OpenDTU Solar Microinverter Gateway

In this lab, students construct an open-source Internet of Things (IoT) telemetry gateway and controller that monitors and controls solar microinverters over 2.4 GHz and sub-gigahertz radio links. Working with 32-bit ESP32-family microcontrollers, students interface multi-channel SPI RF transceivers, decoupling networks, and optional Ethernet or status displays to create a standalone data bridge independent of vendor cloud servers. Students capture and analyze real-time photovoltaic performance telemetry—including DC array voltages and currents, AC grid output power, and diagnostic inverter event logs—while implementing inverter active power limits. Through compiling embedded firmware, deploying network services like MQTT and REST APIs, and configuring local web dashboards, students learn practical wireless embedded communications, SPI bus interfacing, 3.3 V system electrical constraints, network protocol integration, and solar power monitoring.

photovoltaics solar energy microinverter solar microinverter Internet of Things IoT gateway telemetry embedded systems ESP32 serial peripheral interface SPI NRF24L01 sub-GHz RF MQTT Power over Ethernet energy monitoring

Uploaded by demo on 2026-09-03 · ready · Electronics · Original source ↗

Files: OpenDTU_README.md · defaults.h · platformio.ini · webapp_package.json

Readiness checks

  • complete 2026-09-03 03:53 🛡 Cybersecurity: Review before networking · 11 findings 24 searches · 10 pages
    view · PDF

Latest report — 2026-09-03 03:53

Readiness: OpenDTU Solar Microinverter Gateway

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $5–$66 per station (one host-board variant; the OpenDTU Fusion carrier-board route is priced separately at EUR 30,00) Cybersecurity — software & network: Review before networking

This is the cold check for this lab — there is no previous report, so everything below establishes the baseline that future checks will measure drift against. The lab is implementable today. Most of the bill of materials is in healthy supply: both Olimex boards, both WIZnet Ethernet options, the ceramic capacitor and the indicator LED are Active at an authorized distributor with deep stock, and the generic ESP32 board, both RF modules and the OLED display are plentiful at retail for a few dollars each. The caveats are real but bounded. Two of the ten selectable host boards — the ESP32-S3-DevKitC-1-N8 and the ESP32-C3-DevKitC-02 — are Obsolete with zero stock at both DigiKey and Mouser, and each needs the substitute named below. The snapshot's example bulk capacitor is unsourceable, though its commodity replacement costs $0.24 and sits in deep stock. The OpenDTU Fusion carrier board, the only route to the opendtufusion build targets, comes from a single small European community shop with no authorized alternative and no published design files — the one dependency that could strand a class. Because the host platform is explicitly "select one variant" and the cheap generic ESP32 route is unaffected, none of this blocks the lab; it constrains which build target an instructor should choose.

Action required

Part Problem Recommended action
ESP32-S3-DevKitC-1-N8 Obsolete at DigiKey; 0 stock at DigiKey and Mouser, 8-week factory lead, ECIA lifecycle risk High Order ESP32-S3-DEVKITC-1-N8R8 instead — $15.00, 1,825 in stock at Mouser. Adds 8 MB PSRAM; confirm the pinout against your target before buying a class set.
ESP32-C3-DevKitC-02 Obsolete at DigiKey; 0 stock at DigiKey and Mouser; no genuine retail listings found this run Order ESP32-C3-DEVKITM-1-N4X — $8.00, 110 in stock. Different module and pin arrangement; OpenDTU's C3 targets use dynamic pin mapping, so remap pins rather than expecting a drop-in.
Bulk decoupling capacitor (snapshot example UEP1A470MDD) No DigiKey listing; 0 stock at TTI and Mouser Substitute Panasonic ECA-1CM470I — 47 µF, 16 V, radial through-hole, $0.24, 6,565 in stock.
CMT2300A sub-GHz module Retail listings mix 433 MHz and 868 MHz parts; a 433 MHz module will not talk to an 868 MHz HMS/HMT inverter Order the 868/915 MHz variant explicitly — the Ebyte listing at $7.99 is the only band-correct result this run.
OpenDTU Fusion v1 / v2 / v2 PoE carrier board Single-sourced from one European community shop at EUR 30,00; no authorized distributor, no published gerbers or EDA files, stock not stated Budget for international shipping and lead time, or choose a generic ESP32 / ESP32-S3 build target instead for a class set.

Cybersecurity — software & network

Review before networking — The gateway serves an unauthenticated read-only API over plain HTTP and ships with published default credentials, and its frontend build chain carries eight vulnerable packages including a critical one — all mitigable, but each needs a deliberate step before the device goes on a shared network.

