Fix smoke test redirects and default updates to stable

docs/workflow.md

@@ -101,3 +101,4 @@ Use the helper:
 - Keep `RESCUE.md` in `/root` and `/home/dietpi` only (not in `/var/www`).
 - Prep enforces a password change for `dietpi` on first login; set `PIKIT_FORCE_PASSWORD_CHANGE=0` to skip.
 - After the password change, a one‑time SSH hardening tip is shown on login.
+- End-user defaults: auto updates off, stable release channel; both can be changed in the dashboard.

pikit-prep.sh

@@ -250,6 +250,8 @@ prep_image() {
   clean_file /etc/pikit/certs/pikit.local.csr
   clean_file /var/www/pikit-web/assets/pikit-ca.crt
   clean_file /var/www/pikit-web/assets/pikit-ca.sha256
+  clean_file /var/lib/pikit-update/state.json
+  clean_file /var/run/pikit-update.lock
 
   # --- Backup/editor cruft ---
   clean_backups /var/www/pikit-web
@@ -531,6 +533,8 @@ check_image() {
   check_file_missing /etc/pikit/certs/pikit.local.key
   check_file_missing /var/www/pikit-web/assets/pikit-ca.crt
   check_file_missing /var/www/pikit-web/assets/pikit-ca.sha256
+  check_file_missing /var/lib/pikit-update/state.json
+  check_file_missing /var/run/pikit-update.lock
 
   section "Logs"
   if [ -d /var/log ]; then

pikit-smoke-test.sh

@@ -126,28 +126,45 @@ check_https() {
 check_api() {
   local url="$1"
   local body
-  if ! body="$(curl -fsS --max-time 5 "$url")"; then
+  if ! body="$(curl -kfsSL --max-time 5 "$url")"; then
     status FAIL "API not reachable: $url"
     return
   fi
-  local ok
-  ok="$(printf "%s" "$body" | json_get "services" || true)"
-  if [ -n "$ok" ]; then
-    status OK "API responds with JSON"
+  if command -v python3 >/dev/null 2>&1; then
+    if printf "%s" "$body" | python3 - <<'PY'
+import json, sys
+try:
+    data = json.load(sys.stdin)
+except Exception:
+    sys.exit(1)
+for key in ("services", "hostname", "uptime_seconds"):
+    if key in data:
+        sys.exit(0)
+sys.exit(1)
+PY
+    then
+      status OK "API responds with JSON"
+    else
+      status WARN "API response did not include expected fields"
+    fi
   else
-    status WARN "API response did not include expected fields"
+    status WARN "python3 missing; API JSON check skipped"
   fi
 }
 
 check_firstboot() {
   local url="$1"
   local body state error_present
-  if ! body="$(curl -fsS --max-time 5 "$url")"; then
+  if ! body="$(curl -kfsSL --max-time 5 "$url")"; then
     status FAIL "firstboot API not reachable"
     return
   fi
   state="$(printf "%s" "$body" | json_get "state" || true)"
   error_present="$(printf "%s" "$body" | json_get "error_present" || true)"
+  if [ -z "$state" ]; then
+    status FAIL "firstboot status invalid or missing"
+    return
+  fi
   if [ "$state" = "done" ] && [ "$error_present" != "true" ]; then
     status OK "firstboot completed"
   else

pikit_api/releases.py

@@ -90,10 +90,10 @@ def load_update_state() -> Dict[str, Any]:
             "last_check": None,
             "status": "unknown",
             "message": "",
-            "auto_check": False,
+            "auto_check": True,
             "in_progress": False,
             "progress": None,
-            "channel": os.environ.get("PIKIT_CHANNEL", "dev"),
+            "channel": os.environ.get("PIKIT_CHANNEL", "stable"),
             "changelog_url": None,
             "latest_release_date": None,
             "current_release_date": None,