fix(otbr,kan,mysql): OTBR vendor/model/socat/web binding, Kan build env vars, MySQL trixie support

- openthread-br: add socat dep for TCP adapters, add --vendor-name/--model-name
  (mandatory), bind REST API to 0.0.0.0:8081, configure otbr-web to listen on
  all interfaces, update TCP example with socat forkpty pattern
- kan: export BETTER_AUTH_SECRET and POSTGRES_URL before build (required by
  @t3-oss/env-nextjs zod validation at build time)
- mysql: remove MariaDB-on-trixie workaround (MySQL repo now has trixie packages),
  update GPG key from RPM-GPG-KEY-mysql-2023 to RPM-GPG-KEY-mysql-2025

install/kan-install.sh

@@ -31,11 +31,14 @@ fetch_and_deploy_gh_tag "kan" "kanbn/kan"
 
 msg_info "Building Application"
 cd /opt/kan
+AUTH_SECRET=$(openssl rand -base64 32)
 export NEXT_PUBLIC_USE_STANDALONE_OUTPUT=true
 export NEXT_PUBLIC_BASE_URL="http://${LOCAL_IP}:3000"
+export BETTER_AUTH_SECRET="${AUTH_SECRET}"
+export POSTGRES_URL="postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}"
 $STD pnpm install
 $STD pnpm build --filter=@kan/web
-unset NEXT_PUBLIC_USE_STANDALONE_OUTPUT NEXT_PUBLIC_BASE_URL
+unset NEXT_PUBLIC_USE_STANDALONE_OUTPUT NEXT_PUBLIC_BASE_URL BETTER_AUTH_SECRET POSTGRES_URL
 msg_ok "Built Application"
 
 msg_info "Setting up Standalone"
@@ -50,7 +53,6 @@ POSTGRES_URL="postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME
 msg_ok "Ran Database Migrations"
 
 msg_info "Configuring Application"
-AUTH_SECRET=$(openssl rand -base64 32)
 cat <<EOF >/opt/kan/.env
 NEXT_PUBLIC_BASE_URL=http://${LOCAL_IP}:3000
 BETTER_AUTH_SECRET=${AUTH_SECRET}

install/openthread-br-install.sh

@@ -33,7 +33,8 @@ $STD apt install -y \
   libnetfilter-queue1 \
   libnetfilter-queue-dev \
   libprotobuf-dev \
-  protobuf-compiler
+  protobuf-compiler \
+  socat
 msg_ok "Installed Dependencies"
 
 setup_nodejs
@@ -72,10 +73,15 @@ $STD sysctl -p /etc/sysctl.d/99-otbr.conf
 msg_ok "Configured Network"
 
 msg_info "Configuring Services"
-cat <<EOF >/etc/default/otbr-agent
-# USB example:   spinel+hdlc+uart:///dev/ttyACM0
-# TCP example:   spinel+hdlc+uart://192.168.1.100:9999
-OTBR_AGENT_OPTS="-I wpan0 -B eth0 spinel+hdlc+uart:///dev/ttyACM0"
+cat <<'EOF' >/etc/default/otbr-agent
+# USB example:
+#   OTBR_AGENT_OPTS="-I wpan0 -B eth0 --vendor-name OpenThread --model-name BorderRouter --rest-listen-address 0.0.0.0 --rest-listen-port 8081 spinel+hdlc+uart:///dev/ttyACM0"
+# TCP via socat (for network-attached RCP like SLZB-06/SLZB-MR3):
+#   OTBR_AGENT_OPTS="-I wpan0 -B eth0 --vendor-name OpenThread --model-name BorderRouter --rest-listen-address 0.0.0.0 --rest-listen-port 8081 'spinel+hdlc+forkpty:///usr/bin/socat?forkpty-arg=-,rawer&forkpty-arg=tcp:IP:PORT' trel://eth0"
+OTBR_AGENT_OPTS="-I wpan0 -B eth0 --vendor-name OpenThread --model-name BorderRouter --rest-listen-address 0.0.0.0 --rest-listen-port 8081 spinel+hdlc+uart:///dev/ttyACM0"
+EOF
+cat <<'EOF' >/etc/default/otbr-web
+OTBR_WEB_OPTS="-I wpan0 -a 0.0.0.0 -p 80"
 EOF
 systemctl enable -q dbus rsyslog otbr-agent otbr-web
 systemctl enable -q bind9 2>/dev/null || systemctl enable -q named 2>/dev/null || true

json/openthread-br.json

@@ -33,11 +33,15 @@
     },
     "notes": [
         {
-            "text": "Requires a Thread Radio Co-Processor (RCP) device. USB: pass through to LXC (e.g. /dev/ttyACM0). TCP: use `spinel+hdlc+uart://IP:PORT` format.",
+            "text": "Requires a Thread Radio Co-Processor (RCP) device. USB: pass through to LXC (e.g. /dev/ttyACM0). TCP: use socat forkpty pattern (see `/etc/default/otbr-agent` for examples).",
             "type": "warning"
         },
         {
-            "text": "Services are enabled but not started at install. Configure `/etc/default/otbr-agent` with your RCP device, then run: `systemctl start otbr-agent && systemctl start otbr-web`",
+            "text": "Services are enabled but not started at install. Configure `/etc/default/otbr-agent` with your RCP device, then run: `systemctl restart otbr-agent otbr-web`",
+            "type": "info"
+        },
+        {
+            "text": "Home Assistant: Add 'OpenThread Border Router' integration with URL `http://<IP>:8081`. Web UI is on port 80.",
             "type": "info"
         }
     ]

misc/tools.func

@@ -6114,29 +6114,11 @@ function setup_mysql() {
     return 1
   }
 
-  # Debian 13+ Fix: MySQL repo has expired GPG key and no trixie packages, use MariaDB from distro
-  if [[ "$DISTRO_ID" == "debian" && "$DISTRO_CODENAME" =~ ^(trixie|forky|sid)$ ]]; then
-    msg_info "Debian ${DISTRO_CODENAME} detected → using MariaDB from distro repository"
-
-    ensure_apt_working || return 1
-
-    install_packages_with_retry "mariadb-server" "mariadb-client" || {
-      msg_error "Failed to install MariaDB from distro repository"
-      return 1
-    }
-
-    local INSTALLED_VERSION=""
-    INSTALLED_VERSION=$(mariadb --version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+' | head -1) || true
-    cache_installed_version "mysql" "${INSTALLED_VERSION:-mariadb}"
-    msg_ok "Setup MariaDB ${INSTALLED_VERSION:-} (Debian ${DISTRO_CODENAME})"
-    return 0
-  fi
-
   # Standard setup for other distributions
   local SUITE
   if [[ "$DISTRO_ID" == "debian" ]]; then
     case "$DISTRO_CODENAME" in
-    bookworm | bullseye) SUITE="$DISTRO_CODENAME" ;;
+    trixie | bookworm | bullseye) SUITE="$DISTRO_CODENAME" ;;
     *) SUITE="bookworm" ;;
     esac
   else
@@ -6145,7 +6127,7 @@ function setup_mysql() {
 
   # Setup repository
   manage_tool_repository "mysql" "$MYSQL_VERSION" "https://repo.mysql.com/apt/${DISTRO_ID}" \
-    "https://repo.mysql.com/RPM-GPG-KEY-mysql-2023" || {
+    "https://repo.mysql.com/RPM-GPG-KEY-mysql-2025" || {
     msg_error "Failed to setup MySQL repository"
     return 1
   }