Hotspot AI-Drone-Zero

Der eigene Access Point des Pi als Rückfallebene, inklusive Internetfreigabe.

Originaltitel im Repository: Raspberry Pi networking

The Pi uses one onboard Wi-Fi interface, wlan0. At boot, ai-drone-network.service tries the preferred saved profile eduroam, then other saved auto-connect client profiles, and finally starts the AI-Drone-Zero fallback hotspot.

The saved eduroam profile has autoconnect enabled at priority 400, above the other saved client profiles (currently at most 300). Its BSSID and band fields are empty and its channel is unrestricted, so NetworkManager can select any reachable eduroam access point. Preserve the institution's certificate validation when maintaining this profile. These settings govern connection selection; the boot selector does not continuously switch away from an already connected fallback network when eduroam later becomes available.

Only one wlan0 mode is active at a time: joining a client network stops the hotspot, and starting the hotspot disconnects the client network.

#Access and status

Prefer Tailscale whenever the Pi has an internet uplink:

ssh -F /dev/null seb@seb-is-pm.tail59e6a4.ts.net

When the fallback hotspot is active, join AI-Drone-Zero and use:

ssh -F /dev/null seb@192.168.4.1

Inspect the active network and saved client profiles without changing them:

ai-drone-network status
ai-drone-network list

Network-changing commands are scheduled as transient systemd units so an SSH session can disconnect without aborting the handover:

sudo ai-drone-network auto
sudo ai-drone-network connect "PROFILE"
sudo ai-drone-network hotspot

auto tries eduroam, other saved auto-connect profiles, then Hotspot. Profile names and credentials stay in NetworkManager on the Pi and must not be stored in this repository.

#Shared teammate SSH access

For the same short SSH command on each teammate's computer, add this alias to ~/.ssh/config (Windows: %USERPROFILE%\.ssh\config), before any broad Host * block:

Host seb-is-pm
    HostName seb-is-pm.tail59e6a4.ts.net
    User seb

If the alias already exists, update its HostName and preserve personal settings such as IdentityFile. Connect with:

ssh seb@seb-is-pm

Use this command without -F /dev/null, which would bypass the alias. The full-hostname command in the previous section also works without an alias. Shared teammates need the fully qualified name for MagicDNS; a central access rule cannot install this client-side SSH alias. See sharing and MagicDNS.

Alternatively, use the Pi address shown in the teammate's own tailscale status. A shared machine can have a different address in the recipient's tailnet; 100.84.84.2 is the address observed in the owning tailnet.

The Pi uses ordinary OpenSSH over Tailscale. A successful device share must also be allowed by the tailnet's network policy, and the teammate still needs an accepted SSH key or the appropriate Unix-account credentials. The Pi's Tailscale SSH server is disabled; do not enable it without separately reviewing the tailnet's SSH policy, because it takes over SSH on the Tailscale address.

The following grant was installed and verified on 7 September 2026. It allows already accepted shares to reach the drone's SSH port:

{"src": ["autogroup:shared"], "dst": ["tag:pi-drone"], "ip": ["tcp:22"]}

It is an addition to the existing grants list in the owning tailnet's policy. Existing owner access and other rules were preserved. The full policy passed validation, and the Pi's delivered rules cover all three accepted share recipients and their eight visible devices. The short command was verified on the maintenance laptop; teammates must configure their own alias and use their existing OpenSSH credentials. See the dated access verification.

For future changes, validate the complete policy and preserve unrelated rules. Use the current ETag when saving to avoid overwriting a concurrent edit. Administrative credentials belong in a private local store, never this repository.

See Tailscale's sharing rules and Tailscale SSH distinction. Dated maintenance records describe which paths and peer rules were actually verified, rather than guaranteeing every teammate has completed an SSH login.

#Configure the fallback hotspot

Run on the Pi:

sudo scripts/setup-pi-hotspot.sh

The script prompts for the WPA2 passphrase without echoing it. For unattended setup, use a root-owned file inaccessible to group and other users:

sudo scripts/setup-pi-hotspot.sh \
  --password-file /root/hotspot-passphrase

The resulting NetworkManager profile is named Hotspot, serves AI-Drone-Zero, and gives the Pi 192.168.4.1/24. It has no internet uplink unless a second interface supplies one. Phones may need explicit confirmation to remain connected to a network without internet.

#Add a client network

Create credentials directly on the Pi. For ordinary WPA networks, use NetworkManager interactively and then verify that the profile is listed:

sudo nmcli device wifi connect "SSID" --ask
ai-drone-network list

For Frankfurt UAS eduroam, prefer the institution's current eduroam CAT installer. The expected profile uses PEAP/MSCHAPv2, validates the institution's CA and server domain, and stores its password only in the root-readable NetworkManager profile. Do not disable certificate validation or copy the credential-bearing profile into the repository.

Enabling a reachable client profile can immediately terminate hotspot SSH. Confirm Tailscale is logged in before switching:

tailscale status --self=true --peers=false
sudo ai-drone-network connect eduroam

If the connection fails, inspect NetworkManager without printing secrets:

journalctl -u NetworkManager --since '-10 min'
nmcli -f DEVICE,TYPE,STATE,CONNECTION device status

#Simultaneous hotspot and internet

Keeping AI-Drone-Zero active while also joining Wi-Fi requires a second interface. The recommended topology is:

laptop/phone <-- Wi-Fi --> wlan0 / AI-Drone-Zero / 192.168.4.1
                              Raspberry Pi
internet     <-- Wi-Fi --> wlan1 / USB Wi-Fi / client network

After attaching a Linux-compatible USB Wi-Fi adapter, run the read-only preflight:

sudo scripts/setup-pi-dual-network.sh \
  --uplink-interface wlan1 \
  --source-profile eduroam

Apply only after the preflight identifies both interfaces and profiles:

sudo scripts/setup-pi-dual-network.sh \
  --uplink-interface wlan1 \
  --source-profile eduroam \
  --apply

The script clones the existing profile locally without printing its password, binds the clone to wlan1, and keeps the hotspot on wlan0. A phone-hotspot profile can be supplied instead. USB Ethernet or phone tethering are also usable uplinks.

Applying this setup stops and disables the single-radio ai-drone-network.service; NetworkManager autoconnect then manages both interfaces across reboot. The source, cloned uplink and hotspot profiles must have distinct names. Do not run the single-radio auto/connect commands while relying on the persistent hotspot. To return to single-radio boot selection, run sudo systemctl enable --now ai-drone-network.service; this can disconnect hotspot SSH when a saved client network is reachable.

Do not rely on virtual AP/client concurrency on the single onboard radio for a control network: both roles share airtime and one radio failure removes both paths.

#Recovery

If the Pi becomes unreachable after a switch:

1. Wait for the boot selector to try the remaining saved profiles and hotspot.
2. Look for AI-Drone-Zero and connect to 192.168.4.1.
3. If no Wi-Fi path returns, use the USB gadget procedure in Raspberry Pi USB SSH.