = int(sys.argv[i + 1])\n\n if not args:\n print(\"Usage: python extract-elevation0-from-images.py \"\n \"--db-max [--variants narrow,wide] [--cy-shift N] [--n-bands N] [--db-min -20] [--debug]\")\n print(\"\\n --db-max is REQUIRED. Read it from the outer ring label on the polar plot.\")\n print(\" Common values: 10 (indoor APs), 15 (outdoor APs)\")\n print(\"\\n --variants: Split rows into named variants (e.g., narrow,wide).\")\n print(\" Top rows = first variant, bottom rows = second variant.\")\n sys.exit(1)\n\n if db_max is None:\n print(\"ERROR: --db-max is required. Read the outer ring dBi label from the polar plot image.\")\n print(\" Common values: 10 (indoor APs like U7-Pro-XGS), 15 (outdoor APs like U7-Outdoor)\")\n sys.exit(1)\n\n db_range = db_max - db_min\n\n image_path = Path(args[0])\n if not image_path.exists():\n print(f\"Error: {image_path} not found\")\n sys.exit(1)\n\n print(f\"Processing: {image_path.name}\")\n print(f\" dB scale: center={db_min} dBi, outer ring={db_max} dBi, range={db_range} dB\")\n if cx_shift or cy_shift is not None:\n print(f\" Center shift: dx={cx_shift}, dy={cy_shift} (positive = right/down on page)\")\n if variants:\n print(f\" Variants: {variants}\")\n\n img = Image.open(image_path)\n arr = np.array(img)\n h, w = arr.shape[:2]\n print(f\" Image: {w}x{h}\")\n\n # Number of grid rings (5 dB spacing)\n n_rings = int(db_range / 5) + 1\n\n # ── Phase 1: Find el0 plots in column 1 ──\n col1_end = w // 4\n el0_plots = find_plots_in_column(arr, 0, col1_end, n_expected=n_bands,\n n_rings=n_rings)\n print(f\" Found {len(el0_plots)} el0 plots in column 1\")\n\n if not el0_plots:\n print(\" ERROR: No plots found!\")\n sys.exit(1)\n\n # Apply center overrides (cx_override sets all plots to same cx)\n if cx_override is not None or cy_override is not None:\n for p in el0_plots:\n if cx_override is not None:\n p[\"cx\"] = cx_override\n if cy_override is not None:\n p[\"cy\"] = cy_override\n print(f\" Center override: cx={cx_override}, cy={cy_override}\")\n\n # Apply cx_shift (immediately, independent of cy)\n if cx_shift:\n for p in el0_plots:\n p[\"cx\"] += cx_shift\n\n for i, p in enumerate(el0_plots):\n shift_dist = math.sqrt((p[\"cx\"] - p[\"blue_cx\"]) ** 2 +\n (p[\"cy\"] - p[\"blue_cy\"]) ** 2)\n print(f\" #{i}: grid_center=({p['cx']},{p['cy']}) \"\n f\"blue_center=({p['blue_cx']},{p['blue_cy']}) \"\n f\"shift={shift_dist:.0f}px grid_r={p.get('radius', 0):.0f} \"\n f\"pat_r={p['pattern_radius']:.0f} \"\n f\"n_grid={p['n_grid_pixels']}\")\n\n # ── Model name ──\n model = extract_model_name(image_path.stem)\n\n # ── Load .ant reference data ──\n ant_json = None\n search = image_path.parent\n for _ in range(8):\n candidate = search / \"src\" / \"NetworkOptimizer.Web\" / \"wwwroot\" / \"data\" / \"antenna-patterns.json\"\n if candidate.exists():\n ant_json = candidate\n break\n search = search.parent\n\n ant_data = {}\n if ant_json:\n with open(ant_json) as f:\n ant_data = json.load(f)\n print(f\" Loaded .ant data from: {ant_json}\")\n else:\n print(f\"\\n No antenna-patterns.json found for validation\")\n\n # ── Phase 2: Validate with el90 from column 2 ──\n # Also use el90 cy values for el0 plots when cx is overridden\n # (el90 often detects vertical centers more reliably)\n el90_plots = []\n n_total = len(el0_plots)\n\n # Pre-detect el90 plots to borrow cy values when el0 centering is overridden\n # Only borrow if el90 spacing is more consistent than el0 spacing\n if cx_override is not None and len(el0_plots) >= 3:\n col2_start = w // 4\n col2_end = w // 2\n n_rings = int(db_range / 5) + 1\n el90_pre = find_plots_in_column(arr, col2_start, col2_end, n_rings=n_rings)\n if len(el90_pre) == len(el0_plots):\n def _spacing_variance(plots):\n cys = [p[\"cy\"] for p in plots]\n spacings = [cys[i+1] - cys[i] for i in range(len(cys)-1)]\n if not spacings:\n return float('inf')\n mean = sum(spacings) / len(spacings)\n return sum((s - mean) ** 2 for s in spacings) / len(spacings)\n\n el0_var = _spacing_variance(el0_plots)\n el90_var = _spacing_variance(el90_pre)\n print(f\" cy spacing variance: el0={el0_var:.1f} el90={el90_var:.1f}\")\n\n if el90_var < el0_var:\n for p0, p90 in zip(el0_plots, el90_pre):\n old_cy = p0[\"cy\"]\n p0[\"cy\"] = p90[\"cy\"]\n if old_cy != p90[\"cy\"]:\n print(f\" cy from el90: {old_cy}->{p90['cy']}\")\n else:\n print(f\" keeping el0 cy (more consistent than el90)\")\n\n # Apply cy_shift after el90 borrowing\n if cy_shift is not None:\n if isinstance(cy_shift, list):\n for i, p in enumerate(el0_plots):\n shift = cy_shift[i] if i < len(cy_shift) else cy_shift[-1]\n p[\"cy\"] += shift\n print(f\" cy_shift (per-plot): {cy_shift}\")\n else:\n for p in el0_plots:\n p[\"cy\"] += cy_shift\n print(f\" cy_shift: {cy_shift:+d}\")\n\n if variants:\n # Split plots evenly across variants\n n_per = n_total // len(variants)\n if n_total % len(variants) != 0:\n print(f\" WARNING: {n_total} plots doesn't divide evenly by \"\n f\"{len(variants)} variants ({n_per} each, {n_total % len(variants)} extra)\")\n\n bands_per_variant = assign_bands(n_per, image_path.name)\n # Flat band list for el90 validation (repeated for each variant)\n all_bands = bands_per_variant * len(variants)\n\n if ant_json:\n # Validate using first variant's model key for el90\n first_key = f\"{model}:{variants[0]}\"\n _, el90_plots = validate_with_el90(\n arr, el0_plots, ant_data, first_key, all_bands, db_max, db_range, debug)\n\n # Process each variant\n output = {}\n for vi, variant_name in enumerate(variants):\n start = vi * n_per\n end = start + n_per\n variant_plots = el0_plots[start:end]\n model_key = f\"{model}:{variant_name}\"\n\n results = process_variant(\n arr, variant_plots, bands_per_variant, model_key, ant_data,\n db_max, db_range, debug, grid_radius_override)\n output[model_key] = {\"elevation_0\": results}\n\n # Save output\n out_path = image_path.with_suffix(\".elevation0.json\")\n with open(out_path, \"w\") as f:\n json.dump(output, f, indent=2)\n print(f\"\\n Model: {model} (variants: {', '.join(variants)})\")\n print(f\" Saved: {out_path}\")\n\n else:\n # Original single-variant path\n bands = assign_bands(n_total, image_path.name)\n\n if ant_json:\n _, el90_plots = validate_with_el90(\n arr, el0_plots, ant_data, model, bands, db_max, db_range, debug)\n\n results = process_variant(\n arr, el0_plots, bands, model, ant_data, db_max, db_range, debug,\n grid_radius_override)\n\n output = {model: {\"elevation_0\": results}}\n out_path = image_path.with_suffix(\".elevation0.json\")\n with open(out_path, \"w\") as f:\n json.dump(output, f, indent=2)\n print(f\"\\n Model: {model}\")\n print(f\" Saved: {out_path}\")\n\n # ── Save debug image ──\n if debug:\n all_bands = assign_bands(n_total, image_path.name) if not variants else (\n assign_bands(n_total // len(variants), image_path.name) * len(variants))\n debug_path = image_path.with_suffix(\".debug.png\")\n save_debug_image(arr, img, el0_plots, el90_plots, grid_radius_override,\n all_bands, db_max, db_range, debug_path)\n\n\nif __name__ == \"__main__\":\n main()\n"
},
{
"path": "scripts/install-macos-native.sh",
"content": "#!/bin/bash\n# Install Network Optimizer natively on macOS\n# Usage: ./scripts/install-macos-native.sh\n#\n# This script:\n# 1. Installs prerequisites via Homebrew\n# 2. Builds the application (or uses pre-built if available)\n# 3. Signs binaries for macOS\n# 4. Sets up OpenSpeedTest with nginx for browser-based speed testing\n# 5. Creates launchd service for auto-start\n\nset -e\n\n# Refuse to run as root - everything installs to $HOME, root is never needed\nif [ \"$(id -u)\" = \"0\" ]; then\n echo \"Error: Do not run this script with sudo or as root.\"\n echo \"\"\n echo \"This installer puts everything in your home directory and does not need\"\n echo \"root access. Running with sudo causes file ownership problems that break\"\n echo \"future upgrades.\"\n echo \"\"\n echo \"If you previously installed with sudo, just run the script normally:\"\n echo \" ./scripts/install-macos-native.sh\"\n echo \"\"\n echo \"The script will detect and clean up any root-owned files automatically.\"\n exit 1\nfi\n\n# Configuration\nINSTALL_DIR=\"$HOME/network-optimizer\"\nDATA_DIR=\"$HOME/Library/Application Support/NetworkOptimizer\"\nLAUNCH_AGENT_DIR=\"$HOME/Library/LaunchAgents\"\nLAUNCH_AGENT_FILE=\"net.ozarkconnect.networkoptimizer.plist\"\nOLD_LAUNCH_AGENT_FILE=\"com.networkoptimizer.app.plist\" # For migration from older installs\n\n# Detect architecture\nARCH=$(uname -m)\nif [ \"$ARCH\" = \"arm64\" ]; then\n RUNTIME=\"osx-arm64\"\n BREW_PREFIX=\"/opt/homebrew\"\nelse\n RUNTIME=\"osx-x64\"\n BREW_PREFIX=\"/usr/local\"\nfi\n\necho \"=== Network Optimizer macOS Native Installation ===\"\necho \"\"\necho \"Architecture: $ARCH ($RUNTIME)\"\necho \"Install directory: $INSTALL_DIR\"\necho \"\"\n\n# Check if running from repo root\nSCRIPT_DIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\nREPO_ROOT=\"$(cd \"$SCRIPT_DIR/..\" && pwd)\"\n\nif [ ! -f \"$REPO_ROOT/src/NetworkOptimizer.Web/NetworkOptimizer.Web.csproj\" ]; then\n echo \"Error: This script must be run from the NetworkOptimizer repository.\"\n echo \"Clone the repo first: git clone https://github.com/Ozark-Connect/NetworkOptimizer.git\"\n exit 1\nfi\n\n# Check for root-owned remnants from a previous sudo installation.\n# If someone ran this script with sudo, all files and processes end up owned by root.\n# A normal user can't overwrite those files or kill those processes, so the next\n# install fails. This function detects the problem and fixes it with one sudo prompt.\ncheck_root_remnants() {\n local root_files=false\n\n # Check for root-owned install directories and files (visible without sudo)\n for dir in \"$INSTALL_DIR\" \"$DATA_DIR\"; do\n if [ -d \"$dir\" ] && [ \"$(stat -f '%Su' \"$dir\" 2>/dev/null)\" = \"root\" ]; then\n root_files=true\n fi\n done\n if [ -f \"$LAUNCH_AGENT_DIR/$LAUNCH_AGENT_FILE\" ] && \\\n [ \"$(stat -f '%Su' \"$LAUNCH_AGENT_DIR/$LAUNCH_AGENT_FILE\" 2>/dev/null)\" = \"root\" ]; then\n root_files=true\n fi\n\n # Check for root-owned .NET directories (blocks dotnet publish)\n for dotdir in \"$HOME/.nuget\" \"$HOME/.dotnet\"; do\n if [ -d \"$dotdir\" ] && [ \"$(stat -f '%Su' \"$dotdir\" 2>/dev/null)\" = \"root\" ]; then\n root_files=true\n fi\n done\n\n if [ \"$root_files\" = false ]; then\n return 0\n fi\n\n echo \"Detected root-owned files from a previous sudo installation.\"\n echo \"This needs sudo to fix. You'll be prompted for your password once.\"\n echo \"\"\n read -rp \"Press Enter to clean up, or Ctrl+C to cancel... \"\n\n # Validate sudo credentials upfront so a failed password doesn't leave\n # things half-cleaned (some processes killed but files still root-owned)\n if ! sudo -v; then\n echo \"Error: sudo authentication failed. Please re-run the script and try again.\"\n exit 1\n fi\n\n local current_user\n current_user=$(whoami)\n\n # Now that we have sudo, check for root-owned processes on our ports.\n # Regular users can't see root-owned sockets with lsof on macOS.\n local root_pids=\"\"\n for port in 8042 3005 5201; do\n local pids\n pids=$(sudo lsof -i \":$port\" -sTCP:LISTEN -t 2>/dev/null) || true\n for pid in $pids; do\n local owner\n owner=$(ps -o user= -p \"$pid\" 2>/dev/null | tr -d ' ') || true\n if [ \"$owner\" = \"root\" ]; then\n root_pids=\"$root_pids $pid\"\n fi\n done\n done\n\n if [ -n \"$root_pids\" ]; then\n echo \"Stopping root-owned processes (PIDs:$root_pids)...\"\n for pid in $root_pids; do\n sudo kill \"$pid\" 2>/dev/null || true\n done\n sleep 2\n fi\n\n # Unload any root-loaded launchd services\n sudo launchctl unload \"$LAUNCH_AGENT_DIR/$LAUNCH_AGENT_FILE\" 2>/dev/null || true\n sudo launchctl unload \"$LAUNCH_AGENT_DIR/$OLD_LAUNCH_AGENT_FILE\" 2>/dev/null || true\n\n # Fix ownership on install directories\n if [ -d \"$INSTALL_DIR\" ]; then\n echo \"Fixing ownership: $INSTALL_DIR\"\n sudo chown -R \"$current_user:staff\" \"$INSTALL_DIR\"\n fi\n if [ -d \"$DATA_DIR\" ]; then\n echo \"Fixing ownership: $DATA_DIR\"\n sudo chown -R \"$current_user:staff\" \"$DATA_DIR\"\n fi\n for plist in \"$LAUNCH_AGENT_FILE\" \"$OLD_LAUNCH_AGENT_FILE\"; do\n if [ -f \"$LAUNCH_AGENT_DIR/$plist\" ]; then\n sudo chown \"$current_user:staff\" \"$LAUNCH_AGENT_DIR/$plist\"\n fi\n done\n\n # Fix .NET directories\n for dotdir in \"$HOME/.nuget\" \"$HOME/.dotnet\"; do\n if [ -d \"$dotdir\" ] && [ \"$(stat -f '%Su' \"$dotdir\" 2>/dev/null)\" = \"root\" ]; then\n echo \"Fixing ownership: ${dotdir/#$HOME/~}\"\n sudo chown -R \"$current_user:staff\" \"$dotdir\"\n fi\n done\n\n echo \"\"\n echo \"Cleanup complete. Continuing with installation...\"\n echo \"\"\n}\n\ncheck_root_remnants\n\n# Backup existing installation if present\nif [ -d \"$DATA_DIR\" ] || [ -d \"$INSTALL_DIR\" ]; then\n BACKUP_DIR=\"$HOME/network-optimizer-backup-$(date +%Y%m%d-%H%M%S)\"\n echo \"Backing up existing installation to $BACKUP_DIR...\"\n mkdir -p \"$BACKUP_DIR\"\n\n # Backup data directory contents (DB, keys, etc.)\n if [ -f \"$DATA_DIR/network_optimizer.db\" ]; then\n cp \"$DATA_DIR/network_optimizer.db\" \"$BACKUP_DIR/\"\n echo \" ✓ Database backed up\"\n fi\n if [ -f \"$DATA_DIR/.credential_key\" ]; then\n cp \"$DATA_DIR/.credential_key\" \"$BACKUP_DIR/\"\n echo \" ✓ Credential key backed up\"\n fi\n if [ -d \"$DATA_DIR/keys\" ]; then\n cp -r \"$DATA_DIR/keys\" \"$BACKUP_DIR/\"\n echo \" ✓ Encryption keys backed up\"\n fi\n\n # Backup start.sh (has custom env config)\n if [ -f \"$INSTALL_DIR/start.sh\" ]; then\n cp \"$INSTALL_DIR/start.sh\" \"$BACKUP_DIR/\"\n echo \" ✓ Startup script backed up\"\n fi\n\n echo \"Backup complete: $BACKUP_DIR\"\n echo \"\"\nfi\n\n# Step 1: Install prerequisites\necho \"[1/9] Installing prerequisites...\"\nif ! command -v brew &> /dev/null; then\n echo \"Installing Homebrew...\"\n /bin/bash -c \"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\"\n eval \"$($BREW_PREFIX/bin/brew shellenv)\"\nfi\n\n# Ensure brew is in PATH\neval \"$($BREW_PREFIX/bin/brew shellenv)\"\n\necho \"Installing required packages...\"\nbrew install sshpass iperf3 nginx go 2>/dev/null || true\n\n# Check for .NET SDK\nif ! command -v dotnet &> /dev/null; then\n echo \"Installing .NET SDK...\"\n brew install dotnet\nfi\n\n# Verify .NET version\nDOTNET_VERSION=$(dotnet --version 2>/dev/null | cut -d. -f1)\nif [ \"$DOTNET_VERSION\" -lt 8 ]; then\n echo \"Warning: .NET $DOTNET_VERSION detected. Network Optimizer requires .NET 8 or later.\"\n echo \"Updating .NET SDK...\"\n brew upgrade dotnet || brew install dotnet\nfi\n\n# Step 2: Clean up old installation files (preserving user config and logs)\necho \"\"\necho \"[2/9] Cleaning up old installation files...\"\nif [ -d \"$INSTALL_DIR\" ]; then\n cd \"$INSTALL_DIR\"\n # Remove old non-single-file artifacts (DLLs, pdb, runtimes folder, etc.)\n rm -rf *.dll *.pdb *.json runtimes/ BuildHost-*/ LatoFont/ 2>/dev/null || true\n # Note: start.sh, logs/, SpeedTest/, wwwroot/, Templates/ are preserved or rebuilt\nfi\n\n# Step 3: Build the application\necho \"\"\necho \"[3/9] Building Network Optimizer for $RUNTIME...\"\ncd \"$REPO_ROOT\"\n\n# Ensure NuGet cache is writable (stale cache from brew or failed restores can block builds)\nif [ -d \"$HOME/.nuget/packages\" ] && ! touch \"$HOME/.nuget/packages/.write-test\" 2>/dev/null; then\n echo \"NuGet package cache has permission issues, clearing...\"\n chmod -R u+w \"$HOME/.nuget/packages\" 2>/dev/null || true\n rm -rf \"$HOME/.nuget/packages\"\n if [ -d \"$HOME/.nuget/packages\" ]; then\n echo \"Error: Could not clear NuGet cache. Try running: sudo rm -rf ~/.nuget/packages\"\n exit 1\n fi\nfi\nrm -f \"$HOME/.nuget/packages/.write-test\" 2>/dev/null\n\ndotnet publish src/NetworkOptimizer.Web/NetworkOptimizer.Web.csproj \\\n -c Release \\\n -r \"$RUNTIME\" \\\n --self-contained \\\n -p:PublishSingleFile=true \\\n -p:IncludeNativeLibrariesForSelfExtract=true \\\n -p:EnableCompressionInSingleFile=true \\\n -p:DebugType=None \\\n -o \"$INSTALL_DIR\"\n\n# Step 3b: Build Go binaries\necho \"\"\necho \"[3b/9] Building Go binaries...\"\nif command -v go &> /dev/null; then\n mkdir -p \"$INSTALL_DIR/tools\"\n\n # Get version from git tags for Go binary version stamps\n GO_VERSION=$(cd \"$REPO_ROOT\" && git describe --tags --always 2>/dev/null || echo \"dev\")\n GO_VERSION=\"${GO_VERSION#v}\" # strip leading v\n echo \"Go binary version: $GO_VERSION\"\n\n # Detect Go architecture for local binary\n GO_ARCH=\"amd64\"\n if [ \"$ARCH\" = \"arm64\" ]; then\n GO_ARCH=\"arm64\"\n fi\n\n CFSPEEDTEST_SRC=\"$REPO_ROOT/src/cfspeedtest\"\n if [ -d \"$CFSPEEDTEST_SRC\" ]; then\n cd \"$CFSPEEDTEST_SRC\"\n CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -a -trimpath \\\n -ldflags \"-s -w -X main.version=$GO_VERSION\" \\\n -o \"$INSTALL_DIR/tools/cfspeedtest-linux-arm64\" .\n echo \"Built cfspeedtest for linux/arm64\"\n else\n echo \"Warning: cfspeedtest source not found at $CFSPEEDTEST_SRC\"\n fi\n\n UWNSPEEDTEST_SRC=\"$REPO_ROOT/src/uwnspeedtest\"\n if [ -d \"$UWNSPEEDTEST_SRC\" ]; then\n cd \"$UWNSPEEDTEST_SRC\"\n # Build local binary for server-side WAN speed tests\n CGO_ENABLED=0 GOOS=darwin GOARCH=$GO_ARCH go build -a -trimpath \\\n -ldflags \"-s -w -X main.version=$GO_VERSION\" \\\n -o \"$INSTALL_DIR/tools/uwnspeedtest-darwin-$GO_ARCH\" .\n echo \"Built uwnspeedtest for darwin/$GO_ARCH (local)\"\n # Build gateway binary for deployment via SSH to UniFi gateways\n CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -a -trimpath \\\n -ldflags \"-s -w -X main.version=$GO_VERSION\" \\\n -o \"$INSTALL_DIR/tools/uwnspeedtest-linux-arm64\" .\n echo \"Built uwnspeedtest for linux/arm64 (gateway)\"\n else\n echo \"Warning: uwnspeedtest source not found at $UWNSPEEDTEST_SRC\"\n fi\n\n WANSTEER_SRC=\"$REPO_ROOT/src/wansteer\"\n if [ -d \"$WANSTEER_SRC\" ]; then\n cd \"$WANSTEER_SRC\"\n # Build gateway binary for WAN steering (deployed via SSH to UniFi gateways)\n CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -a -trimpath \\\n -ldflags \"-s -w -X main.version=$GO_VERSION\" \\\n -o \"$INSTALL_DIR/tools/wansteer-linux-arm64\" .\n echo \"Built wansteer for linux/arm64 (gateway)\"\n else\n echo \"Warning: wansteer source not found at $WANSTEER_SRC\"\n fi\nelse\n echo \"Warning: Go not installed - speed test binaries not available\"\n echo \" Install with: brew install go\"\nfi\n\n# Step 4: Sign binary (single-file executable has native libs embedded)\necho \"\"\necho \"[4/9] Signing binary...\"\ncd \"$INSTALL_DIR\"\ncodesign --force --sign - NetworkOptimizer.Web\necho \"Verifying signature...\"\ncodesign -v NetworkOptimizer.Web\n\n# Step 5: Create startup script\necho \"\"\necho \"[5/9] Creating startup script...\"\n\n# Get local IP address for display purposes (app auto-detects its own IP)\nLOCAL_IP=$(ipconfig getifaddr en0 2>/dev/null || ipconfig getifaddr en1 2>/dev/null || echo \"your-mac-ip\")\n\ncat > \"$INSTALL_DIR/start.sh\" << EOF\n#!/bin/bash\ncd \"\\$(dirname \"\\$0\")\"\n\n# Add Homebrew to PATH\nexport PATH=\"$BREW_PREFIX/bin:/usr/local/bin:\\$PATH\"\n\n# Environment configuration\nexport TZ=\"${TZ:-America/Chicago}\"\nexport ASPNETCORE_URLS=\"http://0.0.0.0:8042\"\n\n# Enable iperf3 server for CLI-based client speed testing (port 5201)\nexport Iperf3Server__Enabled=true\n\n# OpenSpeedTest configuration (browser-based speed tests on port 3005)\nexport OPENSPEEDTEST_PORT=3005\n\n# Optional: Set admin password (otherwise auto-generated on first run)\n# export APP_PASSWORD=\"your-secure-password\"\n\n# Start the application\n./NetworkOptimizer.Web\nEOF\n\nchmod +x \"$INSTALL_DIR/start.sh\"\n\n# Restore backed up start.sh if it exists (preserves user's env config on upgrade)\nif [ -n \"${BACKUP_DIR:-}\" ] && [ -f \"$BACKUP_DIR/start.sh\" ]; then\n cp \"$BACKUP_DIR/start.sh\" \"$INSTALL_DIR/start.sh\"\n echo \" ✓ Restored custom startup configuration from backup\"\nfi\n\n# Step 6: Create log directory\necho \"\"\necho \"[6/9] Creating directories...\"\nmkdir -p \"$INSTALL_DIR/logs\"\nmkdir -p \"$DATA_DIR\"\nmkdir -p \"$LAUNCH_AGENT_DIR\"\n\n# Step 7: Set up OpenSpeedTest with nginx\necho \"\"\necho \"[7/9] Setting up OpenSpeedTest...\"\n\nSPEEDTEST_DIR=\"$INSTALL_DIR/SpeedTest\"\nmkdir -p \"$SPEEDTEST_DIR\"/{conf,logs,temp,html/assets/{css,js,fonts,images/icons}}\n\n# Copy nginx configuration\nif [ -f \"$REPO_ROOT/src/OpenSpeedTest/index.html\" ]; then\n # Copy mime.types from Homebrew's nginx\n if [ -f \"$BREW_PREFIX/etc/nginx/mime.types\" ]; then\n cp \"$BREW_PREFIX/etc/nginx/mime.types\" \"$SPEEDTEST_DIR/conf/\"\n else\n echo \"Warning: mime.types not found at $BREW_PREFIX/etc/nginx/mime.types\"\n fi\n\n # Create nginx.conf optimized for SpeedTest (based on Docker config)\n cat > \"$SPEEDTEST_DIR/conf/nginx.conf\" << 'NGINXCONF'\n# Run in foreground so the app can track the process\ndaemon off;\nworker_processes 1;\nerror_log logs/error.log;\npid logs/nginx.pid;\n\nevents {\n worker_connections 1024;\n}\n\nhttp {\n include mime.types;\n default_type application/octet-stream;\n sendfile on;\n tcp_nodelay on;\n tcp_nopush on;\n keepalive_timeout 65;\n access_log off;\n gzip off;\n\n server {\n listen 3005;\n server_name _;\n root html;\n index index.html;\n client_max_body_size 50m;\n error_page 405 =200 $uri;\n log_not_found off;\n server_tokens off;\n error_log /dev/null;\n\n # Performance tuning\n open_file_cache max=200000 inactive=20s;\n open_file_cache_valid 30s;\n open_file_cache_min_uses 2;\n open_file_cache_errors off;\n\n # Upload endpoint - reads entire POST body before responding.\n # Without this, the error_page 405 hack responds before the body is\n # fully received, causing ERR_CONNECTION_RESET behind reverse proxies.\n location = /upload {\n add_header 'Access-Control-Allow-Origin' \"*\" always;\n add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With' always;\n add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;\n add_header Cache-Control 'no-store, no-cache, max-age=0, no-transform';\n\n client_body_buffer_size 35m;\n client_max_body_size 50m;\n\n proxy_pass http://127.0.0.1:3005/upload-sink;\n proxy_set_header Host $host;\n }\n\n location = /upload-sink {\n add_header 'Access-Control-Allow-Origin' \"*\" always;\n return 200;\n }\n\n location / {\n add_header 'Access-Control-Allow-Origin' \"*\" always;\n add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With' always;\n add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;\n add_header Cache-Control 'no-store, no-cache, max-age=0, no-transform';\n if_modified_since off;\n expires off;\n etag off;\n\n if ($request_method = OPTIONS) {\n add_header 'Access-Control-Allow-Credentials' \"true\";\n add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With' always;\n add_header 'Access-Control-Allow-Origin' \"$http_origin\" always;\n add_header 'Access-Control-Allow-Methods' \"GET, POST, OPTIONS\" always;\n return 200;\n }\n }\n\n location ~* ^.+\\.