Component Version How known Support status
OpenDTU gateway firmware (project) not determined not determined (The lab's materials name the project but state no OpenDTU release version.) —
PlatformIO platform espressif32 6.10.0 read from project (platformio.ini (fetched this run as fetched/03-platformio.ini): 'platform = espressif32@6.10.0') —
Arduino framework for ESP32 not determined not determined (platformio.ini (fetched this run as fetched/03-platformio.ini) states only 'framework = arduino'; the framework version is bundled inside espressif32@6.10.0 and is not stated independently.) —
platformio/tool-mklittlefs not determined unpinned (platformio.ini (fetched this run as fetched/03-platformio.ini) lists it under platform_packages with no version, so PlatformIO installs whatever is current.) —
ESP32Async/ESPAsyncWebServer 3.10.3 read from project (platformio.ini (fetched this run as fetched/03-platformio.ini) lib_deps) —
ESP32Async/AsyncTCP 3.4.10 read from project (platformio.ini (fetched this run as fetched/03-platformio.ini) lib_deps) —
bblanchon/ArduinoJson 7.4.3 read from project (platformio.ini (fetched this run as fetched/03-platformio.ini) lib_deps) —
espMqttClient (bertmelis, git dependency) v1.7.2 read from project (platformio.ini (fetched this run as fetched/03-platformio.ini) lib_deps: 'https://github.com/bertmelis/espMqttClient.git#v1.7.2') —
nrf24/RF24 1.5.0 read from project (platformio.ini (fetched this run as fetched/03-platformio.ini) lib_deps) —
olikraus/U8g2 2.36.18 read from project (platformio.ini (fetched this run as fetched/03-platformio.ini) lib_deps) —
buelowp/sunset 1.1.7 read from project (platformio.ini (fetched this run as fetched/03-platformio.ini) lib_deps) —
arkhipenko/TaskScheduler 4.0.4 read from project (platformio.ini (fetched this run as fetched/03-platformio.ini) lib_deps) —
mathieucarbou/MycilaNTP 6.0.5 read from project (platformio.ini (fetched this run as fetched/03-platformio.ini) lib_deps) —
Yarn (package manager) 1.22.22 inferred (webapp/package.json (fetched this run as fetched/02-package.json) packageManager field; validation: this version appears in no file fetched this run) —
vue 3.5.31 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock) resolves vue@^3.5.31) —
vue-i18n 11.3.0 read from project (webapp/package.json (fetched this run as fetched/02-package.json) pins 11.3.0 exactly; webapp/yarn.lock (fetched this run as fetched/01-yarn.lock) resolves it) —
vue-router 5.0.4 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
bootstrap 5.3.8 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
bootstrap-icons-vue 1.11.3 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
@popperjs/core 2.11.8 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
sortablejs 1.15.7 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
spark-md5 3.0.2 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
mitt 3.0.1 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
pulltorefreshjs 0.1.22 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
vite (frontend build tool) 8.0.3 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
@vitejs/plugin-vue 6.0.5 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
@intlify/unplugin-vue-i18n 11.0.7 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
typescript 5.9.3 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
vue-tsc 3.2.6 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
sass 1.98.0 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
terser 5.46.1 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
eslint 10.1.0 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
prettier 3.8.1 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
oxlint 1.50.0 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
npm-run-all 4.1.5 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
shell-quote (transitive, build toolchain) 1.8.3 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
postcss (transitive, build toolchain) 8.5.8 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
nanoid (transitive, build toolchain) 3.3.11 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
brace-expansion (transitive, build toolchain) 1.1.13 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
brace-expansion (transitive, second resolution) 5.0.5 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
immutable (transitive, via sass) 5.1.5 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
@humanfs/node (transitive, via eslint) 0.16.7 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
postcss-selector-parser (transitive) 7.1.1 read from project (webapp/yarn.lock (fetched this run as fetched/01-yarn.lock)) —
Component Finding Severity Fix available?
shell-quote 1.8.3 The frontend build chain pulls in shell-quote 1.8.3, which fails to escape newlines when quoting shell arguments (rated critical) and can be stalled by a crafted string; This is a build-machine dependency: it runs on the workstation that rebuilds the web UI, not on the ESP32 gateway itself. — GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv critical Yes — update to 1.9.0
brace-expansion 1.1.13 and 5.0.5 Two separate resolutions of brace-expansion in the lockfile can be driven into runaway memory or CPU use by a crafted glob pattern, crashing the build; This is a build-machine dependency: it runs on the workstation that rebuilds the web UI, not on the ESP32 gateway itself. — GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg, GHSA-3jxr-9vmj-r5cp, GHSA-jxxr-4gwj-5jf2 high Yes — update to 1.1.18 and 5.0.9
immutable 5.1.5 Immutable.js 5.1.5, pulled in by the Sass compiler, can be forced into an unrecoverable stall by hash collisions or oversized lists; This is a build-machine dependency: it runs on the workstation that rebuilds the web UI, not on the ESP32 gateway itself. — GHSA-v56q-mh7h-f735, GHSA-xvcm-6775-5m9r high Yes — update to 5.1.8
nanoid 3.3.11 nanoid 3.3.11 can loop indefinitely or wrap around on malformed size arguments, hanging the build; This is a build-machine dependency: it runs on the workstation that rebuilds the web UI, not on the ESP32 gateway itself. — GHSA-xwg4-73v4-xw9w, GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8 high Yes — update to 3.3.18
postcss 8.5.8 PostCSS 8.5.8 can be induced by a crafted CSS comment to read arbitrary source-map files during the build; This is a build-machine dependency: it runs on the workstation that rebuilds the web UI, not on the ESP32 gateway itself. — GHSA-r28c-9q8g-f849, GHSA-6g55-p6wh-862q, GHSA-qx2v-qp2m-jg93, GHSA-fxqj-rqcc-2cmp high Yes — update to 8.5.23
vite 8.0.3 The Vite dev server used to build and preview the web UI can be made to serve files from outside the project directory, so anyone who can reach a running dev server may read files off the build machine; This is a build-machine dependency: it runs on the workstation that rebuilds the web UI, not on the ESP32 gateway itself. — GHSA-fx2h-pf6j-xcff, GHSA-p9ff-h696-f583, GHSA-v2wj-q39q-566r, GHSA-v6wh-96g9-6wx3 (+1 more) high Yes — update to 8.0.16
@humanfs/node 0.16.7 The ESLint file helper follows symbolic links during a recursive copy and can pull in files from outside the project tree; This is a build-machine dependency: it runs on the workstation that rebuilds the web UI, not on the ESP32 gateway itself. — GHSA-p498-v437-472g moderate Yes — update to 0.16.8
postcss-selector-parser 7.1.1 A deeply nested CSS selector can exhaust the parser's stack and stop the build; This is a build-machine dependency: it runs on the workstation that rebuilds the web UI, not on the ESP32 gateway itself. — GHSA-w9m9-85wc-3x92 low Yes — update to 7.1.3
OpenDTU network services (no transport encryption by default) The web interface runs over plain HTTP on port 80 and MQTT telemetry defaults to unencrypted port 1883 with TLS switched off, so credentials and inverter data cross the network in the clear if MQTT is enabled. posture Mitigation only — enable MQTT TLS and keep the gateway off untrusted or public networks
OpenDTU web interface (default credentials) The gateway ships with a published setup Wi-Fi password (openDTU42) and the administrative username 'admin', both written into the firmware defaults, so anyone who knows the project knows the factory credentials. posture Mitigation only — change the access-point password and the admin credentials during first-boot configuration, before the device joins a shared network
OpenDTU web interface (unauthenticated read access) Read-only access is enabled without any authentication by default (SECURITY_ALLOW_READONLY true), so any device on the same network can read the gateway's live solar data and event log over plain HTTP on port 80 without logging in. posture Mitigation only — turn off read-only access or place the gateway on an isolated network segment

What this means for your lab

Out of the box this gateway is meant to be easy to set up, and that comes at a cost: anyone else on the same network can open its web page and read your solar data — live inverter output, the event log and the metrics feed — without a password, because read-only access is deliberately left open by default. The setup Wi-Fi password (openDTU42) and the administrator username (admin) are published in the project's own source code, so they are not secrets; if you leave them unchanged, someone nearby could join the setup network and reconfigure the device, which on this hardware means changing how your inverters are told to behave. Everything travels unencrypted — the web page over plain HTTP, and the optional MQTT telemetry feed over an unencrypted port unless you switch TLS on. The practical steps are: change the access-point password and the admin credentials during first-boot setup, turn off unauthenticated read-only access if the data is sensitive, and put the gateway on an isolated lab network or VLAN rather than the main campus network — talk to campus IT before connecting it, since this is a device that controls power-generating equipment. Separately, the packages used to rebuild the web interface carry a number of known vulnerabilities, including a critical one; those affect the workstation doing the build rather than the gateway, and refreshing the lockfile clears them. One honest gap: the nine embedded firmware libraries could not be checked at all, because no vulnerability database covers Arduino and PlatformIO libraries — that is unknown territory, not a clean bill of health.

