Add initial OpenDRM-web interface

[Copilot]

Bootstrap the opendrm-web repository with a functional CGI-based web interface for the OpenDRM service on OpenIPC embedded cameras, following the same haserl/Bootstrap-less/shell-script pattern as majestic-webui.

Structure

• www/index.html — redirects to status dashboard
• www/a/ — custom responsive CSS (dark/light theme), minimal JS, SVG logo
• www/cgi-bin/p/ — shared partials: common.cgi (helper functions, form builders, redirect/flash), header.cgi (nav), footer.cgi
• sbin/setnetwork, sbin/updateopendrm — network config and self-update helpers

Pages

CGI	Purpose
status.cgi	Dashboard: hardware info, DRM service state, license, network
drm-settings.cgi	Service config (port, bind addr, log level, max streams)
drm-license.cgi	License key activation (online via POST, offline fallback)
drm-streams.cgi	Protected RTSP/HTTP stream CRUD with per-stream access tokens
fw-network.cgi	DHCP/static network configuration
fw-interface.cgi	Password change + dark/light theme toggle
fw-update.cgi	Firmware update via URL (download + extract + reboot)
tool-console.cgi	Web console restricted to an explicit command allowlist
tool-files.cgi	File browser restricted to /etc/opendrm, /var/log, /tmp/opendrm

Security notes

• tool-console.cgi: no eval — first token matched against allowlist (cat, ls, df, ip, opendrm, etc.)
• tool-files.cgi: realpath canonicalization against an allowed-base whitelist, prevents traversal
• drm-streams.cgi: tokens generated from /dev/urandom, regex-escaped before sed deletion
• drm-license.cgi: activation key sent via POST body, not URL query param
• fw-interface.cgi: password sentinel checks /etc/shadow directly; first-login redirect enforced until password is changed

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• cdn.jsdelivr.net
  • Triggering command: /usr/bin/curl curl -s -o bootstrap.min.css REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

OpenDRM-web

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.