Readiness: FarmBot Open-Source Farming Robot

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $13.28–$75.00 (controller board only; the host server is unpriced and no electromechanical BOM was uploaded) Cybersecurity — software & network: Do not place on an open network

This is the cold check for this lab — it establishes the baseline every future report will measure drift against. Every part the snapshot actually lists is easy to buy today and none is anywhere near end of production: all three Raspberry Pi controller options carry Raspberry Pi obsolescence statements running to 2030 or 2034, bare boards run $13.28 to $75.00 depending on which target you build for, and the host server is ordinary commodity hardware or a cloud instance. Nothing needed a substitute. The verdict is not a clean "Ready" for two reasons. First, this upload is the FarmBot software tree only: it contains no schematics, board files, Gerbers or parts list for the machine itself, so the motors, motor drivers, encoders, solenoid valves, gantry extrusions and power distribution that make a FarmBot move were never in scope and cannot be called ready or not ready. Second, the host machine is deliberately left unpriced because no specific machine or instance was chosen. An instructor can stand up the control software from these materials; they cannot build the robot from them.

Action required

None — all checked parts are sourceable.

Cybersecurity — software & network

Do not place on an open network — The device firmware runs on an end-of-life Erlang runtime with no fix path, ships a publicly known remote-connection secret alongside an enabled SSH daemon, and carries several high-severity flaws in the web stack it exposes on the network.

What this means for your lab

Treat this as equipment that must not sit on a shared campus or public network. The FarmBot controller runs a web server and an SSH service on the Raspberry Pi, and the firmware ships with a published connection secret (the literal word 'democookie') that is meant to be replaced before you build an image; leave it as shipped and anyone who can reach the device on the network can attach to the software running it and command the machine. The device's web and HTTP libraries also have known flaws that let a stranger crash it with a single malformed request, and the Erlang runtime it is built on stopped receiving security fixes in May 2026, so those will not be patched for you. If you self-host the web app, the default compose file also opens the message broker and its administration web page directly to the network. What to do: put the FarmBot and its server on their own isolated network segment or VLAN with no inbound access from outside, set your own release cookie and your own admin, database and Devise secrets before deploying, install the Ruby side from the committed lockfile rather than letting it pull the newest gems, and talk to campus IT before connecting any of it to the institutional network. Nothing here means the software is unusable in a lab - it means it should be run on a network you control.

Not checked

• FarmBot Web App frontend transitive dependencies (bun.lock): bun.lock is not a lockfile format this pipeline parses; only the 95 direct pins in package.json were checked
• RabbitMQ / MQTT broker image: version not determined - the compose file builds it from docker_configs/rabbitmq.Dockerfile, which was not fetched
• Bun runtime: unpinned - package.json declares bun@1.x, a range, so there is no version to check
• farmbot_system_rpi / farmbot_system_rpi3 / farmbot_system_rpi4: source-hosted GitHub dependencies pinned by git tag and commit; no package registry and no advisory database covers them
• Linux kernel and Buildroot userland inside the Nerves firmware images: the built firmware images were not fetched or unpacked, so only the Elixir and Erlang layer above them was checked
• Ubuntu Server (host operating system): no version is stated anywhere in the project or the snapshot, so no support-status lookup was possible
• example.env: not a dependency manifest - the parser classified this environment-variable template as a requirements file, so its 60 rows are variable names, not packages, and no versions were checked from it

Parts

Bill of Materials

Two near-match traps appeared in the shopping results and are recorded here so a future check does not mistake them for price movement. The $25.00 DigiKey listing "Raspberry Pi Model B+ 512MB RAM" surfaced under the Pi 3 Model B+ search but is the 2014 Pi 1 Model B+ — a different board, priced in its own row above. And the "Raspberry Pi Zero 2 W" listings at $18.00 and $28.93 surfaced under the Zero W search; the snapshot restricts that BOM line to the ARMv6 BCM2835 architecture the farmbot_system_rpi target builds for, so the Zero 2 W is out of spec, not a cheaper equivalent.

Substitutes

None needed.

Other dependencies

• No hardware design files at all. The snapshot's own fabrication section records no board layer count and no board dimensions because no PCB CAD, Gerber, drill or fabrication files were uploaded. Downstream checking of the physical build — motor drivers, rotary encoders, solenoid valves, power distribution — cannot be performed from these materials. This is the single largest gap in the report.
• Historical OS releases, https://github.com/FarmBot/farmbot_os/releases — fetched this session and readable. The release list is live and current: newest entries v15.5.3-rc1 and v15.5.2, which matches the 15.5.2 in the repository's own VERSION file, so the download channel the lab depends on is alive and in step with the source tree.
• OS image downloads, https://my.farm.bot/os — fetched this session; the page downloaded but returned no extractable text (it is JavaScript-rendered). Reachable; content not checked.
• Official documentation, https://software.farm.bot/docs/farmbot-os — fetched this session; downloaded but no extractable text. Reachable; content not checked.
• Vendor host-machine specification, https://raw.githubusercontent.com/FarmBot/Farmbot-Web-App/main/DEPLOYMENT.md — fetched this session; returned no extractable text, so FarmBot's own stated minimum host spec is not checked. The "≥ 2 cores, 4 GB RAM" figure in the Parts table is the snapshot's, not the vendor's.
• Further farm.bot properties listed in the snapshot — https://developer.farm.bot/docs/farmbot-os, https://developer.farm.bot/docs/api-docs, https://software.farm.bot/docs/getting-started, https://my.farm.bot/, http://disclosure.farm.bot/ and https://farm.bot/responsible-disclosure-of-security-vulnerabilities/: not checked, no fetch attempted this run. All sit on the same two hosts as the two pages above, which did respond.

Watch list

• The missing electromechanical BOM. Until the lab's hardware files are uploaded, every re-check will keep reporting the same three Raspberry Pi boards and nothing about the machine. Getting the parts list into the lab materials is worth more than any sourcing action in this report.
• Raspberry Pi Zero W / Pi 1 Model B+ (the ARMv6 target). These are the oldest boards in the list and the ones a supplier is most likely to quietly swap for a Zero 2 W, which the farmbot_system_rpi build does not target. Check what actually arrives, and watch for the 01 Jan 2030 end-of-production date coming into view.
• Raspberry Pi 3 Model B+. Now priced at or above a Pi 4 2 GB in several listings, so its cost advantage is gone; if that persists, standardising on the Pi 4 target is the cheaper and longer-lived choice (2034 versus 2030).
• Retail-only pricing. All three boards were priced from consumer shopping listings rather than an authorized distributor catalog, so stock levels are unknown and prices move faster than distributor pricing. Expect noisier drift on these rows than on a typical BOM.
• Host server sizing. Unpriced this run by design. Once a specific machine or cloud instance is chosen, record it so the next check has a baseline.