One of the quiet design goals of TrailCurrent is that a firmware module should never have to know your WiFi password at build time. This week that became real.
WiFi credentials now travel over the CAN bus from Headwaters to every module that needs them. Bearing, Tapper, Therma, Solstice, Aftline, Ampline, Plateau, and Milepost all deleted their Secrets.h files and picked up the credentials over the wire. The OTA library was refactored to support the new flow. For anyone forking this platform, this is a big quality-of-life change: you configure WiFi once, in one place, and every module on the bus joins automatically.
A real end-to-end deployment
We ran our first complete deployment cycle: push a zip, Headwaters picks it up, containers swap in, firmware flashes over OTA, and the PWA updates on the phone in the kitchen. A few iOS-specific bugs came out of the woodwork along the way. Service worker caching was holding onto stale assets. The CA certificate wasn't being trusted. The PWA icon was rendering as a text monogram instead of the real logo. Every one of those is fixed, and the process is now documented end to end.
Let's Encrypt in the cloud
Farwatch, the cloud companion to Headwaters, moved to Let's Encrypt for SSL. The mosquitto broker picked up proper cert mounts. A handful of path and ownership issues that only surface when you run containers as a non-root user were cleaned up. Farwatch also got its first real feature beyond monitoring: a node-red cloud workflow that auto-populates with rate limiters when the cloud bridge is enabled.
Headwaters keeps polishing
Headwaters had 25 commits this week, most of them invisible to users and crucial to the ones who will install this in three months. Cert generation, logo rendering, orphan-container cleanup on redeploy, and a working node-red starter flow that ships with the initial image are the ones worth calling out.
Nothing shipped this week is glamorous. All of it is load-bearing.