(?:css|cur|js|jpe?g|gif|htc|ico|png|html|xml|otf|ttf|eot|woff|woff2|svg)$ {\n access_log off;\n expires -1;\n add_header Cache-Control \"no-cache, no-store, must-revalidate\";\n add_header Vary Accept-Encoding;\n tcp_nodelay off;\n open_file_cache max=3000 inactive=120s;\n open_file_cache_valid 45s;\n open_file_cache_min_uses 2;\n open_file_cache_errors off;\n gzip on;\n gzip_disable \"msie6\";\n gzip_vary on;\n gzip_proxied any;\n gzip_comp_level 6;\n gzip_buffers 16 8k;\n gzip_http_version 1.1;\n gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;\n }\n }\n}\nNGINXCONF\n\n # Copy OpenSpeedTest HTML files\n cp \"$REPO_ROOT/src/OpenSpeedTest/index.html\" \"$SPEEDTEST_DIR/html/\"\n cp \"$REPO_ROOT/src/OpenSpeedTest/hosted.html\" \"$SPEEDTEST_DIR/html/\"\n cp \"$REPO_ROOT/src/OpenSpeedTest/downloading\" \"$SPEEDTEST_DIR/html/\"\n cp \"$REPO_ROOT/src/OpenSpeedTest/upload\" \"$SPEEDTEST_DIR/html/\"\n\n # Copy assets\n cp \"$REPO_ROOT/src/OpenSpeedTest/assets/css/\"* \"$SPEEDTEST_DIR/html/assets/css/\" 2>/dev/null || true\n cp \"$REPO_ROOT/src/OpenSpeedTest/assets/js/\"* \"$SPEEDTEST_DIR/html/assets/js/\" 2>/dev/null || true\n cp \"$REPO_ROOT/src/OpenSpeedTest/assets/fonts/\"* \"$SPEEDTEST_DIR/html/assets/fonts/\" 2>/dev/null || true\n cp \"$REPO_ROOT/src/OpenSpeedTest/assets/images/\"*.svg \"$SPEEDTEST_DIR/html/assets/images/\" 2>/dev/null || true\n cp \"$REPO_ROOT/src/OpenSpeedTest/assets/images/icons/\"* \"$SPEEDTEST_DIR/html/assets/images/icons/\" 2>/dev/null || true\n\n # Copy config.js template and inject runtime values (same approach as Docker entrypoint)\n cp \"$REPO_ROOT/src/OpenSpeedTest/assets/js/config.js\" \"$SPEEDTEST_DIR/html/assets/js/config.js\"\n\n # Replace placeholders - use __DYNAMIC__ so URL is constructed client-side from browser location\n sed -i '' \"s|__SAVE_DATA__|true|g\" \"$SPEEDTEST_DIR/html/assets/js/config.js\"\n sed -i '' \"s|__SAVE_DATA_URL__|__DYNAMIC__|g\" \"$SPEEDTEST_DIR/html/assets/js/config.js\"\n sed -i '' \"s|__API_PATH__|/api/public/speedtest/results|g\" \"$SPEEDTEST_DIR/html/assets/js/config.js\"\n\n SPEEDTEST_AVAILABLE=true\n echo \"OpenSpeedTest files installed\"\nelse\n echo \"Warning: OpenSpeedTest source files not found. Skipping SpeedTest setup.\"\n echo \"Browser-based speed testing will not be available.\"\n SPEEDTEST_AVAILABLE=false\nfi\n\n# Step 8: Create launchd plist for main app\necho \"\"\necho \"[8/9] Creating launchd service...\"\n\ncat > \"$LAUNCH_AGENT_DIR/$LAUNCH_AGENT_FILE\" << EOF\n\n\n\n\n Label\n net.ozarkconnect.networkoptimizer\n ProgramArguments\n \n $INSTALL_DIR/start.sh\n \n WorkingDirectory\n $INSTALL_DIR\n KeepAlive\n \n RunAtLoad\n \n StandardOutPath\n $INSTALL_DIR/logs/stdout.log\n StandardErrorPath\n $INSTALL_DIR/logs/stderr.log\n\n\nEOF\n\n# Step 9: Start services\n# Note: The app manages nginx and iperf3 internally - no separate launchd services needed\necho \"\"\necho \"[9/9] Starting services...\"\n\n# Migrate from old plist name if present\nif [ -f \"$LAUNCH_AGENT_DIR/$OLD_LAUNCH_AGENT_FILE\" ]; then\n echo \"Migrating from old service name...\"\n launchctl unload \"$LAUNCH_AGENT_DIR/$OLD_LAUNCH_AGENT_FILE\" 2>/dev/null || true\n rm -f \"$LAUNCH_AGENT_DIR/$OLD_LAUNCH_AGENT_FILE\"\n # Also remove the old speedtest plist if it exists\n launchctl unload \"$LAUNCH_AGENT_DIR/com.networkoptimizer.speedtest.plist\" 2>/dev/null || true\n rm -f \"$LAUNCH_AGENT_DIR/com.networkoptimizer.speedtest.plist\"\nfi\n\n# Gracefully stop any orphaned processes from previous installs\npkill -f \"NetworkOptimizer.Web\" 2>/dev/null || true\npkill iperf3 2>/dev/null || true\npkill nginx 2>/dev/null || true\nsleep 2 # Give processes time to shut down gracefully\n\n# Unload if already loaded (ignore errors)\nlaunchctl unload \"$LAUNCH_AGENT_DIR/$LAUNCH_AGENT_FILE\" 2>/dev/null || true\nlaunchctl load \"$LAUNCH_AGENT_DIR/$LAUNCH_AGENT_FILE\"\n\n# Wait for startup and verify\necho \"\"\necho \"Waiting for service to start...\"\n\n# Check launchd service status\nif launchctl list | grep -q \"net.ozarkconnect.networkoptimizer\"; then\n echo \"✓ Network Optimizer service is running\"\nelse\n echo \"✗ Network Optimizer service failed to start\"\n echo \" Check logs: tail -f $INSTALL_DIR/logs/stderr.log\"\nfi\n\n# Wait for health endpoint with retries\necho \"Waiting for application to be ready...\"\nHEALTH_OK=false\nfor i in {1..12}; do\n if curl -sL http://localhost:8042/api/health | grep -qi \"healthy\"; then\n HEALTH_OK=true\n break\n fi\n sleep 5\ndone\n\necho \"\"\necho \"=== Installation Complete ===\"\necho \"\"\nif [ \"$HEALTH_OK\" = true ]; then\n echo \"✓ Health check passed\"\nelse\n echo \"✗ Health check failed after 60 seconds\"\n echo \" The app may still be starting. Check logs: tail -f $INSTALL_DIR/logs/stdout.log\"\nfi\n\necho \"\"\necho \"=== Access Information ===\"\necho \"\"\necho \"Web UI: http://localhost:8042\"\necho \" http://$LOCAL_IP:8042 (from other devices)\"\nif [ \"$SPEEDTEST_AVAILABLE\" = true ]; then\n echo \"\"\n echo \"SpeedTest: http://localhost:3005\"\n echo \" http://$LOCAL_IP:3005 (from other devices)\"\nfi\necho \"\"\necho \"On first run, check logs for the auto-generated admin password:\"\necho \" grep -A5 'AUTO-GENERATED' $INSTALL_DIR/logs/stdout.log\"\necho \"\"\necho \"Service management:\"\necho \" Stop: launchctl unload ~/Library/LaunchAgents/$LAUNCH_AGENT_FILE\"\necho \" Start: launchctl load ~/Library/LaunchAgents/$LAUNCH_AGENT_FILE\"\necho \" Logs: tail -f $INSTALL_DIR/logs/stdout.log\"\necho \"\"\n"
},
{
"path": "scripts/parse-antenna-patterns.ps1",
"content": "<#\n.SYNOPSIS\n Parses Ubiquiti .ant antenna pattern files from zip archives into a single JSON file.\n\n.DESCRIPTION\n Extracts .ant files from all zip archives in the antenna-patterns directory,\n parses the gain values, and outputs a consolidated JSON file for the web app.\n\n Each .ant file contains 719+ gain values:\n - 360 azimuth values (0-359 degrees)\n - 359 elevation values (0-358 degrees)\n\n Files may be UTF-16LE or UTF-8 encoded (both are tried automatically).\n macOS resource fork files (._prefix) are skipped.\n\n Antenna variant files (e.g., U7-Outdoor-Omni-Antenna.zip) are stored under\n variant keys like \"U7-Outdoor:omni\". The base model uses the standard key.\n\n.PARAMETER InputDir\n Directory containing .zip files with .ant patterns.\n Default: research/wifi-optimizer/antenna-patterns/\n\n.PARAMETER OutputFile\n Output JSON file path.\n Default: src/NetworkOptimizer.Web/wwwroot/data/antenna-patterns.json\n#>\n\nparam(\n [string]$InputDir = (Join-Path $PSScriptRoot \"..\" \"research\" \"wifi-optimizer\" \"antenna-patterns\"),\n [string]$OutputFile = (Join-Path $PSScriptRoot \"..\" \"src\" \"NetworkOptimizer.Web\" \"wwwroot\" \"data\" \"antenna-patterns.json\")\n)\n\n$ErrorActionPreference = \"Stop\"\nAdd-Type -AssemblyName System.IO.Compression.FileSystem\n\n# Band name extraction from filename\nfunction Get-BandFromFilename($filename) {\n if ($filename -match \"2\\.4GHz|2\\.4 GHz|2_4GHz|2\\.45GHz\") { return \"2.4\" }\n if ($filename -match \"(? (\"U7-Outdoor\", \"omni\")\n# \"UACC-UK-Ultra-Panel-Antenna\" -> (\"UK-Ultra\", \"panel\")\n# \"U7-Pro\" -> (\"U7-Pro\", $null)\nfunction Get-ModelAndVariant($zipName) {\n # Variant patterns and their normalized names\n $variantPatterns = @(\n @{ Pattern = \"-Omni-Antenna$\"; Variant = \"omni\"; StripPrefix = \"UACC-\" },\n @{ Pattern = \"-Panel-Antenna$\"; Variant = \"panel\"; StripPrefix = \"UACC-\" },\n @{ Pattern = \"-Narrow-Angle-High-Gain$\"; Variant = \"narrow\" },\n @{ Pattern = \"-Narrow-Angle$\"; Variant = \"narrow\" },\n @{ Pattern = \"-Wide-Angle-Low-Gain$\"; Variant = \"wide\" },\n @{ Pattern = \"-Wide-Angle$\"; Variant = \"wide\" }\n )\n\n foreach ($vp in $variantPatterns) {\n if ($zipName -match $vp.Pattern) {\n $baseName = $zipName -replace $vp.Pattern, \"\"\n # Strip accessory prefix (UACC-) if present\n if ($vp.StripPrefix -and $baseName.StartsWith($vp.StripPrefix)) {\n $baseName = $baseName.Substring($vp.StripPrefix.Length)\n }\n return @{ Model = $baseName; Variant = $vp.Variant }\n }\n }\n\n return @{ Model = $zipName; Variant = $null }\n}\n\n# Try to parse gain values from raw content string\nfunction Parse-GainValues($content) {\n $values = @()\n foreach ($line in $content.Split(\"`n\")) {\n $trimmed = $line.Trim()\n if ($trimmed -ne \"\" -and $trimmed -match \"^-?\\d\") {\n $values += [float]$trimmed\n }\n }\n return $values\n}\n\n# Parse a single .ant file, trying UTF-16LE first then UTF-8\nfunction Parse-AntFile($entry) {\n # Try UTF-16LE first (newer files)\n $stream = $entry.Open()\n $reader = [System.IO.StreamReader]::new($stream, [System.Text.Encoding]::Unicode)\n $content = $reader.ReadToEnd()\n $reader.Dispose()\n $stream.Dispose()\n\n $values = Parse-GainValues $content\n\n # Fall back to UTF-8 (older/macOS-created files)\n if ($values.Count -lt 719) {\n $stream = $entry.Open()\n $reader = [System.IO.StreamReader]::new($stream, [System.Text.Encoding]::UTF8)\n $content = $reader.ReadToEnd()\n $reader.Dispose()\n $stream.Dispose()\n\n $values = Parse-GainValues $content\n }\n\n if ($values.Count -lt 719) {\n Write-Warning \" Expected 719+ values, got $($values.Count) in $($entry.Name)\"\n return $null\n }\n\n return @{\n azimuth = $values[0..359]\n elevation = $values[360..718]\n }\n}\n\nWrite-Host \"Parsing antenna patterns from: $InputDir\"\nWrite-Host \"Output: $OutputFile\"\nWrite-Host \"\"\n\n$patterns = @{}\n$zipFiles = Get-ChildItem -Path $InputDir -Filter \"*.zip\" -ErrorAction SilentlyContinue | Sort-Object Name\n\nWrite-Host \"Found $($zipFiles.Count) zip files\"\nWrite-Host \"\"\n\nforeach ($zip in $zipFiles) {\n $rawName = [System.IO.Path]::GetFileNameWithoutExtension($zip.Name)\n $parsed = Get-ModelAndVariant $rawName\n\n # Build the key: \"ModelName\" for base, \"ModelName:variant\" for variants\n if ($parsed.Variant) {\n $patternKey = \"$($parsed.Model):$($parsed.Variant)\"\n } else {\n $patternKey = $parsed.Model\n }\n\n Write-Host \"Processing: $rawName -> $patternKey\"\n\n try {\n $archive = [System.IO.Compression.ZipFile]::OpenRead($zip.FullName)\n\n # Filter to .ant files, skip macOS resource forks (._prefix)\n $antFiles = $archive.Entries | Where-Object {\n $_.Name -match \"\\.(ant|amt)$\" -and $_.Name -notmatch \"^\\._\"\n }\n\n if ($antFiles.Count -eq 0) {\n Write-Warning \" No .ant files found in $($zip.Name)\"\n $archive.Dispose()\n continue\n }\n\n if (-not $patterns.ContainsKey($patternKey)) {\n $patterns[$patternKey] = @{}\n }\n\n foreach ($entry in $antFiles) {\n $band = Get-BandFromFilename $entry.Name\n if (-not $band) {\n Write-Warning \" Could not determine band for: $($entry.Name)\"\n continue\n }\n\n Write-Host \" Band $band : $($entry.Name)\"\n\n $result = Parse-AntFile $entry\n\n if ($result) {\n $patterns[$patternKey][$band] = $result\n }\n }\n\n $archive.Dispose()\n }\n catch {\n Write-Warning \" Error processing $($zip.Name): $_\"\n }\n}\n\n# Remove models with no band data (failed to parse anything)\n$emptyModels = $patterns.Keys | Where-Object { $patterns[$_].Count -eq 0 }\nforeach ($key in $emptyModels) {\n Write-Warning \"Removing $key (no band data parsed)\"\n $patterns.Remove($key)\n}\n\n# Ensure output directory exists\n$outputDir = [System.IO.Path]::GetDirectoryName($OutputFile)\nif (-not (Test-Path $outputDir)) {\n New-Item -ItemType Directory -Path $outputDir -Force | Out-Null\n}\n\n# Write JSON\n$json = $patterns | ConvertTo-Json -Depth 5 -Compress\n[System.IO.File]::WriteAllText($OutputFile, $json)\n\n$fileSize = (Get-Item $OutputFile).Length\n$totalBands = ($patterns.Values | ForEach-Object { $_.Count } | Measure-Object -Sum).Sum\n$variantCount = ($patterns.Keys | Where-Object { $_ -match \":\" }).Count\nWrite-Host \"\"\nWrite-Host \"Done! Wrote $($patterns.Count) models ($variantCount with variants, $totalBands total band patterns) to $OutputFile ($([math]::Round($fileSize / 1024))KB)\"\n"
},
{
"path": "scripts/proxmox/README.md",
"content": "# Proxmox LXC Installation\n\nInstall Network Optimizer for UniFi in a Proxmox LXC container with a single command.\n\n## Quick Start\n\nRun this command on your **Proxmox VE host** (not inside a VM or container):\n\n```bash\nbash -c \"$(wget -qLO - https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)\"\n```\n\nOr with curl:\n\n```bash\nbash -c \"$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)\"\n```\n\nThe script will guide you through:\n1. Container configuration (ID, hostname, resources, network)\n2. Application settings (timezone, ports, optional HTTPS via Traefik, optional password)\n3. Automatic installation of Docker and Network Optimizer\n4. Optional Traefik HTTPS proxy with automatic Let's Encrypt certificates\n\n## Requirements\n\n- **Proxmox VE 7.0** or later\n- **10GB** disk space minimum (20GB recommended)\n- **2GB** RAM minimum (4GB recommended)\n- Internet access for downloading container template and Docker images\n\n## What Gets Installed\n\nThe script creates a privileged Debian LXC container (Debian 13 Trixie by default) with:\n\n- Docker CE and Docker Compose (privileged container for reliable Docker operation)\n- Network Optimizer (Blazor web UI on port 8042)\n- OpenSpeedTest (browser-based speed testing on port 3005)\n- Persistent storage in `/opt/network-optimizer/data`\n- Auto-start on boot enabled\n- Swap space for memory stability\n\n## Default Configuration\n\n| Setting | Default | Description |\n|---------|---------|-------------|\n| Container ID | Next available | Starting from 100, checks VMs too |\n| Hostname | `network-optimizer` | Container hostname |\n| Debian Version | 13 (Trixie) | Debian 12 (Bookworm) also supported |\n| RAM | 2048 MB | Container memory |\n| Swap | 512 MB | Swap space |\n| CPU | 2 cores | Container CPU cores |\n| Disk | 10 GB | Root filesystem size |\n| Storage | `local-lvm` | Proxmox storage for container |\n| VLAN Tag | None | Tag network interface for VLAN-aware bridges |\n| Network | DHCP | Static IP also supported (with DNS) |\n| SSH Access | Disabled | Enable for direct SSH root login |\n| Web Port | 8042 | Network Optimizer web UI (fixed) |\n| Speedtest Port | 3005 | OpenSpeedTest web UI (configurable) |\n| iperf3 Server | Disabled | CLI-based speed testing (port 5201) |\n| Host Redirect | Disabled | Redirect IP access to hostname (requires local DNS) |\n| HTTPS (Traefik) | Disabled | Automatic HTTPS with Let's Encrypt via Cloudflare DNS |\n| Reverse Proxy | None | Optional hostname for reverse proxy setup (skipped if Traefik enabled) |\n| Geo Location | Disabled | GPS tagging for speed tests and signal levels (auto-enabled with Traefik) |\n| Timezone | America/New_York | Container timezone |\n\n## Post-Installation\n\n### Get Admin Password\n\nIf you didn't set a password during installation, an auto-generated one is shown in the logs:\n\n```bash\npct exec -- docker logs network-optimizer 2>&1 | grep -A5 \"AUTO-GENERATED\"\n```\n\n### Access the Web UI\n\n1. Open `http://:8042` in your browser\n2. Log in with the admin password\n3. Go to **Settings** and connect to your UniFi controller\n4. Navigate to **Audit** to run your first security scan\n\n### Container Management\n\n```bash\n# Enter container shell\npct enter \n\n# Start/stop container\npct start \npct stop \n\n# View application logs\npct exec -- docker logs -f network-optimizer\n\n# Check container status\npct status \n```\n\n### SSH Access (Optional)\n\nIf you enabled SSH during installation, set a root password:\n\n```bash\npct exec -- passwd\n```\n\nThen connect directly:\n\n```bash\nssh root@\n```\n\n### Application Management\n\nAll commands run from the Proxmox host:\n\n```bash\n# View logs\npct exec -- docker logs -f network-optimizer\n\n# Restart services\npct exec -- bash -c \"cd /opt/network-optimizer && docker compose restart\"\n\n# Update to latest version\npct exec -- bash -c \"cd /opt/network-optimizer && docker compose pull && docker compose up -d\"\n\n# Check health\npct exec -- curl -s http://localhost:8042/api/health\n```\n\nOr enter the container first:\n\n```bash\npct enter \ncd /opt/network-optimizer\ndocker compose logs -f\ndocker compose pull && docker compose up -d\n```\n\n## HTTPS with Traefik\n\nDuring installation, you can optionally enable HTTPS via a built-in [Traefik](https://github.com/Ozark-Connect/NetworkOptimizer-Proxy) reverse proxy. This provides:\n\n- Automatic Let's Encrypt certificates via Cloudflare DNS-01 challenge\n- HTTP/1.1 for speed tests (HTTP/2 multiplexing skews results), HTTP/2 for the main app\n- Geo location tagging for speed tests and signal walk tests (browsers require HTTPS for location access)\n\n**Requirements:**\n- A domain managed by Cloudflare (for DNS-01 certificate validation)\n- A Cloudflare API token with Zone > DNS > Edit permission ([create one here](https://dash.cloudflare.com/profile/api-tokens))\n- Two DNS records pointing to your container's IP (e.g., `optimizer.example.com` and `speedtest.example.com`)\n\n**What gets deployed:**\n- Traefik container at `/opt/network-optimizer-proxy/`\n- Dynamic configuration in `/opt/network-optimizer-proxy/dynamic/config.yml`\n- Certificates stored in `/opt/network-optimizer-proxy/acme/acme.json`\n\n**Management commands:**\n\n```bash\n# View Traefik logs\npct exec -- docker logs -f traefik-proxy\n\n# Update Traefik\npct exec -- bash -c \"cd /opt/network-optimizer-proxy && docker compose pull && docker compose up -d\"\n\n# Edit proxy configuration\npct exec -- nano /opt/network-optimizer-proxy/dynamic/config.yml\n\n# Edit proxy environment (ACME email, API token)\npct exec -- nano /opt/network-optimizer-proxy/.env\n```\n\n**Note:** Certificates may take about a minute to issue on first start. If you see certificate errors immediately after installation, wait a moment and refresh.\n\nIf you don't enable Traefik during installation, you can still set up a reverse proxy manually later. See the [Deployment Guide](../../docker/DEPLOYMENT.md#https-with-reverse-proxy) for nginx, Caddy, and Traefik examples.\n\n## Advanced Configuration\n\n### Static IP Address\n\nDuring installation, when prompted for IP address, enter a CIDR notation:\n\n```\nIP address [dhcp]: 192.168.1.100/24\nGateway IP: 192.168.1.1\n```\n\n### Custom Ports\n\nModify ports during installation or edit `/opt/network-optimizer/.env` afterward:\n\n```bash\npct exec -- nano /opt/network-optimizer/.env\n```\n\nThen restart:\n\n```bash\npct exec -- bash -c \"cd /opt/network-optimizer && docker compose down && docker compose up -d\"\n```\n\n### Resource Adjustments\n\nAdjust container resources via Proxmox:\n\n```bash\n# Increase RAM to 4GB\npct set --memory 4096\n\n# Increase CPU to 4 cores\npct set --cores 4\n\n# Resize disk to 20GB\npct resize rootfs 20G\n```\n\n### Enable iperf3 Server\n\nFor CLI-based speed testing from network devices:\n\n```bash\npct exec -- bash -c \"echo 'IPERF3_SERVER_ENABLED=true' >> /opt/network-optimizer/.env\"\npct exec -- bash -c \"cd /opt/network-optimizer && docker compose down && docker compose up -d\"\n```\n\n## Network Configuration\n\n### VLAN-Aware Bridges\n\nIf your Proxmox bridge is VLAN-aware (`bridge-vlan-aware yes` in `/etc/network/interfaces`) and the default untagged VLAN doesn't have internet access, the installer will prompt for a VLAN tag. This tags the container's network interface so it can reach the internet for package downloads and Docker image pulls.\n\nExample: If your management/setup VLAN is 10, enter `10` when prompted. Leave empty if your default VLAN already has internet access.\n\n### Host Networking\n\nThe container uses Docker's host networking mode by default, which provides:\n- Best performance for speed testing\n- Accurate client IP detection\n- No port mapping overhead\n\n### Firewall Rules\n\nIf you have Proxmox firewall enabled, allow these ports:\n\n```bash\n# Web UI\npct set --firewall 1\npvesh create /nodes//lxc//firewall/rules --type in --action ACCEPT --dport 8042 --proto tcp\n\n# OpenSpeedTest\npvesh create /nodes//lxc//firewall/rules --type in --action ACCEPT --dport 3005 --proto tcp\n\n# iperf3 (if enabled)\npvesh create /nodes//lxc//firewall/rules --type in --action ACCEPT --dport 5201 --proto tcp\n```\n\nOr disable container firewall:\n\n```bash\npct set --firewall 0\n```\n\n## Backup and Restore\n\n### Backup Container\n\n```bash\n# Full container backup\nvzdump --storage local --compress zstd --mode snapshot\n\n# Or just the data directory\npct exec -- tar czf /tmp/data-backup.tar.gz -C /opt/network-optimizer data\npct pull /tmp/data-backup.tar.gz ./data-backup.tar.gz\n```\n\n### Restore Data\n\n```bash\n# Stop services\npct exec -- bash -c \"cd /opt/network-optimizer && docker compose down\"\n\n# Restore data\npct push ./data-backup.tar.gz /tmp/data-backup.tar.gz\npct exec -- tar xzf /tmp/data-backup.tar.gz -C /opt/network-optimizer\n\n# Start services\npct exec -- bash -c \"cd /opt/network-optimizer && docker compose up -d\"\n```\n\n## Troubleshooting\n\n### Container Won't Start\n\nCheck for Docker-related issues:\n\n```bash\n# View container config\ncat /etc/pve/lxc/.conf\n\n# Ensure nesting is enabled\npct set --features nesting=1\n```\n\n### Docker Fails Inside Container\n\nThe script creates a privileged container with nesting enabled, which is the most reliable configuration for Docker. If Docker still fails:\n\n```bash\n# Check Docker service status\npct exec -- systemctl status docker\n\n# Try restarting Docker\npct exec -- systemctl restart docker\n\n# Check for errors in Docker logs\npct exec -- journalctl -u docker --no-pager -n 50\n```\n\n### Application Not Responding\n\n```bash\n# Check Docker status\npct exec -- systemctl status docker\n\n# Check container logs\npct exec -- docker logs network-optimizer\n\n# Restart everything\npct exec -- bash -c \"cd /opt/network-optimizer && docker compose down && docker compose up -d\"\n```\n\n### Permission Errors\n\nIf you see permission errors with volumes:\n\n```bash\n# Check ownership\npct exec -- ls -la /opt/network-optimizer/\n\n# Fix permissions\npct exec -- chown -R 1000:1000 /opt/network-optimizer/data\n```\n\n### Reset Admin Password\n\nIf you forget the admin password:\n\n```bash\npct exec -- bash -c \"curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/reset-password.sh | bash -s -- --force\"\n```\n\n**Manual fallback:**\n\n```bash\n# Clear the password\npct exec -- docker exec network-optimizer sqlite3 /app/data/network_optimizer.db \\\n \"UPDATE AdminSettings SET Password = NULL, Enabled = 0;\"\n\n# Restart and view the new password\npct exec -- docker restart network-optimizer\nsleep 10\npct exec -- docker logs network-optimizer 2>&1 | grep -A5 \"AUTO-GENERATED\"\n```\n\n## Uninstall\n\nTo completely remove Network Optimizer:\n\n```bash\n# Stop and destroy container\npct stop \npct destroy \n```\n\n## Manual Installation\n\nIf you prefer manual installation or the script doesn't work in your environment:\n\n1. Create an LXC container (Debian 12, **privileged**, nesting enabled)\n ```bash\n pct create :vztmpl/debian-12-standard_*.tar.zst \\\n --hostname network-optimizer \\\n --memory 2048 --swap 512 --cores 2 \\\n --rootfs :10 \\\n --net0 name=eth0,bridge=vmbr0,ip=dhcp \\\n --unprivileged 0 --features nesting=1 --onboot 1\n ```\n If using a VLAN-aware bridge, add `,tag=` to the `--net0` value (e.g., `...,ip=dhcp,tag=10`).\n2. Start container and install Docker: https://docs.docker.com/engine/install/debian/\n3. Follow the [Docker deployment guide](../../docker/DEPLOYMENT.md)\n\n## Support\n\n- **Issues:** [GitHub Issues](https://github.com/Ozark-Connect/NetworkOptimizer/issues)\n- **Documentation:** [Deployment Guide](../../docker/DEPLOYMENT.md)\n\nWhen reporting issues, include:\n- Proxmox VE version (`pveversion`)\n- Container logs (`pct exec -- docker logs network-optimizer`)\n- Any error messages from the installation script\n"
