Switch the lab reflector to jayReflector and harden local station use.

Build DJ1JAY’s fork with an optional Satellite/Trunk stub, allow -c/--config, open capture and playback as separate devices, and add a lab start helper.

Co-authored-by: Cursor <cursoragent@cursor.com>

svxlink-docker/config/svxreflector.conf

@@ -1,6 +1,10 @@
 ###################################################################
-# Local lab SvxReflector for Funknetz (protocol 2.0 / ReflectorV2)
+# Local lab jayReflector for Funknetz (protocol 2.0 / ReflectorV2)
 # Secrets here are placeholders — do not reuse production keys.
+#
+# Standalone by default: local clients only. FM-Funknetz Satellite/Trunk
+# keys live in svxreflector.link.conf and are appended when
+# ENABLE_FM_LINK=1 (see .env and docker-compose).
 ###################################################################
 
 [GLOBAL]
@@ -8,10 +12,13 @@ TIMESTAMP_FORMAT="%c"
 LISTEN_PORT=5300
 TG_FOR_V1_CLIENTS=999
 # CODECS=OPUS
-COMMAND_PTY=/dev/shm/reflector_ctrl
+COMMAND_PTY=/dev/shm/svxreflector_ctrl
+CERT_PKI_DIR=/etc/svxlink/pki/
+# Optional status JSON (publish 8080 in compose if you enable this):
+# HTTP_SRV_PORT=8080
 
-# Newer SvxReflector bootstraps a local PKI even for protocol 2.0 AUTH_KEY clients.
-# COMMON_NAME is required so the server certificate can be generated on first start.
+# jayReflector / modern SvxReflector bootstraps a local PKI even for
+# protocol 2.0 AUTH_KEY clients. COMMON_NAME is required on first start.
 [SERVER_CERT]
 COMMON_NAME=funknetz-lab.local
 SUBJECT_ALT_NAME=DNS:funknetz-lab.local,DNS:localhost,IP:127.0.0.1

svxlink-docker/config/svxreflector.link.conf

@@ -0,0 +1,41 @@
+###################################################################
+# Optional FM-Funknetz link stub (jayReflector)
+#
+# Default: leave ENABLE_FM_LINK=0 in .env — this file is ignored.
+# When DJ1JAY provides values:
+#   1. Fill ONE of the blocks below (prefer Satellite for home/NAT labs).
+#   2. Set ENABLE_FM_LINK=1 in .env
+#   3. docker compose up -d
+#
+# Satellite (recommended): this reflector dials OUT to the parent on
+# TCP 5303. No public DNS, no inbound peer port, no port-forward required
+# for the link. Local Funknetz clients still use host :5300 only.
+#
+# Trunk: equal mesh peer; needs mutual reachability on TCP 5302 and a
+# matching [TRUNK_x] section name + SECRET on both sides.
+#
+# Do not commit real secrets. Prefer a local override or keep secrets
+# only in your private .env workflow if you copy this file.
+# Docs: docs/research/2026-10-07-jayreflector-fm-funknetz.md
+# README: https://github.com/dj1jay/jayReflector
+###################################################################
+
+# --- Satellite (fill from DJ1JAY; uncomment to use) ---
+# SATELLITE_OF=parent.example.org:5303
+# SATELLITE_ID=lab-yourcall
+# SATELLITE_SECRET="replace-with-secret-from-dj1jay"
+# Only these TGs cross to/from the parent (bidirectional). Omit for all TGs.
+# SATELLITE_FILTER=2621,2629,20
+
+# --- Trunk peer alternative (fill from DJ1JAY; usually leave commented) ---
+# LOCAL_PREFIX=9
+# TRUNK_LISTEN_PORT=5302
+#
+# [TRUNK_LAB_FM]
+# HOST=fm-parent.example.org
+# PORT=5302
+# SECRET="replace-with-agreed-trunk-secret"
+# REMOTE_PREFIX=262
+# ALLOW_TGS=2621,2629,20
+# # TG_MAP=1:2624100
+# MQTT_NAME=Lab-YourCall