npub12m5exm2uk3xa674cc5r0hlyvccs5xxn7qv83ezuteefv5972nquq4j4szl/esp32-tollgate/main/captive_portal.c, branch feature/cvm-integration[no description]https://upleb.uk/npub12m5exm2uk3xa674cc5r0hlyvccs5xxn7qv83ezuteefv5972nquq4j4szl/esp32-tollgate/atom?h=feature%2Fcvm-integration2026-05-17T09:19:16+00:00Bug fixes: reset_auth clears sessions, port 80 /usage shows real data, metric defaults to milliseconds, fix sys_evt stack overflow2026-05-17T09:19:16+00:00Your Nameyou@example.com2026-05-17T09:19:16+00:00urn:sha1:3342c8e7b4f645c75470d3d893d09037a672cfd2Fix captive portal detection on GrapheneOS + embed mint URL in portal HTML2026-05-16T07:32:23+00:00Your Nameyou@example.com2026-05-16T07:32:23+00:00urn:sha1:236b61d619f60d941119d891dc1c6a49b504a880
- Add esp_netif_set_dns_info() on AP interface so DHCP advertises
AP as DNS server to clients (fixes captive portal on GrapheneOS)
- Embed price and mint URL directly in portal HTML via server-side
template substitution (no JavaScript fetch to :2121 needed)
- Move supported mints section below the token input field
- Add Playwright tests: no unresolved placeholders, embedded mint/price,
DOM order verification (14/14 passing)
Unique SSID/IP per board + captive detection fix + mint list in portal2026-05-16T06:26:43+00:00Your Nameyou@example.com2026-05-16T06:26:43+00:00urn:sha1:38aa9ec3801f5895e09866fe92cb8e44fb987cee
- Derive unique SSID (TollGate-{MAC4}{MAC5}) and AP IP (10.{b5}.{subnet}.1)
from factory MAC — boards no longer conflict
- Board A: TollGate-377C @ 10.55.85.1, Board B: TollGate-5050 @ 10.80.10.1
- Captive portal detection URIs return 200 with portal HTML (matching
esp32-mesh working approach) instead of 302 redirect
- Dynamic AP IP in portal HTML via __AP_IP__ template substitution
- Supported mints section in portal page (shows mint URL, tap to copy)
- Fixed mint URL to testnut.cashu.space (was stale in SPIFFS)
- DoT reject server on port 853 for DNS-over-TLS fallback
- DNS hijack: NXDOMAIN for all non-A queries, no forwarding for unauthed
- Playwright tests updated for 200 response on detection URIs
- Phase 2 test suite: 20/21 pass (test 22 expiry ping route issue)
- Tests 25-27 deferred to Phase 3 (Board B as second client)
Captive portal detection fix + Phase 2 tests 16-18,20 passing (17/17)2026-05-15T23:16:32+00:00Your Nameyou@example.com2026-05-15T23:16:32+00:00urn:sha1:50b5975ac8793d6d820c35b5999f8a909f64e71b
- Add DoT reject server on port 853 (TCP RST forces DNS-over-TLS fallback)
- DNS hijack returns NXDOMAIN for all non-A query types (no forwarding for unauthed)
- Shorter TTL on hijack responses (10s) for faster captive detection
- Explicit 302 redirect handlers for /generate_204, /hotspot-detect.html, etc.
- HTTP and DNS request logging for debugging captive detection
- Per-MAC tracking in firewall (find_by_mac, get_mac_for_ip with ARP fallback)
- Session MAC tracking (session_find_by_mac)
- Phase 2 test 18: add route through TollGate before ping test
- All 17 Phase 2 tests pass (15-21 + whoami + portal form)
Phase 2 WIP: Cashu payment endpoints, session tracking, updated checklist2026-05-15T16:57:14+00:00Your Nameyou@example.com2026-05-15T16:57:14+00:00urn:sha1:1263d86314fc0760d9be8eea415ccecbc047a5eb
- Add cashu.c/h: Cashu token decode (cashuA/base64url), proof state check via mint API, allotment calculator
- Add session.c/h: time-based session management with allotment/expiry, spent secret tracking
- Add tollgate_api.c/h: HTTP server on :2121 with GET / (kind=10021 discovery), POST / (payment processing), /usage, /whoami
- Update captive portal HTML: replace Grant Free Access with Cashu token paste form + Pay & Connect button
- Update tollgate_main.c: wire in session manager, TollGate API, 1s session tick loop
- Add tests/phase2.mjs: Phase 2 test suite (discovery, invalid token, wrong mint, valid payment)
- Update CHECKLIST.md: reflect Phase 1 complete, Phase 2 in progress with known bugs
Known issues (not yet flashed):
- Stack overflow crash in httpd POST handler (need stack_size=16384 + heap allocations)
- cashu_decode_token uses 2KB stack buffer (needs heap alloc)
- Mint URL should be testnut.cashu.space (nofee.testnut has API compat issues)
Phase 1 working: captive portal, DNS hijack, NAT-based access control2026-05-15T11:33:40+00:00Your Nameyou@example.com2026-05-15T11:33:40+00:00urn:sha1:a7d0a672d59bf8985a6fc0e61b49015fabd96513
- Fix WiFi init order: netif creation before esp_wifi_init, set mode before set_config
- Replace broken netif input filter with NAPT on/off per authentication state
- NAPT disabled by default, enabled when client granted, disabled on revoke
- Fix test helpers: use -I wlp59s0 for ping, handle nslookup exit code 1
- All 20 API tests pass, all 6 smoke tests pass