OTA on the gateway

The OTA server (nginx, port 8080) serves firmware files to nodes on the rack LAN. A node turns a relative /fw/… URL into http://<gateway>:8080/fw/….

Three routes under `/fw/`

Route	Used for	File source
`/fw/<token>/<file>`	rollout from Celestian (Firmware OTA menu)	forwarded to Celestian, cached 7 days on the gateway: one wave downloads once from Celestian, and already-cached files are still served when the WAN is down
`/fw/snt-g1/<file>`, `/fw/snt-g2/<file>`	manual installs, one folder per model	`firmware/snt-g1/` and `firmware/snt-g2/`
`/fw/<file>` (single segment, legacy)	only G1 units that already store this kind of URL	`firmware/snt-g1/`

The X-Cache-Status header (MISS / HIT) on the token route helps check the cache.

Firmware of different models must not be mixed up

The pins and output behavior of G1 and G2 differ. Two layers of prevention:

Per-model folder and file name: edge-snt-g1-idf-<version>.bin in firmware/snt-g1/. The folder is mounted into the nginx container as-is; the .bin files inside are not in git.
Nodes reject images of other models. Every image carries a model tag; the node checks it before activating the image and rejects a mismatch. Applies to firmware that carries this tag.

Enabling rollout from Celestian

Fill in .env:

Variable	Contents
`CELESTIAN_WEB_URL`	the address of the Celestian web that issues tokens, without a path or trailing slash (e.g. `https://iot.contoh.id`)
`CELESTIAN_WEB_HOST`	the host name (and port if non-default) for the `Host` header

Then docker compose up -d (recreates the ota container). Without this, nodes get HTTP 503 on rollout, while local files keep working. The gateway needs outbound (HTTPS) access to Celestian; nodes only need to reach the gateway.

Test from the gateway machine (an invalid token should be answered with 403 by Celestian, not 404 or a connection error):

curl -sI http://127.0.0.1:8080/fw/abc/x.bin

Manual install on one node

Put the file in firmware/snt-g1/, then publish to m/<workspace>/c/<channel>/<mac>/cmd:

{"action":"ota","url":"/fw/snt-g1/edge-snt-g1-idf-0.21.1.bin","sha256":"<64 hex>"}

Migrating from the old layout

Move all .bin files in firmware/ to firmware/snt-g1/, then docker compose up -d so the OTA container uses the new configuration:

mkdir -p firmware/snt-g1 firmware/snt-g2 && mv firmware/*.bin firmware/snt-g1/