},
{
"path": "scripts/proxmox/install.sh",
"content": "#!/usr/bin/env bash\n\n# Network Optimizer for UniFi - Proxmox LXC Installation Script\n# https://github.com/Ozark-Connect/NetworkOptimizer\n#\n# This script creates a Proxmox LXC container and installs Network Optimizer\n# using Docker Compose. Designed for the homelab community.\n#\n# Usage:\n# bash -c \"$(wget -qLO - https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)\"\n#\n# Requirements:\n# - Proxmox VE 7.0 or later\n# - Internet access for downloading container template and Docker images\n# - Sufficient storage (10GB minimum recommended)\n\nset -Eeuo pipefail\n\n# =============================================================================\n# Configuration Defaults\n# =============================================================================\nAPP_NAME=\"Network Optimizer\"\nGITHUB_REPO=\"Ozark-Connect/NetworkOptimizer\"\nGITHUB_BRANCH=\"main\"\n\n# Container defaults\nDEFAULT_HOSTNAME=\"network-optimizer\"\nDEFAULT_DISK_SIZE=\"10\"\nDEFAULT_RAM=\"2048\"\nDEFAULT_SWAP=\"512\"\nDEFAULT_CPU=\"2\"\nDEFAULT_BRIDGE=\"vmbr0\"\nDEFAULT_STORAGE=\"local-lvm\"\nDEFAULT_TEMPLATE_STORAGE=\"local\"\n\n# Application defaults\nDEFAULT_TZ=\"America/New_York\"\nDEFAULT_SPEEDTEST_PORT=\"3005\"\n\n# =============================================================================\n# Colors and Formatting\n# =============================================================================\nreadonly RD='\\033[0;31m' # Red\nreadonly GN='\\033[0;32m' # Green\nreadonly YW='\\033[0;33m' # Yellow\nreadonly BL='\\033[0;34m' # Blue\nreadonly MG='\\033[0;35m' # Magenta\nreadonly CY='\\033[0;36m' # Cyan\nreadonly WH='\\033[0;37m' # White\nreadonly BLD='\\033[1m' # Bold\nreadonly DIM='\\033[2m' # Dim\nreadonly CL='\\033[0m' # Clear/Reset\n\n# =============================================================================\n# Helper Functions\n# =============================================================================\nmsg_info() {\n echo -e \"${BL}[INFO]${CL} $1\"\n}\n\nmsg_ok() {\n echo -e \"${GN}[OK]${CL} $1\"\n}\n\nmsg_warn() {\n echo -e \"${YW}[WARN]${CL} $1\"\n}\n\nmsg_error() {\n echo -e \"${RD}[ERROR]${CL} $1\"\n}\n\nheader() {\n echo -e \"\\n${BLD}${CY}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${CL}\"\n echo -e \"${BLD}${CY} $1${CL}\"\n echo -e \"${BLD}${CY}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${CL}\\n\"\n}\n\ncleanup() {\n local exit_code=$?\n if [[ $exit_code -ne 0 ]]; then\n echo \"\"\n msg_error \"Installation failed. Check the output above for errors.\"\n if [[ -n \"${CT_ID:-}\" ]] && pct status \"$CT_ID\" &>/dev/null; then\n echo -e \"${DIM}To clean up the failed container:${CL}\"\n echo -e \"${DIM} pct stop $CT_ID 2>/dev/null; pct destroy $CT_ID${CL}\"\n fi\n fi\n}\n\ntrap cleanup EXIT\n\n# =============================================================================\n# Validation Functions\n# =============================================================================\ncheck_root() {\n if [[ $EUID -ne 0 ]]; then\n msg_error \"This script must be run as root on Proxmox VE.\"\n echo -e \"${DIM}Try: sudo bash install.sh${CL}\"\n exit 1\n fi\n}\n\ncheck_proxmox() {\n if ! command -v pveversion &> /dev/null; then\n msg_error \"This script must be run on Proxmox VE.\"\n echo -e \"${DIM}Proxmox VE not detected. Please run this script on your Proxmox host.${CL}\"\n exit 1\n fi\n\n local pve_version\n pve_version=$(pveversion --verbose | grep \"pve-manager\" | awk '{print $2}' | cut -d'/' -f1)\n msg_ok \"Proxmox VE $pve_version detected\"\n}\n\nget_next_ct_id() {\n local id=100\n while pct status \"$id\" &>/dev/null || qm status \"$id\" &>/dev/null 2>&1; do\n ((id++))\n done\n echo \"$id\"\n}\n\nvalidate_ct_id() {\n local id=$1\n if ! [[ \"$id\" =~ ^[0-9]+$ ]]; then\n msg_error \"Container ID must be a number.\"\n return 1\n fi\n if [[ \"$id\" -lt 100 ]]; then\n msg_error \"Container ID must be 100 or greater.\"\n return 1\n fi\n if pct status \"$id\" &>/dev/null || qm status \"$id\" &>/dev/null 2>&1; then\n msg_error \"ID $id already exists (VM or container).\"\n return 1\n fi\n return 0\n}\n\nvalidate_hostname() {\n local hostname=$1\n if ! [[ \"$hostname\" =~ ^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$ ]]; then\n msg_error \"Invalid hostname: $hostname\"\n msg_info \"Hostnames may only contain letters, numbers, dots, and hyphens.\"\n return 1\n fi\n return 0\n}\n\nget_storage_list() {\n pvesm status -content rootdir 2>/dev/null | awk 'NR>1 {print $1}' | tr '\\n' ' '\n}\n\nget_template_storage_list() {\n pvesm status -content vztmpl 2>/dev/null | awk 'NR>1 {print $1}' | tr '\\n' ' '\n}\n\nget_bridge_list() {\n ip -o link show type bridge 2>/dev/null | awk -F': ' '{print $2}' | tr '\\n' ' '\n}\n\nvalidate_storage() {\n local storage=$1\n local content_type=$2\n if ! pvesm status -content \"$content_type\" 2>/dev/null | awk 'NR>1 {print $1}' | grep -qw \"$storage\"; then\n return 1\n fi\n return 0\n}\n\n# Find the Debian template based on version selection\nfind_debian_template() {\n local storage=$1\n local version=${2:-12}\n\n # Update template list\n pveam update &>/dev/null || true\n\n # Find the latest debian template for the selected version\n local template\n template=$(pveam available -section system 2>/dev/null | grep \"debian-${version}-standard\" | tail -1 | awk '{print $2}')\n\n if [[ -z \"$template\" ]]; then\n msg_error \"Could not find Debian ${version} template in repository.\"\n msg_info \"Available templates:\"\n pveam available -section system 2>/dev/null | grep -i debian | head -5\n exit 1\n fi\n\n echo \"$template\"\n}\n\n# =============================================================================\n# Interactive Configuration\n# =============================================================================\nshow_banner() {\n clear\n echo -e \"${BLD}${MG}\"\n cat << \"EOF\"\n _ __ __ __ ____ __ _ _\n / | / /__ / /__ ______ _____/ /__ / __ \\____ / /_(_)___ ___ (_)___ ___ _____\n / |/ / _ \\/ __/ | /| / / __ \\/ ___/ //_/ / / / / __ \\/ __/ / __ `__ \\/ /_ / / _ \\/ ___/\n / /| / __/ /_ | |/ |/ / /_/ / / / ,< / /_/ / /_/ / /_/ / / / / / / / / /_/ __/ /\n/_/ |_/\\___/\\__/ |__/|__/\\____/_/ /_/|_| \\____/ .___/\\__/_/_/ /_/ /_/_/ /___/\\___/_/\n /_/\nEOF\n echo -e \"${CL}\"\n echo -e \"${DIM}Proxmox LXC Installation Script${CL}\"\n echo -e \"${DIM}https://github.com/${GITHUB_REPO}${CL}\\n\"\n}\n\nconfigure_container() {\n header \"Container Configuration\"\n\n # Container ID\n local default_id\n default_id=$(get_next_ct_id)\n echo -e \"${WH}Container ID${CL} ${DIM}(next available: $default_id)${CL}\"\n read -rp \"Enter CT ID [$default_id]: \" CT_ID\n CT_ID=${CT_ID:-$default_id}\n if ! validate_ct_id \"$CT_ID\"; then\n exit 1\n fi\n\n # Hostname\n echo -e \"\\n${WH}Hostname${CL}\"\n read -rp \"Enter hostname [$DEFAULT_HOSTNAME]: \" CT_HOSTNAME\n CT_HOSTNAME=${CT_HOSTNAME:-$DEFAULT_HOSTNAME}\n\n # Debian version\n echo -e \"\\n${WH}Debian Version${CL}\"\n echo -e \"${DIM}Debian 13 (Trixie) is the current stable release.${CL}\"\n echo -e \"${DIM}Debian 12 (Bookworm) also supported if preferred.${CL}\"\n read -rp \"Debian version [13]: \" DEBIAN_VERSION\n DEBIAN_VERSION=${DEBIAN_VERSION:-13}\n\n # Resources\n echo -e \"\\n${WH}Resources${CL}\"\n read -rp \"RAM in MB [$DEFAULT_RAM]: \" CT_RAM\n CT_RAM=${CT_RAM:-$DEFAULT_RAM}\n\n read -rp \"Swap in MB [$DEFAULT_SWAP]: \" CT_SWAP\n CT_SWAP=${CT_SWAP:-$DEFAULT_SWAP}\n\n read -rp \"CPU cores [$DEFAULT_CPU]: \" CT_CPU\n CT_CPU=${CT_CPU:-$DEFAULT_CPU}\n\n read -rp \"Disk size in GB [$DEFAULT_DISK_SIZE]: \" CT_DISK\n CT_DISK=${CT_DISK:-$DEFAULT_DISK_SIZE}\n\n # Storage\n local available_storage\n available_storage=$(get_storage_list)\n echo -e \"\\n${WH}Storage${CL} ${DIM}(available: $available_storage)${CL}\"\n read -rp \"Storage for container [$DEFAULT_STORAGE]: \" CT_STORAGE\n CT_STORAGE=${CT_STORAGE:-$DEFAULT_STORAGE}\n\n if ! validate_storage \"$CT_STORAGE\" \"rootdir\"; then\n msg_error \"Storage '$CT_STORAGE' not found or doesn't support rootdir content.\"\n msg_info \"Available storage: $available_storage\"\n exit 1\n fi\n\n local available_template_storage\n available_template_storage=$(get_template_storage_list)\n echo -e \"\\n${WH}Template Storage${CL} ${DIM}(available: $available_template_storage)${CL}\"\n read -rp \"Storage for templates [$DEFAULT_TEMPLATE_STORAGE]: \" TEMPLATE_STORAGE\n TEMPLATE_STORAGE=${TEMPLATE_STORAGE:-$DEFAULT_TEMPLATE_STORAGE}\n\n if ! validate_storage \"$TEMPLATE_STORAGE\" \"vztmpl\"; then\n msg_error \"Storage '$TEMPLATE_STORAGE' not found or doesn't support vztmpl content.\"\n msg_info \"Available storage: $available_template_storage\"\n exit 1\n fi\n\n # Network\n local available_bridges\n available_bridges=$(get_bridge_list)\n echo -e \"\\n${WH}Network Bridge${CL} ${DIM}(available: $available_bridges)${CL}\"\n read -rp \"Network bridge [$DEFAULT_BRIDGE]: \" CT_BRIDGE\n CT_BRIDGE=${CT_BRIDGE:-$DEFAULT_BRIDGE}\n\n # VLAN tag\n echo -e \"\\n${WH}VLAN Tag${CL}\"\n echo -e \"${DIM}If your bridge is VLAN-aware and the default (untagged) VLAN doesn't have${CL}\"\n echo -e \"${DIM}internet access, specify the VLAN ID to tag the container's network interface.${CL}\"\n echo -e \"${DIM}Leave empty for untagged (default VLAN).${CL}\"\n read -rp \"VLAN tag [none]: \" CT_VLAN_TAG\n CT_VLAN_TAG=${CT_VLAN_TAG:-}\n\n if [[ -n \"$CT_VLAN_TAG\" ]]; then\n if ! [[ \"$CT_VLAN_TAG\" =~ ^[0-9]+$ ]] || [[ \"$CT_VLAN_TAG\" -lt 1 ]] || [[ \"$CT_VLAN_TAG\" -gt 4094 ]]; then\n msg_error \"VLAN tag must be a number between 1 and 4094.\"\n exit 1\n fi\n fi\n\n echo -e \"\\n${WH}IP Configuration${CL}\"\n echo -e \"${DIM}Enter 'dhcp' for DHCP or static IP in CIDR format (e.g., 192.168.1.100/24)${CL}\"\n read -rp \"IP address [dhcp]: \" CT_IP\n CT_IP=${CT_IP:-dhcp}\n\n # Initialize gateway and DNS to empty\n CT_GW=\"\"\n CT_DNS=\"\"\n\n if [[ \"$CT_IP\" != \"dhcp\" ]]; then\n read -rp \"Gateway IP: \" CT_GW\n if [[ -z \"$CT_GW\" ]]; then\n msg_error \"Gateway is required for static IP configuration.\"\n exit 1\n fi\n\n echo -e \"${DIM}DNS server (press Enter to use gateway as DNS)${CL}\"\n read -rp \"DNS server [$CT_GW]: \" CT_DNS\n CT_DNS=${CT_DNS:-$CT_GW}\n fi\n}\n\nconfigure_application() {\n header \"Application Configuration\"\n\n # Timezone\n echo -e \"${WH}Timezone${CL}\"\n echo -e \"${DIM}Examples: America/New_York, America/Chicago, America/Los_Angeles, Europe/London${CL}\"\n read -rp \"Timezone [$DEFAULT_TZ]: \" APP_TZ\n APP_TZ=${APP_TZ:-$DEFAULT_TZ}\n\n # OpenSpeedTest port\n echo -e \"\\n${WH}OpenSpeedTest Port${CL}\"\n echo -e \"${DIM}Browser-based speed testing (main web UI is always on port 8042)${CL}\"\n read -rp \"OpenSpeedTest port [$DEFAULT_SPEEDTEST_PORT]: \" APP_SPEEDTEST_PORT\n APP_SPEEDTEST_PORT=${APP_SPEEDTEST_PORT:-$DEFAULT_SPEEDTEST_PORT}\n\n # iperf3 server\n echo -e \"\\n${WH}iperf3 Server${CL}\"\n echo -e \"${DIM}Enable CLI-based speed testing from network devices (port 5201)${CL}\"\n read -rp \"Enable iperf3 server? [y/N]: \" iperf3_response\n if [[ \"${iperf3_response,,}\" =~ ^(y|yes)$ ]]; then\n APP_IPERF3_ENABLED=\"true\"\n else\n APP_IPERF3_ENABLED=\"false\"\n fi\n\n # Hostname-based access (for local DNS users)\n echo -e \"\\n${WH}Hostname-Based Access${CL}\"\n echo -e \"${DIM}Enable if you have local DNS (e.g., Pi-hole) resolving the container hostname.${CL}\"\n echo -e \"${DIM}Uses hostname for redirects, speed test links, and CORS. Requires working DNS.${CL}\"\n echo -e \"${DIM}If disabled, IP address is used instead (works without DNS setup).${CL}\"\n read -rp \"Enable hostname-based access? [y/N]: \" hostname_redirect_response\n if [[ \"${hostname_redirect_response,,}\" =~ ^(y|yes)$ ]]; then\n APP_HOSTNAME_REDIRECT=\"true\"\n else\n APP_HOSTNAME_REDIRECT=\"false\"\n fi\n\n # Initialize Traefik and proxy variables\n APP_TRAEFIK_ENABLED=\"false\"\n TRAEFIK_ACME_EMAIL=\"\"\n TRAEFIK_CF_DNS_API_TOKEN=\"\"\n TRAEFIK_OPTIMIZER_HOSTNAME=\"\"\n TRAEFIK_SPEEDTEST_HOSTNAME=\"\"\n APP_REVERSE_PROXY_HOST=\"\"\n APP_GEOLOCATION=\"false\"\n APP_OPENSPEEDTEST_HOST=\"\"\n\n # HTTPS via Traefik\n echo -e \"\\n${WH}HTTPS via Traefik${CL}\"\n echo -e \"${DIM}Automatic HTTPS with Let's Encrypt certificates via Cloudflare DNS.${CL}\"\n echo -e \"${DIM}Enables geo location tagging and solves the HTTP/1.1 speed test requirement.${CL}\"\n echo -e \"${DIM}Requires a domain managed by Cloudflare.${CL}\"\n read -rp \"Set up HTTPS via Traefik? [y/N]: \" traefik_response\n if [[ \"${traefik_response,,}\" =~ ^(y|yes)$ ]]; then\n APP_TRAEFIK_ENABLED=\"true\"\n\n echo \"\"\n read -rp \"ACME email (for Let's Encrypt): \" TRAEFIK_ACME_EMAIL\n if [[ -z \"$TRAEFIK_ACME_EMAIL\" ]]; then\n msg_error \"ACME email is required for Let's Encrypt.\"\n exit 1\n fi\n\n echo -e \"${DIM}Create a token at: https://dash.cloudflare.com/profile/api-tokens${CL}\"\n echo -e \"${DIM}Required permission: Zone > DNS > Edit${CL}\"\n read -rsp \"Cloudflare DNS API token (hidden): \" TRAEFIK_CF_DNS_API_TOKEN\n echo \"\"\n if [[ -z \"$TRAEFIK_CF_DNS_API_TOKEN\" ]]; then\n msg_error \"Cloudflare API token is required.\"\n exit 1\n fi\n\n read -rp \"Optimizer hostname (e.g., optimizer.example.com): \" TRAEFIK_OPTIMIZER_HOSTNAME\n if [[ -z \"$TRAEFIK_OPTIMIZER_HOSTNAME\" ]]; then\n msg_error \"Optimizer hostname is required.\"\n exit 1\n fi\n if ! validate_hostname \"$TRAEFIK_OPTIMIZER_HOSTNAME\"; then\n exit 1\n fi\n\n read -rp \"SpeedTest hostname (e.g., speedtest.example.com): \" TRAEFIK_SPEEDTEST_HOSTNAME\n if [[ -z \"$TRAEFIK_SPEEDTEST_HOSTNAME\" ]]; then\n msg_error \"SpeedTest hostname is required.\"\n exit 1\n fi\n if ! validate_hostname \"$TRAEFIK_SPEEDTEST_HOSTNAME\"; then\n exit 1\n fi\n\n # Auto-configure reverse proxy and geo location\n APP_REVERSE_PROXY_HOST=\"$TRAEFIK_OPTIMIZER_HOSTNAME\"\n APP_OPENSPEEDTEST_HOST=\"$TRAEFIK_SPEEDTEST_HOSTNAME\"\n APP_GEOLOCATION=\"true\"\n else\n # Reverse proxy\n echo -e \"\\n${WH}Reverse Proxy${CL}\"\n echo -e \"${DIM}If using a reverse proxy (Caddy, nginx, Traefik), enter the public hostname${CL}\"\n echo -e \"${DIM}Leave empty if accessing directly via IP${CL}\"\n read -rp \"Reverse proxy hostname (e.g., optimizer.example.com): \" APP_REVERSE_PROXY_HOST\n APP_REVERSE_PROXY_HOST=${APP_REVERSE_PROXY_HOST:-}\n\n # Geo location tagging\n echo -e \"\\n${WH}Geo Location Tagging${CL}\"\n echo -e \"${DIM}Tag speed tests and Wi-Fi signal levels with GPS coordinates to map${CL}\"\n echo -e \"${DIM}coverage and identify dead zones across your property.${CL}\"\n read -rp \"Set up geo location tagging? [y/N]: \" geolocation_response\n if [[ \"${geolocation_response,,}\" =~ ^(y|yes)$ ]]; then\n echo -e \"\\n${DIM}Geo location requires HTTPS (browser security requirement), and OpenSpeedTest${CL}\"\n echo -e \"${DIM}needs HTTP/1.1 for accurate speed results. Set up an HTTP/1.1 reverse proxy${CL}\"\n echo -e \"${DIM}(Caddy, nginx, etc.) pointing at the speed test server (port ${APP_SPEEDTEST_PORT}).${CL}\"\n echo -e \"${DIM}See .env.example in /opt/network-optimizer for a sample Caddy config.${CL}\"\n echo \"\"\n read -rp \"Speed test HTTPS hostname (e.g., speedtest.example.com): \" APP_OPENSPEEDTEST_HOST\n if [[ -n \"$APP_OPENSPEEDTEST_HOST\" ]]; then\n APP_GEOLOCATION=\"true\"\n # Mixed content check - main app also needs HTTPS\n if [[ -z \"$APP_REVERSE_PROXY_HOST\" ]]; then\n echo -e \"\\n${YW}The main app also needs HTTPS to avoid mixed content blocking.${CL}\"\n echo -e \"${DIM}Speed test results won't save unless the main app is behind HTTPS too.${CL}\"\n read -rp \"Main app HTTPS hostname (e.g., optimizer.example.com): \" APP_REVERSE_PROXY_HOST\n APP_REVERSE_PROXY_HOST=${APP_REVERSE_PROXY_HOST:-}\n if [[ -z \"$APP_REVERSE_PROXY_HOST\" ]]; then\n msg_warn \"No main app hostname set. Speed test results may not save from HTTPS.\"\n fi\n fi\n else\n msg_warn \"Hostname required for geo location. Skipping geo location setup.\"\n fi\n fi\n fi\n\n # SSH access\n echo -e \"\\n${WH}SSH Access${CL}\"\n echo -e \"${DIM}Enable SSH root login for direct container access (alternative to pct enter).${CL}\"\n read -rp \"Enable SSH root access? [y/N]: \" ssh_response\n if [[ \"${ssh_response,,}\" =~ ^(y|yes)$ ]]; then\n APP_SSH_ENABLED=\"true\"\n else\n APP_SSH_ENABLED=\"false\"\n fi\n\n # Optional password\n echo -e \"\\n${WH}Admin Password${CL}\"\n echo -e \"${DIM}If you skip this, a secure password will be auto-generated and displayed in the container logs on first startup.${CL}\"\n echo -e \"${DIM}You can change it anytime in Settings > Admin Password.${CL}\"\n read -rsp \"Admin password (hidden, press Enter to auto-generate): \" APP_PASSWORD\n echo \"\"\n APP_PASSWORD=${APP_PASSWORD:-}\n}\n\nconfirm_settings() {\n header \"Confirm Settings\"\n\n echo -e \"${BLD}Container Settings:${CL}\"\n echo -e \" ID: ${GN}$CT_ID${CL}\"\n echo -e \" Hostname: ${GN}$CT_HOSTNAME${CL}\"\n echo -e \" Debian: ${GN}$DEBIAN_VERSION${CL}\"\n echo -e \" RAM: ${GN}${CT_RAM}MB${CL}\"\n echo -e \" Swap: ${GN}${CT_SWAP}MB${CL}\"\n echo -e \" CPU: ${GN}${CT_CPU} cores${CL}\"\n echo -e \" Disk: ${GN}${CT_DISK}GB${CL}\"\n echo -e \" Storage: ${GN}$CT_STORAGE${CL}\"\n echo -e \" Bridge: ${GN}$CT_BRIDGE${CL}\"\n if [[ -n \"${CT_VLAN_TAG:-}\" ]]; then\n echo -e \" VLAN Tag: ${GN}$CT_VLAN_TAG${CL}\"\n else\n echo -e \" VLAN Tag: ${DIM}none (untagged)${CL}\"\n fi\n echo -e \" IP: ${GN}$CT_IP${CL}\"\n if [[ \"$CT_IP\" != \"dhcp\" ]]; then\n echo -e \" Gateway: ${GN}$CT_GW${CL}\"\n echo -e \" DNS: ${GN}$CT_DNS${CL}\"\n fi\n if [[ \"$APP_SSH_ENABLED\" == \"true\" ]]; then\n echo -e \" SSH: ${GN}enabled${CL}\"\n else\n echo -e \" SSH: ${DIM}disabled${CL}\"\n fi\n\n echo -e \"\\n${BLD}Application Settings:${CL}\"\n echo -e \" Timezone: ${GN}$APP_TZ${CL}\"\n echo -e \" Web UI Port: ${GN}8042${CL} ${DIM}(fixed)${CL}\"\n echo -e \" Speedtest Port: ${GN}$APP_SPEEDTEST_PORT${CL}\"\n if [[ \"$APP_IPERF3_ENABLED\" == \"true\" ]]; then\n echo -e \" iperf3 Server: ${GN}enabled${CL} ${DIM}(port 5201)${CL}\"\n else\n echo -e \" iperf3 Server: ${DIM}disabled${CL}\"\n fi\n if [[ \"$APP_HOSTNAME_REDIRECT\" == \"true\" ]]; then\n echo -e \" Host Redirect: ${GN}$CT_HOSTNAME${CL}\"\n else\n echo -e \" Host Redirect: ${DIM}disabled${CL}\"\n fi\n if [[ \"$APP_TRAEFIK_ENABLED\" == \"true\" ]]; then\n echo -e \" Traefik HTTPS: ${GN}enabled${CL}\"\n echo -e \" ACME Email: ${GN}$TRAEFIK_ACME_EMAIL${CL}\"\n echo -e \" Optimizer: ${GN}https://$TRAEFIK_OPTIMIZER_HOSTNAME${CL}\"\n echo -e \" SpeedTest: ${GN}https://$TRAEFIK_SPEEDTEST_HOSTNAME${CL}\"\n else\n if [[ -n \"$APP_REVERSE_PROXY_HOST\" ]]; then\n echo -e \" Reverse Proxy: ${GN}$APP_REVERSE_PROXY_HOST${CL}\"\n else\n echo -e \" Reverse Proxy: ${DIM}none${CL}\"\n fi\n if [[ \"$APP_GEOLOCATION\" == \"true\" ]]; then\n echo -e \" Geo Location: ${GN}${APP_OPENSPEEDTEST_HOST}${CL} ${DIM}(HTTPS)${CL}\"\n else\n echo -e \" Geo Location: ${DIM}disabled${CL}\"\n fi\n fi\n if [[ -n \"$APP_PASSWORD\" ]]; then\n echo -e \" Password: ${GN}(set)${CL}\"\n else\n echo -e \" Password: ${YW}(auto-generate)${CL}\"\n fi\n\n echo \"\"\n read -rp \"Proceed with installation? [Y/n]: \" confirm\n confirm=${confirm:-Y}\n if [[ ! \"$confirm\" =~ ^[Yy]$ ]]; then\n msg_warn \"Installation cancelled.\"\n exit 0\n fi\n}\n\n# =============================================================================\n# Installation Functions\n# =============================================================================\ndownload_template() {\n header \"Downloading Container Template\"\n\n msg_info \"Finding Debian ${DEBIAN_VERSION} template...\"\n CT_TEMPLATE_FILE=$(find_debian_template \"$TEMPLATE_STORAGE\" \"$DEBIAN_VERSION\")\n msg_ok \"Found template: $CT_TEMPLATE_FILE\"\n\n local template_path\n template_path=$(pvesm path \"$TEMPLATE_STORAGE:vztmpl/$CT_TEMPLATE_FILE\" 2>/dev/null || echo \"\")\n\n if [[ -f \"$template_path\" ]]; then\n msg_ok \"Template already downloaded\"\n return 0\n fi\n\n msg_info \"Downloading template...\"\n if ! pveam download \"$TEMPLATE_STORAGE\" \"$CT_TEMPLATE_FILE\"; then\n msg_error \"Failed to download container template.\"\n echo -e \"${DIM}Try manually: pveam download $TEMPLATE_STORAGE $CT_TEMPLATE_FILE${CL}\"\n exit 1\n fi\n\n msg_ok \"Template downloaded successfully\"\n}\n\ncreate_container() {\n header \"Creating LXC Container\"\n\n msg_info \"Creating container $CT_ID ($CT_HOSTNAME)...\"\n\n local net_config\n if [[ \"$CT_IP\" == \"dhcp\" ]]; then\n net_config=\"name=eth0,bridge=$CT_BRIDGE,ip=dhcp\"\n else\n net_config=\"name=eth0,bridge=$CT_BRIDGE,ip=$CT_IP,gw=$CT_GW\"\n fi\n\n # Add VLAN tag if specified\n if [[ -n \"${CT_VLAN_TAG:-}\" ]]; then\n net_config=\"${net_config},tag=${CT_VLAN_TAG}\"\n fi\n\n # Create privileged container with nesting enabled (required for Docker)\n # Note: Privileged is more reliable for Docker; unprivileged requires extra config\n # that varies by Proxmox version and kernel\n pct create \"$CT_ID\" \"$TEMPLATE_STORAGE:vztmpl/$CT_TEMPLATE_FILE\" \\\n --hostname \"$CT_HOSTNAME\" \\\n --memory \"$CT_RAM\" \\\n --swap \"$CT_SWAP\" \\\n --cores \"$CT_CPU\" \\\n --rootfs \"$CT_STORAGE:$CT_DISK\" \\\n --net0 \"$net_config\" \\\n --ostype debian \\\n --unprivileged 0 \\\n --features nesting=1 \\\n --onboot 1 \\\n --start 0\n\n # Set DNS for static IP\n if [[ \"$CT_IP\" != \"dhcp\" ]] && [[ -n \"$CT_DNS\" ]]; then\n pct set \"$CT_ID\" --nameserver \"$CT_DNS\"\n fi\n\n # Fix Docker-in-LXC compatibility: runc's CVE-2025-52881 security patch uses\n # detached procfs mounts that AppArmor blocks (even in privileged containers).\n # Disabling AppArmor confinement and ensuring writable proc/sys fixes this.\n # See: https://forum.proxmox.com/threads/175437/\n {\n echo \"lxc.apparmor.profile: unconfined\"\n echo \"lxc.mount.auto: proc:rw sys:rw\"\n } >> \"/etc/pve/lxc/${CT_ID}.conf\"\n\n msg_ok \"Container created\"\n}\n\nstart_container() {\n msg_info \"Starting container...\"\n pct start \"$CT_ID\"\n\n # Wait for container to be fully up\n local max_wait=60\n local waited=0\n while ! pct exec \"$CT_ID\" -- test -f /etc/os-release 2>/dev/null; do\n sleep 1\n ((waited++))\n if [[ $waited -ge $max_wait ]]; then\n msg_error \"Container failed to start within ${max_wait}s\"\n exit 1\n fi\n done\n\n # Additional wait for networking\n sleep 3\n\n msg_ok \"Container started\"\n}\n\nconfigure_ssh() {\n if [[ \"$APP_SSH_ENABLED\" != \"true\" ]]; then\n return\n fi\n\n msg_info \"Configuring SSH root access...\"\n\n # Enable root login via SSH\n pct exec \"$CT_ID\" -- bash -c '\n # Ensure SSH is installed\n apt-get update -qq && apt-get install -y -qq openssh-server\n\n # Enable root login with password\n sed -i \"s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g\" /etc/ssh/sshd_config\n sed -i \"s/PermitRootLogin prohibit-password/PermitRootLogin yes/g\" /etc/ssh/sshd_config\n\n # Ensure SSH starts on boot and restart it\n systemctl enable ssh\n systemctl restart ssh\n '\n\n msg_ok \"SSH root access enabled\"\n msg_info \"Set root password with: pct exec $CT_ID -- passwd\"\n}\n\ninstall_dependencies() {\n header \"Installing Dependencies\"\n\n msg_info \"Updating package lists...