Grafana's first start creates and migrates its database: 44 s at
0.5 CPU and 3 minutes at 0.1 CPU (measured with 13.2.3 on an empty
volume). With only 50m requested, the liveness probe (30 s delay,
3 x 30 s) restarted it mid-migration, in a loop, and readiness never
passed.
- startupProbe on /api/health allows up to 10 minutes; liveness and
readiness start only after it succeeds.
- 5 s timeouts on all probes instead of the 1 s default.
- Requests raised to 250m CPU / 256Mi (measured about 240 MB in use);
still no CPU limit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
- The secrets template moves to k8s/secrets/, and the filled-in copy to
k8s/secrets/secrets.yaml (gitignored). `kubectl apply -f k8s/` does
not recurse, so neither the placeholder template nor the real secrets
can be applied by accident.
- The server image digest is pinned in server.yaml instead of through
kustomize's images override, which `-f` ignores (it would have pulled
a nonexistent :latest).
- README and kustomization.yaml say to use `-k`: plain `-f` never
creates the generated Grafana ConfigMaps.
- The IngressRoutes drop `tls: {}`, like the other routes on this
Traefik: TLS is configured on the websecure entrypoint.
Manifests validated both ways (14 resources rendered with kustomize,
11 as plain files — the difference is the Grafana ConfigMaps).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
The code below the QR code was not visible on the head unit: the dialog
stacked the text, a 240 dp QR code, the code and the status, and its
content could not scroll, so on the wide, low screen the lower part
was cut off. On wide screens the QR code now sits left of the text,
the content scrolls, and the code is also part of the instruction
sentence, so it is readable wherever the text is.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
- On a failure the pairing dialog stays open and shows the reason in
red (Cancel becomes Close); before, it closed at once and the reason
was only in the Server tab's status line.
- "Pairing is not enabled" only when the server says so. Any other 404
(a server older than 2.1.0, or a proxy's page) is reported as a
server without pairing.
- Pairing and Test connection name the problem: a server name that
does not resolve (Test connection used to say "No internet
connection"), a server that does not answer, or the HTTP status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
Both IngressRoutes (server and Grafana) now use traefik-internal, like
the rest of *.k8s.stinnesbeck.com, instead of the traefik-external
placeholder. README and SPECS updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
The server's host is car.k8s.stinnesbeck.com, not car.stinnesbeck.com:
IngressRoute, PUBLIC_URL (so the pairing QR code points there), the
app's pre-filled server URL and hint, and the docs. Grafana's
placeholder host follows to car-grafana.k8s.stinnesbeck.com, so one
*.k8s.stinnesbeck.com default certificate covers both. App 2.4.1 for the
new default; the server image is unchanged (its URL comes from the
manifest).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
- kustomization pins mg4-server 2.1.0 by digest; server.yaml sets
PUBLIC_URL for the pairing QR code; the secrets template gains
APPROVAL_PASSWORD.
- Filled-in Secrets now go into k8s/secrets.yaml, which is gitignored;
the template stays on placeholders. This follows a leak where real
values typed into the template were committed and pushed (amended and
force-pushed since; both values regenerated).
- SPECS.md records pairing and the incident.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
The Server tab gets "Pair with phone" right under the server URL, which
is now pre-filled with https://car.stinnesbeck.com. It opens a dialog
with a QR code and the short code, polls the server, and on approval
saves this car's own token like Save would — nothing to type in the
car. Denied, expired, and pairing switched off on the server are each
reported. PairingClient is tested against a stand-in for the server.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
Modelled on the OAuth device authorization grant (RFC 8628) and on
only when APPROVAL_PASSWORD is set (at least 12 characters):
- POST /v1/pair/start opens a request for an installation and returns
a short user code and the /pair URL for the car's QR code;
POST /v1/pair/poll returns pending, the car's own token (once),
denied or expired. Requests live 10 minutes, in memory.
- GET/POST /pair is a script-free approval page for the phone
(strict CSP, no framing). Five wrong passwords lock approvals for a
minute.
- Each car gets its own 43-character token; only its SHA-256 is stored
(measurement "device"), and the device is persisted before the car
can collect the token. Tokens are loaded at startup, so a restart
keeps paired cars working; the server refuses to start if they cannot
be loaded.
- GET /v1/devices and POST /v1/devices/{id}/revoke, authenticated with
the approval password, list and revoke cars.
