WLPC Operator Docs¶
This is the operator runbook for the WLPC gateway fleet: how the gateway's
own software gets there, how to read what it has persisted, how to edit a
template, and how to delete a device. Every command in it was run for real
against a live gateway and the pallax-dev cluster on 2026-09-15 while it
was written — the "what to do when it fails" sections describe failures this
project actually hit that week, not hypotheticals.
Two facts that stay uncomfortable¶
There is no package and no target image
The gateway runs hand-built binaries installed by scp, verified by
SHA-256 on both ends, by hand, every time. A Yocto recipe exists in the
repo; nothing on this device was ever installed from it. See
Where the software comes from.
The OEM-default template tier is writable by nobody
Not by any tenant, not by an org-admin — OEM_DEFAULT_READONLY
(WLPC-86) refuses the write for every caller, because there is no
platform-operator identity in this service to authorize one. See
Editing a template.
The four questions this runbook answers¶
| # | Question | Where |
|---|---|---|
| 1 | Where does the gateway's own software come from, and how do I build, install and roll it back? | Gateway software |
| 2 | How do I read what a gateway has persisted, from a terminal, without leaking a credential? | Reading persisted data |
| 3 | How do I edit a template — and which tiers can I actually write? | Editing a template |
| 4 | How do I delete a device, and what does that actually remove? | Deleting a device |
Start with Before you touch anything if this is your first time on this device — it is the one check every section below assumes you already ran.
When a command fails¶
The runbook above states the local failure mode for each command inline.
Troubleshooting collects the four incidents
this week that were sharp enough to name on their own: an scp that exited
0 on a truncated copy, a kubectl apply that leaked an annotation, a deleted
binary that kept running, and a socket permission that looked like a
password check and was not one.
What this site does not show¶
No real EUI, serial number, TPM fingerprint, or the lab device's organisation name appears anywhere on this site — every identifier below is either a placeholder or was redacted before being pasted in. Every profile read is shown with its named-field extraction command, never a raw dump, for the reason given in Reading persisted data.