\"\n pct exec \"$CT_ID\" -- bash -c \"apt-get update -qq\"\n msg_ok \"Package lists updated\"\n\n msg_info \"Installing prerequisites...\"\n pct exec \"$CT_ID\" -- bash -c \"DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \\\n ca-certificates \\\n curl \\\n gnupg \\\n lsb-release \\\n sudo \\\n wget\"\n msg_ok \"Prerequisites installed\"\n\n msg_info \"Installing Docker (this may take a minute)...\"\n pct exec \"$CT_ID\" -- bash -c '\n set -e\n\n # Add Docker official GPG key\n install -m 0755 -d /etc/apt/keyrings\n curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc\n chmod a+r /etc/apt/keyrings/docker.asc\n\n # Add Docker repository\n echo \"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo \"$VERSION_CODENAME\") stable\" > /etc/apt/sources.list.d/docker.list\n\n # Install Docker\n apt-get update -qq\n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin\n\n # Enable and start Docker\n systemctl enable docker\n systemctl start docker\n '\n msg_ok \"Docker installed\"\n\n # Verify Docker is running\n if ! pct exec \"$CT_ID\" -- docker info &>/dev/null; then\n msg_error \"Docker failed to start properly\"\n msg_info \"Checking Docker status...\"\n pct exec \"$CT_ID\" -- systemctl status docker --no-pager || true\n exit 1\n fi\n msg_ok \"Docker is running\"\n}\n\ndeploy_application() {\n header \"Deploying $APP_NAME\"\n\n local app_dir=\"/opt/network-optimizer\"\n\n msg_info \"Creating application directory...\"\n pct exec \"$CT_ID\" -- mkdir -p \"$app_dir\"\n msg_ok \"Directory created\"\n\n msg_info \"Creating docker-compose.yml...\"\n # Generate compose file that pulls from GHCR (no build context)\n # This is simpler and faster than building from source\n local compose_content='services:\n network-optimizer:\n image: ghcr.io/ozark-connect/network-optimizer:latest\n container_name: network-optimizer\n restart: unless-stopped\n network_mode: host\n volumes:\n - ./data:/app/data\n - ./ssh-keys:/app/ssh-keys:ro\n - ./logs:/app/logs\n environment:\n - TZ=${TZ:-America/Chicago}\n - BIND_LOCALHOST_ONLY=${BIND_LOCALHOST_ONLY:-false}\n - APP_PASSWORD=${APP_PASSWORD:-}\n - HOST_IP=${HOST_IP:-}\n - HOST_NAME=${HOST_NAME:-}\n - REVERSE_PROXIED_HOST_NAME=${REVERSE_PROXIED_HOST_NAME:-}\n - OPENSPEEDTEST_PORT=${OPENSPEEDTEST_PORT:-3005}\n - OPENSPEEDTEST_HOST=${OPENSPEEDTEST_HOST:-}\n - OPENSPEEDTEST_HTTPS=${OPENSPEEDTEST_HTTPS:-false}\n - OPENSPEEDTEST_HTTPS_PORT=${OPENSPEEDTEST_HTTPS_PORT:-443}\n - Iperf3Server__Enabled=${IPERF3_SERVER_ENABLED:-false}\n - Logging__LogLevel__Default=${LOG_LEVEL:-Information}\n - Logging__LogLevel__NetworkOptimizer=${APP_LOG_LEVEL:-Information}\n healthcheck:\n test: [\"CMD\", \"curl\", \"-f\", \"http://localhost:8042/api/health\"]\n interval: 30s\n timeout: 10s\n retries: 3\n start_period: 40s\n\n network-optimizer-speedtest:\n image: ghcr.io/ozark-connect/speedtest:latest\n container_name: network-optimizer-speedtest\n restart: unless-stopped\n ports:\n - \"${OPENSPEEDTEST_PORT:-3005}:3000\"\n environment:\n - TZ=${TZ:-America/Chicago}\n - HOST_IP=${HOST_IP:-}\n - HOST_NAME=${HOST_NAME:-}\n - OPENSPEEDTEST_PORT=${OPENSPEEDTEST_PORT:-3005}\n - OPENSPEEDTEST_HOST=${OPENSPEEDTEST_HOST:-}\n - OPENSPEEDTEST_HTTPS=${OPENSPEEDTEST_HTTPS:-false}\n - OPENSPEEDTEST_HTTPS_PORT=${OPENSPEEDTEST_HTTPS_PORT:-443}\n - REVERSE_PROXIED_HOST_NAME=${REVERSE_PROXIED_HOST_NAME:-}\n healthcheck:\n test: [\"CMD\", \"curl\", \"-f\", \"http://localhost:3000/\"]\n interval: 30s\n timeout: 10s\n retries: 3\n start_period: 10s\n'\n local encoded_compose\n encoded_compose=$(echo \"$compose_content\" | base64 -w 0)\n pct exec \"$CT_ID\" -- bash -c \"echo '$encoded_compose' | base64 -d > $app_dir/docker-compose.yml\"\n msg_ok \"docker-compose.yml created\"\n\n msg_info \"Downloading .env.example (reference)...\"\n pct exec \"$CT_ID\" -- curl -fsSL \\\n \"https://raw.githubusercontent.com/${GITHUB_REPO}/${GITHUB_BRANCH}/docker/.env.example\" \\\n -o \"$app_dir/.env.example\"\n msg_ok \".env.example downloaded\"\n\n msg_info \"Creating environment configuration...\"\n\n # Get container IP for HOST_IP setting\n local container_ip\n container_ip=$(pct exec \"$CT_ID\" -- hostname -I 2>/dev/null | awk '{print $1}')\n\n # Build .env content\n local env_content=\"# Network Optimizer Configuration\n# Generated by Proxmox installation script\n# See .env.example for all available options\n\nTZ=${APP_TZ}\n\n# Host identity for speed testing and CORS\nHOST_IP=${container_ip}\"\n\n # Only set HOST_NAME if user explicitly enabled hostname redirects\n if [[ \"$APP_HOSTNAME_REDIRECT\" == \"true\" ]]; then\n env_content=\"${env_content}\nHOST_NAME=${CT_HOSTNAME}\"\n fi\n\n env_content=\"${env_content}\n\n# Speed testing\nOPENSPEEDTEST_PORT=${APP_SPEEDTEST_PORT}\nIPERF3_SERVER_ENABLED=${APP_IPERF3_ENABLED}\"\n\n if [[ -n \"$APP_REVERSE_PROXY_HOST\" ]]; then\n env_content=\"${env_content}\n\n# Reverse proxy configuration\nREVERSE_PROXIED_HOST_NAME=${APP_REVERSE_PROXY_HOST}\"\n fi\n\n if [[ \"$APP_TRAEFIK_ENABLED\" == \"true\" ]]; then\n env_content=\"${env_content}\n\n# Traefik handles public access - bind app to localhost only\nBIND_LOCALHOST_ONLY=true\"\n fi\n\n if [[ \"$APP_GEOLOCATION\" == \"true\" ]]; then\n env_content=\"${env_content}\n\n# Geo location tagging (HTTPS speed test)\nOPENSPEEDTEST_HTTPS=true\nOPENSPEEDTEST_HOST=${APP_OPENSPEEDTEST_HOST}\"\n fi\n\n if [[ -n \"$APP_PASSWORD\" ]]; then\n env_content=\"${env_content}\n\n# Admin password\nAPP_PASSWORD=${APP_PASSWORD}\"\n fi\n\n # Write .env file using base64 encoding to handle special characters\n local encoded_content\n encoded_content=$(echo \"$env_content\" | base64 -w 0)\n pct exec \"$CT_ID\" -- bash -c \"echo '$encoded_content' | base64 -d > $app_dir/.env\"\n\n msg_ok \"Environment configured\"\n\n # Create data directories\n msg_info \"Creating data directories...\"\n pct exec \"$CT_ID\" -- bash -c \"mkdir -p $app_dir/data $app_dir/logs $app_dir/ssh-keys\"\n msg_ok \"Data directories created\"\n\n msg_info \"Pulling Docker images (this may take a few minutes)...\"\n pct exec \"$CT_ID\" -- bash -c \"cd $app_dir && docker compose pull\"\n msg_ok \"Docker images pulled\"\n\n msg_info \"Starting services...\"\n pct exec \"$CT_ID\" -- bash -c \"cd $app_dir && docker compose up -d\"\n msg_ok \"Services started\"\n}\n\ndeploy_traefik() {\n if [[ \"$APP_TRAEFIK_ENABLED\" != \"true\" ]]; then\n return\n fi\n\n header \"Deploying Traefik HTTPS Proxy\"\n\n local proxy_dir=\"/opt/network-optimizer-proxy\"\n local proxy_repo=\"Ozark-Connect/NetworkOptimizer-Proxy\"\n local proxy_branch=\"main\"\n\n msg_info \"Creating proxy directory...\"\n pct exec \"$CT_ID\" -- mkdir -p \"$proxy_dir/dynamic\" \"$proxy_dir/acme\"\n msg_ok \"Directory created\"\n\n msg_info \"Downloading Traefik configuration files...\"\n pct exec \"$CT_ID\" -- curl -fsSL \\\n \"https://raw.githubusercontent.com/${proxy_repo}/${proxy_branch}/docker-compose.yml\" \\\n -o \"$proxy_dir/docker-compose.yml\"\n pct exec \"$CT_ID\" -- curl -fsSL \\\n \"https://raw.githubusercontent.com/${proxy_repo}/${proxy_branch}/config.example.yml\" \\\n -o \"$proxy_dir/config.example.yml\"\n pct exec \"$CT_ID\" -- curl -fsSL \\\n \"https://raw.githubusercontent.com/${proxy_repo}/${proxy_branch}/.env.example\" \\\n -o \"$proxy_dir/.env.example\"\n msg_ok \"Configuration files downloaded\"\n\n msg_info \"Generating dynamic configuration...\"\n pct exec \"$CT_ID\" -- bash -c \"\n sed -e 's/optimizer\\\\.example\\\\.com/${TRAEFIK_OPTIMIZER_HOSTNAME}/g' \\\n -e 's/speedtest\\\\.example\\\\.com/${TRAEFIK_SPEEDTEST_HOSTNAME}/g' \\\n -e 's|http://localhost:3005|http://localhost:${APP_SPEEDTEST_PORT}|g' \\\n '$proxy_dir/config.example.yml' > '$proxy_dir/dynamic/config.yml'\n \"\n msg_ok \"Dynamic configuration generated\"\n\n msg_info \"Creating environment file...\"\n local proxy_env_content=\"# Traefik Proxy - Generated by Proxmox installation script\nACME_EMAIL=${TRAEFIK_ACME_EMAIL}\nCF_DNS_API_TOKEN=${TRAEFIK_CF_DNS_API_TOKEN}\"\n local encoded_proxy_env\n encoded_proxy_env=$(echo \"$proxy_env_content\" | base64 -w 0)\n pct exec \"$CT_ID\" -- bash -c \"echo '$encoded_proxy_env' | base64 -d > $proxy_dir/.env\"\n msg_ok \"Environment file created\"\n\n msg_info \"Setting up certificate storage...\"\n pct exec \"$CT_ID\" -- bash -c \"touch $proxy_dir/acme/acme.json && chmod 600 $proxy_dir/acme/acme.json\"\n msg_ok \"Certificate storage ready\"\n\n msg_info \"Pulling Traefik image...\"\n pct exec \"$CT_ID\" -- bash -c \"cd $proxy_dir && docker compose pull\"\n msg_ok \"Traefik image pulled\"\n\n msg_info \"Starting Traefik...\"\n pct exec \"$CT_ID\" -- bash -c \"cd $proxy_dir && docker compose up -d\"\n msg_ok \"Traefik started\"\n}\n\nwait_for_healthy() {\n header \"Waiting for Application\"\n\n local max_wait=120\n local waited=0\n\n echo -ne \"${BL}[...]${CL} Waiting for health check...\"\n\n while ! pct exec \"$CT_ID\" -- curl -sf http://localhost:8042/api/health &>/dev/null; do\n sleep 2\n ((waited+=2))\n echo -ne \"\\r${BL}[...]${CL} Waiting for health check... ${waited}s \"\n if [[ $waited -ge $max_wait ]]; then\n echo \"\"\n msg_warn \"Health check timed out, but services may still be starting.\"\n msg_info \"Check status with: pct exec $CT_ID -- docker logs network-optimizer\"\n return 1\n fi\n done\n\n echo \"\"\n msg_ok \"Application is healthy\"\n return 0\n}\n\nget_container_ip() {\n pct exec \"$CT_ID\" -- hostname -I 2>/dev/null | awk '{print $1}'\n}\n\nshow_completion() {\n header \"Installation Complete!\"\n\n local container_ip\n container_ip=$(get_container_ip)\n\n echo -e \"${GN}${BLD}$APP_NAME has been successfully installed!${CL}\\n\"\n\n echo -e \"${BLD}Access Information:${CL}\"\n if [[ \"$APP_TRAEFIK_ENABLED\" == \"true\" ]]; then\n echo -e \" Web UI: ${CY}https://${TRAEFIK_OPTIMIZER_HOSTNAME}${CL}\"\n echo -e \" SpeedTest: ${CY}https://${TRAEFIK_SPEEDTEST_HOSTNAME}${CL} ${DIM}(geo location enabled)${CL}\"\n else\n echo -e \" Web UI: ${CY}http://${container_ip}:8042${CL}\"\n echo -e \" OpenSpeedTest: ${CY}http://${container_ip}:${APP_SPEEDTEST_PORT}${CL}\"\n fi\n if [[ \"$APP_IPERF3_ENABLED\" == \"true\" ]]; then\n echo -e \" iperf3 Server: ${CY}${container_ip}:5201${CL}\"\n fi\n if [[ \"$APP_TRAEFIK_ENABLED\" != \"true\" ]]; then\n if [[ -n \"$APP_REVERSE_PROXY_HOST\" ]]; then\n echo -e \" Reverse Proxy: ${CY}https://${APP_REVERSE_PROXY_HOST}${CL}\"\n fi\n if [[ \"$APP_GEOLOCATION\" == \"true\" ]]; then\n echo -e \" Speed Test: ${CY}https://${APP_OPENSPEEDTEST_HOST}${CL} ${DIM}(geo location enabled)${CL}\"\n fi\n fi\n\n if [[ -z \"$APP_PASSWORD\" ]]; then\n echo -e \"\\n${BLD}Admin Password:${CL}\"\n echo -e \" ${YW}Auto-generated on first run. View with:${CL}\"\n echo -e \" ${DIM}pct exec $CT_ID -- docker logs network-optimizer 2>&1 | grep -A5 'AUTO-GENERATED'${CL}\"\n echo -e \" ${DIM}Set a permanent password in Settings > Admin Password after login.${CL}\"\n fi\n\n echo -e \"\\n${BLD}Container Management:${CL}\"\n echo -e \" Console: ${DIM}pct enter $CT_ID${CL}\"\n echo -e \" Start: ${DIM}pct start $CT_ID${CL}\"\n echo -e \" Stop: ${DIM}pct stop $CT_ID${CL}\"\n echo -e \" Logs: ${DIM}pct exec $CT_ID -- docker logs -f network-optimizer${CL}\"\n if [[ \"$APP_SSH_ENABLED\" == \"true\" ]]; then\n echo -e \" SSH: ${DIM}ssh root@${container_ip}${CL}\"\n echo -e \" ${YW}Set root password: pct exec $CT_ID -- passwd${CL}\"\n fi\n\n echo -e \"\\n${BLD}Application Management:${CL}\"\n echo -e \" Directory: ${DIM}/opt/network-optimizer${CL}\"\n echo -e \" Config: ${DIM}/opt/network-optimizer/.env${CL}\"\n echo -e \" Reference: ${DIM}/opt/network-optimizer/.env.example${CL} ${DIM}(all options)${CL}\"\n echo -e \" Update: ${DIM}pct exec $CT_ID -- bash -c 'cd /opt/network-optimizer && docker compose pull && docker compose up -d'${CL}\"\n\n if [[ \"$APP_TRAEFIK_ENABLED\" == \"true\" ]]; then\n echo -e \"\\n${BLD}Traefik HTTPS Proxy:${CL}\"\n echo -e \" ${YW}Certificates may take a minute to issue on first start.${CL}\"\n echo -e \" Directory: ${DIM}/opt/network-optimizer-proxy${CL}\"\n echo -e \" Config: ${DIM}/opt/network-optimizer-proxy/dynamic/config.yml${CL}\"\n echo -e \" Logs: ${DIM}pct exec $CT_ID -- docker logs -f traefik-proxy${CL}\"\n echo -e \" Update: ${DIM}pct exec $CT_ID -- bash -c 'cd /opt/network-optimizer-proxy && docker compose pull && docker compose up -d'${CL}\"\n fi\n\n echo -e \"\\n${BLD}First Run:${CL}\"\n if [[ \"$APP_TRAEFIK_ENABLED\" == \"true\" ]]; then\n echo -e \" 1. Open ${CY}https://${TRAEFIK_OPTIMIZER_HOSTNAME}${CL} ${DIM}(wait ~1 min for certificates)${CL}\"\n else\n echo -e \" 1. Open ${CY}http://${container_ip}:8042${CL}\"\n fi\n echo -e \" 2. Log in with the auto-generated password (or the one you set)\"\n echo -e \" 3. Go to Settings and connect to your UniFi controller\"\n echo -e \" 4. Run your first Security Audit!\"\n\n echo -e \"\\n${BLD}Documentation:${CL}\"\n echo -e \" ${DIM}https://github.com/${GITHUB_REPO}/blob/main/docker/DEPLOYMENT.md${CL}\"\n\n echo \"\"\n}\n\n# =============================================================================\n# Main Execution\n# =============================================================================\nmain() {\n show_banner\n\n # Pre-flight checks\n check_root\n check_proxmox\n\n # Interactive configuration\n configure_container\n configure_application\n confirm_settings\n\n # Installation\n download_template\n create_container\n start_container\n configure_ssh\n install_dependencies\n deploy_application\n deploy_traefik\n wait_for_healthy || true\n\n # Done\n show_completion\n}\n\n# Run main - this script is designed to be executed, not sourced\nmain \"$@\"\n"
},
{
"path": "scripts/publish.sh",
"content": "#!/bin/bash\n# Publish for production\nset -e\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nPROJECT_ROOT=\"$(dirname \"$SCRIPT_DIR\")\"\n\ncd \"$PROJECT_ROOT\"\n\nOUTPUT_DIR=\"${1:-$PROJECT_ROOT/publish}\"\n\necho \"Publishing to $OUTPUT_DIR...\"\n\ndotnet publish src/NetworkOptimizer.Web/NetworkOptimizer.Web.csproj \\\n -c Release \\\n -o \"$OUTPUT_DIR\"\n\necho \"\"\necho \"Published to: $OUTPUT_DIR\"\n"
},
{
"path": "scripts/reset-password.ps1",
"content": "<#\n.SYNOPSIS\n Resets the Network Optimizer admin password on Windows.\n\n.DESCRIPTION\n Stops the NetworkOptimizer service, clears the admin password from the\n SQLite database, restarts the service, and extracts the auto-generated\n temporary password from the log file.\n\n.PARAMETER InstallDir\n Override the install directory. By default, auto-detected from the\n Windows service registration or defaults to\n \"C:\\Program Files\\Ozark Connect\\Network Optimizer\".\n\n.PARAMETER Force\n Skip the confirmation prompt.\n\n.PARAMETER TimeoutSeconds\n How long to wait for the service to become healthy (default: 60).\n\n.EXAMPLE\n .\\reset-password.ps1\n .\\reset-password.ps1 -Force\n .\\reset-password.ps1 -InstallDir \"D:\\NetworkOptimizer\"\n#>\n\n[CmdletBinding()]\nparam(\n [string]$InstallDir,\n [switch]$Force,\n [int]$TimeoutSeconds = 60\n)\n\n$ErrorActionPreference = 'Stop'\n\n# =============================================================================\n# Require Administrator\n# =============================================================================\n$isAdmin = ([Security.Principal.WindowsPrincipal] `\n [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(\n [Security.Principal.WindowsBuiltInRole]::Administrator)\n\nif (-not $isAdmin) {\n Write-Host \"ERROR: This script must be run as Administrator.\" -ForegroundColor Red\n Write-Host \"Right-click PowerShell and select 'Run as administrator', then try again.\"\n exit 1\n}\n\n# =============================================================================\n# Constants\n# =============================================================================\n$ServiceName = \"NetworkOptimizer\"\n$DbFileName = \"network_optimizer.db\"\n$HealthUrl = \"http://localhost:8042/api/health\"\n\n# =============================================================================\n# Auto-detect Install Directory\n# =============================================================================\nif (-not $InstallDir) {\n # Try 1: Get path from Windows service\n $svc = Get-CimInstance Win32_Service -Filter \"Name='$ServiceName'\" -ErrorAction SilentlyContinue\n if ($svc -and $svc.PathName) {\n $exePath = $svc.PathName -replace '\"', ''\n $InstallDir = Split-Path $exePath -Parent\n }\n\n # Try 2: Registry (WiX installer writes InstallFolder)\n if (-not $InstallDir) {\n $regPaths = @(\n \"HKLM:\\SOFTWARE\\Ozark Connect\\Network Optimizer\",\n \"HKLM:\\SOFTWARE\\WOW6432Node\\Ozark Connect\\Network Optimizer\"\n )\n foreach ($rp in $regPaths) {\n if (Test-Path $rp) {\n $regVal = Get-ItemProperty $rp -Name \"InstallFolder\" -ErrorAction SilentlyContinue\n if ($regVal) { $InstallDir = $regVal.InstallFolder; break }\n }\n }\n }\n\n # Try 3: Default path\n if (-not $InstallDir) {\n $InstallDir = \"C:\\Program Files\\Ozark Connect\\Network Optimizer\"\n }\n}\n\nWrite-Host \"\"\nWrite-Host \"Network Optimizer - Password Reset\" -ForegroundColor Cyan\nWrite-Host \"===================================\" -ForegroundColor Cyan\nWrite-Host \"\"\nWrite-Host \"Install directory: $InstallDir\"\n\n# =============================================================================\n# Verify database exists\n# =============================================================================\n$dbPath = Join-Path $InstallDir \"data\\$DbFileName\"\nif (-not (Test-Path $dbPath)) {\n Write-Host \"ERROR: Database not found at $dbPath\" -ForegroundColor Red\n Write-Host \"Use -InstallDir to specify the correct installation directory.\"\n exit 1\n}\n\nWrite-Host \"Database found: $dbPath\" -ForegroundColor Green\n\n# =============================================================================\n# Check for sqlite3\n# =============================================================================\n$sqlite3 = Get-Command sqlite3 -ErrorAction SilentlyContinue\nif (-not $sqlite3) {\n # Check in the install directory (bundled with WiX installer)\n $bundled = Join-Path $InstallDir \"sqlite3.exe\"\n if (Test-Path $bundled) {\n $sqlite3Path = $bundled\n } else {\n Write-Host \"\"\n Write-Host \"ERROR: sqlite3 not found in PATH or install directory.\" -ForegroundColor Red\n Write-Host \"\"\n Write-Host \"Install it with: winget install SQLite.SQLite\" -ForegroundColor Yellow\n Write-Host \"Then restart this terminal and try again.\"\n exit 1\n }\n} else {\n $sqlite3Path = $sqlite3.Source\n}\n\nWrite-Host \"sqlite3: $sqlite3Path\" -ForegroundColor Green\nWrite-Host \"\"\n\n# =============================================================================\n# Confirm with user\n# =============================================================================\nif (-not $Force) {\n Write-Host \"This will:\" -ForegroundColor Yellow\n Write-Host \" 1. Stop the NetworkOptimizer service\"\n Write-Host \" 2. Clear the admin password from the database\"\n Write-Host \" 3. Restart the service\"\n Write-Host \" 4. Display the new auto-generated temporary password\"\n Write-Host \"\"\n $confirm = Read-Host \"Continue? (y/N)\"\n if ($confirm -notmatch '^[Yy]') {\n Write-Host \"Cancelled.\"\n exit 0\n }\n Write-Host \"\"\n}\n\n# =============================================================================\n# Stop the service\n# =============================================================================\n$svcObj = Get-Service $ServiceName -ErrorAction SilentlyContinue\nif (-not $svcObj) {\n Write-Host \"ERROR: Service '$ServiceName' not found.\" -ForegroundColor Red\n Write-Host \"Is Network Optimizer installed as a Windows service?\"\n exit 1\n}\n\nif ($svcObj.Status -eq 'Running') {\n Write-Host \"Stopping service...\" -NoNewline\n Stop-Service $ServiceName -Force\n $svcObj.WaitForStatus('Stopped', [TimeSpan]::FromSeconds(30))\n Write-Host \" done.\" -ForegroundColor Green\n} else {\n Write-Host \"Service is already stopped.\" -ForegroundColor Yellow\n}\n\n# =============================================================================\n# Clear admin password\n# =============================================================================\nWrite-Host \"Clearing admin password...\" -NoNewline\n& $sqlite3Path $dbPath \"UPDATE AdminSettings SET Password = NULL, Enabled = 0;\"\nif ($LASTEXITCODE -ne 0) {\n Write-Host \" FAILED.\" -ForegroundColor Red\n Write-Host \"sqlite3 returned exit code $LASTEXITCODE\"\n exit 1\n}\nWrite-Host \" done.\" -ForegroundColor Green\n\n# =============================================================================\n# Start the service\n# =============================================================================\nWrite-Host \"Starting service...\" -NoNewline\nStart-Service $ServiceName\nWrite-Host \" done.\" -ForegroundColor Green\n\n# =============================================================================\n# Wait for health endpoint\n# =============================================================================\nWrite-Host \"Waiting for application to start...\" -NoNewline\n$deadline = (Get-Date).AddSeconds($TimeoutSeconds)\n$healthy = $false\n\nwhile ((Get-Date) -lt $deadline) {\n try {\n $resp = Invoke-WebRequest -Uri $HealthUrl -UseBasicParsing -TimeoutSec 3 -ErrorAction SilentlyContinue\n if ($resp.StatusCode -eq 200) {\n $healthy = $true\n break\n }\n } catch {\n # Not ready yet\n }\n Start-Sleep -Seconds 2\n Write-Host \".\" -NoNewline\n}\n\nif ($healthy) {\n Write-Host \" ready!\" -ForegroundColor Green\n} else {\n Write-Host \" timed out.\" -ForegroundColor Yellow\n Write-Host \"The service may still be starting. Check the logs manually.\"\n}\n\n# =============================================================================\n# Extract password from log\n# =============================================================================\nWrite-Host \"\"\n$logDir = Join-Path $InstallDir \"logs\"\n$today = (Get-Date).ToString(\"yyyyMMdd\")\n$logFile = Join-Path $logDir \"networkoptimizer-$today.log\"\n\n$password = $null\nif (Test-Path $logFile) {\n # Find the last occurrence of the password line after AUTO-GENERATED banner\n $logContent = Get-Content $logFile -Tail 100\n for ($i = $logContent.Count - 1; $i -ge 0; $i--) {\n if ($logContent[$i] -match 'Password:\\s+(\\S+)') {\n $password = $Matches[1]\n break\n }\n }\n}\n\nif ($password) {\n Write-Host \"===================================\" -ForegroundColor Green\n Write-Host \" Password reset successful!\" -ForegroundColor Green\n Write-Host \"===================================\" -ForegroundColor Green\n Write-Host \"\"\n Write-Host \" Temporary password: $password\" -ForegroundColor Cyan\n Write-Host \"\"\n Write-Host \" Log in to Network Optimizer with this password,\"\n Write-Host \" then go to Settings to set a permanent one.\"\n Write-Host \"\"\n} else {\n Write-Host \"Password reset completed, but could not extract the new password from logs.\" -ForegroundColor Yellow\n Write-Host \"\"\n Write-Host \"Check the log file manually:\"\n Write-Host \" $logFile\" -ForegroundColor Cyan\n Write-Host \"\"\n Write-Host \"Or look for the password in the Windows Event Viewer under Application logs.\"\n Write-Host \"Search for 'AUTO-GENERATED' in the log output.\"\n Write-Host \"\"\n}\n"
},
{
"path": "scripts/reset-password.sh",
