Mitchell R 4cf9704350 fix(onvif-events): store cluster_key at pairing + implement AES-256-GCM decrypt ... Root cause: kiosk never stored cluster_key from pairing response. Bundle ships onvif_password_encrypted (AES-256-GCM with cluster key). decrypt_cluster was a stub returning None → empty password → WSSE auth fails → CreatePullPoint rejected → no events ever. Fix: 1. ClaimResp now includes cluster_key field 2. Stored encrypted at rest alongside kiosk_key (at_rest.rs) 3. Loaded at bundle render, passed to onvif_events::start() 4. decrypt_cluster implements full AES-256-GCM: parse v1.<iv>.<tag>.<ct> format, base64url decode, decrypt with cluster key Also: removed BF_ENABLE_ONVIF_EVENTS env gate — if camera is type=onvif with onvif_host, subscribe. Gate was redundant with the type filter. Also: bump Angie proxy_read_timeout to 600s on /api/admin/ for OS bundle import (downloads ~1GB from GitHub, was timing out at 60s). NOTE: existing paired kiosks won't have cluster_key stored. They need to re-pair (delete + re-add) to receive it. New pairings get it automatically.		2026-05-22 22:18:25 +02:00
..
betterframe.docker.conf	fix(onvif-events): store cluster_key at pairing + implement AES-256-GCM decrypt	2026-05-22 22:18:25 +02:00