Nurse update

.gitignore

@@ -29,4 +29,5 @@ serviceRegistry.db
 *.pem
 **/files/
 *.pdf
+*.xlsx
 

README.md

@@ -1,6 +1,7 @@
-# mbaigo systems
+# mbaigo systems as building blocks
 
 The Arrowhead Framework is used to compose a *system of systems* for a specific purpose.
+At the same time, a system of systems is a system itself, with emerging behaviors. (Synecdoque is a figure of speech in which a part is made to represent the whole or vice versa.)
 
 It is similar to building with LEGO: the same set of building blocks can be assembled into different solutions (e.g., a plane or a car), and the final assembly represents a distinct functional concept. For example, to build a climate control solution, you would select and integrate systems such as a temperature sensor system, a valve (actuator) system, and a thermostat/control system.
 

beehive/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/beehive
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

beehive/thing.go

@@ -189,7 +189,8 @@ func (t *Traits) backgroundPoll() {
 
 // fetchOnOffState retrieves the current boolean value from one on_off service URL.
 func fetchOnOffState(url string) (state bool, online bool) {
-	client := &http.Client{Timeout: 3 * time.Second}
+	// Preserve framework-installed TLS so this works against HTTPS-only peers.
+	client := &http.Client{Timeout: 3 * time.Second, Transport: http.DefaultClient.Transport}
 	resp, err := client.Get(url)
 	if err != nil {
 		return false, false
@@ -290,7 +291,8 @@ func toggleHandler(t *Traits, w http.ResponseWriter, r *http.Request, ctx contex
 	}
 	req.Header.Set("Content-Type", "application/json")
 
-	client := &http.Client{Timeout: 5 * time.Second}
+	// Preserve framework-installed TLS so this works against HTTPS-only peers.
+	client := &http.Client{Timeout: 5 * time.Second, Transport: http.DefaultClient.Transport}
 	resp, err := client.Do(req)
 	if err != nil {
 		http.Error(w, "upstream error: "+err.Error(), http.StatusBadGateway)

beekeeper/beekeeper.go

@@ -169,7 +169,10 @@ func setLightState(cfg DeconzConfig, lightID string, on bool) error {
 		return err
 	}
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
+	// Preserve the framework's TLS transport while imposing a timeout —
+	// http.DefaultClient itself has no timeout. Without Transport set the
+	// fresh client would lose mTLS configuration installed by enrolment.
+	resp, err := (&http.Client{Timeout: 5 * time.Second, Transport: http.DefaultClient.Transport}).Do(req)
 	if err != nil {
 		return err
 	}

beekeeper/go.mod

@@ -1,6 +1,6 @@
 module github.com/sdoque/systems/beekeeper
 
-go 1.26.2
+go 1.26.3
 
 require (
 	github.com/gorilla/websocket v1.5.3

busdriver/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/busdriver
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

ca/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/ca
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

ca/thing.go

@@ -325,12 +325,18 @@ func generateSelfSignedCert(sys *components.System) ([]byte, []byte, error) {
 			Organization: []string{"Synecdoque"},
 			CommonName:   "synecdoque.com",
 		},
-		DNSNames:              dnsNames,
-		IPAddresses:           ipAddrs,
-		NotBefore:             notBefore,
-		NotAfter:              notAfter,
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		DNSNames:    dnsNames,
+		IPAddresses: ipAddrs,
+		NotBefore:   notBefore,
+		NotAfter:    notAfter,
+		KeyUsage:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		// ExtKeyUsage on the CA root must include every purpose the certs it
+		// signs will be used for. End-entity system certs in this cloud carry
+		// both ServerAuth and ClientAuth (they serve mTLS *and* call mTLS).
+		// Per RFC 5280, an issuer's ExtKeyUsage must be a superset of the
+		// cert it signs. Without ClientAuth here, every mTLS handshake fails
+		// with "x509: certificate specifies an incompatible key usage".
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 		BasicConstraintsValid: true,
 		IsCA:                  true,
 	}

clerk/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/clerk
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

clerk/thing.go

@@ -229,7 +229,8 @@ func (t *Traits) lookupFromTracker(w http.ResponseWriter, id, email string) {
 	}
 
 	targetURL := baseURL + "?id=" + url.QueryEscape(id) + "&email=" + url.QueryEscape(email)
-	resp, err := (&http.Client{Timeout: 10 * time.Second}).Get(targetURL)
+	// Preserve framework-installed TLS so this works against an HTTPS-only tracker.
+	resp, err := (&http.Client{Timeout: 10 * time.Second, Transport: http.DefaultClient.Transport}).Get(targetURL)
 	if err != nil {
 		cer.Nodes = make(map[string][]components.NodeInfo)
 		http.Error(w, "tracker error: "+err.Error(), http.StatusBadGateway)

collector/go.mod

@@ -1,6 +1,6 @@
 module github.com/sdoque/systems/collector
 
-go 1.26.2
+go 1.26.3
 
 require (
 	github.com/influxdata/influxdb-client-go/v2 v2.14.0

democrat/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/democrat
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

drafter/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/drafter
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

ds18b20/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/ds18b20
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

emulator/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/emulator
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

esr/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/esr
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

ethermostat/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/ethermostat
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

filmer/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/filmer
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

flattener/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/flattener
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

kgrapher/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/kgrapher
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

kgrapher/thing.go

@@ -183,7 +183,9 @@ func (t *Traits) assembleOntologies(w http.ResponseWriter) {
 	}
 	req = req.WithContext(ctx)
 
-	client := &http.Client{}
+	// Use the framework's TLS-configured transport so this call works
+	// against an HTTPS-only service registrar.
+	client := &http.Client{Transport: http.DefaultClient.Transport}
 	resp, err := client.Do(req)
 	if err != nil {
 		log.Printf("Error receiving the systems list from service registrar, %s\n", err)
@@ -342,7 +344,10 @@ func (t *Traits) assembleOntologies(w http.ResponseWriter) {
 	}
 	req.Header.Set("Content-Type", "text/turtle")
 
-	client = &http.Client{}
+	// Triple-store endpoint is typically HTTP-only on localhost, but use the
+	// framework transport for consistency in case the deployment ever moves
+	// it to HTTPS.
+	client = &http.Client{Transport: http.DefaultClient.Transport}
 	resp, err = client.Do(req)
 	if err != nil {
 		log.Println("Error PUTting snapshot:", err)

leveler/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/leveler
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

maitreD/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/maitreD
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

messenger/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/messenger
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

meteorologue/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/meteorologue
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

modboss/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/modboss
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

modeler/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/modeler
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7

modeler/thing.go

@@ -142,7 +142,10 @@ func (t *Traits) assembleModel(w http.ResponseWriter) {
 	}
 	req = req.WithContext(ctx)
 
-	client := &http.Client{}
+	// Preserve the framework-configured Transport so this call uses mTLS
+	// when the registrar serves only HTTPS. http.DefaultClient.Transport is
+	// set up by installTLSConfig at enrolment.
+	client := &http.Client{Transport: http.DefaultClient.Transport}
 	resp, err := client.Do(req)
 	if err != nil {
 		log.Printf("Error fetching system list: %s\n", err)

nurse/go.mod

@@ -1,5 +1,5 @@
 module github.com/sdoque/systems/nurse
 
-go 1.26.2
+go 1.26.3
 
 require github.com/sdoque/mbaigo v0.1.0-alpha.7