"content": "#!/usr/bin/env bash\n\n# Network Optimizer - Password Reset Script\n# https://github.com/Ozark-Connect/NetworkOptimizer\n#\n# Resets the admin password by clearing it from the database and restarting\n# the service. Works with Docker, macOS native, and Linux native deployments.\n#\n# Usage:\n# curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/reset-password.sh | bash\n# bash reset-password.sh [--docker|--macos|--linux] [--container NAME] [--data-dir PATH] [--force]\n\nset -euo pipefail\n\n# =============================================================================\n# Colors and Formatting (matches proxmox/install.sh)\n# =============================================================================\nif [[ -t 1 ]]; then\n readonly RD='\\033[0;31m'\n readonly GN='\\033[0;32m'\n readonly YW='\\033[0;33m'\n readonly BL='\\033[0;34m'\n readonly CY='\\033[0;36m'\n readonly BLD='\\033[1m'\n readonly CL='\\033[0m'\nelse\n readonly RD='' GN='' YW='' BL='' CY='' BLD='' CL=''\nfi\n\nmsg_info() { echo -e \"${BL}[INFO]${CL} $1\"; }\nmsg_ok() { echo -e \"${GN}[OK]${CL} $1\"; }\nmsg_warn() { echo -e \"${YW}[WARN]${CL} $1\"; }\nmsg_error() { echo -e \"${RD}[ERROR]${CL} $1\"; }\n\nheader() {\n echo \"\"\n echo -e \"${BLD}${CY}Network Optimizer - Password Reset${CL}\"\n echo -e \"${BLD}${CY}===================================${CL}\"\n echo \"\"\n}\n\n# =============================================================================\n# Defaults\n# =============================================================================\nMODE=\"\" # docker, macos, linux (auto-detected if empty)\nCONTAINER=\"network-optimizer\"\nDATA_DIR=\"\"\nFORCE=false\nTIMEOUT=60\nHEALTH_URL=\"http://localhost:8042/api/health\"\n\n# =============================================================================\n# Parse Arguments\n# =============================================================================\nwhile [[ $# -gt 0 ]]; do\n case \"$1\" in\n --docker) MODE=\"docker\"; shift ;;\n --macos) MODE=\"macos\"; shift ;;\n --linux) MODE=\"linux\"; shift ;;\n --container) CONTAINER=\"$2\"; shift 2 ;;\n --data-dir) DATA_DIR=\"$2\"; shift 2 ;;\n --force) FORCE=true; shift ;;\n --timeout) TIMEOUT=\"$2\"; shift 2 ;;\n -h|--help)\n echo \"Usage: $0 [OPTIONS]\"\n echo \"\"\n echo \"Options:\"\n echo \" --docker Force Docker mode\"\n echo \" --macos Force macOS native mode\"\n echo \" --linux Force Linux native mode\"\n echo \" --container NAME Docker container name (default: network-optimizer)\"\n echo \" --data-dir PATH Override database directory path\"\n echo \" --force Skip confirmation prompt\"\n echo \" --timeout SECS Health check timeout (default: 60)\"\n echo \" -h, --help Show this help\"\n exit 0\n ;;\n *)\n msg_error \"Unknown option: $1\"\n echo \"Use --help for usage information.\"\n exit 1\n ;;\n esac\ndone\n\n# Auto-force when stdin is not a terminal (e.g., curl | bash)\nif [[ ! -t 0 ]]; then\n FORCE=true\nfi\n\n# =============================================================================\n# Auto-detect Mode\n# =============================================================================\ndetect_mode() {\n if [[ -n \"$MODE\" ]]; then\n return\n fi\n\n # Check for Docker container\n if command -v docker &>/dev/null; then\n if docker ps -a --format '{{.Names}}' 2>/dev/null | grep -q \"^${CONTAINER}$\"; then\n MODE=\"docker\"\n msg_info \"Detected Docker container: $CONTAINER\"\n return\n fi\n fi\n\n # Check for macOS native install\n if [[ \"$(uname)\" == \"Darwin\" ]]; then\n if [[ -d \"$HOME/network-optimizer\" ]] || \\\n [[ -f \"$HOME/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\" ]]; then\n MODE=\"macos\"\n msg_info \"Detected macOS native installation\"\n return\n fi\n fi\n\n # Check for Linux native install\n if [[ \"$(uname)\" == \"Linux\" ]]; then\n if systemctl list-unit-files 2>/dev/null | grep -qi \"networkoptimizer\\|network-optimizer\"; then\n MODE=\"linux\"\n msg_info \"Detected Linux native installation (systemd)\"\n return\n fi\n if pgrep -f \"NetworkOptimizer.Web\" &>/dev/null; then\n MODE=\"linux\"\n msg_info \"Detected running NetworkOptimizer process\"\n return\n fi\n if [[ -d \"/opt/network-optimizer\" ]]; then\n MODE=\"linux\"\n msg_info \"Detected Linux installation at /opt/network-optimizer\"\n return\n fi\n fi\n\n msg_error \"Could not auto-detect installation type.\"\n echo \"\"\n echo \"Please specify one of:\"\n echo \" --docker Docker container\"\n echo \" --macos macOS native install\"\n echo \" --linux Linux native install\"\n exit 1\n}\n\n# =============================================================================\n# Check for sqlite3\n# =============================================================================\ncheck_sqlite3() {\n if command -v sqlite3 &>/dev/null; then\n return 0\n fi\n\n msg_error \"sqlite3 is not installed.\"\n echo \"\"\n if [[ \"$(uname)\" == \"Darwin\" ]]; then\n echo \"sqlite3 should be included with macOS. Try:\"\n echo \" brew install sqlite3\"\n elif command -v apt-get &>/dev/null; then\n echo \"Install with: sudo apt-get install -y sqlite3\"\n elif command -v dnf &>/dev/null; then\n echo \"Install with: sudo dnf install -y sqlite\"\n elif command -v pacman &>/dev/null; then\n echo \"Install with: sudo pacman -S sqlite\"\n else\n echo \"Install sqlite3 using your package manager.\"\n fi\n exit 1\n}\n\n# =============================================================================\n# Wait for health endpoint\n# =============================================================================\nwait_for_health() {\n msg_info \"Waiting for application to start...\"\n local deadline=$((SECONDS + TIMEOUT))\n\n while [[ $SECONDS -lt $deadline ]]; do\n if curl -sf \"$HEALTH_URL\" -o /dev/null --max-time 3 2>/dev/null; then\n msg_ok \"Application is ready\"\n return 0\n fi\n sleep 2\n done\n\n msg_warn \"Health check timed out after ${TIMEOUT}s. The service may still be starting.\"\n return 1\n}\n\n# =============================================================================\n# Confirm with user\n# =============================================================================\nconfirm() {\n if [[ \"$FORCE\" == true ]]; then\n return 0\n fi\n\n echo \"This will:\"\n echo \" 1. Stop the Network Optimizer service\"\n echo \" 2. Clear the admin password from the database\"\n echo \" 3. Restart the service\"\n echo \" 4. Display the new auto-generated temporary password\"\n echo \"\"\n read -rp \"Continue? (y/N) \" answer\n if [[ ! \"$answer\" =~ ^[Yy] ]]; then\n echo \"Cancelled.\"\n exit 0\n fi\n echo \"\"\n}\n\n# =============================================================================\n# Docker Mode\n# =============================================================================\nreset_docker() {\n msg_info \"Mode: Docker (container: $CONTAINER)\"\n echo \"\"\n\n # Check container exists\n if ! docker ps -a --format '{{.Names}}' 2>/dev/null | grep -q \"^${CONTAINER}$\"; then\n msg_error \"Container '$CONTAINER' not found.\"\n echo \"Use --container NAME to specify a different container name.\"\n exit 1\n fi\n\n # If container is stopped, start it temporarily for docker exec\n if ! docker ps --format '{{.Names}}' 2>/dev/null | grep -q \"^${CONTAINER}$\"; then\n msg_warn \"Container is stopped. Starting it temporarily...\"\n docker start \"$CONTAINER\" >/dev/null\n sleep 3\n fi\n\n confirm\n\n # Clear password via docker exec\n msg_info \"Clearing admin password...\"\n docker exec \"$CONTAINER\" sqlite3 /app/data/network_optimizer.db \\\n \"UPDATE AdminSettings SET Password = NULL, Enabled = 0;\"\n msg_ok \"Password cleared\"\n\n # Restart container\n msg_info \"Restarting container...\"\n docker restart \"$CONTAINER\" >/dev/null\n msg_ok \"Container restarted\"\n\n # Wait for health\n wait_for_health || true\n\n # Extract password from docker logs\n echo \"\"\n local password\n password=$(docker logs --since 2m \"$CONTAINER\" 2>&1 \\\n | grep \"Password:\" | tail -1 \\\n | sed -E 's/.*Password:[[:space:]]+//' | tr -d '[:space:]')\n\n show_result \"$password\"\n}\n\n# =============================================================================\n# macOS Native Mode\n# =============================================================================\nreset_macos() {\n msg_info \"Mode: macOS native\"\n echo \"\"\n\n local plist=\"$HOME/Library/LaunchAgents/net.ozarkconnect.networkoptimizer.plist\"\n local db_dir=\"${DATA_DIR:-$HOME/Library/Application Support/NetworkOptimizer}\"\n local db_path=\"$db_dir/network_optimizer.db\"\n\n # Detect install directory from plist WorkingDirectory or running process\n local install_dir=\"\"\n if [[ -f \"$plist\" ]]; then\n install_dir=$(/usr/libexec/PlistBuddy -c \"Print :WorkingDirectory\" \"$plist\" 2>/dev/null || true)\n fi\n if [[ -z \"$install_dir\" ]]; then\n install_dir=$(ps aux | grep 'NetworkOptimizer.Web' | grep -v grep | awk '{for(i=11;i<=NF;i++) printf \"%s \",$i}' | sed 's|/NetworkOptimizer.Web.*||' | tr -d '[:space:]')\n fi\n if [[ -z \"$install_dir\" ]]; then\n install_dir=\"$HOME/network-optimizer\"\n fi\n\n local log_file=\"$install_dir/logs/stdout.log\"\n msg_info \"Install directory: $install_dir\"\n\n # Verify database\n if [[ ! -f \"$db_path\" ]]; then\n msg_error \"Database not found at: $db_path\"\n echo \"Use --data-dir to specify the correct data directory.\"\n exit 1\n fi\n msg_ok \"Database found: $db_path\"\n\n check_sqlite3\n confirm\n\n # Record log size before restart so we only read new output\n local log_size_before=0\n if [[ -f \"$log_file\" ]]; then\n log_size_before=$(wc -c < \"$log_file\")\n fi\n\n # Stop service\n if [[ -f \"$plist\" ]]; then\n msg_info \"Stopping service...\"\n launchctl unload \"$plist\" 2>/dev/null || true\n sleep 2\n msg_ok \"Service stopped\"\n else\n msg_warn \"LaunchAgent plist not found at $plist\"\n msg_warn \"You may need to stop the service manually.\"\n fi\n\n # Clear password\n msg_info \"Clearing admin password...\"\n sqlite3 \"$db_path\" \"UPDATE AdminSettings SET Password = NULL, Enabled = 0;\"\n msg_ok \"Password cleared\"\n\n # Start service\n if [[ -f \"$plist\" ]]; then\n msg_info \"Starting service...\"\n launchctl load \"$plist\"\n msg_ok \"Service started\"\n else\n msg_warn \"Cannot auto-start - start the service manually.\"\n fi\n\n # Wait for health\n wait_for_health || true\n\n # Poll for new password in log (up to 15s)\n echo \"\"\n local password=\"\"\n if [[ -f \"$log_file\" ]]; then\n local deadline=$((SECONDS + 15))\n while [[ $SECONDS -lt $deadline ]]; do\n local new_bytes=$(( $(wc -c < \"$log_file\") - log_size_before ))\n if [[ $new_bytes -gt 0 ]]; then\n password=$(tail -c \"$new_bytes\" \"$log_file\" \\\n | grep \"Password:\" | tail -1 \\\n | sed -E 's/.*Password:[[:space:]]+//' | tr -d '[:space:]')\n if [[ -n \"$password\" ]]; then break; fi\n fi\n sleep 1\n done\n fi\n\n show_result \"$password\"\n}\n\n# =============================================================================\n# Linux Native Mode\n# =============================================================================\nreset_linux() {\n msg_info \"Mode: Linux native\"\n echo \"\"\n\n # Find the systemd service name\n local service_name=\"\"\n for name in networkoptimizer NetworkOptimizer network-optimizer; do\n if systemctl list-unit-files \"${name}.service\" &>/dev/null 2>&1; then\n if systemctl list-unit-files \"${name}.service\" 2>/dev/null | grep -q \"$name\"; then\n service_name=\"$name\"\n break\n fi\n fi\n done\n\n # Find database\n local db_path=\"\"\n if [[ -n \"$DATA_DIR\" ]]; then\n db_path=\"$DATA_DIR/network_optimizer.db\"\n else\n for candidate in \\\n \"/opt/network-optimizer/data/network_optimizer.db\" \\\n \"$HOME/.local/share/NetworkOptimizer/network_optimizer.db\" \\\n \"/var/lib/network-optimizer/network_optimizer.db\"; do\n if [[ -f \"$candidate\" ]]; then\n db_path=\"$candidate\"\n break\n fi\n done\n fi\n\n if [[ -z \"$db_path\" ]] || [[ ! -f \"$db_path\" ]]; then\n msg_error \"Database not found.\"\n echo \"Searched:\"\n echo \" /opt/network-optimizer/data/network_optimizer.db\"\n echo \" ~/.local/share/NetworkOptimizer/network_optimizer.db\"\n echo \" /var/lib/network-optimizer/network_optimizer.db\"\n echo \"\"\n echo \"Use --data-dir to specify the correct data directory.\"\n exit 1\n fi\n msg_ok \"Database found: $db_path\"\n\n # Detect install directory from systemd or running process\n local install_dir=\"\"\n if [[ -n \"$service_name\" ]]; then\n install_dir=$(systemctl show \"$service_name\" -p WorkingDirectory --value 2>/dev/null || true)\n fi\n if [[ -z \"$install_dir\" ]]; then\n install_dir=$(readlink -f /proc/$(pgrep -f \"NetworkOptimizer.Web\" | head -1)/cwd 2>/dev/null || true)\n fi\n if [[ -z \"$install_dir\" ]]; then\n install_dir=\"/opt/network-optimizer\"\n fi\n msg_info \"Install directory: $install_dir\"\n\n check_sqlite3\n confirm\n\n # Record log size before restart so we only read new output\n local log_file=\"$install_dir/logs/stdout.log\"\n local log_size_before=0\n if [[ -f \"$log_file\" ]]; then\n log_size_before=$(wc -c < \"$log_file\")\n fi\n\n # Stop service\n if [[ -n \"$service_name\" ]]; then\n msg_info \"Stopping service ($service_name)...\"\n sudo systemctl stop \"$service_name\"\n msg_ok \"Service stopped\"\n else\n msg_warn \"No systemd service found. Attempting to kill the process...\"\n if pkill -f \"NetworkOptimizer.Web\" 2>/dev/null; then\n msg_ok \"Process stopped\"\n else\n msg_warn \"Could not stop process. It may not be running.\"\n fi\n fi\n\n # Clear password\n msg_info \"Clearing admin password...\"\n sqlite3 \"$db_path\" \"UPDATE AdminSettings SET Password = NULL, Enabled = 0;\"\n msg_ok \"Password cleared\"\n\n # Start service\n if [[ -n \"$service_name\" ]]; then\n msg_info \"Starting service ($service_name)...\"\n sudo systemctl start \"$service_name\"\n msg_ok \"Service started\"\n else\n msg_warn \"No systemd service found. Start the application manually.\"\n msg_warn \"The new password will appear in the application logs.\"\n echo \"\"\n return\n fi\n\n # Wait for health\n wait_for_health || true\n\n # Poll for new password in journalctl or log file (up to 15s)\n echo \"\"\n local password=\"\"\n local deadline=$((SECONDS + 15))\n while [[ $SECONDS -lt $deadline ]] && [[ -z \"$password\" ]]; do\n if [[ -n \"$service_name\" ]]; then\n password=$(journalctl -u \"$service_name\" --since \"2 minutes ago\" --no-pager 2>/dev/null \\\n | grep \"Password:\" | tail -1 \\\n | sed -E 's/.*Password:[[:space:]]+//' | tr -d '[:space:]')\n fi\n\n # Fallback: check new log output only\n if [[ -z \"$password\" ]] && [[ -f \"$log_file\" ]]; then\n local new_bytes=$(( $(wc -c < \"$log_file\") - log_size_before ))\n if [[ $new_bytes -gt 0 ]]; then\n password=$(tail -c \"$new_bytes\" \"$log_file\" \\\n | grep \"Password:\" | tail -1 \\\n | sed -E 's/.*Password:[[:space:]]+//' | tr -d '[:space:]')\n fi\n fi\n\n if [[ -z \"$password\" ]]; then sleep 1; fi\n done\n\n show_result \"$password\"\n}\n\n# =============================================================================\n# Display Result\n# =============================================================================\nshow_result() {\n local password=\"$1\"\n\n if [[ -n \"$password\" ]]; then\n echo -e \"${GN}===================================${CL}\"\n echo -e \"${GN} Password reset successful!${CL}\"\n echo -e \"${GN}===================================${CL}\"\n echo \"\"\n echo -e \" Temporary password: ${CY}${BLD}${password}${CL}\"\n echo \"\"\n echo \" Log in to Network Optimizer with this password,\"\n echo \" then go to Settings to set a permanent one.\"\n echo \"\"\n else\n msg_warn \"Password reset completed, but could not extract the new password from logs.\"\n echo \"\"\n echo \"Check the logs manually:\"\n if [[ \"$MODE\" == \"docker\" ]]; then\n echo \" docker logs $CONTAINER 2>&1 | grep -A5 'AUTO-GENERATED'\"\n elif [[ \"$MODE\" == \"macos\" ]]; then\n echo \" grep 'Password:' ~/network-optimizer/logs/stdout.log | tail -1\"\n else\n echo \" journalctl -u networkoptimizer --since '5 minutes ago' | grep 'Password:'\"\n fi\n echo \"\"\n echo \"Look for the line containing 'AUTO-GENERATED ADMIN PASSWORD'.\"\n echo \"\"\n fi\n}\n\n# =============================================================================\n# Main\n# =============================================================================\nheader\ndetect_mode\necho \"\"\n\ncase \"$MODE\" in\n docker) reset_docker ;;\n macos) reset_macos ;;\n linux) reset_linux ;;\n *)\n msg_error \"Unknown mode: $MODE\"\n exit 1\n ;;\nesac\n"
},
{
"path": "scripts/sync-perf-tweaks.ps1",
"content": "# Syncs performance tweak scripts from the unifi-perf-tweaks source repo\n# into the NetworkOptimizer embedded resources directory.\n#\n# Run before building to pick up the latest scripts:\n# pwsh scripts/sync-perf-tweaks.ps1\n#\n# Source repo: https://github.com/tvancott42/unifi-perf-tweaks (private)\n\nparam(\n [string]$SourceRepo = \"$env:USERPROFILE\\OneDrive\\PersonalProjects\\OpenSource\\unifi-perf-tweaks\"\n)\n\n$DestDir = Join-Path $PSScriptRoot \"..\\src\\NetworkOptimizer.Web\\Resources\\PerfTweaks\"\n\nif (-not (Test-Path $SourceRepo)) {\n Write-Error \"Source repo not found at: $SourceRepo\"\n exit 1\n}\n\nif (-not (Test-Path $DestDir)) {\n New-Item -ItemType Directory -Path $DestDir -Force | Out-Null\n}\n\n$scripts = @(\n \"scripts/06-mongodb-ssd-offload.sh\",\n \"scripts/07-mongodb-ssd-backup.sh\",\n \"scripts/10-journald-volatile.sh\",\n \"scripts/15-fan-control-tuning.sh\",\n \"scripts/20-sfp-sgmiiplus.sh\"\n)\n\n$binaries = @(\n \"modules/force-uniphy1-sgmiiplus/force_uniphy1_sgmiiplus.ko\"\n)\n\nforeach ($file in $scripts + $binaries) {\n $src = Join-Path $SourceRepo $file\n $dest = Join-Path $DestDir (Split-Path $file -Leaf)\n if (Test-Path $src) {\n Copy-Item $src $dest -Force\n Write-Host \" Copied: $(Split-Path $file -Leaf)\"\n } else {\n Write-Warning \" Missing: $file\"\n }\n}\n\nWrite-Host \"Sync complete.\"\n"
},
{
"path": "scripts/test.sh",
"content": "#!/bin/bash\n# Run all tests\nset -e\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nPROJECT_ROOT=\"$(dirname \"$SCRIPT_DIR\")\"\n\ncd \"$PROJECT_ROOT\"\n\necho \"Running all tests...\"\ndotnet test --no-restore\n\necho \"\"\necho \"All tests passed!\"\n"
},
{
"path": "scripts/watch.sh",
"content": "#!/bin/bash\n# Run the web app with hot reload\nset -e\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nPROJECT_ROOT=\"$(dirname \"$SCRIPT_DIR\")\"\n\ncd \"$PROJECT_ROOT/src/NetworkOptimizer.Web\"\n\necho \"Starting with hot reload...\"\necho \"Access at http://localhost:5000\"\necho \"\"\n\ndotnet watch run\n"
},
{
"path": "src/NetworkOptimizer.Agents/.gitignore",
"content": "## Ignore Visual Studio temporary files, build results, and\n## files generated by popular Visual Studio add-ons.\n\n# User-specific files\n*.suo\n*.user\n*.userosscache\n*.sln.docstates\n\n# Build results\n[Dd]ebug/\n[Dd]ebugPublic/\n[Rr]elease/\n[Rr]eleases/\nx64/\nx86/\n[Aa][Rr][Mm]/\n[Aa][Rr][Mm]64/\nbld/\n[Bb]in/\n[Oo]bj/\n[Ll]og/\n\n# Visual Studio cache/options directory\n.vs/\n\n# MSTest test Results\n[Tt]est[Rr]esult*/\n[Bb]uild[Ll]og.*\n\n# .NET Core\nproject.lock.json\nproject.fragment.lock.json\nartifacts/\n\n# Agent database files\n*.db\n*.db-shm\n*.db-wal\n\n# Sensitive configuration files\n**/appsettings.*.json\n!**/appsettings.json\ncredentials.json\nsecrets.json\n\n# SSH keys\n*.pem\n*.ppk\nid_rsa*\nid_ed25519*\n\n# Log files\n*.log\nlogs/\n\n# OS files\n.DS_Store\nThumbs.db\n"
},
{
"path": "src/NetworkOptimizer.Agents/AgentDeployer.cs",
"content": "using System.Diagnostics;\nusing System.Text;\nusing Microsoft.Extensions.Logging;\nusing NetworkOptimizer.Agents.Models;\nusing Renci.SshNet;\nusing Renci.SshNet.Common;\n\nnamespace NetworkOptimizer.Agents;\n\n/// \n/// Deploys monitoring agents to remote systems via SSH\n/// \npublic class AgentDeployer\n{\n private readonly ILogger _logger;\n private readonly ScriptRenderer _scriptRenderer;\n\n public AgentDeployer(ILogger logger, ScriptRenderer scriptRenderer)\n {\n _logger = logger;\n _scriptRenderer = scriptRenderer;\n }\n\n /// \n /// Deploys an agent to a remote system\n /// \n /// \n /// Some step lambdas are marked async for future SSH command execution but currently\n /// perform synchronous validation. Suppressing CS1998 until full async implementation.