nilsandClaude Opus 5.5
e5549dddb0
The car updates itself again, from this fork's own releases, while the repository stays private: - publish-car (flake) creates the pre-release car-<version> on the forge and attaches the APK and its .sha256. It needs a forge token that may write releases, from ~/.config/nilsmg4/forge-token or $FORGE_TOKEN; it is sent in a header and never printed. - The server relays releases and attachments (/v1/app/releases, /v1/app/assets/...), read with a read-only FORGE_TOKEN from its Secret, GitHub-shaped with download URLs back at itself. Redirects away from the forge are not followed; off (404) without a token. - The app asks its server with its own paired token, allows exactly the server's host, downloads the APK itself instead of through the DownloadManager (so the token stays in the app), verifies SHA-256 and package name, and tries a PackageInstaller session (it may install silently as the system user) before falling back to Downloads. OTA.md is rewritten for this flow; the k8s and server READMEs explain the new token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
100 lines
2.8 KiB
YAML
100 lines
2.8 KiB
YAML
# The car server (Go). One replica on purpose: pending pairing requests and the wrong-password
|
|
# counters are kept in memory.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: mg4-server
|
|
namespace: mg4
|
|
labels:
|
|
app.kubernetes.io/name: mg4-server
|
|
app.kubernetes.io/part-of: mg4
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: mg4-server
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: mg4-server
|
|
app.kubernetes.io/part-of: mg4
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: server
|
|
# 2.6.0, pinned by digest so a re-pushed tag cannot change what runs.
|
|
image: git.stinnesbeck.com/nils/mg4-server@sha256:35ff5973836620c1e69f06b00163cf95183f938cb9830355452d4161c6c46e33
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
env:
|
|
- name: INFLUX_URL
|
|
value: http://influxdb.mg4.svc:8086
|
|
- name: INFLUX_ORG
|
|
value: mg4
|
|
- name: INFLUX_BUCKET
|
|
value: mg4
|
|
# Where a phone reaches the server; the pairing QR code points here.
|
|
- name: PUBLIC_URL
|
|
value: https://car.k8s.stinnesbeck.com
|
|
# App updates: the releases of this repository, relayed to the car. Read with
|
|
# FORGE_TOKEN from the mg4-server Secret; leave that empty to switch updates off.
|
|
- name: FORGE_URL
|
|
value: https://git.stinnesbeck.com
|
|
- name: FORGE_REPO
|
|
value: nils/mg4
|
|
- name: INFLUX_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: influxdb-auth
|
|
key: admin-token
|
|
# INGEST_TOKEN, APPROVAL_PASSWORD, FORGE_TOKEN.
|
|
envFrom:
|
|
- secretRef:
|
|
name: mg4-server
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /v1/health
|
|
port: http
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /v1/health
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 30
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
memory: 128Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: mg4-server
|
|
namespace: mg4
|
|
labels:
|
|
app.kubernetes.io/name: mg4-server
|
|
app.kubernetes.io/part-of: mg4
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: mg4-server
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: http
|