Not checked

  • Nine PlatformIO/Arduino firmware libraries (ESPAsyncWebServer 3.10.3, AsyncTCP 3.4.10, ArduinoJson 7.4.3, espMqttClient v1.7.2, RF24 1.5.0, U8g2 2.36.18, sunset 1.1.7, TaskScheduler 4.0.4, MycilaNTP 6.0.5): Versions were read from platformio.ini, but OSV.dev has no advisory database covering PlatformIO or Arduino C++ libraries, so no vulnerability check is possible. Absence of a database is not evidence that they are clean.
  • PlatformIO platform espressif32 6.10.0: endoflife.date has no 'platformio' product, so no support-status lookup matched; the platform's supported/end-of-life state is unknown. It also has no OSV ecosystem.
  • Arduino framework for ESP32 (bundled in espressif32@6.10.0): No independent version is stated anywhere in the project, so there is nothing concrete to look up.
  • platformio/tool-mklittlefs: Unpinned in platformio.ini — PlatformIO installs whatever is current, so no fixed version exists to check.
  • OpenDTU firmware itself: No release version is stated in the lab's materials, and the project is not published to a package registry with an advisory database.
  • TypeScript type-definition packages (@types/bootstrap, @types/node, @types/pulltorefreshjs, @types/sortablejs, @types/spark-md5): Compile-time type declarations only; they ship no executable code and the snapshot marks them not checkable.
  • ISRG Root X1 CA certificate embedded in defaults.h: Certificate validity was not verified this run; the snapshot records it as valid to June 2035 but no check was performed.
  • platformio 6.10.0: support status: endoflife.date has no such product
  • validation: Yarn (package manager): 'read from project' downgraded to 'inferred' - version '1.22.22' not in any fetched file

Parts

Microcontroller host platform (select one target variant)

Part Spec/Package Status Stock Price Source
Generic ESP32 dev board (ESP32-DevKitC / ESP32-WROOM-32) 30/38-pin 2.54 mm module, ≥4 MB flash, 3.3 V readily available (retail) — $2.12–$14.99 pcb-hero.com, KUONGSHUN, Walmart sellers
ESP32-S3-DevKitC-1-N8 ESP32-S3-WROOM-1-N8, 8 MB flash, USB CDC Obsolete 0 (DigiKey and Mouser; 8-wk lead) — DigiKey exact match, corroborated via TrustedParts/ECIA
ESP32-C3-DevKitC-02 ESP32-C3-WROOM-02, single-core RISC-V, 3.3 V Obsolete 0 (DigiKey and Mouser; 8-wk lead) — DigiKey exact match, corroborated via TrustedParts/ECIA
Olimex ESP32-POE RJ45 MagJack, TPS2375 PoE, LAN8710A RMII Active 1,625 $20.71 DigiKey
Olimex ESP32-EVB Screw terminals, RJ45, LAN8710A RMII Active 147 $23.01 DigiKey
Wemos D1 Mini ESP32 D1 mini dual 8-pin 2.54 mm headers readily available (retail) — $2.59–$6.99 eBay, Simply. Smarter. Electronics., Walmart/JacobsParts
Wireless-Tag WT32-ETH01 Castellated module, LAN8720A RMII, RJ45 readily available (retail) — $12.32–$19.90 Walmart, banggood.com, DigiKey listing
Wemos Lolin32 Lite Slim 2.54 mm breakout, JST battery connector readily available (retail) — $4.03–$4.69 eBay, Elecbee, Simply. Smarter. Electronics.
Wemos Lolin S2 Mini ESP32-S2FN4R2, compact dual-row headers available (retail, marketplace-concentrated) — $2.56–$3.10 AliExpress sellers; Newegg outlier at $24.26
OpenDTU Fusion v1 / v2 / v2 PoE carrier board Custom PCB accepting ESP32-S3 + RF modules available, single-sourced not stated EUR 30,00 AllianceApps Community Shop (only source found)

Radio frequency transceiver modules

Part Spec/Package Status Stock Price Source
NRF24L01+ PA/LNA module with antenna 2x4 pin 2.54 mm header, 1.9–3.6 V rail, 2.4 GHz readily available (retail) — $2.20–$11.99 eBay, AliExpress, ShillehTek, Walmart/MakerFocus
CMT2300A sub-GHz module (Ebyte E49-900M20S or similar) SMD/DIP adapter, 1.8–3.6 V rail, 868 MHz required available (retail) — check the band — $7.99 (868/915 MHz) Walmart — EBYTE IoT Application Expert

Ethernet transceiver controller

Part Spec/Package Status Stock Price Source
WIZ850IO (W5500 module) Module, supply 2.97–3.63 V, 132 mA Active 3,258 $24.52 DigiKey
W5500 (bare IC) 48-LQFP (7x7), supply 2.97–3.63 V, 132 mA Active 73,493 $3.47 DigiKey

Display module (optional)

Part Spec/Package Status Stock Price Source
0.96"/1.3" monochrome OLED, SSD1306/SH1106, 128x64 4-pin I2C or 7-pin SPI header, 3.3 V readily available (retail) — $2.49–$19.50 BuyDisplay, CANADUINO/DigiKey, Micro Center/Adafruit

Passive and support hardware

Part Spec/Package Status Stock Price Source
Bulk decoupling capacitor (example UEP1A470MDD) 10–100 µF, ≥6.3 V, radial through-hole not sourceable as specified 0 (TTI, Mouser) — DigiKey returned no listing; TrustedParts/ECIA corroborated
100 nF ceramic decoupling capacitor (C0805C104K5RACTU) 0.1 µF, ±10%, 50 V, X7R, 0805 Active 5,566,409 $0.16 DigiKey
Indicator status LEDs (example LG R971-KN-1) 0805 SMD, Vf 2.2 V typ, driven at 2–10 mA Active (orderable P/N LG R971-KN-1-0-20-R18) 1,172,771 $0.17 DigiKey