- The shared INGEST_TOKEN keeps working.
31 tests (race detector clean), govulncheck clean. Tested end to end
against InfluxDB 2.7.12: pairing, wrong password, single collection,
persistence across restarts, revocation (also across a restart), and
that InfluxDB holds only the hash.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
mg4-server:2.0.0 is on git.stinnesbeck.com and pulls anonymously, so
the Deployment no longer references a registry pull secret. The image
is pinned by digest (sha256:6feea777…) so a re-pushed tag cannot
change what the cluster runs. README and secrets template updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
ev_cyan becomes a light red (#FF9A9E, for values and secondary
highlights, readable on black) and ev_cyan_deep a deep red (#3A1215,
version badge). Turquoise hardcoded in the battery card, switch track,
input panel, car outline, background glow and charging-graph grid is
replaced with matching red tones, as are two gold leftovers (tab
outline, second background glow). The mint "OK" status colour and the
amber charging curve are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
- k8s/grafana.yaml: Grafana 13.2.3 with a 1Gi PVC, sign-up and
anonymous access off. The InfluxDB datasource (URL and token from the
environment) and three dashboards — Live, Consumption, Charging — are
provisioned from k8s/grafana/ via kustomize-generated ConfigMaps.
- server.yaml for the Go server (port 8080, UID 65532, smaller limits),
image tag 2.0.0. The NetworkPolicy now admits Grafana to InfluxDB.
- ingress.yaml: IngressRoutes for car.stinnesbeck.com and Grafana
(placeholder host car-grafana.stinnesbeck.com) with tls: {}, using
Traefik's default certificate; the cert-manager Certificate is gone.
- secrets.example.yaml: drops the dashboard secrets, adds grafana-admin.
- AGENTS.md loses its Next.js block; SPECS.md describes the new setup.
The removal of web/ (the Next.js app) and of the stale .next/ cache
upstream had committed already landed in 51e6f6f, which was staged
together with the Go server by mistake.
Checked end to end in podman (Go server + InfluxDB 2.7.12 + Grafana
13.2.3): all 25 dashboard queries return the expected data, and the
dashboards were rendered with headless Chromium. Manifests validated
offline with kustomize and kubeconform. Nothing applied to a cluster.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
Same endpoints, request formats, validation rules and InfluxDB layout as
the Next.js server, so the car needs no change: POST /v1/telemetry,
PUT /v1/consumption/daily, PUT /v1/charging-sessions/{id}, GET
/v1/consumption/history/{id}, GET /v1/health. The dashboard, login and
the /v1/history reads are gone; Grafana takes over the dashboards.
- Go 1.26 standard library (net/http routing, log/slog) plus the
official InfluxDB 2 client. Fails closed at startup on a missing
InfluxDB setting or an ingest token under 24 characters.
- ABRP forwarder ported: newest fresh sample, rate limited, never
queued, credentials only in the form body.
- 22 tests: validation, aggregation, forwarding, config, and the
handlers through a fake store. govulncheck clean (x/net 0.60.0,
toolchain go1.26.9).
- Image: static binary on distroless, about 11 MB, UID 65532, port
8080; the build runs vet and the tests.
- Dev shell: Go, gopls and govulncheck instead of Node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
Dashboard: every label, empty state, chart legend and the login page
are English; numbers and dates use en-GB (24-hour clock, day-month
dates), money is EUR, percentages read 80% instead of %80, durations
"2 h 05 min". html lang is en. Server version 1.1.2; manifests pin it.
Car app: the charging tab's price suffix, validation message and total
cost use € instead of ₺.
Checked by rendering all three pages from the 1.1.2 image against
InfluxDB 2.7.12 in podman.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
Browser title, login heading, hidden password-manager username, session
cookie (nilsmg4_session) and package name. The README keeps the credit
to fatihdonmezdev/FatihsMG4. Server version 1.1.1; the manifests pin it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
ev_accent is now #E0424C, the red of the launcher icon (about 4.6:1 on
the black background, enough for accent-coloured text; the darker MG
brand red is about 3:1). ev_on_accent and ev_gold_surface follow with a
dark red tint; the gold hardcoded in two drawables and the consumption
period buttons is replaced too. AGENTS.md's visual direction updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
- New Server tab: server URL, ingest token and installation id, with
Save, Test connection (health, then a read-only token check) and the
config-file import that upstream removed (app folder / USB stick first,
document picker as fallback). Settings are kept encrypted and read on
every use, so the service picks up a change without a restart. Each
installation generates its own id; the inherited upstream UUID and
the baked-in CONSUMPTION_API_* build fields are gone.
