Add post: "A captive portal for my guest WiFi, and the four bugs that made it real" - #21
Merged
Merged
Conversation
… made it real" Writes up the openNDS + PHP guest portal: the non-derivable gatewayhash, the stranding bug, the DNS gap that 101 passing tests structurally could not catch, and why the self-service OTP flow is accountability rather than authorisation. No live hostnames, keys or private addresses -- the repo is public. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Aswincloud-Bot
approved these changes
Jul 31, 2026
Aswincloud-Bot
left a comment
Aswincloud-Bot
left a comment
There was a problem hiding this comment.
Auto-approved: @Aswinmcw is a member of @Aswincloud/admins.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
blog | 989c65e | Commit Preview URL Branch Preview URL |
Jul 31 2026, 05:42 AM |
There was a problem hiding this comment.
Pull request overview
Adds a new long-form Hugo post documenting a guest WiFi captive portal build (openNDS on OpenWrt + a PHP container), framed around four debugging lessons learned while making the system trustworthy and user-safe.
Changes:
- Adds a new post describing four “bugs” encountered (gatewayhash derivation, authentication stranding/race, DNS/test blind spot, OTP flow semantics).
- Includes operational/security framing around what the OTP flow does and does not guarantee.
- Includes a short branding/accessibility note on contrast ratios for the portal’s color palette.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Aswinmcw
enabled auto-merge
July 31, 2026 06:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Writes up the guest captive portal (openNDS on OpenWrt + a PHP container on the NAS), structured around the four bugs rather than the build — the build was the boring part.
curl --resolve, which bypasses DNS by design. The suite was structurally incapable of catching the missing DNS record — a test that supplies the answer cannot discover the question.Plus a short section on branding the portal, including the contrast trap: the site emerald is 3.0:1 on white, well under the 4.5:1 body text needs.
Verification
hugo --minify --gcclean on the pinned 0.163.3 extended, no warningsAlso checked directly that no live secret appears in the post — the portal FAS key, gatewayhash, guest password, Telegram bot token and chat ID were each grepped for by value, plus private IPs, the real portal hostname, port and SSID. None present. The repo is public, so the post deliberately uses placeholder hostnames.
🤖 Generated with Claude Code