Substitutes

For part Substitute Differences Verified Judgment
ESP32-S3-DevKitC-1-N8 ESP32-S3-DEVKITC-1-N8R8 — $15.00, Active, 1,825 at Mouser Same ESP32-S3-DevKitC-1 board family and Espressif module line; flash 8 MB in both, meeting the snapshot's 4 MB minimum; N8R8 adds 8 MB PSRAM the N8 lacks — exceeding a requirement, which is acceptable; 3.3 V rail and native USB CDC unchanged. Stocked at Mouser, not DigiKey. verified: lifecycle status, price and multi-distributor stock (DigiKey part_lookup + TrustedParts/ECIA); flash and PSRAM difference (DigiKey product descriptions). Not verified: header pinout and GPIO mapping — DigiKey publishes no package, pitch or pinout parametrics for either board. Acceptable — electrically and functionally equivalent within the snapshot's stated latitude; footprint/pinout not verified, so confirm the pin map before ordering a class set.
ESP32-C3-DevKitC-02 ESP32-C3-DEVKITM-1-N4X — $8.00, Active, 110 in stock Both are Espressif ESP32-C3 single-core RISC-V boards on the required 3.3 V rail. The DevKitM-1 carries the ESP32-C3-MINI-1 module where the DevKitC-02 carries ESP32-C3-WROOM-02 — a different module, so a different board outline and pin arrangement. The snapshot's latitude explicitly allows "any ESP32-C3 module providing custom pin reassignment via dynamic pin mapping". Order the -N4X specifically: the plain ESP32-C3-DEVKITM-1 is itself Obsolete with 0 stock. verified: lifecycle status, price and stock (DigiKey part_lookup); ESP32-C3 family and 3.3 V operation (DigiKey product identity + snapshot). Not verified: header pitch, board outline, and which GPIOs are broken out — DigiKey gives only "Mounting Type: Fixed". Acceptable with remapping — the differing pinout is configurable rather than fatal because the C3 targets set pins dynamically, but the pin map must be checked against the target environment first.
Bulk decoupling capacitor (UEP1A470MDD) Panasonic ECA-1CM470I — $0.24, Active, 6,565 in stock 47 µF sits inside the snapshot's 10–100 µF window and matches its named 47 µF option; 16 V rating exceeds the ≥6.3 V requirement, which is acceptable and desirable; Through Hole mounting, "Radial, Can" package — matching the required radial leaded form; lead spacing 2.50 mm, body 5.00 mm dia. x 12.00 mm; ±20%; −40 °C to +85 °C. verified: capacitance, voltage rating, mounting type, package/case and lead spacing (DigiKey parametrics). Not verified: ESR — the snapshot asks for "low ESR" and DigiKey's ESR field for this part is blank. Acceptable — a straightforward commodity replacement. An instructor chasing marginal RF range should prefer a part with a stated ESR figure.

Verify any substitute against its datasheet before ordering — particularly the board pinouts, which distributor parametrics could not confirm.

Other dependencies

  • Project documentation — https://tbnobody.github.io/OpenDTU-docs/ is live (fetched this run).
  • Inverter compatibility matrix — https://www.opendtu.solar/hardware/inverter_overview/ is live (fetched this run). Worth re-checking before each term, since which inverters are supported drives which RF module a student needs.
  • Wireless-Tag WT32-ETH01 vendor page — http://www.wireless-tag.com/portfolio/wt32-eth01/ is dead (HTTP 404). This is the hardware reference link in platformio.ini; the module itself is still sold at retail, so only the manufacturer's documentation has rotted.
  • OpenDTU main repository — https://github.com/tbnobody/OpenDTU is live. Its root listing was retrieved this run and contains partitions_custom_4mb.csv, partitions_custom_8mb.csv and partitions_custom_16mb.csv, so the flash partition tables the README's repartitioning warning refers to are present.
  • OpenDTU Fusion documentation repository — https://github.com/markusdd/OpenDTUFusionDocs is live and directs buyers to the AllianceApps Community Shop.
  • Fusion carrier-board PCB fabrication — not available as a fabrication route on this evidence. No gerbers or EDA design files appear on the fetched documentation page, and the snapshot records that layer count and dimensions are not stated in the sources. The board is bought assembled (EUR 30,00, includes the PCB, three adhesive 800–2600 MHz antennas and a power jumper; USB-C cable and case not included). The shop states the Community Edition is for experienced users and carries no seller support.
  • Olimex ESP32-POE / ESP32-EVB open-source-hardware pages and the Waveshare ESP-S3-12K-Kit wiki — not checked this run.
  • Mikrocontroller.net origin thread (https://www.mikrocontroller.net/topic/525778) — not checked; historical reference only.

Watch list

  • OpenDTU Fusion carrier board — a single European community shop is the only source found, with no stock figure published and no design files to fall back on. If that shop closes, the opendtufusion build targets become unbuildable. Highest-risk dependency in the lab.
  • ESP32-C3-DevKitC-02 — already Obsolete with no retail equivalent found; its substitute (DEVKITM-1-N4X) has only 110 units in stock, so this line could go from "substitute available" to "nothing" quickly.
  • ESP32-S3-DevKitC-1-N8 — Obsolete, and its replacement is stocked at Mouser but not DigiKey, so the check depends on a single distributor holding inventory.
  • Olimex ESP32-EVB — 147 units is the thinnest authorized-distribution stock of any healthy part here; watch for it thinning further.
  • CMT2300A modules — a retail-only, band-sensitive part where the wrong listing silently produces a non-working lab. Re-verify the 868 MHz listing each term.
  • Wemos Lolin S2 Mini — supply is concentrated on AliExpress sellers, with the one mainstream listing priced roughly eight times higher.
Snapshot What the lab depended on when it was uploaded — the baseline the readiness checks research against.

This document provides a temporal snapshot and dependency inventory for the OpenDTU Solar Microinverter Gateway system, based on its firmware configuration manifests, embedded environment build definitions, and frontend web application dependencies.

The OpenDTU lab builds an open-source telemetry gateway and local monitoring controller that interfaces directly with Hoymiles solar microinverters over 2.4 GHz and sub-GHz radio frequency links, replacing proprietary vendor cloud gateways. The hardware system is built around 32-bit Espressif microcontrollers (ESP32, ESP32-S3, ESP32-C3, or ESP32-S2), operating at a primary logic and supply rail of 3.3 V DC (typically derived via on-board linear or switching regulators from a 5 V USB VBUS input or IEEE 802.3af Power-over-Ethernet 36 V to 57 V supply). All logic interfacing between the microcontroller, SPI RF transceivers, Ethernet controllers, and status displays operates strictly at 3.3 V CMOS levels; higher voltages will permanently damage the transceiver ICs.

Bill of Materials

Because this repository defines firmware targets and pin mappings across commercial development boards and custom carrier boards rather than providing a single unified hardware EDA schematic file, the components below represent the physical hardware platforms, RF modules, peripheral ICs, and interface hardware required to construct the functional gateway described across the build manifests.