- Live telemetry restored from before ea8032a (TelemetryPayload,
UploadCadence, UploadSettings, GPS) and sent in batches to
POST /v1/telemetry instead of ABRP; the server forwards to ABRP. Adds
ext_temp, voltage and current. Unsent samples queue in memory (about
8 h) while offline.
- Upload tab: the live-telemetry switch and cadence controls work again;
the dead service and autostart switches are removed.
- Manifest: location permissions and foreground service types.
- Unit tests compile again: 114 (stable) / 136 (unstable) pass. Tests
for the deleted AbrpApi and HeadUnitWeather removed; new tests for
ServerConfig and TelemetryQueue. Lint passes.
Not yet tried on the car.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Namespace, InfluxDB 2.7.12 StatefulSet with PVC and a NetworkPolicy
that admits only the server, the server Deployment (non-root, read-only
root filesystem), a cert-manager Certificate from letsencrypt-prod and a
Traefik IngressRoute. Secrets are a template only. Nothing is applied;
k8s/README.md has the steps. Server version bumped to 1.1.0.
Validated offline with kustomize and kubeconform (including the
cert-manager and Traefik CRD schemas). The InfluxDB container was tested
locally as UID 1000 with no capabilities.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- MongoDB replaced by InfluxDB 2 (one bucket, installationId tag).
Consumption is stored per chunk at its recordedAt and summed on read,
so a chunk the car re-sends from its cache overwrites itself instead
of being counted twice ($inc did count it twice). Lifetime is a
running total derived on read.
- POST /v1/telemetry takes batches of samples in ABRP's tlm fields; every
field is bounded, unknown fields are dropped, unread signals stay absent.
- After a successful write the newest fresh sample is forwarded to ABRP
with ABRP_API_KEY / ABRP_USER_TOKEN from the server environment; rate
limited, never queued. The car no longer needs ABRP credentials.
- Self-hosting: standalone output, Dockerfile (tests run in the build,
runs as UID 10001), .env.example and README for the new setup.
- Dev shell gains Node 22 and InfluxDB 2.
Verified locally against InfluxDB 2.7.12: all endpoints, retry
idempotency, and the dashboard pages. Unit tests: 17 pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without adb there was no way to see why vehicle values stay blank:
refreshVehicle() swallowed every exception. The Logs tab now shows the
package, version, UID (and whether it is the system UID), signer
SHA-256, firmware, car permission grants, the last snapshot and read
error, and the newest 200 entries of the vehicle library's AppLogger.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- applicationId com.evsuite.abrp -> com.stinnesbeck.nilsmg4 (the car
build is .unstable); the Java namespace is unchanged. Installs next to
upstream's app rather than over it.
- APK names NilsMG4-*.apk, debug builds included; build-car follows.
- OTA install-result action, cache/download names, User-Agent and log
tags follow the new name.
- About credits fatihdonmezdev / FatihsMG4.
- SPECS.md journals what changed and what is still to do, starting
with pointing the About link and QR code at git.stinnesbeck.com/nils/mg4.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Changes the launcher label, header brand caption, About title, logo
description and OTA download labels. Package ID, APK file names, log
tags and the repository link are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The updater stays in place, but its releases URL now uses the .invalid
TLD (RFC 2606), so checks fail instead of offering upstream's Turkish
builds over this one. Swap in a fork's releases API to re-enable it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The MG4 head unit's platform certificate (c8a2e9bc…192ab8, per
tools/README.md) is the public AOSP test key. build-car fetches that key
into the gitignored tools/ directory from a pinned android-9.0.0_r1 tag,
builds assembleUnstableDebug, zipaligns and signs it, and refuses to
finish unless both the key's certificate and the resulting signer match
the expected SHA-256. Output lands in build/car/ with a .sha256 sidecar.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Provides JDK 21 and an Android SDK (platforms 36/36.1, build-tools
36.0.0) via `nix develop`. Points AGP at the SDK's aapt2 and Gradle at
the Nix JDK, since the binaries they would otherwise download do not
run on NixOS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Translates string resources, hardcoded layout text and user-facing
strings in Java sources (toasts, dialogs, status labels, upload log).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nilsandClaude Opus 5.5