Bump main agent-install preview pin to v2.0.0-beta.5

Author: tvancott42

docker/agent/docker-compose.yml

@@ -15,7 +15,7 @@ services:
     # 2.0 preview tag so the beta agent one-liner (fetched from `main`) works
     # before GA. FIX before release/2.0-multi-site -> main: restore :latest /
     # real version handling. BUMP this tag on every new beta.
-    image: ghcr.io/ozark-connect/agent:2.0.0-beta.4
+    image: ghcr.io/ozark-connect/agent:2.0.0-beta.5
     container_name: network-optimizer-agent
     restart: unless-stopped
     network_mode: host

docker/agent/nginx.conf

@@ -2,11 +2,23 @@
 # (/downloading via sendfile, /upload) run here so the agent saturates 10 GbE on
 # modest hardware; result posts + the results link proxy to the agent's loopback
 # relay (127.0.0.1:3001), which forwards them to the central server with the site
-# slug and the real client IP. Same-origin, so no CORS is needed.
+# slug and the real client IP. LAN tests are same-origin; the /wan/ flow's
+# post-back from the external test page is cross-origin, so the relay answers
+# with CORS headers.
 server {
     server_name _;
-    listen 3000 reuseport;
-    listen [::]:3000 reuseport;
+    listen 3000 ssl reuseport;
+    listen [::]:3000 ssl reuseport;
+    # Self-signed TLS by default so the OpenSpeedTest page is a secure context - the
+    # browser Geolocation API (GPS-tagged results) requires https, and it works over
+    # the agent's LAN IP without a per-site reverse proxy. The cert is generated once
+    # and persisted (entrypoint.sh for Docker, install-native.sh for bare-metal) with
+    # the LAN IP + hostname as SANs, so a client's browser trust exception survives
+    # restarts. Cert paths are filled in at build/install time (like __PIDFILE__).
+    ssl_certificate __CERTFILE__;
+    ssl_certificate_key __KEYFILE__;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_session_cache shared:ost:2m;
 
     root /usr/share/nginx/html;
     index index.html;
@@ -39,20 +51,43 @@ server {
         proxy_set_header Host $host;
     }
 
+    # Who-am-I for the central Client Performance page: a browser on this site's LAN
+    # learns its own address here (the central server only ever sees the site's WAN
+    # IP). Open CORS is deliberate - the response is the caller's own address, nothing
+    # else, and the page fetching it runs on the central server's origin.
+    location = /netopt/whoami {
+        default_type application/json;
+        add_header Access-Control-Allow-Origin "*" always;
+        return 200 '{"ip":"$remote_addr"}';
+    }
+
+    # WAN speed test router: the agent serves /wan/ (default server) or
+    # /wan/<server-ID>/ as an interstitial that navigates to the mapped external
+    # WAN test server, making this agent the page's referrer so results post
+    # back to this origin with the real client LAN IP.
+    location /wan/ {
+        proxy_pass http://127.0.0.1:3001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+    }
+
+    location = /wan {
+        return 302 /wan/$is_args$args;
+    }
+
     # Upload endpoint - reads the entire POST body before responding (the
     # error_page 405 hack alone would respond before the body is received).
     location = /upload {
         add_header Cache-Control 'no-store, no-cache, max-age=0, no-transform';
         client_body_buffer_size 35m;
         client_max_body_size 50m;
-        proxy_pass http://127.0.0.1:3000/upload-sink;
+        # The public :3000 listener is now TLS; the sink that consumes the upload
+        # body lives on a plaintext loopback listener (server block below) so the
+        # self-proxy stays cheap HTTP rather than looping back through TLS.
+        proxy_pass http://127.0.0.1:3002/upload-sink;
         proxy_set_header Host $host;
     }
 
-    location = /upload-sink {
-        return 200;
-    }
-
     location / {
         add_header Cache-Control 'no-store, no-cache, max-age=0, no-transform';
         add_header Last-Modified $date_gmt;
@@ -76,3 +111,15 @@ server {
         gzip_types text/plain text/css application/json application/javascript text/xml application/xml image/svg+xml;
     }
 }
+
+# Plaintext loopback sink for the upload leg. The /upload location proxies the POST
+# body here purely to read it (measuring upload throughput) then returns 200 - it must
+# be plaintext HTTP since the public :3000 listener is now TLS. Loopback-only, so it is
+# never reachable from the network. client_max_body_size 0 lifts the body cap for the
+# discard (the client-facing /upload keeps its own 50m cap).
+server {
+    listen 127.0.0.1:3002;
+    client_max_body_size 0;
+    access_log off;
+    location = /upload-sink { return 200; }
+}

scripts/agent/install-docker.sh

@@ -21,9 +21,9 @@
 # ##  ⚠️  TEMPORARY HACK — main ONLY. DO NOT SHIP TO STABLE 2.0 GA.  ⚠️      ##
 # ############################################################################
 # This script + docker/agent/docker-compose.yml live on `main` purely so the
-# 2.0.0-beta.4 agent-install one-liner (baked into the beta app image, fetched
+# 2.0.0-beta.5 agent-install one-liner (baked into the beta app image, fetched
 # from `main`) works BEFORE 2.0 GA without rebuilding the app. The compose it
-# pulls HARDCODES the preview image tag (agent:2.0.0-beta.4).
+# pulls HARDCODES the preview image tag (agent:2.0.0-beta.5).
 #
 #   >>> FIX BEFORE MERGING release/2.0-multi-site -> main <<<
 #   Restore :latest / real version handling in docker-compose.yml, and detect

scripts/agent/install-native.sh

@@ -39,7 +39,7 @@ SERVICE_NAME="netopt-agent"
 #   version or accept --version; default to /releases/latest for stable).
 #   Until then, BUMP this tag on every new beta (beta.2, beta.3, ...).
 # ############################################################################
-RELEASE_BASE="https://github.com/Ozark-Connect/NetworkOptimizer/releases/download/v2.0.0-beta.4"
+RELEASE_BASE="https://github.com/Ozark-Connect/NetworkOptimizer/releases/download/v2.0.0-beta.5"
 
 while [ $# -gt 0 ]; do
     case "$1" in