Microcontroller Host Platform (Select one target variant)

  • Generic ESP32 Development Board

    • Identity: Espressif ESP32-WROOM-32 module on standard dual-row development board (e.g., ESP32-DevKitC, NodeMCU-32S).
    • Quantity: 1.
    • Footprint/package: Standard 30-pin or 38-pin 2.54 mm pitch DIP breakout module.
    • Electrical constraints: 5 V input via USB; regulated 3.3 V DC logic rail; 3.3 V GPIO; minimum 4 MB SPI flash (16 MB required for generic_esp32_16mb_psram build).
    • Substitution latitude: Any standard dual-core ESP32-D0WD-V3 / ESP32-WROOM-32 module with access to GPIO 4, 5, 16, 18, 19, and 23.
    • Student control: No (reset and boot buttons are setup/programming only).
    • Sourcing plan: retail shopping search: ESP32-DevKitC ESP32-WROOM-32 development board

  • ESP32-S3 Development Board

    • Identity: Espressif ESP32-S3-DevKitC-1.
    • Quantity: 1 (required for generic_esp32s3, generic_esp32s3_usb, Waveshare esp_s3_12k_kit, and opendtufusion builds).
    • Footprint/package: Dual-row 2.54 mm pitch DIP development board with dual USB-C ports (USB CDC / JTAG).
    • Electrical constraints: 5 V USB; 3.3 V operating rail; minimum 4 MB quad/octal SPI flash.
    • Substitution latitude: Any ESP32-S3 board with native USB CDC breakout and available GPIOs matching the target environment pinout.
    • Student control: No.
    • Sourcing plan: distributor lookup: ESP32-S3-DevKitC-1-N8

  • ESP32-C3 Development Board

    • Identity: Espressif ESP32-C3-DevKitC-02.
    • Quantity: 1 (required for generic_esp32c3 and generic_esp32c3_usb builds).
    • Footprint/package: Dual-row 2.54 mm pitch DIP development module.
    • Electrical constraints: 5 V USB; 3.3 V operating rail; single-core RISC-V 3.3 V logic.
    • Substitution latitude: Any ESP32-C3 module providing custom pin reassignment via dynamic pin mapping.
    • Student control: No.
    • Sourcing plan: distributor lookup: ESP32-C3-DevKitC-02

  • Olimex ESP32-PoE Development Board

    • Identity: Olimex ESP32-POE (IoT development board with Power-over-Ethernet).
    • Quantity: 1 (required for olimex_esp32_poe environment).
    • Footprint/package: Integrated PCB with RJ45 MagJack and pin headers.
    • Electrical constraints: IEEE 802.3af PoE (36 V to 57 V DC) or 5 V micro-USB input; 3.3 V onboard rail; Texas Instruments TPS2375 PoE controller and Microchip LAN8710A 10/100 Ethernet PHY on RMII.
    • Substitution latitude: Must be exactly Olimex ESP32-POE because firmware hard-codes the RMII clock and pin mapping for this board.
    • Student control: No.
    • Sourcing plan: distributor lookup: ESP32-POE

  • Olimex ESP32-EVB Development Board

    • Identity: Olimex ESP32-EVB (ESP32 evaluation board with Ethernet, relays, and CAN).
    • Quantity: 1 (required for olimex_esp32_evb environment).
    • Footprint/package: Populated board assembly with screw terminals and RJ45 connector.
    • Electrical constraints: 5 V DC external power; 3.3 V on-board logic; LAN8710A Ethernet PHY on RMII.
    • Substitution latitude: Must be Olimex ESP32-EVB to match hardware definitions.
    • Student control: No.
    • Sourcing plan: distributor lookup: ESP32-EVB

  • Wemos D1 Mini ESP32 Board

    • Identity: Wemos D1 Mini 32 (ESP32 in D1 Mini form factor).
    • Quantity: 1 (required for d1_mini_esp32 environment).
    • Footprint/package: D1 mini dual 8-pin 2.54 mm headers.
    • Electrical constraints: 5 V USB / pin; 3.3 V rail.
    • Substitution latitude: Any pin-compatible D1 Mini ESP32 clone matching pin assignments (GPIO 19, 23, 18, 16, 17, 5).
    • Student control: No.
    • Sourcing plan: retail shopping search: Wemos D1 Mini ESP32 board

  • Wireless-Tag WT32-ETH01 Module

    • Identity: Wireless-Tag WT32-ETH01 embedded Ethernet board.
    • Quantity: 1 (required for wt32_eth01 environment).
    • Footprint/package: Castellated edge / 2.54 mm dual header module with integrated RJ45 jack.
    • Electrical constraints: 3.3 V or 5 V DC supply; on-board LAN8720A RMII Ethernet transceiver.
    • Substitution latitude: Specific module required to match the hard-coded WT32 Ethernet PHY clocking and pin allocation.
    • Student control: No.
    • Sourcing plan: retail shopping search: Wireless-Tag WT32-ETH01 module

  • Wemos Lolin32 Lite Board

    • Identity: Wemos Lolin32 Lite development board.
    • Quantity: 1 (required for lolin32_lite environment).
    • Footprint/package: Slim 2.54 mm pitch breakout board with JST battery connector.
    • Electrical constraints: 5 V USB or 3.7 V LiPo battery; 3.3 V rail.
    • Substitution latitude: Any Lolin32 Lite compatible clone.
    • Student control: No.
    • Sourcing plan: retail shopping search: Wemos Lolin32 Lite

  • Wemos Lolin S2 Mini Board

    • Identity: Wemos Lolin S2 Mini development board.
    • Quantity: 1 (required for lolin_s2_mini environment).
    • Footprint/package: Dual row compact header module (ESP32-S2FN4R2).
    • Electrical constraints: 5 V USB-C; 3.3 V logic.
    • Substitution latitude: Requires ESP32-S2 board matching pin assignments (GPIO 13, 11, 12, 10, 4, 5).
    • Student control: No.
    • Sourcing plan: retail shopping search: Lolin S2 Mini ESP32-S2

  • OpenDTU Fusion v1 / v2 / v2 PoE Carrier Boards

    • Identity: OpenDTU Fusion v1, Fusion v2, or Fusion v2 PoE custom carrier boards.
    • Quantity: 1.
    • Footprint/package: Custom PCB carrier accepting an ESP32-S3 module, RF modules, status LEDs, and optional PoE/Ethernet magnetics.
    • Electrical constraints: 5 V DC USB-C or 36 V to 57 V IEEE 802.3af PoE; onboard 3.3 V LDO/buck regulators.
    • Substitution latitude: Specific open-hardware project PCB layouts matching OpenDTU Fusion pin definitions.
    • Student control: No.
    • Sourcing plan: general web research: OpenDTU Fusion v2 PCB hardware design files and fabrication gerbers

Radio Frequency (RF) Transceiver Modules

  • 2.4 GHz RF Transceiver Module (for Hoymiles MI and HM series inverters)

