nils/mg4
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 28 Wiki Activity

App 2.41.0, server 2.9.0: recordings reach the server

Browse Source 
A finished signal recording goes to an outbox and is sent gzipped with
the car's token (PUT /v1/logs/{name}); the service retries every 2
minutes while the car is offline. The server keeps the newest 200 on a
new volume (LOGS_DIR); reading takes a token of its own (LOGS_TOKEN).
fetch-logs in the dev shell fetches new ones into logs/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6
This commit is contained in:
nils
2026-10-27 10:22:40 +01:00
co-authored by Claude Opus 5.5
parent 16e6f349da
commit eebe840b6a
20 changed files with 840 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/README.md
+11 -2
View File
@@ -7,7 +7,7 @@ is applied automatically. Apply them yourself.
|---|---|
| `namespace.yaml` | Namespace `mg4` |
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem) and Service |
| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem), Service, and two 1Gi PVCs: the map tile cache and the logs the car sends |
| `grafana.yaml` | Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
| `grafana/` | The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
| `ingress.yaml` | Traefik `IngressRoute`s for car.k8s.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
@@ -22,7 +22,8 @@ is applied automatically. Apply them yourself.
covered by Traefik's default certificate.
2. **Create the Secrets.** `cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml` (gitignored), replace
every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,
approval password for pairing, the forge token for app updates) and `grafana-admin`.
approval password for pairing, the forge token for app updates, the token that reads the
car's logs) and `grafana-admin`.
Keep the template itself on placeholders only.
3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
@@ -54,6 +55,14 @@ the forge that can only **read** the `nils/mg4` repository, put it there, apply
restart the server. Without it, updates are off (the car's updater gets a 404). `FORGE_URL`
and `FORGE_REPO` are set in `server.yaml`.
## Logs from the car
The car sends its signal recordings to the server (`server/README.md`, "Logs from the car"),
which keeps them on the `mg4-server-logs` volume at `LOGS_DIR`. Reading them needs `LOGS_TOKEN`
from the `mg4-server` Secret: `openssl rand -hex 32`, put it there (it must differ from
`INGEST_TOKEN`), apply the Secret and restart the server. For `fetch-logs` on your machine, put
the same value in `~/.config/nilsmg4/logs-token`. Without it the car still sends; nobody can read.
## Agent access
[`agent-access/`](agent-access/README.md) creates a service account limited to the `mg4`