[EmDecay]

What changed

Fixes from a repository-wide security review. Each item is its own commit so it can be dropped independently.

High

• packet/winlink: the Pat .deb was downloaded to a predictable /tmp path and installed as root with no verification. get_url skips an existing destination, so any local account could pre-create the file and have it installed as root. The package now goes into the root-owned HamStack package cache and is verified against per-architecture SHA-256 digests (hamstack_winlink_package_checksums, enforced by hamstack_winlink_require_checksum).
• services/cloudlog: application/config (where the installer writes database.php) was recursively forced to o=rX on every run. It is now u=rwX,g=rwX,o= root:www-data.
• digital/multimon-ng: the managed decoder service ran as root while parsing over-the-air data. It now runs as a dedicated hamstack-multimon system account (audio/plugdev) under a sandboxed systemd unit; the log file is owned by that account.
• digital/selfie_station: the service defaulted to the hamstack automation account (passwordless sudo, SSH trust) with keyboard-capture and PTT groups and ownership of its own code. It now runs as a dedicated hamstack-selfie nologin account, the install tree and script are root-owned, writes are limited to the data directory, and the unit is sandboxed. Numeric inventory values are cast before being rendered into Python source.

Medium

• Download verification: JS8Call AppImages ship with upstream digests (required by default); GridTracker2, Graywolf, CHIRP wheel, NetLogger, and LinBPQ accept sha256: checksums; all download URLs must be HTTPS. GridTracker2 now caches by upstream filename so a version bump is not satisfied by a stale cached file. id -gn arguments are quoted in js8call/chirp/kiosk.
• network/openwrt: Wi-Fi, radio, route, and firewall-zone identifiers (and forward_to targets) are validated as UCI-safe before being rendered into the root shell script applied via raw. Only LAN names were checked before.
• network/routeros: hamstack_routeros_api_validate_certs defaults to true. playbooks/network.yml sets become: false so controller-side API tasks no longer run under sudo.
• infrastructure/technitium-dns: admin password floor raised from 8 to 12 characters.
• voice/allstar / voice/wpsd: credential-bearing files no longer leave Ansible *~ backup copies by default (rpt_http_registrations.conf; new hamstack_wpsd_config_backups: false). The WPSD pass-through loops now use no_log.
• digital/ft8web: the role referenced nginx-default.conf.j2, which did not exist, so the role could not deploy. Added a minimal template, and scripts/qa.py now fails when a role task references a template/file the role does not ship.

CI (last two commits, separable)

• The "Repository QA" workflow has been red since the initial commit: yamllint failed on a list-indentation error in roles/common/defaults/main.yml, so the ansible-lint and syntax-check steps never ran. Fixed the indentation, added explicit become: true to the seven tasks that set become_user (flagged by partial-become), and moved var-naming[no-role-prefix] and yaml[line-length] to the .ansible-lint warn list. The hamstack_* namespace is intentional per AGENTS.md, and .yamllint already treats line length as a warning. Drop the last commit if you would rather handle the lint policy separately.

Docs: role READMEs, docs/configuration.md, docs/network-devices.md, CHANGELOG.md, regenerated docs/variables.md.

Why

Review findings: local privilege escalation via an attacker-plantable package, database credentials readable by every local account, RF-facing and camera/PTT services running with root or sudo-capable identities, unverified root-installed binaries, command injection through unvalidated router inventory fields, API credentials sent without TLS verification, and secret copies left behind by Ansible backups.

Intentionally not changed in this PR (deferred by maintainer decision): default published ports and bind addresses, pinning of upstream source refs (cloudlog master, qsstv main, dcdash main), container image tags, and pysstv version pinning.

Validation

• python3 scripts/qa.py
• yamllint . (0 errors; remaining line-length warnings are pre-existing)
• ansible-lint (0 failures on the basic profile with the updated config)
• All six playbooks pass ansible-playbook --syntax-check against inventory/example
• A second Ansible run was checked for unexpected changes when live hardware/software was exercised

Tested hardware/OS and commands used: no hardware or live host was exercised. Validation was repository QA, lint, syntax check, and offline rendering of the changed templates (the rendered selfie_station.py compiles). The multimon-ng and Selfie Station service-account changes in particular need a real Pi/SDR/camera run to confirm device access under the new accounts and ProtectSystem=strict.

Checksums: the Pat 1.0.0 and JS8Call 3.0.3 digests were computed from the GitHub release assets as downloaded on 2026-10-12 through this session's proxy. Please independently verify them against the upstream release pages before merging.

Release/user impact

• hamstack_selfie_station_user default changes from hamstack to hamstack-selfie; existing data directories are re-owned on the next run and old files remain readable. Set hamstack_selfie_station_manage_user: false to keep an operator-managed account.
• hamstack_routeros_api_validate_certs now defaults to true; routers with self-signed API-SSL certificates need the CA trusted on the controller or an explicit false.
• Technitium admin passwords shorter than 12 characters now fail validation.
• JS8Call and Pat installs fail if the configured version has no matching digest unless *_require_checksum: false is set.
• Non-HTTPS download URLs are rejected for GridTracker, Graywolf, LinBPQ, NetLogger, CHIRP, JS8Call.
• WPSD no longer writes Ansible backups of its config files unless hamstack_wpsd_config_backups: true.
• New variables: hamstack_winlink_package_checksums, hamstack_winlink_require_checksum, hamstack_winlink_package_cache_dir, hamstack_multimon_ng_{user,group,manage_user,user_groups}, hamstack_selfie_station_{group,manage_user,user_groups}, hamstack_gridtracker_package_checksum, hamstack_js8call_{x86_64,aarch64}_checksum, hamstack_js8call_require_checksum, hamstack_chirp_wheel_checksum, hamstack_graywolf_package_checksum, hamstack_netlogger_package_checksum, hamstack_wpsd_config_backups.

Documentation and secrets

• Public variable changes are reflected in examples/docs and docs/variables.md is regenerated
• No real credentials, private inventory, event-only secrets, or sensitive artifacts are included
• Upstream-derived code/configuration retains required attribution and licensing information

🤖 Generated with Claude Code

https://claude.ai/code/session_01LUNnYzucjok597pz3cUK2K

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.