    • Identity: Nordic Semiconductor NRF24L01+ transceiver module, preferably with external antenna and RFX2401C Power Amplifier / Low Noise Amplifier (PA/LNA).
    • Quantity: 1.
    • Footprint/package: 2x4 pin (8-pin) 2.54 mm pitch header (standard NRF24L01+ module footprint).
    • Electrical constraints: Supply rail strictly 1.9 V to 3.6 V (run at 3.3 V DC); logic inputs are 5 V tolerant, but VCC must never exceed 3.6 V; peak current draw during PA transmit up to 150 mA.
    • Substitution latitude: Genuine Nordic NRF24L01+ or Si24R1 drop-in clone module. PA/LNA version strongly recommended for reliable solar inverter range.
    • Student control: No.
    • Sourcing plan: retail shopping search: NRF24L01+ PA LNA module with antenna

  • Sub-GHz RF Transceiver Module (for Hoymiles HMS and HMT series inverters)

    • Identity: CMOSTEK / Hoperf CMT2300A sub-GHz FSK/GFSK RF transceiver module (often branded as Ebyte E49-900M20S or similar).
    • Quantity: 1 (required for HMS/HMT inverters and OpenDTU Fusion v2 / v2 PoE environments).
    • Footprint/package: SMD castellated module or 2.54 mm DIP adapter board with external SMA/IPEX antenna connector.
    • Electrical constraints: Supply rail 1.8 V to 3.6 V (operated at 3.3 V DC); default carrier frequency set to 865.0 MHz (configurable to 868 MHz or 915 MHz); peak transmit current up to 100 mA at +20 dBm.
    • Substitution latitude: Must be based on CMOSTEK CMT2300A to match register-level SPI driver and control lines (CLK, CS, FCS, GPIO2, GPIO3, SDIO).
    • Student control: No.
    • Sourcing plan: retail shopping search: CMT2300A 868MHz SPI RF module E49-900M20S

Ethernet Transceiver Controller (for SPI Ethernet targets)

  • WIZnet W5500 SPI Ethernet Controller Module
    • Identity: WIZnet W5500 hardwired TCP/IP embedded Ethernet controller module.
    • Quantity: 1 (required for opendtufusionv2_poe environment).
    • Footprint/package: Standalone 2.54 mm pitch module with integrated RJ45 MagJack, or bare W5500 IC in 48-pin LQFP (7x7 mm) on carrier board.
    • Electrical constraints: Supply rail 3.3 V DC (current up to 132 mA); 3.3 V SPI interface (MOSI=GPIO 40, MISO=GPIO 41, SCLK=GPIO 39, CS=GPIO 42, INT=GPIO 44, RST=GPIO 43).
    • Substitution latitude: Must be WIZnet W5500; software driver uses W5500 SPI register model.
    • Student control: No.
    • Sourcing plan: distributor lookup: WIZ850IO
    • Sourcing plan (bare IC): distributor lookup: W5500

Display Module (Optional Local Status Display)

  • Monochrome Graphical OLED/LCD Display
    • Identity: 0.96 inch or 1.3 inch monochrome OLED display module (typically Solomon Systech SSD1306 or Sino Wealth SH1106 controller).
    • Quantity: 1 (optional, supported via U8g2 library).
    • Footprint/package: 4-pin 2.54 mm header (I2C: VCC, GND, SCL, SDA) or 7-pin header (SPI).
    • Electrical constraints: Supply rail 3.3 V DC (or 5 V tolerant module with on-board 3.3 V LDO); 128x64 pixel resolution.
    • Substitution latitude: Any display panel supported by olikraus/U8g2 (SSD1306, SH1106, SSD1309, ST7567, etc.).
    • Student control: No.
    • Sourcing plan: retail shopping search: 0.96 inch I2C OLED display 128x64 SSD1306

Passive & Support Hardware

  • Decoupling Electrolytic / Tantalum Capacitor for NRF24L01+

    • Identity: 10 µF to 100 µF capacitor, low ESR, rated ≥ 6.3 V.
    • Quantity: 1 per NRF24L01+ module.
    • Footprint/package: Radial leaded electrolytic (through-hole) or 1206 / 1210 SMD ceramic soldered directly across NRF24L01+ VCC and GND pins.
    • Electrical constraints: 3.3 V rail. Required to absorb transient current spikes during RF packet bursts and prevent ESP32 brownouts or transceiver packet loss.
    • Substitution latitude: Any 10 µF, 47 µF, or 100 µF capacitor rated ≥ 6.3 V.
    • Student control: No.
    • Sourcing plan: distributor lookup (representative example — sources give spec only): UEP1A470MDD

  • Decoupling Ceramic Capacitor

    • Identity: 100 nF (0.1 µF) ceramic capacitor, 50 V, X7R.
    • Quantity: 1 per RF transceiver module.
    • Footprint/package: 0805 SMD or 2.54 mm pitch axial/radial through-hole.
    • Electrical constraints: 3.3 V rail.
    • Substitution latitude: Any standard 100 nF ceramic capacitor.
    • Student control: No.
    • Sourcing plan: distributor lookup (representative example — sources give spec only): C0805C104K5RACTU

  • Indicator Status LEDs (for OpenDTU Fusion targets)

    • Identity: Surface mount or through-hole indicator LEDs (LED0 on GPIO 17, LED1 on GPIO 18).
    • Quantity: 2.
    • Footprint/package: 0805 SMD or 3 mm through-hole.
    • Electrical constraints: Forward current 2 mA to 10 mA; 3.3 V logic drive with appropriate series current limiting resistors (e.g. 330 Ω to 1 kΩ).
    • Substitution latitude: Any standard red, green, or yellow indicator LEDs.
    • Student control: No.
    • Sourcing plan: distributor lookup (representative example — sources give spec only): LG R971-KN-1 (green 0805)

Software and network dependencies

The gateway depends on an embedded C++ PlatformIO firmware toolchain, nine pinned Arduino/C++ libraries, a Node.js web application frontend stack managed by Yarn, and multiple network services.

Embedded Firmware Platform and Toolchain

  • PlatformIO Core & Espressif32 Platform

    • Name: PlatformIO platform espressif32.
    • Version: 6.10.0.
    • Where the version came from: pinned in platformio.ini line 22 (platform = espressif32@6.10.0).
    • Manifest location: platformio.ini.
    • Check plan: support-status lookup: platformio/espressif32 6.10.0

  • Arduino Framework for ESP32

    • Name: arduino framework (within espressif32@6.10.0, based on ESP-IDF v4.4.x / Arduino-ESP32 v2.0.x).
    • Version: bundled with espressif32@6.10.0 (version not stated independently).
    • Where the version came from: stated in documentation (framework = arduino in platformio.ini).
    • Manifest location: platformio.ini.
    • Check plan: not checkable: bundled framework dependency within PlatformIO platform

  • Filesystem Packaging Tool

    • Name: platformio/tool-mklittlefs
    • Version: unpinned (installed automatically by PlatformIO).
    • Where the version came from: not stated in platformio.ini line 24.
    • Manifest location: platformio.ini.
    • Check plan: not checkable: unpinned version