\n /// \n#pragma warning disable CS1998 // Async lambdas without await - will be async when SSH commands are added\n public async Task DeployAgentAsync(AgentConfiguration config, CancellationToken cancellationToken = default)\n {\n var result = new DeploymentResult\n {\n AgentId = config.AgentId,\n DeviceName = config.DeviceName,\n AgentType = config.AgentType\n };\n\n try\n {\n _logger.LogInformation(\"Starting deployment of {AgentType} agent to {Device} ({Host})\",\n config.AgentType, config.DeviceName, config.SshCredentials.Host);\n\n // Step 1: Validate credentials\n await AddStepAsync(result, \"Validate Credentials\", async () =>\n {\n if (!config.SshCredentials.IsValid())\n {\n throw new InvalidOperationException(\"Invalid SSH credentials\");\n }\n return \"Credentials validated\";\n });\n\n // Step 2: Test SSH connection\n await AddStepAsync(result, \"Test SSH Connection\", async () =>\n {\n await TestConnectionAsync(config.SshCredentials, cancellationToken);\n return $\"Successfully connected to {config.SshCredentials.Host}\";\n });\n\n // Step 3: Render templates\n Dictionary renderedScripts = new();\n await AddStepAsync(result, \"Render Templates\", async () =>\n {\n var templates = _scriptRenderer.GetTemplatesForAgent(config.AgentType);\n foreach (var template in templates)\n {\n var rendered = await _scriptRenderer.RenderTemplateAsync(template, config);\n var scriptName = template.Replace(\".template\", \"\");\n renderedScripts[scriptName] = rendered;\n }\n return $\"Rendered {renderedScripts.Count} templates\";\n });\n\n // Step 4: Deploy scripts based on agent type\n if (config.AgentType == AgentType.UDM || config.AgentType == AgentType.UCG)\n {\n await DeployUniFiAgentAsync(config, renderedScripts, result, cancellationToken);\n }\n else if (config.AgentType == AgentType.Linux)\n {\n await DeployLinuxAgentAsync(config, renderedScripts, result, cancellationToken);\n }\n\n // Step 5: Verify deployment\n await AddStepAsync(result, \"Verify Deployment\", async () =>\n {\n result.Verification = await VerifyDeploymentAsync(config, cancellationToken);\n if (!result.Verification.Passed)\n {\n throw new InvalidOperationException(\"Deployment verification failed: \" +\n string.Join(\", \", result.Verification.Messages));\n }\n return \"Deployment verified successfully\";\n });\n\n result.Success = true;\n result.Message = $\"Successfully deployed {config.AgentType} agent to {config.DeviceName}\";\n\n _logger.LogInformation(\"Successfully deployed agent {AgentId} to {Device}\",\n config.AgentId, config.DeviceName);\n }\n catch (Exception ex)\n {\n result.Success = false;\n result.Message = $\"Deployment failed: {ex.Message}\";\n _logger.LogError(ex, \"Failed to deploy agent {AgentId} to {Device}\",\n config.AgentId, config.DeviceName);\n }\n\n return result;\n }\n#pragma warning restore CS1998\n\n /// \n /// Tests SSH connection to the remote host\n /// \n public async Task TestConnectionAsync(SshCredentials credentials, CancellationToken cancellationToken = default)\n {\n using var client = CreateSshClient(credentials);\n\n try\n {\n await Task.Run(() =>\n {\n client.Connect();\n _logger.LogDebug(\"SSH connection test successful to {Host}\", credentials.Host);\n }, cancellationToken);\n }\n catch (SshAuthenticationException ex)\n {\n _logger.LogError(\"SSH authentication failed for {Host}: {Error}\", credentials.Host, ex.Message);\n throw new InvalidOperationException($\"SSH authentication failed: {ex.Message}\", ex);\n }\n catch (SshConnectionException ex)\n {\n _logger.LogError(\"SSH connection failed for {Host}: {Error}\", credentials.Host, ex.Message);\n throw new InvalidOperationException($\"SSH connection failed: {ex.Message}\", ex);\n }\n finally\n {\n if (client.IsConnected)\n {\n client.Disconnect();\n }\n }\n }\n\n /// \n /// Deploys agent to UniFi device (UDM/UCG)\n /// \n private async Task DeployUniFiAgentAsync(\n AgentConfiguration config,\n Dictionary scripts,\n DeploymentResult result,\n CancellationToken cancellationToken)\n {\n using var client = CreateSshClient(config.SshCredentials);\n using var sftp = CreateSftpClient(config.SshCredentials);\n\n await Task.Run(() =>\n {\n client.Connect();\n sftp.Connect();\n\n try\n {\n // Create directories\n ExecuteCommand(client, \"mkdir -p /data/on_boot.d\");\n ExecuteCommand(client, \"mkdir -p /data/network-optimizer\");\n\n // Deploy boot script\n if (scripts.TryGetValue(\"udm-agent-boot.sh\", out var bootScript))\n {\n var bootPath = \"/data/on_boot.d/99-network-optimizer.sh\";\n UploadScript(sftp, bootScript, bootPath);\n ExecuteCommand(client, $\"chmod +x \\\"{bootPath}\\\"\");\n result.DeployedFiles.Add(bootPath);\n _logger.LogDebug(\"Deployed boot script to {Path}\", bootPath);\n }\n\n // Deploy metrics collector\n if (scripts.TryGetValue(\"udm-metrics-collector.sh\", out var metricsScript))\n {\n var metricsPath = \"/data/network-optimizer/metrics-collector.sh\";\n UploadScript(sftp, metricsScript, metricsPath);\n ExecuteCommand(client, $\"chmod +x \\\"{metricsPath}\\\"\");\n result.DeployedFiles.Add(metricsPath);\n _logger.LogDebug(\"Deployed metrics collector to {Path}\", metricsPath);\n }\n\n // Run installation script if present\n if (scripts.TryGetValue(\"install-udm.sh\", out var installScript))\n {\n var installPath = \"/tmp/install-network-optimizer.sh\";\n UploadScript(sftp, installScript, installPath);\n ExecuteCommand(client, $\"chmod +x \\\"{installPath}\\\"\");\n var installOutput = ExecuteCommand(client, $\"sh \\\"{installPath}\\\"\");\n _logger.LogDebug(\"Installation output: {Output}\", installOutput);\n ExecuteCommand(client, $\"rm \\\"{installPath}\\\"\");\n }\n\n _logger.LogInformation(\"Successfully deployed UniFi agent scripts\");\n }\n finally\n {\n client.Disconnect();\n sftp.Disconnect();\n }\n }, cancellationToken);\n }\n\n /// \n /// Deploys agent to Linux system\n /// \n private async Task DeployLinuxAgentAsync(\n AgentConfiguration config,\n Dictionary scripts,\n DeploymentResult result,\n CancellationToken cancellationToken)\n {\n using var client = CreateSshClient(config.SshCredentials);\n using var sftp = CreateSftpClient(config.SshCredentials);\n\n await Task.Run(() =>\n {\n client.Connect();\n sftp.Connect();\n\n try\n {\n // Create directories\n ExecuteCommand(client, \"mkdir -p /opt/network-optimizer\");\n ExecuteCommand(client, \"mkdir -p /var/log/network-optimizer\");\n\n // Deploy agent script\n if (scripts.TryGetValue(\"linux-agent.sh\", out var agentScript))\n {\n var agentPath = \"/opt/network-optimizer/agent.sh\";\n UploadScript(sftp, agentScript, agentPath);\n ExecuteCommand(client, $\"chmod +x \\\"{agentPath}\\\"\");\n result.DeployedFiles.Add(agentPath);\n _logger.LogDebug(\"Deployed agent script to {Path}\", agentPath);\n }\n\n // Deploy systemd service\n if (scripts.TryGetValue(\"linux-agent.service\", out var serviceScript))\n {\n var servicePath = \"/etc/systemd/system/network-optimizer-agent.service\";\n UploadScript(sftp, serviceScript, servicePath);\n result.DeployedFiles.Add(servicePath);\n _logger.LogDebug(\"Deployed systemd service to {Path}\", servicePath);\n\n // Reload systemd and enable service\n ExecuteCommand(client, \"systemctl daemon-reload\");\n ExecuteCommand(client, \"systemctl enable network-optimizer-agent.service\");\n ExecuteCommand(client, \"systemctl restart network-optimizer-agent.service\");\n }\n\n // Run installation script if present\n if (scripts.TryGetValue(\"install-linux.sh\", out var installScript))\n {\n var installPath = \"/tmp/install-network-optimizer.sh\";\n UploadScript(sftp, installScript, installPath);\n ExecuteCommand(client, $\"chmod +x \\\"{installPath}\\\"\");\n var installOutput = ExecuteCommand(client, $\"bash \\\"{installPath}\\\"\");\n _logger.LogDebug(\"Installation output: {Output}\", installOutput);\n ExecuteCommand(client, $\"rm \\\"{installPath}\\\"\");\n }\n\n _logger.LogInformation(\"Successfully deployed Linux agent\");\n }\n finally\n {\n client.Disconnect();\n sftp.Disconnect();\n }\n }, cancellationToken);\n }\n\n /// \n /// Verifies that the deployment was successful\n /// \n private async Task VerifyDeploymentAsync(\n AgentConfiguration config,\n CancellationToken cancellationToken)\n {\n var verification = new VerificationResult();\n\n using var client = CreateSshClient(config.SshCredentials);\n\n await Task.Run(() =>\n {\n client.Connect();\n\n try\n {\n if (config.AgentType == AgentType.UDM || config.AgentType == AgentType.UCG)\n {\n // Verify UniFi agent files\n var bootScriptExists = FileExists(client, \"/data/on_boot.d/99-network-optimizer.sh\");\n var metricsScriptExists = FileExists(client, \"/data/network-optimizer/metrics-collector.sh\");\n\n if (bootScriptExists)\n verification.VerifiedFiles.Add(\"/data/on_boot.d/99-network-optimizer.sh\");\n if (metricsScriptExists)\n verification.VerifiedFiles.Add(\"/data/network-optimizer/metrics-collector.sh\");\n\n // Check if metrics collector is running\n var processCheck = ExecuteCommand(client, \"pgrep -f metrics-collector.sh\");\n verification.AgentRunning = !string.IsNullOrWhiteSpace(processCheck);\n\n verification.Passed = bootScriptExists && metricsScriptExists;\n\n if (!verification.Passed)\n {\n if (!bootScriptExists)\n verification.Messages.Add(\"Boot script not found\");\n if (!metricsScriptExists)\n verification.Messages.Add(\"Metrics collector script not found\");\n }\n }\n else if (config.AgentType == AgentType.Linux)\n {\n // Verify Linux agent files\n var agentScriptExists = FileExists(client, \"/opt/network-optimizer/agent.sh\");\n var serviceExists = FileExists(client, \"/etc/systemd/system/network-optimizer-agent.service\");\n\n if (agentScriptExists)\n verification.VerifiedFiles.Add(\"/opt/network-optimizer/agent.sh\");\n if (serviceExists)\n verification.VerifiedFiles.Add(\"/etc/systemd/system/network-optimizer-agent.service\");\n\n // Check service status\n var serviceStatus = ExecuteCommand(client, \"systemctl is-active network-optimizer-agent.service\");\n verification.ServiceStatus = serviceStatus.Trim();\n verification.AgentRunning = verification.ServiceStatus == \"active\";\n\n verification.Passed = agentScriptExists && serviceExists && verification.AgentRunning;\n\n if (!verification.Passed)\n {\n if (!agentScriptExists)\n verification.Messages.Add(\"Agent script not found\");\n if (!serviceExists)\n verification.Messages.Add(\"Systemd service not found\");\n if (!verification.AgentRunning)\n verification.Messages.Add($\"Service not running (status: {verification.ServiceStatus})\");\n }\n }\n }\n finally\n {\n client.Disconnect();\n }\n }, cancellationToken);\n\n return verification;\n }\n\n /// \n /// Creates an SSH client with the given credentials\n /// \n private SshClient CreateSshClient(SshCredentials credentials)\n {\n var authMethods = new List();\n\n if (credentials.GetAuthenticationType() == AuthenticationType.PrivateKey)\n {\n var keyFile = credentials.PrivateKeyPassphrase != null\n ? new PrivateKeyFile(credentials.PrivateKeyPath!, credentials.PrivateKeyPassphrase)\n : new PrivateKeyFile(credentials.PrivateKeyPath!);\n\n authMethods.Add(new PrivateKeyAuthenticationMethod(credentials.Username, keyFile));\n }\n else if (credentials.GetAuthenticationType() == AuthenticationType.Password)\n {\n authMethods.Add(new PasswordAuthenticationMethod(credentials.Username, credentials.Password!));\n }\n\n var connectionInfo = new ConnectionInfo(\n credentials.Host,\n credentials.Port,\n credentials.Username,\n authMethods.ToArray())\n {\n Timeout = TimeSpan.FromSeconds(credentials.TimeoutSeconds)\n };\n\n return new SshClient(connectionInfo);\n }\n\n /// \n /// Creates an SFTP client with the given credentials\n /// \n private SftpClient CreateSftpClient(SshCredentials credentials)\n {\n var authMethods = new List();\n\n if (credentials.GetAuthenticationType() == AuthenticationType.PrivateKey)\n {\n var keyFile = credentials.PrivateKeyPassphrase != null\n ? new PrivateKeyFile(credentials.PrivateKeyPath!, credentials.PrivateKeyPassphrase)\n : new PrivateKeyFile(credentials.PrivateKeyPath!);\n\n authMethods.Add(new PrivateKeyAuthenticationMethod(credentials.Username, keyFile));\n }\n else if (credentials.GetAuthenticationType() == AuthenticationType.Password)\n {\n authMethods.Add(new PasswordAuthenticationMethod(credentials.Username, credentials.Password!));\n }\n\n var connectionInfo = new ConnectionInfo(\n credentials.Host,\n credentials.Port,\n credentials.Username,\n authMethods.ToArray())\n {\n Timeout = TimeSpan.FromSeconds(credentials.TimeoutSeconds)\n };\n\n return new SftpClient(connectionInfo);\n }\n\n /// \n /// Executes a command on the remote system\n /// \n private string ExecuteCommand(SshClient client, string command)\n {\n using var cmd = client.CreateCommand(command);\n var result = cmd.Execute();\n\n if (cmd.ExitStatus != 0 && !string.IsNullOrEmpty(cmd.Error))\n {\n _logger.LogWarning(\"Command '{Command}' returned non-zero exit code {ExitCode}: {Error}\",\n command, cmd.ExitStatus, cmd.Error);\n }\n\n return result;\n }\n\n /// \n /// Uploads a script to the remote system\n /// \n private void UploadScript(SftpClient sftp, string content, string remotePath)\n {\n using var stream = new MemoryStream(Encoding.UTF8.GetBytes(content));\n sftp.UploadFile(stream, remotePath, true);\n }\n\n /// \n /// Checks if a file exists on the remote system\n /// \n private bool FileExists(SshClient client, string path)\n {\n var result = ExecuteCommand(client, $\"test -f \\\"{path}\\\" && echo 'exists' || echo 'not found'\");\n return result.Trim() == \"exists\";\n }\n\n /// \n /// Helper to add a deployment step with error handling\n /// \n private async Task AddStepAsync(DeploymentResult result, string stepName, Func> action)\n {\n var step = new DeploymentStep { Name = stepName };\n var sw = Stopwatch.StartNew();\n\n try\n {\n step.Message = await action();\n step.Success = true;\n _logger.LogDebug(\"Step '{Step}' completed: {Message}\", stepName, step.Message);\n }\n catch (Exception ex)\n {\n step.Success = false;\n step.Message = ex.Message;\n _logger.LogError(ex, \"Step '{Step}' failed\", stepName);\n throw;\n }\n finally\n {\n sw.Stop();\n step.DurationMs = sw.ElapsedMilliseconds;\n result.Steps.Add(step);\n }\n }\n}\n"
},
{
"path": "src/NetworkOptimizer.Agents/AgentHealthMonitor.cs",
"content": "using System.Data;\nusing Microsoft.Data.Sqlite;\nusing Microsoft.Extensions.Logging;\nusing NetworkOptimizer.Agents.Models;\n\nnamespace NetworkOptimizer.Agents;\n\n/// \n/// Monitors agent health and tracks heartbeats\n/// \npublic class AgentHealthMonitor : IDisposable\n{\n private readonly ILogger _logger;\n private readonly string _connectionString;\n private readonly TimeSpan _offlineThreshold;\n\n public AgentHealthMonitor(\n ILogger logger,\n string databasePath,\n TimeSpan? offlineThreshold = null)\n {\n _logger = logger;\n _connectionString = $\"Data Source={databasePath}\";\n _offlineThreshold = offlineThreshold ?? TimeSpan.FromMinutes(5);\n\n InitializeDatabase();\n }\n\n /// \n /// Records a heartbeat from an agent\n /// \n public async Task RecordHeartbeatAsync(string agentId, string deviceName, AgentType agentType, Dictionary? metadata = null)\n {\n try\n {\n using var connection = new SqliteConnection(_connectionString);\n await connection.OpenAsync();\n\n var metadataJson = metadata != null ? System.Text.Json.JsonSerializer.Serialize(metadata) : null;\n\n var command = connection.CreateCommand();\n command.CommandText = @\"\n INSERT OR REPLACE INTO agent_heartbeats (agent_id, device_name, agent_type, last_heartbeat, metadata)\n VALUES (@agentId, @deviceName, @agentType, @lastHeartbeat, @metadata)\";\n\n command.Parameters.AddWithValue(\"@agentId\", agentId);\n command.Parameters.AddWithValue(\"@deviceName\", deviceName);\n command.Parameters.AddWithValue(\"@agentType\", agentType.ToString());\n command.Parameters.AddWithValue(\"@lastHeartbeat\", DateTime.UtcNow);\n command.Parameters.AddWithValue(\"@metadata\", (object?)metadataJson ?? DBNull.Value);\n\n await command.ExecuteNonQueryAsync();\n\n _logger.LogDebug(\"Recorded heartbeat for agent {AgentId} ({DeviceName})\", agentId, deviceName);\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to record heartbeat for agent {AgentId}\", agentId);\n throw;\n }\n }\n\n /// \n /// Gets the status of a specific agent\n /// \n public async Task GetAgentStatusAsync(string agentId)\n {\n try\n {\n using var connection = new SqliteConnection(_connectionString);\n await connection.OpenAsync();\n\n var command = connection.CreateCommand();\n command.CommandText = @\"\n SELECT agent_id, device_name, agent_type, last_heartbeat, metadata, first_seen\n FROM agent_heartbeats\n WHERE agent_id = @agentId\";\n\n command.Parameters.AddWithValue(\"@agentId\", agentId);\n\n using var reader = await command.ExecuteReaderAsync();\n if (await reader.ReadAsync())\n {\n return ReadAgentStatus(reader);\n }\n\n return null;\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to get status for agent {AgentId}\", agentId);\n throw;\n }\n }\n\n /// \n /// Gets all registered agents\n /// \n public async Task> GetAllAgentsAsync()\n {\n try\n {\n using var connection = new SqliteConnection(_connectionString);\n await connection.OpenAsync();\n\n var command = connection.CreateCommand();\n command.CommandText = @\"\n SELECT agent_id, device_name, agent_type, last_heartbeat, metadata, first_seen\n FROM agent_heartbeats\n ORDER BY last_heartbeat DESC\";\n\n var agents = new List();\n\n using var reader = await command.ExecuteReaderAsync();\n while (await reader.ReadAsync())\n {\n agents.Add(ReadAgentStatus(reader));\n }\n\n return agents;\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to get all agents\");\n throw;\n }\n }\n\n /// \n /// Gets all offline agents\n /// \n public async Task> GetOfflineAgentsAsync()\n {\n var allAgents = await GetAllAgentsAsync();\n return allAgents.Where(a => !a.IsOnline).ToList();\n }\n\n /// \n /// Gets all online agents\n /// \n public async Task> GetOnlineAgentsAsync()\n {\n var allAgents = await GetAllAgentsAsync();\n return allAgents.Where(a => a.IsOnline).ToList();\n }\n\n /// \n /// Removes an agent from monitoring\n /// \n public async Task RemoveAgentAsync(string agentId)\n {\n try\n {\n using var connection = new SqliteConnection(_connectionString);\n await connection.OpenAsync();\n\n var command = connection.CreateCommand();\n command.CommandText = \"DELETE FROM agent_heartbeats WHERE agent_id = @agentId\";\n command.Parameters.AddWithValue(\"@agentId\", agentId);\n\n var rowsAffected = await command.ExecuteNonQueryAsync();\n\n if (rowsAffected > 0)\n {\n _logger.LogInformation(\"Removed agent {AgentId} from monitoring\", agentId);\n }\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to remove agent {AgentId}\", agentId);\n throw;\n }\n }\n\n /// \n /// Gets statistics about agent health\n /// \n public async Task GetHealthStatsAsync()\n {\n var allAgents = await GetAllAgentsAsync();\n\n return new AgentHealthStats\n {\n TotalAgents = allAgents.Count,\n OnlineAgents = allAgents.Count(a => a.IsOnline),\n OfflineAgents = allAgents.Count(a => !a.IsOnline),\n AgentsByType = allAgents\n .GroupBy(a => a.AgentType)\n .ToDictionary(g => g.Key, g => g.Count()),\n OldestHeartbeat = allAgents.Any() ? allAgents.Min(a => a.LastHeartbeat) : null,\n NewestHeartbeat = allAgents.Any() ? allAgents.Max(a => a.LastHeartbeat) : null\n };\n }\n\n /// \n /// Cleans up old heartbeat records\n /// \n public async Task CleanupOldRecordsAsync(TimeSpan retentionPeriod)\n {\n try\n {\n using var connection = new SqliteConnection(_connectionString);\n await connection.OpenAsync();\n\n var cutoffDate = DateTime.UtcNow - retentionPeriod;\n\n var command = connection.CreateCommand();\n command.CommandText = \"DELETE FROM agent_heartbeats WHERE last_heartbeat < @cutoffDate\";\n command.Parameters.AddWithValue(\"@cutoffDate\", cutoffDate);\n\n var rowsAffected = await command.ExecuteNonQueryAsync();\n\n if (rowsAffected > 0)\n {\n _logger.LogInformation(\"Cleaned up {Count} old agent records\", rowsAffected);\n }\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to cleanup old records\");\n throw;\n }\n }\n\n /// \n /// Initializes the SQLite database\n /// \n private void InitializeDatabase()\n {\n try\n {\n using var connection = new SqliteConnection(_connectionString);\n connection.Open();\n\n var command = connection.CreateCommand();\n command.CommandText = @\"\n CREATE TABLE IF NOT EXISTS agent_heartbeats (\n agent_id TEXT PRIMARY KEY,\n device_name TEXT NOT NULL,\n agent_type TEXT NOT NULL,\n last_heartbeat TEXT NOT NULL,\n first_seen TEXT NOT NULL DEFAULT (datetime('now')),\n metadata TEXT\n );\n\n CREATE INDEX IF NOT EXISTS idx_last_heartbeat ON agent_heartbeats(last_heartbeat);\n CREATE INDEX IF NOT EXISTS idx_agent_type ON agent_heartbeats(agent_type);\n \";\n\n command.ExecuteNonQuery();\n\n _logger.LogDebug(\"Initialized agent health database\");\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to initialize database\");\n throw;\n }\n }\n\n /// \n /// Reads an AgentStatus from a data reader\n /// \n private AgentStatus ReadAgentStatus(SqliteDataReader reader)\n {\n var agentId = reader.GetString(0);\n var deviceName = reader.GetString(1);\n var agentTypeStr = reader.GetString(2);\n var lastHeartbeat = reader.GetDateTime(3);\n var metadataJson = reader.IsDBNull(4) ? null : reader.GetString(4);\n var firstSeen = reader.GetDateTime(5);\n\n var agentType = Enum.Parse(agentTypeStr);\n\n var metadata = metadataJson != null\n ? System.Text.Json.JsonSerializer.Deserialize>(metadataJson)\n : null;\n\n var timeSinceLastHeartbeat = DateTime.UtcNow - lastHeartbeat;\n var isOnline = timeSinceLastHeartbeat <= _offlineThreshold;\n\n return new AgentStatus\n {\n AgentId = agentId,\n DeviceName = deviceName,\n AgentType = agentType,\n LastHeartbeat = lastHeartbeat,\n FirstSeen = firstSeen,\n IsOnline = isOnline,\n SecondsSinceLastHeartbeat = (int)timeSinceLastHeartbeat.TotalSeconds,\n Metadata = metadata ?? new Dictionary()\n };\n }\n\n public void Dispose()\n {\n // Clean up any resources if needed\n GC.SuppressFinalize(this);\n }\n}\n\n/// \n/// Current status of an agent\n/// \npublic class AgentStatus\n{\n public required string AgentId { get; set; }\n public required string DeviceName { get; set; }\n public required AgentType AgentType { get; set; }\n public DateTime LastHeartbeat { get; set; }\n public DateTime FirstSeen { get; set; }\n public bool IsOnline { get; set; }\n public int SecondsSinceLastHeartbeat { get; set; }\n public Dictionary Metadata { get; set; } = new();\n}\n\n/// \n/// Overall health statistics for all agents\n/// \npublic class AgentHealthStats\n{\n public int TotalAgents { get; set; }\n public int OnlineAgents { get; set; }\n public int OfflineAgents { get; set; }\n public Dictionary AgentsByType { get; set; } = new();\n public DateTime? OldestHeartbeat { get; set; }\n public DateTime? NewestHeartbeat { get; set; }\n\n public double OnlinePercentage => TotalAgents > 0\n ? (double)OnlineAgents / TotalAgents * 100\n : 0;\n}\n"
},
{
"path": "src/NetworkOptimizer.Agents/Models/AgentConfiguration.cs",
"content": "namespace NetworkOptimizer.Agents.Models;\n\n/// \n/// Configuration for a deployed agent\n/// \npublic class AgentConfiguration\n{\n /// \n /// Unique identifier for the agent\n /// \n public required string AgentId { get; set; }\n\n /// \n /// Friendly name for the device\n /// \n public required string DeviceName { get; set; }\n\n /// \n /// Type of agent being deployed\n /// \n public required AgentType AgentType { get; set; }\n\n /// \n /// InfluxDB endpoint URL\n /// \n public required string InfluxDbUrl { get; set; }\n\n /// \n /// InfluxDB organization\n /// \n public required string InfluxDbOrg { get; set; }\n\n /// \n /// InfluxDB bucket name\n /// \n public required string InfluxDbBucket { get; set; }\n\n /// \n /// InfluxDB authentication token\n /// \n public required string InfluxDbToken { get; set; }\n\n /// \n /// Metric collection interval in seconds\n /// \n public int CollectionIntervalSeconds { get; set; } = 30;\n\n /// \n /// Speedtest interval in minutes (UDM/UCG only)\n /// \n public int SpeedtestIntervalMinutes { get; set; } = 60;\n\n /// \n /// Enable Docker metrics collection (Linux agent only)\n /// \n public bool EnableDockerMetrics { get; set; } = false;\n\n /// \n /// Additional tags to apply to all metrics\n /// \n public Dictionary Tags { get; set; } = new();\n\n /// \n /// SSH credentials for deployment\n /// \n public required SshCredentials SshCredentials { get; set; }\n}\n\npublic enum AgentType\n{\n /// \n /// UniFi Dream Machine (UDM/UDM-Pro/UDM-SE)\n /// \n UDM,\n\n /// \n /// UniFi Cloud Gateway (UCG-Ultra/UCG-Max)\n /// \n UCG,\n\n /// \n /// Generic Linux system\n /// \n Linux\n}\n"
},
{
"path": "src/NetworkOptimizer.Agents/Models/DeploymentResult.cs",
