nilsandClaude Opus 5.5
a5db5604d3
Telemetry no longer loses queued batches. The server drops a bad value, or a sample without a plausible time, instead of rejecting the batch, and answers 200 with what it dropped. The app sends only values inside the server's ranges (speed as a magnitude, so reversing is fine) and no samples before the head unit's clock is set. Server: - Pairing hands out and accepts a token only after the device is saved; a failed save leaves the request pending. - A paired token serves only the installation id it was paired with (403 otherwise); the shared INGEST_TOKEN still serves any. - Wrong-password lockouts and open pairing requests are limited per client address (last X-Forwarded-For entry), so a stranger cannot lock the owner out; a car starting again replaces its own request. - ABRP forwarding skips samples stamped ahead of the server's clock, which used to stop it until a restart. App: - Settings written to plaintext during a keystore failure move back into encrypted storage; the stored installation id wins. - The installation id is derived from ANDROID_ID on first start, so a reinstall finds its history; a stored or imported id still wins. - The scanned config file is deleted after import (it holds the token). - GPS stops while live telemetry is off or the server unconfigured, and pauses while parked and idle, keeping the fix the car parked with. - Range estimates use the monotonic clock. - One HTTP helper (ServerHttp) for telemetry, sync and pairing. - Last Turkish strings translated; mise logs shows the NilsMG4 tags. Grafana reads InfluxDB with its own read-only token (new grafana-influx Secret, created by hand as described in k8s/README.md). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
55 lines
1.7 KiB
YAML
55 lines
1.7 KiB
YAML
# TEMPLATE ONLY — not part of kustomization.yaml. Copy it to k8s/secrets/secrets.yaml
|
|
# (gitignored), fill in real values there, and apply that file yourself. Never put real values
|
|
# in here. This folder is outside `kubectl apply -f k8s/`, which does not recurse.
|
|
#
|
|
# openssl rand -hex 32 for every token and password below
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: influxdb-auth
|
|
namespace: mg4
|
|
type: Opaque
|
|
stringData:
|
|
admin-password: CHANGE-ME-at-least-8-characters
|
|
admin-token: CHANGE-ME-openssl-rand-hex-32
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: mg4-server
|
|
namespace: mg4
|
|
type: Opaque
|
|
stringData:
|
|
# The car's write token, entered in the app. At least 24 characters, or the server
|
|
# refuses to start.
|
|
INGEST_TOKEN: CHANGE-ME-openssl-rand-hex-32
|
|
# Approves a car on your phone when it pairs by QR code (at least 12 characters). Leave it
|
|
# empty to switch pairing off; then only the INGEST_TOKEN above works.
|
|
APPROVAL_PASSWORD: CHANGE-ME-at-least-12-characters
|
|
# Your ABRP credentials. Leave either empty to switch forwarding off.
|
|
ABRP_API_KEY: CHANGE-ME
|
|
ABRP_USER_TOKEN: CHANGE-ME
|
|
ABRP_MIN_INTERVAL_SECONDS: "5"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: grafana-admin
|
|
namespace: mg4
|
|
type: Opaque
|
|
stringData:
|
|
# Grafana's admin login (user "admin"). Only read on first start: change it in Grafana
|
|
# afterwards, or reset it with grafana cli.
|
|
admin-password: CHANGE-ME
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: grafana-influx
|
|
namespace: mg4
|
|
type: Opaque
|
|
stringData:
|
|
# A read-only InfluxDB token for the mg4 bucket, not the admin token. InfluxDB makes it;
|
|
# the command is in k8s/README.md ("Grafana's InfluxDB token").
|
|
token: CHANGE-ME-read-only-token-from-influx-auth-create
|