Embedded C++ Firmware Libraries

All embedded libraries are declared in platformio.ini under [env] lib_deps:

  • ESPAsyncWebServer

    • Name: ESP32Async/ESPAsyncWebServer
    • Version: 3.10.3
    • Where the version came from: pinned in platformio.ini line 52.
    • Check plan: vulnerability lookup: ESPAsyncWebServer / GitHub / 3.10.3

  • AsyncTCP

    • Name: ESP32Async/AsyncTCP
    • Version: 3.4.10
    • Where the version came from: pinned in platformio.ini line 53.
    • Check plan: vulnerability lookup: AsyncTCP / GitHub / 3.4.10

  • ArduinoJson

    • Name: bblanchon/ArduinoJson
    • Version: 7.4.3
    • Where the version came from: pinned in platformio.ini line 54.
    • Check plan: vulnerability lookup: ArduinoJson / GitHub / 7.4.3

  • espMqttClient

    • Name: espMqttClient (source: https://github.com/bertmelis/espMqttClient.git)
    • Version: v1.7.2
    • Where the version came from: pinned in platformio.ini line 55 (#v1.7.2).
    • Check plan: vulnerability lookup: espMqttClient / GitHub / v1.7.2

  • RF24

    • Name: nrf24/RF24
    • Version: 1.5.0
    • Where the version came from: pinned in platformio.ini line 56.
    • Check plan: vulnerability lookup: RF24 / GitHub / 1.5.0

  • U8g2

    • Name: olikraus/U8g2
    • Version: 2.36.18
    • Where the version came from: pinned in platformio.ini line 57.
    • Check plan: vulnerability lookup: U8g2 / GitHub / 2.36.18

  • sunset

    • Name: buelowp/sunset
    • Version: 1.1.7
    • Where the version came from: pinned in platformio.ini line 58.
    • Check plan: vulnerability lookup: sunset / GitHub / 1.1.7

  • TaskScheduler

    • Name: arkhipenko/TaskScheduler
    • Version: 4.0.4
    • Where the version came from: pinned in platformio.ini line 59.
    • Check plan: vulnerability lookup: TaskScheduler / GitHub / 4.0.4

  • MycilaNTP

    • Name: mathieucarbou/MycilaNTP
    • Version: 6.0.5
    • Where the version came from: pinned in platformio.ini line 60.
    • Check plan: vulnerability lookup: MycilaNTP / GitHub / 6.0.5

Web Frontend Toolchain & Package Manager

  • Yarn Package Manager
    • Name: yarn
    • Version: 1.22.22 (hash: sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e)
    • Where the version came from: pinned in webapp_package.json line 44 (packageManager field).
    • Manifest location: webapp_package.json.
    • Check plan: vulnerability lookup: yarn / npm / 1.22.22

Web Frontend Runtime Dependencies (webapp_package.json)

All frontend runtime packages are located in webapp_package.json under dependencies. Note that version ranges are unpinned using caret syntax except where noted:

  • @popperjs/core: version ^2.11.8 (unpinned caret range in webapp_package.json). Check plan: vulnerability lookup: @popperjs/core / npm / 2.11.8
  • bootstrap: version ^5.3.8 (unpinned caret range in webapp_package.json). Check plan: vulnerability lookup: bootstrap / npm / 5.3.8
  • bootstrap-icons-vue: version ^1.11.3 (unpinned caret range in webapp_package.json). Check plan: vulnerability lookup: bootstrap-icons-vue / npm / 1.11.3
  • mitt: version ^3.0.1 (unpinned caret range in webapp_package.json). Check plan: vulnerability lookup: mitt / npm / 3.0.1
  • sortablejs: version ^1.15.7 (unpinned caret range in webapp_package.json). Check plan: vulnerability lookup: sortablejs / npm / 1.15.7
  • spark-md5: version ^3.0.2 (unpinned caret range in webapp_package.json). Check plan: vulnerability lookup: spark-md5 / npm / 3.0.2
  • vue: version ^3.5.31 (unpinned caret range in webapp_package.json). Check plan: vulnerability lookup: vue / npm / 3.5.31
  • vue-i18n: version 11.3.0 (pinned in webapp_package.json line 23). Check plan: vulnerability lookup: vue-i18n / npm / 11.3.0
  • vue-router: version ^5.0.4 (unpinned caret range in webapp_package.json). Check plan: vulnerability lookup: vue-router / npm / 5.0.4

Web Frontend Development & Build Tooling (webapp_package.json)

All frontend dev packages are located in webapp_package.json under devDependencies. Note that these are unpinned caret/tilde ranges without a lockfile in the upload:

  • vite: version ^8.0.3 (unpinned in webapp_package.json). Check plan: vulnerability lookup: vite / npm / 8.0.3
  • @vitejs/plugin-vue: version ^6.0.5 (unpinned in webapp_package.json). Check plan: vulnerability lookup: @vitejs/plugin-vue / npm / 6.0.5
  • vite-plugin-compression: version ^0.5.1 (unpinned in webapp_package.json). Check plan: vulnerability lookup: vite-plugin-compression / npm / 0.5.1
  • vite-plugin-css-injected-by-js: version ^4.0.1 (unpinned in webapp_package.json). Check plan: vulnerability lookup: vite-plugin-css-injected-by-js / npm / 4.0.1
  • @intlify/unplugin-vue-i18n: version ^11.0.7 (unpinned in webapp_package.json). Check plan: vulnerability lookup: @intlify/unplugin-vue-i18n / npm / 11.0.7
  • typescript: version ~5.9.3 (unpinned tilde range in webapp_package.json). Check plan: vulnerability lookup: typescript / npm / 5.9.3
  • vue-tsc: version ^3.2.6 (unpinned in webapp_package.json). Check plan: vulnerability lookup: vue-tsc / npm / 3.2.6
  • @vue/tsconfig: version ^0.9.1 (unpinned in webapp_package.json). Check plan: vulnerability lookup: @vue/tsconfig / npm / 0.9.1
  • @tsconfig/node24: version ^24.0.4 (unpinned in webapp_package.json). Check plan: vulnerability lookup: @tsconfig/node24 / npm / 24.0.4
  • sass: version ^1.98.0 (unpinned in webapp_package.json). Check plan: vulnerability lookup: sass / npm / 1.98.0
  • terser: version ^5.46.1 (unpinned in webapp_package.json). Check plan: vulnerability lookup: terser / npm / 5.46.1
  • pulltorefreshjs: version ^0.1.22 (unpinned in webapp_package.json). Check plan: vulnerability lookup: pulltorefreshjs / npm / 0.1.22
  • eslint: version ^10.1.0 (unpinned in webapp_package.json). Check plan: vulnerability lookup: eslint / npm / 10.1.0
  • eslint-config-prettier: version ^10.1.8 (unpinned in webapp_package.json). Check plan: vulnerability lookup: eslint-config-prettier / npm / 10.1.8
  • eslint-plugin-oxlint: version ~1.50.0 (unpinned in webapp_package.json). Check plan: vulnerability lookup: eslint-plugin-oxlint / npm / 1.50.0
  • eslint-plugin-vue: version ^10.8.0 (unpinned in webapp_package.json). Check plan: vulnerability lookup: eslint-plugin-vue / npm / 10.8.0
  • npm-run-all: version ^4.1.5 (unpinned in webapp_package.json). Check plan: vulnerability lookup: npm-run-all / npm / 4.1.5
  • oxlint: version ~1.50.0 (unpinned in webapp_package.json). Check plan: vulnerability lookup: oxlint / npm / 1.50.0
  • prettier: version ^3.8.1 (unpinned in webapp_package.json). Check plan: vulnerability lookup: prettier / npm / 3.8.1
  • @eslint/js: version ^10.0.1 (unpinned in webapp_package.json). Check plan: vulnerability lookup: @eslint/js / npm / 10.0.1
  • @vue/eslint-config-typescript: version ^14.5.0 (unpinned in webapp_package.json). Check plan: vulnerability lookup: @vue/eslint-config-typescript / npm / 14.5.0
  • Type definition packages: @types/bootstrap (^5.2.10), @types/node (^25.5.0), @types/pulltorefreshjs (^0.1.7), @types/sortablejs (^1.15.9), @types/spark-md5 (^3.0.5). All unpinned in webapp_package.json. Check plans: not checkable: typescript type definitions only.

