Turn on OpenBeken web auth and manage scripts over HTTP

Steps#

1. Give every client that polls the plug the password, before anything else. The password is set in memory at once and saved to flash shortly after, so auth applies from the next request. Any poller still sending anonymous requests gets 401 from then on. The username is fixed: admin (http_basic_auth.c:29). In my setup the poller is nut-observer, which reads OBSERVER_PLUG_PASSWORD from its environment and sends it with its voltage polls and LED commands. I updated it first. While auth is still off, a request that carries a password is accepted like any other, so clients can be switched over early.

2. Save plug/enable-auth.sh.

   #!/bin/bash
   # Turn on OpenBeken web authentication (HTTP Basic, user admin) with OBSERVER_PLUG_PASSWORD from
   # router/secrets.env. Run AFTER router/update-observer.sh, so the observer already sends the password.
   # Uses /cfg_wifi_set with only the password fields: Wi-Fi settings untouched, no module reset.
   # Undo: same form with web_admin_password_enabled absent (clears the password), sent with the password.
   set -euo pipefail
   cd "$(dirname "$0")"
   IP=${IP:-<plug>}
   set -a; . ../router/secrets.env; set +a
   [ -n "${OBSERVER_PLUG_PASSWORD:-}" ] || { echo "ABORT: OBSERVER_PLUG_PASSWORD missing (run router/update-observer.sh first)"; exit 1; }
   # URL with the password goes through curl's stdin config, not argv
   printf 'url = "http://%s/cfg_wifi_set?web_admin_password_enabled=1&web_admin_password=%s"\n' "$IP" "$OBSERVER_PLUG_PASSWORD" \
     | curl -fsS --max-time 10 -K - | /usr/bin/grep -o 'Web password has been changed\|No changes detected' || true
   sleep 2
   code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "http://$IP/cm?cmnd=STATUS%208")
   echo "without password: HTTP $code (want 401)"
   code=$(printf 'user = "admin:%s"\n' "$OBSERVER_PLUG_PASSWORD" | curl -s -o /dev/null -w '%{http_code}' --max-time 10 -K - "http://$IP/cm?cmnd=STATUS%208")
   echo "with password:    HTTP $code (want 200)"
   

   Replace <plug> on the IP= line, or leave it and run with IP=<address> in front. router/update-observer.sh in the comments is my step 1; yours is whatever you did there.

   Why it is safe for the Wi-Fi settings: the request sends only web_admin_password_enabled and web_admin_password. http_fn_cfg_wifi_set changes the SSID and Wi-Fi password only when the ssid, pass, ssid2 or pass2 arguments are present (src/httpserver/http_fns.c:1889-1903). It schedules a module reset only when one of those changed (http_fns.c:1920-1926). The web password itself is set without a reset (http_fns.c:1905-1913).

   Why the password stays out of argv: printf is a bash builtin, and curl reads the URL and the user = line as a config file from stdin (-K -). Neither the password nor the URL that contains it appears in any process's command line.

3. Run it.

   $ ./plug/enable-auth.sh
   Web password has been changed
   No changes detected
   without password: HTTP 401 (want 401)
   with password:    HTTP 200 (want 200)
   

   Expected: all four lines as above. No changes detected is the Wi-Fi half of the reply page (WiFi: No changes detected., http_fns.c:1921): Wi-Fi settings unchanged, no reset. If the first line is missing, read curl's error above the output; a password under 5 characters is refused and prints only No changes detected (Notes). If without password says 200, auth is not on.

4. Save plug/upload-scripts.sh.

   #!/bin/bash
   # Upload led.bat, prot.bat and autoexec.bat to the plug's filesystem, then restart it so they run.
   # The AC180's wall input runs through this plug: the restart drops the relay for a few seconds.
   # Sends the web password from router/secrets.env (OBSERVER_PLUG_PASSWORD) if set; harmless while auth is off.
   set -euo pipefail
   cd "$(dirname "$0")"
   IP=${IP:-<plug>}
   set -a; . ../router/secrets.env; set +a
   AUTH=()
   [ -n "${OBSERVER_PLUG_PASSWORD:-}" ] && AUTH=(-K -)   # credentials via stdin, not argv
   cr(){ if [ ${#AUTH[@]} -gt 0 ]; then printf 'user = "admin:%s"\n' "$OBSERVER_PLUG_PASSWORD" | curl -fsS --max-time 10 "${AUTH[@]}" "$@"; else curl -fsS --max-time 10 "$@"; fi; }
   for f in led.bat prot.bat autoexec.bat; do
     cr -X POST --data-binary @"$f" "http://$IP/api/lfs/$f" -o /dev/null && echo "uploaded $f"
   done
   cr "http://$IP/cm?cmnd=restart" -o /dev/null || true
   echo "restarting; waiting for the plug"
   for _ in $(seq 1 30); do
     sleep 3
     if out=$(cr "http://$IP/cm?cmnd=STATUS%208" 2>/dev/null); then echo "$out"; exit 0; fi
   done
   echo "plug not back after 90 s"; exit 1
   

   Edit the file list in the for line to match your scripts. POST /api/lfs/<name> writes the file (src/httpserver/rest_interface.c:283). The whole /api/ tree is registered with auth_required = 1 (rest_interface.c:79-80), so uploads need the password.

5. Warn whatever hangs off the relay, then run it. The restart drops the relay for a few seconds. On my plug that cuts the power station's wall input, so the station briefly runs on battery.

   $ ./plug/upload-scripts.sh
   uploaded led.bat
   uploaded prot.bat
   uploaded autoexec.bat
   restarting; waiting for the plug
   {"StatusSNS":{"Time":"2026-10-16T20:39:44","ENERGY":{"Power": 381.000000,"ApparentPower": 454.151275,"ReactivePower": 247.168716,"Factor":0.838927,"Voltage":232.121780,"Current":1.956521,"Frequency":0.000000,"ConsumptionTotal":5332.825683,"Yesterday": 0.047083,"ConsumptionLastHour":0.000000},"ESP32":{"Temperature": 49.9},"TempUnit":"C"}}
   

   Expected: one uploaded line per file, then one STATUS 8 JSON line once the plug answers again with the password. plug not back after 90 s means it did not answer with the password within 90 s.