luci-app-nut: add/update SSL configuration for full support

[danielfdickinson]

Pull request details

Description

Both the configuration for NSS-based SSL and the configuration for OpenSSL-based SSL were incomplete, so add missing options, and enhance existing settings.

Additionally, the method of checking for being compiled with SSL changes with openwrt/packages#29893. We now have a file /usr/share/nut/ssl_backend which contains either 'nss', 'openssl', or 'none'. We use this to show the applicable configuration options in the UI, and remove the runtime ldd check on the upsd and upsmon binaries.

Finally, SSL settings are security-sensitive so move them to the 'admin' NUT screens instead of being readable by a non-privileged user.

Maintainer

@danielfdickinson @systemcrash

---

Tested on

OpenWrt version: OpenWrt SNAPSHOT r35715-94a21b3fe9
LuCI version: LuCI Master 26.220.05649~98417a6
Web browser(s): Firefox 140.13.0esr (64-bit)

---

Checklist

• Includes what Issue it closes (e.g. openwrt/luci#issue-number).
• Includes what it depends on (e.g. openwrt/packages#pr-number in sister repo).
  Depends on: nut: enable SSL via NSS by default packages#29893

[openwrt-ai]

Reviewed 1 new commit. Main functional finding: fs.read() is not newline-trimmed, so the ssl_support_type comparisons in both admin views will not match a shell-written /usr/share/nut/ssl_backend and the SSL sections would never render — see the inline comment on nut_monitor_admin.js. Also flagged the tuple() datatypes rejecting the quoted form the help text prescribes, the unchanged luci-app-nut-read uci ACL vs. the commit message's security claim, and the missing upsd-side consumers for several new options. The .po/.pot regeneration looks clean and CI is still pending on this head, so nothing to report there.

Commit checks

• 75d1349 "luci-app-nut: add/update SSL configuration for full support" — the message covers the SSL rework, the ssl_backend switch and the ldd removal, but not the new debug_min option added to nut_server.js and nut_monitor.js. It also states the SSL settings are no longer "readable by a non-privileged user", which the ACL change does not actually accomplish (see the inline comment on acl.d/luci-app-nut.json).

---

Generated by Claude Code

[openwrt-ai]

Re-reviewed the force-push (75d1349 → 6c73922). All of the previous round's findings are addressed: fs.trimmed() replaces the untrimmed fs.read() + unreachable .catch() in both admin views, the tuple() datatypes that rejected the quoted syntax are gone, the certifcte / has as space / as and empty pair typos and the unbalanced NO (... label are fixed, the monitor-side certfile is now labelled "Client", the NSS certpath optional flag is consistent across both admin views, debug_min is dropped so the diff matches the subject, and the commit message no longer claims the ACL restricts read access. The .pot/.po regeneration is consistent with the new sources — no stale Unable to read ssl_backend / Minimum debug level / ldd strings remain. CI is green on this head, so nothing to report there.

Three remaining items inline, all minor: a leftover empty load() override in nut_monitor.js, a question about placeholder vs default for the NSS certpath, and a comment-style nit on the new /* Update certpath ... */ lines.

---

Generated by Claude Code

[openwrt-ai]

Re-reviewed the force-push (6c73922 → 3a6958f). The delta is three files / six lines and it addresses all three items from the last round: the empty load() override in nut_monitor.js is gone, the /* Update certpath ... */ changelog-style comments are now // statements of fact matching the file's existing style, and the NSS certpath placeholder became default on both admin views. The commit message matches the diff. CI is green on this head (build x86_64, eslint, CodeQL, FormalityCheck all passing), so nothing to report there.

One item inline, and it is a correction of my own previous advice: o.default combined with o.optional = true does not persist the value either — form.js explicitly removes the option when the form value equals the default. So the placeholder → default swap changes only the rendering, not what ends up in UCI.

---

Generated by Claude Code

[openwrt-ai]

Re-reviewed the delta since 3a6958f — the branch was rebased onto 98417a6 and the single commit force-pushed to e37d312. Outside the .po/.pot regeneration the change is seven lines across the two admin views.

The previous round's item is resolved, and resolved correctly: rather than trying to make default/placeholder persist /etc/nut/cert_db, the NSS certpath field is now left genuinely empty with the rationale spelled out in an inline comment ("the default database has no certificates, and must be filled to be useful") and a help string telling the user how to populate it. That sidesteps the parse()-removes-value-equal-to-default behaviour entirely, so there is nothing left to flag there.

Two things I checked specifically because of the rebase:

• The rebase base 98417a6 added +USE_GLIBC:ldd to LUCI_DEPENDS, which this PR's own removal of the ldd probe makes dead. The rebase handled it — 98417a6..e37d312 drops that token from the Makefile, and no ldd reference survives anywhere in applications/luci-app-nut/ (Makefile, ACL, or views).
• The .pot regeneration is consistent with the sources: the new An empty database was created… msgid is present with correct nut_monitor_admin.js:52 / nut_server_admin.js:50 references, the shifted nut_monitor.js line numbers now match the file after the load() removal from the previous round, and all 44 .po files carry the same reference updates with no translations misattached.

Commit message is unchanged from the last round and still matches the diff. GitHub reports no check runs on this head yet, so nothing to report from CI.

Two nits inline, both cosmetic and both in strings/comments introduced by this delta.

---

Generated by Claude Code

[openwrt-ai]

Re-reviewed the delta since e37d312 (force-pushed to 2218fe0d). Outside the .po/.pot regeneration the change is three lines across the two admin views — both items from the last round.

• The comment-parity nit is fixed correctly: nut_server_admin.js:41 now carries the same sentence-terminating period as its twin in nut_monitor_admin.js:43, and the two blocks are byte-identical again.
• The grammar nit is not fixed correctly — the comma was inserted one word to the left of where it belongs, producing "To use, it SSH in", which is worse than the original. Inline comment with the suggestion; it needs applying in both views.

The .pot/.po regeneration is consistent with the (new) source string: the msgid is rewrapped in the template and in all 43 .po files with the same nut_monitor_admin.js:52 / nut_server_admin.js:50 references, no msgstr was left attached to the old msgid, and no copy of the previous wording survives anywhere under applications/luci-app-nut/.

Commit message is unchanged from the last round and still matches the diff. CI is green on this head (build x86_64, eslint, CodeQL, all three FormalityCheck jobs), so nothing to report there.

---

Generated by Claude Code

[openwrt-ai]

Reviewed 1 new commit; no new issues found.

Re-reviewed the delta since 2218fe0d (force-pushed to 7b479dc). Outside the .po/.pot regeneration the change is one line, duplicated in the two admin views, and it is the grammar nit from the last round — now fixed correctly: "To use, it SSH in" → "To use it, SSH in". Applied identically in nut_monitor_admin.js:52 and [`nut_server_admin.js:50`](https://github.com/openwrt/luci/blob/7b479dcbea9d183fa3a3843ed348f0760809919d/applications/luci-app-nut/htdocs/luci-static/resources/view/nut/nut_server_admin.js#L50),`` and the surrounding NSS certpath blocks in the two views remain byte-identical.

The .pot/.po regeneration is consistent with the new source string: the msgid is rewrapped in the template and in all 42 .po files, every file carries exactly the same three removed / two added msgid lines and no other change (no msgstr line was touched anywhere in the delta), the nut_monitor_admin.js:52 / nut_server_admin.js:50 references are unchanged, and no copy of the old wording survives anywhere under applications/luci-app-nut/.

Commit message is unchanged from the last round and still matches the diff. CI is green on this head (build x86_64, eslint, CodeQL, all three FormalityCheck jobs).

---

Generated by Claude Code