"content": "namespace NetworkOptimizer.Agents.Models;\n\n/// \n/// Result of an agent deployment operation\n/// \npublic class DeploymentResult\n{\n /// \n /// Whether the deployment was successful\n /// \n public bool Success { get; set; }\n\n /// \n /// Agent ID that was deployed\n /// \n public required string AgentId { get; set; }\n\n /// \n /// Device name\n /// \n public required string DeviceName { get; set; }\n\n /// \n /// Agent type deployed\n /// \n public AgentType AgentType { get; set; }\n\n /// \n /// Deployment timestamp\n /// \n public DateTime DeployedAt { get; set; } = DateTime.UtcNow;\n\n /// \n /// Success or error message\n /// \n public string Message { get; set; } = string.Empty;\n\n /// \n /// Detailed deployment steps and their results\n /// \n public List Steps { get; set; } = new();\n\n /// \n /// Files that were deployed\n /// \n public List DeployedFiles { get; set; } = new();\n\n /// \n /// Verification results\n /// \n public VerificationResult? Verification { get; set; }\n\n /// \n /// Creates a successful deployment result\n /// \n public static DeploymentResult CreateSuccess(string agentId, string deviceName, AgentType agentType, string message)\n {\n return new DeploymentResult\n {\n Success = true,\n AgentId = agentId,\n DeviceName = deviceName,\n AgentType = agentType,\n Message = message\n };\n }\n\n /// \n /// Creates a failed deployment result\n /// \n public static DeploymentResult CreateFailure(string agentId, string deviceName, AgentType agentType, string message)\n {\n return new DeploymentResult\n {\n Success = false,\n AgentId = agentId,\n DeviceName = deviceName,\n AgentType = agentType,\n Message = message\n };\n }\n}\n\n/// \n/// Individual deployment step\n/// \npublic class DeploymentStep\n{\n /// \n /// Step name\n /// \n public required string Name { get; set; }\n\n /// \n /// Whether the step succeeded\n /// \n public bool Success { get; set; }\n\n /// \n /// Step message or error\n /// \n public string Message { get; set; } = string.Empty;\n\n /// \n /// When the step was executed\n /// \n public DateTime ExecutedAt { get; set; } = DateTime.UtcNow;\n\n /// \n /// Step duration in milliseconds\n /// \n public long DurationMs { get; set; }\n}\n\n/// \n/// Post-deployment verification results\n/// \npublic class VerificationResult\n{\n /// \n /// Whether verification passed\n /// \n public bool Passed { get; set; }\n\n /// \n /// Files verified as present\n /// \n public List VerifiedFiles { get; set; } = new();\n\n /// \n /// Service status (if applicable)\n /// \n public string? ServiceStatus { get; set; }\n\n /// \n /// Agent process is running\n /// \n public bool AgentRunning { get; set; }\n\n /// \n /// Verification messages\n /// \n public List Messages { get; set; } = new();\n}\n"
},
{
"path": "src/NetworkOptimizer.Agents/Models/SshCredentials.cs",
"content": "namespace NetworkOptimizer.Agents.Models;\n\n/// \n/// SSH connection credentials supporting both password and key-based authentication\n/// \npublic class SshCredentials\n{\n /// \n /// SSH hostname or IP address\n /// \n public required string Host { get; set; }\n\n /// \n /// SSH port (default: 22)\n /// \n public int Port { get; set; } = 22;\n\n /// \n /// SSH username\n /// \n public required string Username { get; set; }\n\n /// \n /// Password for password-based authentication\n /// \n public string? Password { get; set; }\n\n /// \n /// Private key path for key-based authentication\n /// \n public string? PrivateKeyPath { get; set; }\n\n /// \n /// Private key passphrase (if the key is encrypted)\n /// \n public string? PrivateKeyPassphrase { get; set; }\n\n /// \n /// Connection timeout in seconds\n /// \n public int TimeoutSeconds { get; set; } = 30;\n\n /// \n /// Validates that credentials are properly configured\n /// \n public bool IsValid()\n {\n if (string.IsNullOrWhiteSpace(Host) || string.IsNullOrWhiteSpace(Username))\n return false;\n\n // Must have either password or private key\n return !string.IsNullOrWhiteSpace(Password) || !string.IsNullOrWhiteSpace(PrivateKeyPath);\n }\n\n /// \n /// Gets authentication type\n /// \n public AuthenticationType GetAuthenticationType()\n {\n if (!string.IsNullOrWhiteSpace(PrivateKeyPath))\n return AuthenticationType.PrivateKey;\n\n if (!string.IsNullOrWhiteSpace(Password))\n return AuthenticationType.Password;\n\n return AuthenticationType.None;\n }\n}\n\npublic enum AuthenticationType\n{\n None,\n Password,\n PrivateKey\n}\n"
},
{
"path": "src/NetworkOptimizer.Agents/NetworkOptimizer.Agents.csproj",
"content": "\n\n \n net10.0\n enable\n enable\n \n\n \n \n \n\n \n \n \n \n \n \n \n \n\n \n \n PreserveNewest\n \n \n\n\n"
},
{
"path": "src/NetworkOptimizer.Agents/README.md",
"content": "# NetworkOptimizer.Agents\n\n> **Status: Future Project** - This library is planned but not yet implemented. The structure and interfaces below represent the intended design.\n\nGeneric agent deployment and monitoring system for Linux systems. This library will provide SSH-based deployment, health monitoring, and template-based configuration management.\n\n## Features\n\n### Agent Deployment\n- **SSH-Based Deployment**: Secure deployment via SSH.NET with support for:\n - Password authentication\n - Private key authentication (with or without passphrase)\n - Connection testing before deployment\n - Deployment verification after installation\n\n### Supported Platforms\n- **Linux Systems**: Generic Linux servers (Ubuntu, Debian, CentOS, RHEL, Fedora)\n - Deploys as systemd service\n - Collects CPU, memory, disk, and network metrics\n - Optional Docker container monitoring\n - Automatic service management\n\n### Health Monitoring\n- Track agent heartbeats in SQLite database\n- Detect offline agents\n- Monitor agent status and uptime\n- View comprehensive health statistics\n\n### Template System\n- Scriban-based template rendering\n- Dynamic configuration injection\n\n## Project Structure\n\n```\nNetworkOptimizer.Agents/\n├── Models/\n│ ├── AgentConfiguration.cs # Agent configuration model\n│ ├── DeploymentResult.cs # Deployment result tracking\n│ └── SshCredentials.cs # SSH authentication credentials\n├── Templates/\n│ ├── linux-agent.sh.template # Linux agent script\n│ ├── linux-agent.service.template # Systemd service definition\n│ └── install-linux.sh.template # Linux installation\n├── AgentDeployer.cs # Main deployment orchestrator\n├── AgentHealthMonitor.cs # Health monitoring and heartbeat tracking\n├── ScriptRenderer.cs # Template rendering engine\n└── NetworkOptimizer.Agents.csproj # Project file\n```\n\n## Related Projects\n\n- **NetworkOptimizer.Sqm** - Adaptive SQM (Smart Queue Management) for UniFi gateways\n- **NetworkOptimizer.Web/Services/SqmDeploymentService.cs** - SQM script deployment via SSH\n\n## Metrics Collected (Linux Agents)\n\n- **CPU**: Usage percentage, load averages (1m, 5m, 15m)\n- **Memory**: Total, used, free, available, swap usage\n- **Disk**: Usage, I/O operations (reads/writes)\n- **Network**: Per-interface traffic, packets, errors\n- **Docker** (optional): Container count, per-container CPU and memory\n- **Heartbeats**: Agent online status, system uptime\n\n## Dependencies\n\n- **SSH.NET** (2025.1.0): SSH/SFTP client library\n- **Scriban** (6.5.2): Template rendering engine\n- **Microsoft.Data.Sqlite** (10.0.1): SQLite database for health monitoring\n- **Microsoft.Extensions.Logging.Abstractions** (10.0.1): Logging infrastructure\n\n## .NET Version\n\nBuilt for **.NET 10.0** with nullable reference types enabled and implicit usings.\n"
},
{
"path": "src/NetworkOptimizer.Agents/ScriptRenderer.cs",
"content": "using Microsoft.Extensions.Logging;\nusing NetworkOptimizer.Agents.Models;\nusing Scriban;\nusing Scriban.Runtime;\n\nnamespace NetworkOptimizer.Agents;\n\n/// \n/// Renders script templates with configuration values using Scriban\n/// \npublic class ScriptRenderer\n{\n private readonly ILogger _logger;\n private readonly string _templatesPath;\n\n public ScriptRenderer(ILogger logger, string? templatesPath = null)\n {\n _logger = logger;\n _templatesPath = templatesPath ?? Path.Combine(AppContext.BaseDirectory, \"Templates\");\n }\n\n /// \n /// Renders a template file with the given configuration\n /// \n public async Task RenderTemplateAsync(string templateName, AgentConfiguration config)\n {\n try\n {\n var templatePath = Path.Combine(_templatesPath, templateName);\n\n if (!File.Exists(templatePath))\n {\n throw new FileNotFoundException($\"Template not found: {templatePath}\");\n }\n\n var templateContent = await File.ReadAllTextAsync(templatePath);\n var template = Template.Parse(templateContent);\n\n if (template.HasErrors)\n {\n var errors = string.Join(\", \", template.Messages.Select(m => m.Message));\n throw new InvalidOperationException($\"Template parsing errors: {errors}\");\n }\n\n var scriptObject = BuildScriptObject(config);\n var rendered = await template.RenderAsync(scriptObject);\n\n _logger.LogDebug(\"Successfully rendered template {Template} for agent {AgentId}\",\n templateName, config.AgentId);\n\n return rendered;\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to render template {Template}\", templateName);\n throw;\n }\n }\n\n /// \n /// Renders a template from a string rather than a file\n /// \n public async Task RenderTemplateStringAsync(string templateContent, AgentConfiguration config)\n {\n try\n {\n var template = Template.Parse(templateContent);\n\n if (template.HasErrors)\n {\n var errors = string.Join(\", \", template.Messages.Select(m => m.Message));\n throw new InvalidOperationException($\"Template parsing errors: {errors}\");\n }\n\n var scriptObject = BuildScriptObject(config);\n return await template.RenderAsync(scriptObject);\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to render template string\");\n throw;\n }\n }\n\n /// \n /// Gets the appropriate template names for an agent type\n /// \n public List GetTemplatesForAgent(AgentType agentType)\n {\n return agentType switch\n {\n AgentType.UDM or AgentType.UCG => new List\n {\n \"udm-agent-boot.sh.template\",\n \"udm-metrics-collector.sh.template\",\n \"install-udm.sh.template\"\n },\n AgentType.Linux => new List\n {\n \"linux-agent.sh.template\",\n \"linux-agent.service.template\",\n \"install-linux.sh.template\"\n },\n _ => throw new ArgumentException($\"Unknown agent type: {agentType}\")\n };\n }\n\n /// \n /// Builds a Scriban script object with all configuration values\n /// \n private ScriptObject BuildScriptObject(AgentConfiguration config)\n {\n var scriptObject = new ScriptObject\n {\n { \"agent_id\", config.AgentId },\n { \"device_name\", config.DeviceName },\n { \"agent_type\", config.AgentType.ToString().ToLower() },\n { \"influxdb_url\", config.InfluxDbUrl },\n { \"influxdb_org\", config.InfluxDbOrg },\n { \"influxdb_bucket\", config.InfluxDbBucket },\n { \"influxdb_token\", config.InfluxDbToken },\n { \"collection_interval\", config.CollectionIntervalSeconds },\n { \"speedtest_interval\", config.SpeedtestIntervalMinutes },\n { \"enable_docker\", config.EnableDockerMetrics },\n { \"is_udm\", config.AgentType == AgentType.UDM },\n { \"is_ucg\", config.AgentType == AgentType.UCG },\n { \"is_linux\", config.AgentType == AgentType.Linux },\n { \"is_unifi\", config.AgentType == AgentType.UDM || config.AgentType == AgentType.UCG }\n };\n\n // Add tags as a dictionary\n if (config.Tags.Any())\n {\n var tagsObject = new ScriptObject();\n foreach (var tag in config.Tags)\n {\n tagsObject.Add(tag.Key, tag.Value);\n }\n scriptObject.Add(\"tags\", tagsObject);\n }\n\n var context = new TemplateContext();\n context.PushGlobal(scriptObject);\n\n return scriptObject;\n }\n\n /// \n /// Validates that all required templates exist\n /// \n public bool ValidateTemplates(AgentType agentType, out List missingTemplates)\n {\n missingTemplates = new List();\n var templates = GetTemplatesForAgent(agentType);\n\n foreach (var template in templates)\n {\n var path = Path.Combine(_templatesPath, template);\n if (!File.Exists(path))\n {\n missingTemplates.Add(template);\n }\n }\n\n return missingTemplates.Count == 0;\n }\n\n /// \n /// Lists all available templates\n /// \n public List ListAvailableTemplates()\n {\n if (!Directory.Exists(_templatesPath))\n {\n return new List();\n }\n\n return Directory.GetFiles(_templatesPath, \"*.template\")\n .Select(Path.GetFileName)\n .Where(n => n != null)\n .Cast()\n .ToList();\n }\n}\n"
},
{
"path": "src/NetworkOptimizer.Agents/Templates/install-linux.sh.template",
"content": "#!/bin/bash\n#\n# Network Optimizer Agent - Linux Installation Script\n#\n\nset -e\n\necho \"=== Network Optimizer Agent Installation ===\"\necho \"Agent ID: {{ agent_id }}\"\necho \"Device: {{ device_name }}\"\necho \"\"\n\n# Check if running as root\nif [ \"$EUID\" -ne 0 ]; then\n echo \"ERROR: This script must be run as root\"\n echo \"Please run: sudo $0\"\n exit 1\nfi\n\necho \"✓ Running as root\"\n\n# Detect Linux distribution\nif [ -f /etc/os-release ]; then\n . /etc/os-release\n OS=$ID\n OS_VERSION=$VERSION_ID\n echo \"✓ Detected $PRETTY_NAME\"\nelse\n echo \"WARNING: Could not detect Linux distribution\"\n OS=\"unknown\"\nfi\n\n# Create necessary directories\necho \"Creating directories...\"\nmkdir -p /opt/network-optimizer\nmkdir -p /var/log/network-optimizer\nchmod 755 /opt/network-optimizer\nchmod 755 /var/log/network-optimizer\n\n# Check for required commands\necho \"Checking dependencies...\"\n\nif ! command -v curl &> /dev/null; then\n echo \"ERROR: curl is not installed\"\n echo \"Please install curl:\"\n case $OS in\n ubuntu|debian)\n echo \" sudo apt-get install curl\"\n ;;\n centos|rhel|fedora)\n echo \" sudo yum install curl\"\n ;;\n *)\n echo \" Use your package manager to install curl\"\n ;;\n esac\n exit 1\nfi\necho \"✓ curl found\"\n\nif ! command -v bc &> /dev/null; then\n echo \"Installing bc (basic calculator)...\"\n case $OS in\n ubuntu|debian)\n apt-get install -y bc\n ;;\n centos|rhel|fedora)\n yum install -y bc\n ;;\n *)\n echo \"WARNING: Could not install bc automatically\"\n ;;\n esac\nfi\n\n# Check for Docker if Docker metrics are enabled\nENABLE_DOCKER=\"{{ enable_docker }}\"\nif [ \"$ENABLE_DOCKER\" = \"True\" ] || [ \"$ENABLE_DOCKER\" = \"true\" ]; then\n if ! command -v docker &> /dev/null; then\n echo \"WARNING: Docker metrics enabled but Docker not found\"\n echo \"Docker metrics will be disabled\"\n else\n echo \"✓ Docker found\"\n\n # Check if current user can access Docker\n if docker ps &> /dev/null; then\n echo \"✓ Docker access verified\"\n else\n echo \"WARNING: Cannot access Docker socket\"\n echo \"You may need to run: sudo usermod -aG docker $USER\"\n fi\n fi\nfi\n\n# Test InfluxDB connection\necho \"Testing InfluxDB connection...\"\nINFLUXDB_URL=\"{{ influxdb_url }}\"\nINFLUXDB_ORG=\"{{ influxdb_org }}\"\nINFLUXDB_BUCKET=\"{{ influxdb_bucket }}\"\nINFLUXDB_TOKEN=\"{{ influxdb_token }}\"\n\ncurl_output=$(curl -s -o /dev/null -w \"%{http_code}\" \\\n -X POST \"${INFLUXDB_URL}/api/v2/write?org=${INFLUXDB_ORG}&bucket=${INFLUXDB_BUCKET}\" \\\n -H \"Authorization: Token ${INFLUXDB_TOKEN}\" \\\n -H \"Content-Type: text/plain\" \\\n --data-binary \"test,source=installer value=1\")\n\nif [ \"$curl_output\" = \"204\" ]; then\n echo \"✓ InfluxDB connection successful\"\nelse\n echo \"WARNING: InfluxDB connection returned HTTP $curl_output\"\n echo \"Please verify your InfluxDB configuration\"\nfi\n\n# Make agent script executable\nif [ -f \"/opt/network-optimizer/agent.sh\" ]; then\n chmod +x /opt/network-optimizer/agent.sh\n echo \"✓ Agent script configured\"\nfi\n\n# Check if systemd is available\nif command -v systemctl &> /dev/null; then\n if [ -f \"/etc/systemd/system/network-optimizer-agent.service\" ]; then\n echo \"Configuring systemd service...\"\n systemctl daemon-reload\n systemctl enable network-optimizer-agent.service\n systemctl restart network-optimizer-agent.service\n\n # Wait a moment and check status\n sleep 2\n if systemctl is-active --quiet network-optimizer-agent.service; then\n echo \"✓ Service started successfully\"\n else\n echo \"WARNING: Service may have failed to start\"\n echo \"Check status with: systemctl status network-optimizer-agent.service\"\n fi\n fi\nelse\n echo \"WARNING: systemd not found, service will not auto-start\"\n echo \"You can run the agent manually:\"\n echo \" /opt/network-optimizer/agent.sh\"\nfi\n\necho \"\"\necho \"=== Installation Complete ===\"\necho \"\"\necho \"Service status:\"\nif command -v systemctl &> /dev/null; then\n systemctl status network-optimizer-agent.service --no-pager || true\nfi\necho \"\"\necho \"To view logs:\"\necho \" tail -f /var/log/network-optimizer/agent.log\"\nif command -v journalctl &> /dev/null; then\n echo \" journalctl -u network-optimizer-agent.service -f\"\nfi\necho \"\"\necho \"To stop the agent:\"\necho \" systemctl stop network-optimizer-agent.service\"\necho \"\"\necho \"To restart the agent:\"\necho \" systemctl restart network-optimizer-agent.service\"\necho \"\"\n"
},
{
"path": "src/NetworkOptimizer.Agents/Templates/linux-agent.service.template",
"content": "[Unit]\nDescription=Network Optimizer Agent\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nUser=root\nExecStart=/opt/network-optimizer/agent.sh\nRestart=always\nRestartSec=10\n\n# Logging\nStandardOutput=append:/var/log/network-optimizer/agent.log\nStandardError=append:/var/log/network-optimizer/agent.log\n\n# Security hardening\nNoNewPrivileges=true\nPrivateTmp=true\nProtectSystem=strict\nProtectHome=true\nReadWritePaths=/var/log/network-optimizer\n\n# Resource limits\nMemoryLimit=256M\nCPUQuota=10%\n\n[Install]\nWantedBy=multi-user.target\n"
},
{
"path": "src/NetworkOptimizer.Agents/Templates/linux-agent.sh.template",
"content": "#!/bin/bash\n#\n# Network Optimizer - Linux Agent\n#\n# Configuration\nAGENT_ID=\"{{ agent_id }}\"\nDEVICE_NAME=\"{{ device_name }}\"\nAGENT_TYPE=\"{{ agent_type }}\"\nINFLUXDB_URL=\"{{ influxdb_url }}\"\nINFLUXDB_ORG=\"{{ influxdb_org }}\"\nINFLUXDB_BUCKET=\"{{ influxdb_bucket }}\"\nINFLUXDB_TOKEN=\"{{ influxdb_token }}\"\nCOLLECTION_INTERVAL={{ collection_interval }}\nENABLE_DOCKER={{ enable_docker }}\n\n# Paths\nLOG_DIR=\"/var/log/network-optimizer\"\nLOG_FILE=\"$LOG_DIR/agent.log\"\n\n# Ensure log directory exists\nmkdir -p \"$LOG_DIR\"\n\n# Logging function\nlog() {\n echo \"[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $1\" | tee -a \"$LOG_FILE\"\n}\n\n# Send metrics to InfluxDB\nsend_metric() {\n local measurement=$1\n local tags=$2\n local fields=$3\n local timestamp=$(date +%s)000000000\n\n local line_protocol=\"${measurement},agent_id=${AGENT_ID},device=${DEVICE_NAME},agent_type=${AGENT_TYPE}${tags} ${fields} ${timestamp}\"\n\n curl -s -X POST \"${INFLUXDB_URL}/api/v2/write?org=${INFLUXDB_ORG}&bucket=${INFLUXDB_BUCKET}\" \\\n -H \"Authorization: Token ${INFLUXDB_TOKEN}\" \\\n -H \"Content-Type: text/plain\" \\\n --data-binary \"$line_protocol\" >/dev/null 2>&1\n\n if [ $? -eq 0 ]; then\n log \"Sent metric: $measurement\"\n else\n log \"ERROR: Failed to send metric: $measurement\"\n fi\n}\n\n# Collect CPU metrics\ncollect_cpu_metrics() {\n # Get CPU usage using top\n local cpu_usage=$(top -bn2 -d 0.5 | grep \"Cpu(s)\" | tail -1 | awk '{print $2}' | sed 's/%us,//')\n\n # Get load averages\n local load_avg_1=$(uptime | awk -F'load average:' '{print $2}' | awk '{print $1}' | sed 's/,//')\n local load_avg_5=$(uptime | awk -F'load average:' '{print $2}' | awk '{print $2}' | sed 's/,//')\n local load_avg_15=$(uptime | awk -F'load average:' '{print $2}' | awk '{print $3}' | sed 's/,//')\n\n # Get CPU count\n local cpu_count=$(nproc)\n\n send_metric \"cpu_stats\" \"\" \"usage_percent=${cpu_usage},load_1m=${load_avg_1},load_5m=${load_avg_5},load_15m=${load_avg_15},cpu_count=${cpu_count}i\"\n}\n\n# Collect memory metrics\ncollect_memory_metrics() {\n local mem_total=$(free -b | grep Mem | awk '{print $2}')\n local mem_used=$(free -b | grep Mem | awk '{print $3}')\n local mem_free=$(free -b | grep Mem | awk '{print $4}')\n local mem_available=$(free -b | grep Mem | awk '{print $7}')\n local mem_percent=$(awk \"BEGIN {printf \\\"%.2f\\\", ($mem_used/$mem_total)*100}\")\n\n local swap_total=$(free -b | grep Swap | awk '{print $2}')\n local swap_used=$(free -b | grep Swap | awk '{print $3}')\n\n send_metric \"memory_stats\" \"\" \"total=${mem_total}i,used=${mem_used}i,free=${mem_free}i,available=${mem_available}i,percent=${mem_percent},swap_total=${swap_total}i,swap_used=${swap_used}i\"\n}\n\n# Collect disk metrics\ncollect_disk_metrics() {\n # Get disk usage for root filesystem\n local disk_info=$(df -B1 / | tail -1)\n local disk_total=$(echo $disk_info | awk '{print $2}')\n local disk_used=$(echo $disk_info | awk '{print $3}')\n local disk_available=$(echo $disk_info | awk '{print $4}')\n local disk_percent=$(echo $disk_info | awk '{print $5}' | sed 's/%//')\n\n send_metric \"disk_stats\" \",mount=/\" \"total=${disk_total}i,used=${disk_used}i,available=${disk_available}i,percent=${disk_percent}\"\n\n # Get disk I/O stats if available\n if [ -f /proc/diskstats ]; then\n local disk_device=$(df / | tail -1 | awk '{print $1}' | sed 's/\\/dev\\///' | sed 's/[0-9]*$//')\n local disk_stats=$(grep \" ${disk_device} \" /proc/diskstats | head -1)\n\n if [ -n \"$disk_stats\" ]; then\n local reads_completed=$(echo $disk_stats | awk '{print $4}')\n local writes_completed=$(echo $disk_stats | awk '{print $8}')\n\n send_metric \"disk_io\" \",device=${disk_device}\" \"reads=${reads_completed}i,writes=${writes_completed}i\"\n fi\n fi\n}\n\n# Collect network metrics\ncollect_network_metrics() {\n # Get all network interfaces except loopback\n for iface in $(ls /sys/class/net/ | grep -v lo); do\n if [ -f \"/sys/class/net/${iface}/statistics/rx_bytes\" ]; then\n local rx_bytes=$(cat /sys/class/net/${iface}/statistics/rx_bytes)\n local tx_bytes=$(cat /sys/class/net/${iface}/statistics/tx_bytes)\n local rx_packets=$(cat /sys/class/net/${iface}/statistics/rx_packets)\n local tx_packets=$(cat /sys/class/net/${iface}/statistics/tx_packets)\n local rx_errors=$(cat /sys/class/net/${iface}/statistics/rx_errors)\n local tx_errors=$(cat /sys/class/net/${iface}/statistics/tx_errors)\n\n send_metric \"network_stats\" \",interface=${iface}\" \"rx_bytes=${rx_bytes}i,tx_bytes=${tx_bytes}i,rx_packets=${rx_packets}i,tx_packets=${tx_packets}i,rx_errors=${rx_errors}i,tx_errors=${tx_errors}i\"\n fi\n done\n}\n\n# Collect Docker metrics\ncollect_docker_metrics() {\n if [ \"$ENABLE_DOCKER\" != \"True\" ] && [ \"$ENABLE_DOCKER\" != \"true\" ]; then\n return\n fi\n\n if ! command -v docker &> /dev/null; then\n return\n fi\n\n # Get running container count\n local container_count=$(docker ps -q 2>/dev/null | wc -l)\n send_metric \"docker_stats\" \"\" \"running_containers=${container_count}i\"\n\n # Get stats for each running container\n docker ps --format '{{.Names}}' 2>/dev/null | while read container; do\n local stats=$(docker stats --no-stream --format \"{{.CPUPerc}},{{.MemUsage}},{{.NetIO}},{{.BlockIO}}\" \"$container\" 2>/dev/null)\n\n if [ -n \"$stats\" ]; then\n local cpu=$(echo $stats | cut -d',' -f1 | sed 's/%//')\n local mem=$(echo $stats | cut -d',' -f2 | awk '{print $1}' | numfmt --from=iec)\n\n send_metric \"docker_container\" \",container=${container}\" \"cpu_percent=${cpu},memory_bytes=${mem}i\"\n fi\n done\n}\n\n# Send heartbeat\nsend_heartbeat() {\n local uptime_seconds=$(cat /proc/uptime | awk '{print int($1)}')\n send_metric \"agent_heartbeat\" \"\" \"status=1i,uptime=${uptime_seconds}i\"\n}\n\n# Signal handlers for graceful shutdown\nshutdown() {\n log \"Received shutdown signal, stopping agent...\"\n exit 0\n}\n\ntrap shutdown SIGTERM SIGINT\n\n# Main collection loop\nlog \"Starting Network Optimizer Linux agent\"\nlog \"Agent ID: $AGENT_ID\"\nlog \"Device: $DEVICE_NAME\"\nlog \"Collection interval: ${COLLECTION_INTERVAL}s\"\nlog \"Docker metrics: $ENABLE_DOCKER\"\n\n# Send initial heartbeat\nsend_heartbeat\n\nwhile true; do\n # Collect all metrics\n collect_cpu_metrics\n collect_memory_metrics\n collect_disk_metrics\n collect_network_metrics\n collect_docker_metrics\n send_heartbeat\n\n # Wait for next collection\n sleep $COLLECTION_INTERVAL\ndone\n"
},
{
"path": "src/NetworkOptimizer.Alerts/AlertCooldownTracker.cs",
