BirdDog PLAY firmware package generator

Builds an installable .fw carrying an SSH key, Tailscale and an NDI KVM endpoint. Everything is assembled in this browser — nothing is uploaded, and no existing firmware file is needed.

Read this first. This package has been installed on a real PLAY: SSH, Tailscale and the NDI KVM endpoint all confirmed working. That is one unit on firmware 1.0.30 — treat your first install as an experiment on a unit you can afford to have offline.

The installer refuses to run unless /etc/birddog-hardware-version reads BirdDog PLAY or BirdDog Pod, never touches sshd, birddog-update-wrapper, BirdDogUpdateRunner or the web UI, and cannot reach the kernel or bootloader — those are not in this package format at all.

Access

SSH public key

Installed to /root/.ssh/authorized_keys. SSH on the PLAY listens on port 9031.

Payload

Tailscale

Current stable arm64 build into /userdata/tailscale, with a systemd unit. No auth key is baked in — it would sit in cleartext in the archive. SSH in afterwards and run tailscale up. Stock firmware has no /dev/net/tun and ships no kernel modules at all, so you get userspace-networking. Inbound still works — SSH, the web UI and the :8080 API are all reachable over the tailnet, measured at ~195 Mbps against a 920 Mbps wired baseline. Enough for NDI|HX and SRT, not for full-bandwidth NDI.

NDI KVM endpoint

Installs bdkvm to /userdata/bd-kvm under its own self-supervising unit, rather than behind BirdDog's 1.0.34-only hooks (which bdup.sh deletes on every vendor update). Needs a USB keyboard or mouse attached and an NDI source selected to do anything.

Reboot when finished

Off by default. Without it the installer restarts BirdDogRunner itself, so video comes back without a reboot.

Build

Build tag

Names the file and is logged on the device as the installed build.

Tailscale tarball (optional)

Leave empty to fetch the current stable arm64 release and verify it against the published SHA-256. Supply tailscale_<version>_arm64.tgz yourself to pin a version or build offline.

Installing it

Open the PLAY's web UI and upload the .fw on the firmware page, exactly as you would a vendor release.
Read the first-boot report at http://<play-ip>/static/bd-probe.txt — it works even if the SSH key did not take, and reports whether /dev/net/tun exists, free space, and USB input topology.
ssh -p 9031 root@<play-ip>, then /userdata/tailscale/tailscale --socket=/run/bd-tailscaled.sock up.
Delete the probe report when you are done: rm /srv/birddog-web-ui/static/bd-probe.txt.

Before you put it on a tailnet

The PLAY's REST API on :8080 has no authentication of any kind and sets Access-Control-Allow-Origin: *. Joining a tailnet does not change that — anyone who can reach the device on the tailnet can reconfigure it without credentials. Scope an ACL for this node; the device has no access control of its own to fall back on.

Undoing it

systemctl disable --now bd-tailscaled bd-kvm
rm -rf /userdata/tailscale /userdata/bd-kvm /etc/systemd/system/bd-{tailscaled,kvm}.service

Then reflash stock firmware if you want a clean unit. Recovery-mode flashing of the factory image is a proven path, but it restores factory state — not this unit's provisioned serial, hostname or /userdata.