App 2.41.0, server 2.9.0: recordings reach the server

A finished signal recording goes to an outbox and is sent gzipped with
the car's token (PUT /v1/logs/{name}); the service retries every 2
minutes while the car is offline. The server keeps the newest 200 on a
new volume (LOGS_DIR); reading takes a token of its own (LOGS_TOKEN).
fetch-logs in the dev shell fetches new ones into logs/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6

k8s/README.md

@@ -7,7 +7,7 @@ is applied automatically. Apply them yourself.
 |---|---|
 | `namespace.yaml` | Namespace `mg4` |
 | `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
-| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem) and Service |
+| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem), Service, and two 1Gi PVCs: the map tile cache and the logs the car sends |
 | `grafana.yaml` | Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
 | `grafana/` | The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
 | `ingress.yaml` | Traefik `IngressRoute`s for car.k8s.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
@@ -22,7 +22,8 @@ is applied automatically. Apply them yourself.
    covered by Traefik's default certificate.
 2. **Create the Secrets.** `cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml` (gitignored), replace
    every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,
-   approval password for pairing, the forge token for app updates) and `grafana-admin`.
+   approval password for pairing, the forge token for app updates, the token that reads the
+   car's logs) and `grafana-admin`.
    Keep the template itself on placeholders only.
 3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
    secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
@@ -54,6 +55,14 @@ the forge that can only **read** the `nils/mg4` repository, put it there, apply
 restart the server. Without it, updates are off (the car's updater gets a 404). `FORGE_URL`
 and `FORGE_REPO` are set in `server.yaml`.
 
+## Logs from the car
+
+The car sends its signal recordings to the server (`server/README.md`, "Logs from the car"),
+which keeps them on the `mg4-server-logs` volume at `LOGS_DIR`. Reading them needs `LOGS_TOKEN`
+from the `mg4-server` Secret: `openssl rand -hex 32`, put it there (it must differ from
+`INGEST_TOKEN`), apply the Secret and restart the server. For `fetch-logs` on your machine, put
+the same value in `~/.config/nilsmg4/logs-token`. Without it the car still sends; nobody can read.
+
 ## Agent access
 
 [`agent-access/`](agent-access/README.md) creates a service account limited to the `mg4`

k8s/secrets/secrets.example.yaml

@@ -30,6 +30,9 @@ stringData:
   # relays the releases to the car; k8s/README.md, "App updates"). Leave it empty to switch
   # updates off.
   FORGE_TOKEN: CHANGE-ME-read-only-forge-token
+  # Reads the files the car sends from its Logs tab (GET /v1/logs). At least 24 characters and
+  # not the INGEST_TOKEN. Leave it empty to switch reading off; the car can still send.
+  LOGS_TOKEN: CHANGE-ME-openssl-rand-hex-32
 ---
 apiVersion: v1
 kind: Secret

k8s/server.yaml

@@ -16,6 +16,22 @@ spec:
     requests:
       storage: 1Gi
 ---
+# The files the car sends from its Logs tab (signal recordings), read with LOGS_TOKEN. Unlike
+# the map cache these are not fetched again, so they get a volume of their own.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mg4-server-logs
+  namespace: mg4
+  labels:
+    app.kubernetes.io/name: mg4-server
+    app.kubernetes.io/part-of: mg4
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 1Gi
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -73,12 +89,16 @@ spec:
               value: https://tiles.openfreemap.org/planet
             - name: MAP_CACHE_DIR
               value: /var/cache/mg4-maps
+            # Files from the car's Logs tab, kept on the volume below (the newest 200, at most
+            # 180 days). Reading them needs LOGS_TOKEN from the Secret; empty switches reading off.
+            - name: LOGS_DIR
+              value: /var/lib/mg4-logs
             - name: INFLUX_TOKEN
               valueFrom:
                 secretKeyRef:
                   name: influxdb-auth
                   key: admin-token
-          # INGEST_TOKEN, APPROVAL_PASSWORD, FORGE_TOKEN.
+          # INGEST_TOKEN, APPROVAL_PASSWORD, FORGE_TOKEN, LOGS_TOKEN.
           envFrom:
             - secretRef:
                 name: mg4-server
@@ -107,10 +127,15 @@ spec:
           volumeMounts:
             - name: maps
               mountPath: /var/cache/mg4-maps
+            - name: logs
+              mountPath: /var/lib/mg4-logs
       volumes:
         - name: maps
           persistentVolumeClaim:
             claimName: mg4-server-maps
+        - name: logs
+          persistentVolumeClaim:
+            claimName: mg4-server-logs
 ---
 apiVersion: v1
 kind: Service