- authorized_keys moved to /data/adacam/.ssh/authorized_keys (writable)
- sshd AuthorizedKeysFile updated to match
- Added filesystem writability check early in script
- sshd -t check tries both sshd and /usr/sbin/sshd
CRITICAL fixes:
- SSH hardening: guard to prevent duplicate directives, sshd -t validation before restart
- set -euo pipefail: added || true to optional commands (systemctl stop/mask, ip addr, udevadm, etc.)
- SSH survives IP change: defer all network changes to reboot via persistence service
- Serial detection: fail loudly instead of timestamp fallback
- GPS Redis keys: try multiple key names with fallback (GNSSFusion30Hz, GnssData, GnssFreqHz, gnss:latest)
IMPORTANT fixes:
- adacam-forwarder.py: signal handlers for graceful shutdown
- adacam-wigle.py: signal handlers and GPS key fallback
- keys/adacam_authorized_key.pub: two public keys baked into liberate.sh
(cobb@adacam + kayos@openclaw) — no env var needed for standard deployments
- liberate.sh: injects built-in keys always, ADACAM_PUBKEY still works additively
- keys/README.md: documents key locations, SSH usage, future signing story
- Private key: /boot/config/adacam/id_ed25519_adacam on Lucy (boot-persistent)
