It starts, logs and waits; the radio, the cache and the OTA conversation
land in CCS-UHA-2 onwards. No privileged flag and no capability: the
privileged work is NetworkManager's, over D-Bus.

@@ -161,1 +161,4 @@
   integration wants `127.0.0.1` on port `1883` with no credentials.
+- The `updater` service is built from `updater/` and will own the Pi's radio,
+  the firmware cache and the over-the-air conversation with the nodes. It runs
+  with no privileged flag and no added capability: NetworkManager does the

@@ -38,0 +42,4 @@
+    volumes:
+      - ./updater-data/firmware:/var/lib/campervan-updater/firmware
+      - /etc/localtime:/etc/localtime:ro
+      # NetworkManager does the privileged work in its own process; this only

@@ -38,0 +49,4 @@
+      - /run/dbus:/run/dbus:ro
+    restart: unless-stopped
+    # Long enough to put the host's network back the way it was found.
+    stop_grace_period: 30s

@@ -0,0 +40,4 @@
+	"""The startup line goes to the container log, which is not a secret store."""
+	summary = Settings(Path("/cache"), "secret").describe()
+	assert "secret" not in summary
+	assert "set" in summary

@@ -0,0 +89,4 @@
+	running = asyncio.create_task(run(Settings(tmp_path, "")))
+	await asyncio.sleep(0)
+
+	signal.raise_signal(signal.SIGTERM)

@@ -0,0 +8,4 @@
+COPY requirements.txt ./updater/
+RUN pip install --no-cache-dir -r updater/requirements.txt
+
+COPY . ./updater/

@@ -0,0 +25,4 @@
+		leaving it out, so an empty string has to mean the default.
+		"""
+		source = os.environ if environment is None else environment
+		cache = source.get("FIRMWARE_CACHE") or DEFAULT_FIRMWARE_CACHE