"content": "using System.Collections.Concurrent;\n\nnamespace NetworkOptimizer.Alerts;\n\n/// \n/// In-memory cooldown tracker. Keyed by \"{ruleId}:{deviceId}\" to avoid DB round-trips.\n/// \npublic class AlertCooldownTracker\n{\n private readonly ConcurrentDictionary _lastFired = new();\n\n /// \n /// Check if the given key is currently in cooldown.\n /// \n public bool IsInCooldown(string key, int cooldownSeconds)\n {\n if (cooldownSeconds <= 0)\n return false;\n\n if (!_lastFired.TryGetValue(key, out var lastFired))\n return false;\n\n return (DateTime.UtcNow - lastFired).TotalSeconds < cooldownSeconds;\n }\n\n /// \n /// Record that an alert was fired for the given key.\n /// \n public void RecordFired(string key)\n {\n _lastFired[key] = DateTime.UtcNow;\n }\n\n /// \n /// Clear expired entries to prevent unbounded growth.\n /// \n public void Cleanup(TimeSpan maxAge)\n {\n var cutoff = DateTime.UtcNow - maxAge;\n foreach (var kvp in _lastFired)\n {\n if (kvp.Value < cutoff)\n _lastFired.TryRemove(kvp.Key, out _);\n }\n }\n}\n"
},
{
"path": "src/NetworkOptimizer.Alerts/AlertCorrelationService.cs",
"content": "using Microsoft.Extensions.Logging;\nusing NetworkOptimizer.Alerts.Events;\nusing NetworkOptimizer.Alerts.Interfaces;\nusing NetworkOptimizer.Alerts.Models;\nusing NetworkOptimizer.Core.Enums;\n\nnamespace NetworkOptimizer.Alerts;\n\n/// \n/// Groups related alerts into incidents using correlation keys.\n/// \npublic class AlertCorrelationService\n{\n private readonly ILogger _logger;\n private static readonly TimeSpan CorrelationWindow = TimeSpan.FromMinutes(30);\n\n public AlertCorrelationService(ILogger logger)\n {\n _logger = logger;\n }\n\n /// \n /// Derive incident status from the statuses of its constituent alerts.\n /// \n public static (AlertStatus Status, DateTime? ResolvedAt) DeriveIncidentStatus(List alerts)\n {\n if (alerts.Count == 0)\n return (AlertStatus.Active, null);\n\n if (alerts.All(a => a.Status == AlertStatus.Resolved))\n return (AlertStatus.Resolved, DateTime.UtcNow);\n\n if (alerts.All(a => a.Status is AlertStatus.Acknowledged or AlertStatus.Resolved))\n return (AlertStatus.Acknowledged, null);\n\n return (AlertStatus.Active, null);\n }\n\n /// \n /// Derive a correlation key from an alert event.\n /// Events with the same key within the correlation window will be grouped.\n /// \n public string? GetCorrelationKey(AlertEvent alertEvent)\n {\n // Device-level correlation: group by device IP\n if (!string.IsNullOrEmpty(alertEvent.DeviceIp))\n return $\"device:{alertEvent.DeviceIp}\";\n\n // Source-level correlation: group by event source + type prefix\n var dotIndex = alertEvent.EventType.IndexOf('.');\n if (dotIndex > 0)\n {\n var prefix = alertEvent.EventType[..dotIndex];\n return $\"source:{prefix}\";\n }\n\n return null;\n }\n\n /// \n /// Find or create an incident for the given alert event.\n /// Returns the incident if correlated, null if no correlation applies.\n /// \n public async Task CorrelateAsync(\n AlertEvent alertEvent,\n AlertHistoryEntry historyEntry,\n IAlertRepository repository,\n CancellationToken cancellationToken = default)\n {\n var correlationKey = GetCorrelationKey(alertEvent);\n if (correlationKey == null)\n return null;\n\n try\n {\n // Look for existing active incident with the same key within the window\n var existingIncident = await repository.GetActiveIncidentByKeyAsync(correlationKey, cancellationToken);\n\n if (existingIncident != null &&\n (DateTime.UtcNow - existingIncident.LastTriggeredAt) < CorrelationWindow)\n {\n // Add to existing incident\n existingIncident.AlertCount++;\n existingIncident.LastTriggeredAt = DateTime.UtcNow;\n if (alertEvent.Severity > existingIncident.Severity)\n existingIncident.Severity = alertEvent.Severity;\n\n await repository.UpdateIncidentAsync(existingIncident, cancellationToken);\n\n historyEntry.IncidentId = existingIncident.Id;\n _logger.LogDebug(\"Correlated alert to incident {IncidentId} ({Key})\", existingIncident.Id, correlationKey);\n return existingIncident;\n }\n\n // Create new incident\n var incident = new AlertIncident\n {\n Title = alertEvent.Title,\n Severity = alertEvent.Severity,\n AlertCount = 1,\n CorrelationKey = correlationKey,\n FirstTriggeredAt = DateTime.UtcNow,\n LastTriggeredAt = DateTime.UtcNow\n };\n\n await repository.SaveIncidentAsync(incident, cancellationToken);\n\n historyEntry.IncidentId = incident.Id;\n _logger.LogDebug(\"Created new incident {IncidentId} ({Key})\", incident.Id, correlationKey);\n return incident;\n }\n catch (Exception ex)\n {\n _logger.LogWarning(ex, \"Failed to correlate alert\");\n return null;\n }\n }\n}\n"
},
{
"path": "src/NetworkOptimizer.Alerts/AlertProcessingService.cs",
"content": "using System.Text.Json;\nusing Microsoft.Extensions.Configuration;\nusing Microsoft.Extensions.DependencyInjection;\nusing Microsoft.Extensions.Hosting;\nusing Microsoft.Extensions.Logging;\nusing NetworkOptimizer.Alerts.Delivery;\nusing NetworkOptimizer.Alerts.Events;\nusing NetworkOptimizer.Alerts.Interfaces;\nusing NetworkOptimizer.Alerts.Models;\nusing NetworkOptimizer.Core.Enums;\nusing NetworkOptimizer.Core.Helpers;\n\nnamespace NetworkOptimizer.Alerts;\n\n/// \n/// Background service that consumes alert events from the event bus,\n/// evaluates them against configured rules, persists history,\n/// correlates into incidents, and dispatches to delivery channels.\n/// \npublic class AlertProcessingService : BackgroundService\n{\n private readonly ILogger _logger;\n private readonly IAlertEventBus _eventBus;\n private readonly IServiceScopeFactory _scopeFactory;\n private readonly AlertRuleEvaluator _ruleEvaluator;\n private readonly AlertCorrelationService _correlationService;\n private readonly IEnumerable _deliveryChannels;\n private readonly AlertCooldownTracker _cooldownTracker;\n private readonly string? _appBaseUrl;\n\n // In-memory rule cache (refreshed periodically)\n private List _cachedRules = [];\n private DateTime _rulesCachedAt = DateTime.MinValue;\n private static readonly TimeSpan RuleCacheDuration = TimeSpan.FromSeconds(60);\n private DateTime _lastCooldownCleanup = DateTime.UtcNow;\n private static readonly TimeSpan CooldownCleanupInterval = TimeSpan.FromMinutes(30);\n\n public AlertProcessingService(\n ILogger logger,\n IAlertEventBus eventBus,\n IServiceScopeFactory scopeFactory,\n AlertRuleEvaluator ruleEvaluator,\n AlertCorrelationService correlationService,\n IEnumerable deliveryChannels,\n AlertCooldownTracker cooldownTracker,\n IConfiguration configuration)\n {\n _logger = logger;\n _eventBus = eventBus;\n _scopeFactory = scopeFactory;\n _ruleEvaluator = ruleEvaluator;\n _correlationService = correlationService;\n _deliveryChannels = deliveryChannels;\n _cooldownTracker = cooldownTracker;\n\n // Build base URL using same priority as canonical host redirect in Program.cs:\n // REVERSE_PROXIED_HOST_NAME (https) > HOST_NAME (http:8042) > HOST_IP (http:8042)\n var reverseProxy = configuration[\"REVERSE_PROXIED_HOST_NAME\"];\n var hostName = configuration[\"HOST_NAME\"];\n var hostIp = configuration[\"HOST_IP\"];\n\n if (!string.IsNullOrEmpty(reverseProxy))\n _appBaseUrl = $\"https://{reverseProxy}\";\n else if (!string.IsNullOrEmpty(hostName))\n _appBaseUrl = $\"http://{hostName}:8042\";\n else if (!string.IsNullOrEmpty(hostIp))\n _appBaseUrl = $\"http://{hostIp}:8042\";\n else\n {\n var detectedIp = NetworkUtilities.DetectLocalIpFromInterfaces();\n if (!string.IsNullOrEmpty(detectedIp))\n _appBaseUrl = $\"http://{detectedIp}:8042\";\n }\n }\n\n protected override async Task ExecuteAsync(CancellationToken stoppingToken)\n {\n _logger.LogInformation(\"Alert processing service started\");\n\n try\n {\n await foreach (var alertEvent in _eventBus.ConsumeAsync(stoppingToken))\n {\n try\n {\n await ProcessEventAsync(alertEvent, stoppingToken);\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to process alert event {EventType}\", alertEvent.EventType);\n }\n }\n }\n catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)\n {\n // Normal shutdown\n }\n\n _logger.LogInformation(\"Alert processing service stopped\");\n }\n\n private async Task ProcessEventAsync(AlertEvent alertEvent, CancellationToken cancellationToken)\n {\n using var scope = _scopeFactory.CreateScope();\n var repository = scope.ServiceProvider.GetRequiredService();\n\n // Refresh rule cache if stale\n await RefreshRuleCacheAsync(repository, cancellationToken);\n\n // Periodic cooldown cleanup to prevent unbounded growth\n if ((DateTime.UtcNow - _lastCooldownCleanup) > CooldownCleanupInterval)\n {\n CleanupCooldowns();\n _lastCooldownCleanup = DateTime.UtcNow;\n }\n\n // Evaluate event against rules\n var matchingRules = _ruleEvaluator.Evaluate(alertEvent, _cachedRules);\n if (matchingRules.Count == 0)\n {\n _logger.LogWarning(\"No matching rules for event {EventType}\", alertEvent.EventType);\n return;\n }\n\n foreach (var rule in matchingRules)\n {\n try\n {\n _ruleEvaluator.RecordFired(rule, alertEvent);\n await ProcessRuleMatchAsync(alertEvent, rule, repository, cancellationToken);\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to process rule {RuleId} for event {EventType}\", rule.Id, alertEvent.EventType);\n }\n }\n }\n\n private async Task ProcessRuleMatchAsync(\n AlertEvent alertEvent,\n AlertRule rule,\n IAlertRepository repository,\n CancellationToken cancellationToken)\n {\n // Create history entry\n var historyEntry = new AlertHistoryEntry\n {\n EventType = alertEvent.EventType,\n Severity = alertEvent.Severity,\n Source = alertEvent.Source,\n Title = alertEvent.Title,\n Message = alertEvent.Message,\n DeviceId = alertEvent.DeviceId,\n DeviceName = alertEvent.DeviceName,\n DeviceIp = alertEvent.DeviceIp,\n SourceUrl = ResolveSourceUrl(alertEvent.SourceUrl),\n RuleId = rule.Id,\n TriggeredAt = DateTime.UtcNow,\n ContextJson = alertEvent.Context.Count > 0\n ? JsonSerializer.Serialize(alertEvent.Context)\n : null\n };\n\n await repository.SaveAlertAsync(historyEntry, cancellationToken);\n\n // Correlate into incidents\n await _correlationService.CorrelateAsync(alertEvent, historyEntry, repository, cancellationToken);\n\n // Persist incident correlation even for digest-only rules\n if (historyEntry.IncidentId.HasValue)\n {\n await repository.UpdateAlertAsync(historyEntry, cancellationToken);\n }\n\n // Skip delivery for digest-only rules\n if (rule.DigestOnly)\n {\n _logger.LogDebug(\"Rule {RuleId} is digest-only, skipping immediate delivery\", rule.Id);\n return;\n }\n\n // Deliver to matching channels (use resolved absolute URL for delivery)\n var deliveryEvent = alertEvent with { SourceUrl = historyEntry.SourceUrl };\n await DeliverAsync(deliveryEvent, historyEntry, repository, cancellationToken);\n }\n\n private async Task DeliverAsync(\n AlertEvent alertEvent,\n AlertHistoryEntry historyEntry,\n IAlertRepository repository,\n CancellationToken cancellationToken)\n {\n var channels = await repository.GetEnabledChannelsAsync(cancellationToken);\n var deliveredTo = new List();\n var errors = new List();\n\n foreach (var channel in channels)\n {\n // Skip channels with higher minimum severity than this alert\n if (alertEvent.Severity < channel.MinSeverity)\n continue;\n\n // Channels with digest enabled still get immediate alerts too\n // (digest is an additional summary, not a replacement for immediate delivery)\n\n var handler = _deliveryChannels.FirstOrDefault(d => d.ChannelType == channel.ChannelType);\n if (handler == null)\n {\n _logger.LogWarning(\"No delivery handler for channel type {Type}\", channel.ChannelType);\n continue;\n }\n\n try\n {\n var success = await handler.SendAsync(alertEvent, historyEntry, channel, cancellationToken);\n if (success)\n {\n deliveredTo.Add(channel.Id);\n }\n else\n {\n errors.Add($\"Channel {channel.Id} ({channel.Name}): delivery returned false\");\n }\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to deliver alert to channel {ChannelId} ({ChannelName})\",\n channel.Id, channel.Name);\n errors.Add($\"Channel {channel.Id} ({channel.Name}): {ex.Message}\");\n }\n }\n\n // Update history entry with delivery results\n historyEntry.DeliveredToChannels = deliveredTo.Count > 0\n ? string.Join(\",\", deliveredTo)\n : null;\n historyEntry.DeliverySucceeded = deliveredTo.Count > 0 && errors.Count == 0;\n historyEntry.DeliveryError = errors.Count > 0\n ? string.Join(\"; \", errors)\n : null;\n\n await repository.UpdateAlertAsync(historyEntry, cancellationToken);\n }\n\n private async Task RefreshRuleCacheAsync(IAlertRepository repository, CancellationToken cancellationToken)\n {\n if ((DateTime.UtcNow - _rulesCachedAt) < RuleCacheDuration)\n return;\n\n try\n {\n _cachedRules = await repository.GetEnabledRulesAsync(cancellationToken);\n _rulesCachedAt = DateTime.UtcNow;\n _logger.LogDebug(\"Refreshed alert rule cache ({Count} enabled rules)\", _cachedRules.Count);\n }\n catch (Exception ex)\n {\n _logger.LogError(ex, \"Failed to refresh alert rule cache\");\n // Keep using stale cache rather than failing\n }\n }\n\n /// \n /// Resolves a relative SourceUrl (e.g., \"/audit\") to an absolute URL using the app's\n /// configured hostname. Falls back to the relative path if no hostname is configured.\n /// \n private string? ResolveSourceUrl(string? relativeUrl)\n {\n if (string.IsNullOrEmpty(relativeUrl))\n return null;\n\n if (_appBaseUrl != null)\n return $\"{_appBaseUrl}{relativeUrl}\";\n\n return relativeUrl;\n }\n\n private void CleanupCooldowns()\n {\n _cooldownTracker.Cleanup(TimeSpan.FromHours(2));\n }\n}\n"
},
{
"path": "src/NetworkOptimizer.Alerts/AlertRuleEvaluator.cs",
"content": "using Microsoft.Extensions.Logging;\nusing NetworkOptimizer.Alerts.Events;\nusing NetworkOptimizer.Alerts.Models;\n\nnamespace NetworkOptimizer.Alerts;\n\n/// \n/// Evaluates alert events against configured rules to determine which rules match.\n/// \npublic class AlertRuleEvaluator\n{\n private readonly AlertCooldownTracker _cooldownTracker;\n private readonly ILogger _logger;\n\n public AlertRuleEvaluator(AlertCooldownTracker cooldownTracker, ILogger logger)\n {\n _cooldownTracker = cooldownTracker;\n _logger = logger;\n }\n\n /// \n /// Find all rules that match the given event and are not in cooldown.\n /// \n public List Evaluate(AlertEvent alertEvent, IReadOnlyList rules)\n {\n var matches = new List();\n\n foreach (var rule in rules)\n {\n if (!rule.IsEnabled)\n continue;\n\n if (alertEvent.Severity < rule.MinSeverity)\n continue;\n\n if (!MatchesEventType(alertEvent.EventType, rule.EventTypePattern))\n continue;\n\n if (!string.IsNullOrEmpty(rule.Source) &&\n !string.Equals(rule.Source, alertEvent.Source, StringComparison.OrdinalIgnoreCase))\n continue;\n\n if (!MatchesTargetDevice(alertEvent.DeviceId, alertEvent.DeviceIp, rule.TargetDevices))\n continue;\n\n if (!MeetsThreshold(alertEvent, rule))\n {\n _logger.LogDebug(\"Rule '{RuleName}' matched event {EventType} but below threshold ({ThresholdPercent}%)\",\n rule.Name, alertEvent.EventType, rule.ThresholdPercent);\n continue;\n }\n\n var cooldownKey = $\"{rule.Id}:{alertEvent.DeviceId ?? alertEvent.DeviceIp ?? \"global\"}\";\n if (_cooldownTracker.IsInCooldown(cooldownKey, rule.CooldownSeconds))\n {\n _logger.LogDebug(\"Rule '{RuleName}' matched event {EventType} but in cooldown\",\n rule.Name, alertEvent.EventType);\n continue;\n }\n\n matches.Add(rule);\n }\n\n return matches;\n }\n\n /// \n /// Record that a rule was fired (for cooldown tracking).\n /// \n public void RecordFired(AlertRule rule, AlertEvent alertEvent)\n {\n var cooldownKey = $\"{rule.Id}:{alertEvent.DeviceId ?? alertEvent.DeviceIp ?? \"global\"}\";\n _cooldownTracker.RecordFired(cooldownKey);\n }\n\n /// \n /// Match event type against pattern. Supports exact match and trailing wildcard (e.g., \"audit.*\").\n /// \n internal static bool MatchesEventType(string eventType, string pattern)\n {\n if (string.IsNullOrEmpty(pattern) || pattern == \"*\")\n return true;\n\n if (pattern.EndsWith(\".*\"))\n {\n var prefix = pattern[..^2];\n return eventType.StartsWith(prefix, StringComparison.OrdinalIgnoreCase) &&\n eventType.Length > prefix.Length && eventType[prefix.Length] == '.';\n }\n\n return string.Equals(eventType, pattern, StringComparison.OrdinalIgnoreCase);\n }\n\n /// \n /// Check if the event meets the rule's degradation threshold.\n /// If the rule has a ThresholdPercent, the event must have a \"drop_percent\" context value >= threshold.\n /// \n private static bool MeetsThreshold(AlertEvent alertEvent, AlertRule rule)\n {\n if (rule.ThresholdPercent == null)\n return true;\n\n if (alertEvent.Context.TryGetValue(\"drop_percent\", out var dropStr) ||\n alertEvent.Context.TryGetValue(\"drop\", out dropStr))\n {\n if (double.TryParse(dropStr, out var dropValue))\n return dropValue >= rule.ThresholdPercent.Value;\n }\n\n // No drop context = not a threshold event, let it through\n return true;\n }\n\n /// \n /// Check if event matches the rule's target device filter.\n /// \n private static bool MatchesTargetDevice(string? deviceId, string? deviceIp, string? targetDevices)\n {\n if (string.IsNullOrEmpty(targetDevices))\n return true;\n\n var targets = targetDevices.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);\n if (targets.Length == 0)\n return true;\n\n if (!string.IsNullOrEmpty(deviceId) && targets.Contains(deviceId, StringComparer.OrdinalIgnoreCase))\n return true;\n\n if (!string.IsNullOrEmpty(deviceIp) && targets.Contains(deviceIp, StringComparer.OrdinalIgnoreCase))\n return true;\n\n return false;\n }\n}\n"
},
{
"path": "src/NetworkOptimizer.Alerts/DefaultAlertRules.cs",
"content": "using NetworkOptimizer.Alerts.Models;\nusing NetworkOptimizer.Core.Enums;\n\nnamespace NetworkOptimizer.Alerts;\n\n/// \n/// Default alert rules seeded when the AlertRules table is empty on startup.\n/// Rule names use \"Nav Title: Description\" format to match the app's menu structure.\n/// Rules that need infrastructure configured (speed tests, etc.) are disabled by default\n/// as helpful starting points for users to enable after setup.\n/// \npublic static class DefaultAlertRules\n{\n public static List GetDefaults() =>\n [\n // --- Security Audit rules (enabled - only needs UniFi connection) ---\n new AlertRule\n {\n Name = \"Security Audit: Score Drop\",\n IsEnabled = true,\n EventTypePattern = \"audit.score_dropped\",\n Source = \"audit\",\n MinSeverity = AlertSeverity.Warning,\n ThresholdPercent = 15,\n CooldownSeconds = 3600 // 1 hour\n },\n new AlertRule\n {\n Name = \"Security Audit: Completed\",\n IsEnabled = false,\n EventTypePattern = \"audit.completed\",\n Source = \"audit\",\n MinSeverity = AlertSeverity.Info,\n CooldownSeconds = 3600 // 1 hour\n },\n new AlertRule\n {\n Name = \"Security Audit: Critical Finding\",\n IsEnabled = true,\n EventTypePattern = \"audit.critical_findings\",\n Source = \"audit\",\n MinSeverity = AlertSeverity.Critical,\n CooldownSeconds = 0\n },\n\n // --- Device monitoring (disabled - can be noisy until user configures which devices matter) ---\n new AlertRule\n {\n Name = \"Device Offline\",\n IsEnabled = false,\n EventTypePattern = \"device.offline\",\n Source = \"device\",\n MinSeverity = AlertSeverity.Error,\n CooldownSeconds = 300 // 5 minutes\n },\n\n // --- Wi-Fi Optimizer (enabled, digest only - works automatically) ---\n new AlertRule\n {\n Name = \"Wi-Fi Optimizer: Channel Congestion\",\n IsEnabled = true,\n EventTypePattern = \"wifi.congestion\",\n Source = \"wifi\",\n MinSeverity = AlertSeverity.Warning,\n CooldownSeconds = 3600, // 1 hour\n DigestOnly = true // High frequency, low urgency\n },\n\n // --- Threat Intelligence (enabled - works with IPS data) ---\n new AlertRule\n {\n Name = \"Threat Intelligence: Critical Event\",\n IsEnabled = true,\n EventTypePattern = \"threats.ips_event\",\n Source = \"threats\",\n MinSeverity = AlertSeverity.Critical,\n CooldownSeconds = 60 // 1 minute\n },\n\n // --- Threat Intelligence: Attack Chain (enabled - multi-stage attacks are high signal) ---\n new AlertRule\n {\n Name = \"Threat Intelligence: Attack Chain\",\n IsEnabled = true,\n EventTypePattern = \"threats.attack_chain\",\n Source = \"threats\",\n MinSeverity = AlertSeverity.Warning,\n CooldownSeconds = 3600 // 1 hour\n },\n new AlertRule\n {\n Name = \"Threat Intelligence: Early-Stage Attack Chain\",\n IsEnabled = false,\n EventTypePattern = \"threats.attack_chain_attempt\",\n Source = \"threats\",\n MinSeverity = AlertSeverity.Info,\n CooldownSeconds = 3600 // 1 hour\n },\n new AlertRule\n {\n Name = \"Threat Intelligence: Attack Pattern\",\n IsEnabled = false,\n EventTypePattern = \"threats.attack_pattern\",\n Source = \"threats\",\n MinSeverity = AlertSeverity.Warning,\n CooldownSeconds = 3600 // 1 hour\n },\n\n // --- WAN Speed Test (disabled - needs gateway SSH configured) ---\n new AlertRule\n {\n Name = \"WAN Speed Test: Degradation\",\n IsEnabled = false,\n EventTypePattern = \"wan.speed_degradation\",\n Source = \"wan\",\n MinSeverity = AlertSeverity.Warning,\n ThresholdPercent = 40,\n CooldownSeconds = 1800 // 30 minutes\n },\n\n // --- LAN Speed Test (disabled - needs device SSH configured) ---\n new AlertRule\n {\n Name = \"LAN Speed Test: Regression\",\n IsEnabled = false,\n EventTypePattern = \"speedtest.regression\",\n Source = \"speedtest\",\n MinSeverity = AlertSeverity.Warning,\n ThresholdPercent = 25,\n CooldownSeconds = 3600 // 1 hour\n },\n\n // --- Schedule (enabled - monitors scheduled task failures) ---\n new AlertRule\n {\n Name = \"Scheduled Task Failed\",\n IsEnabled = true,\n EventTypePattern = \"schedule.task_failed\",\n Source = \"schedule\",\n MinSeverity = AlertSeverity.Error,\n CooldownSeconds = 3600 // 1 hour\n },\n\n // --- WAN Data Usage (disabled - needs data usage tracking configured) ---\n new AlertRule\n {\n Name = \"WAN Data Usage: Warning\",\n IsEnabled = false,\n EventTypePattern = \"wan.data_usage_warning\",\n Source = \"wan\",\n MinSeverity = AlertSeverity.Warning,\n CooldownSeconds = 86400 // 24 hours\n },\n new AlertRule\n {\n Name = \"WAN Data Usage: Cap Exceeded\",\n IsEnabled = false,\n EventTypePattern = \"wan.data_usage_exceeded\",\n Source = \"wan\",\n MinSeverity = AlertSeverity.Error,\n CooldownSeconds = 86400 // 24 hours\n }\n ];\n}\n"
},
{
"path": "src/NetworkOptimizer.Alerts/Delivery/DiscordChannelConfig.cs",
"content": "namespace NetworkOptimizer.Alerts.Delivery;\n\npublic class DiscordChannelConfig\n{\n public string WebhookUrl { get; set; } = string.Empty;\n}\n"
},
{
"path": "src/NetworkOptimizer.Alerts/Delivery/DiscordDeliveryChannel.cs",
"content": "using System.Text;\nusing System.Text.Json;\nusing Microsoft.Extensions.Logging;\nusing NetworkOptimizer.Alerts.Events;\nusing NetworkOptimizer.Alerts.Models;\nusing NetworkOptimizer.Core.Enums;\n\nnamespace NetworkOptimizer.Alerts.Delivery;\n\n/// \n/// Discord delivery via webhook with embed formatting and severity colors.\n/// \npublic class DiscordDeliveryChannel : IAlertDeliveryChannel\n{\n private readonly ILogger _logger;\n private readonly HttpClient _httpClient;\n\n public DeliveryChannelType ChannelType => DeliveryChannelType.Discord;\n\n public DiscordDeliveryChannel(ILogger logger, HttpClient httpClient)\n {\n _logger = logger;\n _httpClient = httpClient;\n }\n\n public async Task SendAsync(AlertEvent alertEvent, AlertHistoryEntry historyEntry, DeliveryChannel channel, CancellationToken cancellationToken = default)\n {\n var config = JsonSerializer.Deserialize(channel.ConfigJson);\n if (config == null || string.IsNullOrEmpty(config.WebhookUrl)) return false;\n\n var fields = new List![\"Network](\"docs/images/app-logo-v2.png\"){kind=logo}
\n