App 2.41.0, server 2.9.0: recordings reach the server

A finished signal recording goes to an outbox and is sent gzipped with
the car's token (PUT /v1/logs/{name}); the service retries every 2
minutes while the car is offline. The server keeps the newest 200 on a
new volume (LOGS_DIR); reading takes a token of its own (LOGS_TOKEN).
fetch-logs in the dev shell fetches new ones into logs/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6

server/main.go

@@ -36,6 +36,8 @@ type config struct {
 	forgeToken   string
 	mapTilesURL  string
 	mapCacheDir  string
+	logsDir      string
+	logsToken    string
 }
 
 // loadConfig reads the environment and fails closed: a missing InfluxDB setting or a
@@ -55,6 +57,8 @@ func loadConfig(getenv func(string) string) (config, error) {
 		forgeToken:   getenv("FORGE_TOKEN"),
 		mapTilesURL:  getenv("MAP_TILES_URL"),
 		mapCacheDir:  getenv("MAP_CACHE_DIR"),
+		logsDir:      getenv("LOGS_DIR"),
+		logsToken:    getenv("LOGS_TOKEN"),
 	}
 	if c.listenAddr == "" {
 		c.listenAddr = ":8080"
@@ -89,6 +93,17 @@ func loadConfig(getenv func(string) string) (config, error) {
 			return config{}, errors.New("MAP_TILES_URL must be an https URL or \"off\"")
 		}
 	}
+	// Logs from the car are optional (LOGS_DIR); reading them needs a token of their own, as
+	// long as the ingest token, and never the ingest token itself.
+	if c.logsToken != "" && c.logsDir == "" {
+		return config{}, errors.New("LOGS_TOKEN is set but LOGS_DIR is not")
+	}
+	if c.logsToken != "" && len(c.logsToken) < minIngestTokenLength {
+		return config{}, fmt.Errorf("LOGS_TOKEN must be at least %d characters", minIngestTokenLength)
+	}
+	if c.logsToken != "" && c.logsToken == c.ingestToken {
+		return config{}, errors.New("LOGS_TOKEN must differ from INGEST_TOKEN")
+	}
 	if c.approvalPass != "" && len(c.approvalPass) < minApprovalPasswordLength {
 		return config{}, fmt.Errorf("APPROVAL_PASSWORD must be at least %d characters", minApprovalPasswordLength)
 	}
@@ -127,6 +142,13 @@ func main() {
 		}
 		api.Maps = NewMaps(cfg.mapTilesURL, cfg.mapCacheDir, mapUserAgent)
 	}
+	if cfg.logsDir != "" {
+		if err := os.MkdirAll(cfg.logsDir, 0o700); err != nil {
+			slog.Error("logs directory not usable", "error", err)
+			os.Exit(1)
+		}
+		api.Logs = NewLogs(cfg.logsDir, cfg.logsToken)
+	}
 
 	srv := &http.Server{
 		Addr:              cfg.listenAddr,
@@ -142,7 +164,7 @@ func main() {
 	go func() {
 		slog.Info("listening", "addr", cfg.listenAddr, "bucket", cfg.influxBucket,
 			"pairing", pairing.Enabled(), "pairedDevices", len(devices), "appUpdates", releases.enabled(),
-			"maps", api.Maps != nil)
+			"maps", api.Maps != nil, "logs", api.Logs != nil, "logsReadable", api.Logs != nil && cfg.logsToken != "")
 		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 			slog.Error("server failed", "error", err)
 			os.Exit(1)