Network Exposure and Default Credentials

The network topology, listening services, and default authentication credentials are explicitly defined in defaults.h:

  • Wi-Fi Station (Client) Interface:
    • Automatically joins a local 802.11 b/g/n 2.4 GHz wireless network using DHCP (#define WIFI_DHCP true). Reconnection timeout is set to 60 seconds with a redo retry interval of 600 seconds (defaults.h lines 17-18).
  • Wi-Fi Soft Access Point (Captive Portal / Setup):
    • Active on boot if unconfigured or unable to connect.
    • SSID: OpenDTU- followed by chip ID / MAC suffix (APP_HOSTNAME format OpenDTU-%06X, ACCESS_POINT_NAME "OpenDTU-", line 12).
    • Password: openDTU42 (#define ACCESS_POINT_PASSWORD "openDTU42", line 13).
    • SoftAP timeout: 3 minutes (#define ACCESS_POINT_TIMEOUT 3, line 14).
  • Embedded Web Server (HTTP):
    • Port: TCP port 80 (#define HTTP_PORT 80, line 10).
    • Default Administrative Username: admin (#define AUTH_USERNAME "admin", line 15).
    • Read-Only Access: Enabled by default without authentication (#define SECURITY_ALLOW_READONLY true, line 16).
    • Exposed Endpoints: REST API endpoints including /api/limit/config, /api/livedata/status, /api/prometheus/metrics, /api/eventlog/status, and /api/devinfo/status (OpenDTU_README.md).
  • Ethernet Interface (Optional Targets):
    • Enabled when compiled with -DOPENDTU_ETHERNET (Olimex PoE, Olimex EVB, WT32-ETH01, OpenDTU Fusion v2 PoE). Uses standard DHCP.
  • MQTT Client (Outbound Telemetry):
    • Port: TCP port 1883 (#define MQTT_PORT 1883U, line 32); disabled by default (#define MQTT_ENABLED false, line 30).
    • Base Topic: solar/ (#define MQTT_TOPIC "solar/", line 35).
    • Last Will and Testament (LWT) Topic: dtu/status with QoS 2 (defaults.h lines 86-89).
    • Home Assistant Auto-Discovery Topic: homeassistant/ (defaults.h line 100).
    • TLS Support: Optional (#define MQTT_TLS false, line 37). Built-in root CA certificate provided in full in defaults.h (ISRG Root X1 / Let's Encrypt Root CA, valid June 4 2015 to June 4 2035).
  • NTP Network Time Client (Outbound):
    • Queries opendtu.pool.ntp.org (fallback pool.ntp.org) on UDP port 123 (defaults.h lines 24-25).
  • Syslog Client (Outbound UDP):
    • Port: UDP port 514; disabled by default (#define SYSLOG_ENABLED false, #define SYSLOG_PORT 514, lines 21-22).
  • mDNS Service:
    • Disabled by default (#define MDNS_ENABLED false, line 20).
  • USB CDC Serial Console:
    • USB CDC virtual COM port enabled on ESP32-S3 and ESP32-C3 builds at 115200 baud (SERIAL_BAUDRATE 115200).

Remaining Temporal Dependencies

External Downloads and Web Resources

  • Documentation URL: https://tbnobody.github.io/OpenDTU-docs/ (stated in OpenDTU_README.md).
  • Supported Inverter Compatibility Matrix: https://www.opendtu.solar/hardware/inverter_overview/ (stated in OpenDTU_README.md).
  • Project Forum Origin: https://www.mikrocontroller.net/topic/525778 (Mikrocontroller.net reverse engineering thread).
  • Upstream Git Repositories:
    • Git library dependency: https://github.com/bertmelis/espMqttClient.git#v1.7.2.
    • OpenDTU main repository: https://github.com/tbnobody/OpenDTU.
  • Hardware reference links in platformio.ini:
    • Olimex ESP32-PoE: https://www.olimex.com/Products/IoT/ESP32/ESP32-POE/open-source-hardware
    • Olimex ESP32-EVB: https://www.olimex.com/Products/IoT/ESP32/ESP32-EVB/open-source-hardware
    • Wireless-Tag WT32-ETH01: http://www.wireless-tag.com/portfolio/wt32-eth01/
    • Waveshare ESP-S3-12K-Kit: https://www.waveshare.com/wiki/NodeMCU-ESP-S3-12K-Kit

Hardware Fabrication and Partitions

  • Flash Memory & Partition Tables:
    • The firmware relies on custom partition schemes defined in partitions_custom_4mb.csv (default 4 MB flash) and partitions_custom_16mb.csv (16 MB flash). Note that upgrading from firmware versions before 15.03.2023 requires a complete repartitioning and reflashing of the ESP32 storage layout as warned in OpenDTU_README.md.
  • Carrier Board PCB Fabrication (OpenDTU Fusion targets):
    • Layer count: Not stated in the sources (EDA files omitted from repository upload). Standard OpenDTU Fusion carrier boards typically employ 2-layer FR4 boards (1.6 mm thickness, 1 oz copper) accommodating through-hole pin sockets for ESP32 and RF daughtercards, or 4-layer boards for PoE variants handling Ethernet differential routing. Dimensions are not stated in the sources.