Skip to content

docs(wrt): Settings fixes, ChromeOS CA trust, DIY Wi-Fi via web UI - #3622

Open
Dominion5254 wants to merge 4 commits into
masterfrom
wrt/docs-improvements
Open

docs(wrt): Settings fixes, ChromeOS CA trust, DIY Wi-Fi via web UI#3622
Dominion5254 wants to merge 4 commits into
masterfrom
wrt/docs-improvements

Conversation

@Dominion5254

Copy link
Copy Markdown
Collaborator

Three user-guide improvements, each verified against the code/UI before writing:

Settings page mirrors the screen + Remote Access explained (tester feedback)

  • Reordered the Settings doc to the actual tab order (General, Password, SSH Keys, Activity, Logs, Backup, Advanced) and added the previously undocumented SSH Keys and Backup sections, each linking to its dedicated page. The General tab's subsections now follow their on-screen order too.
  • Rewrote Remote Access around the question the old text never answered — how to manage the router when away from home. It now leads with the Inbound VPN (works regardless of the setting, no port forwards or whitelists needed), then describes each mode by who can reach the admin UI from the WAN side; notably, "When behind NAT" only admits private sources while the WAN address is itself private, so the public Internet can never reach the UI in that mode (semantics verified in system.rs).
  • Initial Setup's "Explore the Web Interface" bullets now link each feature to its documentation page.

ChromeOS root-CA trust instructions

  • Added a ChromeOS tab to both "Trusting Your Root CA" pages (StartWRT and StartOS) — Chromebooks have no keychain/MMC/profile/terminal trust store, so none of the existing five platform tabs applied. Leads with the current chrome://certificate-manager UI, keeps the older Authorities-tab dialog as a fallback, and notes the rename-to-.pem escape hatch (our .crt is already PEM).
  • Extended the canonical global="platform" label set in the start-docs conventions with ChromeOS; a page may omit a platform that genuinely doesn't apply (tabs.js degrades gracefully). The start-os inbound-vpn and start-tunnel installing tab groups deliberately don't get a ChromeOS tab — they'd need real ChromeOS VPN content.
  • ⚠️ The ChromeOS steps are sourced from current documentation, not bench-tested — worth verifying on a real Chromebook before release.

DIY Wi-Fi password setup routed through the web interface

  • The DIY/unprogrammed-board instructions no longer send users to startwrt-cli set-wifi-password over Ethernet/serial. The web UI handles this end to end: after initial setup, adding the first Admin-profile password on Points of Entry → Wi-Fi → Passwords switches the radios on (auto_enable_radios_on_first_admin_password in wifi.rs) — the docs call out selecting Admin explicitly, since a first password on any other profile leaves the AP down. Cross-references in wifi.md, factory-reset.md, and faq.md aligned; the CLI remains documented in the developer-facing init-reflash.md for headless provisioning.

…e UI tour

Tester feedback on the user guide, all four points verified against the
web UI and backend before fixing:

- Reorder the Settings page to the actual tab order (General, Password,
  SSH Keys, Activity, Logs, Backup, Advanced) and add the missing SSH
  Keys and Backup sections, each linking to its dedicated page. Reorder
  the General tab's subsections to their on-screen order (Updates banner,
  Preferences, Remote Access, Security, About).

- Rewrite Remote Access around the question the old text never answered:
  how to manage the router when away from home. Lead with the Inbound
  VPN (works regardless of the setting — VPN clients join a profile zone,
  which accepts router input — with no port forwards or whitelists on the
  router), then describe each option by who can connect from the WAN
  side: "When behind NAT" admits only private sources and only while the
  WAN address is itself private (the double-NAT case), so the public
  Internet can never reach the admin UI in that mode.

- Link each feature named in Initial Setup's "Explore the Web Interface"
  bullets to its documentation page.
ChromeOS has no Keychain, MMC, profile install, or terminal trust store —
the CA is imported through Chrome's certificate manager — so none of the
five platform tabs in the "Trusting Your Root CA" guides covered
Chromebooks. Add a ChromeOS tab to both twin pages (StartWRT and StartOS),
leading with the current chrome://certificate-manager UI and keeping the
older Authorities-tab dialog as a fallback note. The importer only accepts
PEM; our .crt download is PEM-encoded (ssl.rs generates the CA with
to_pem()), so the tab notes a rename-to-.pem escape hatch rather than a
conversion step.

Extend the canonical global="platform" label set in the start-docs
conventions with ChromeOS, and document that a page may omit a platform
that genuinely doesn't apply (tabs.js ignores a stored label the page
lacks, so sync degrades gracefully). The other platform groups
(start-os inbound-vpn, start-tunnel installing) are deliberately left
without a ChromeOS tab — they'd need real ChromeOS VPN content.

The ChromeOS steps are sourced from current documentation, not
bench-tested — verify on a real Chromebook before release.
The DIY/unprogrammed-board instructions told users to run
startwrt-cli set-wifi-password over Ethernet or serial. The web
interface handles this case end to end: after initial setup, adding the
first Admin-profile password on Points of Entry > Wi-Fi > Passwords
switches the radios on and starts broadcasting
(auto_enable_radios_on_first_admin_password in wifi.rs) — a first
password mapped to any other profile is saved but leaves the AP down,
so the instructions call out selecting Admin explicitly.

Rewrite installing.md's DIY section around that UI flow (with the
Generate button for a random password) and align the cross-references
in wifi.md, factory-reset.md, and faq.md. The CLI remains documented in
the developer-facing init-reflash.md for headless provisioning.
PR #3607 bumps the prospective start-wrt version from 1.0.2 (never
tagged) to 1.1.0 — new-hardware support is a minor per semver — renaming
the unreleased changelog heading in place and bumping the manifest.
Retitle the heading this branch's entries sit under to match, so the
entries land under the version that will actually ship. The manifest
bump itself stays with #3607.
@Dominion5254
Dominion5254 requested a review from dr-bonez August 3, 2026 18:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant