TCFDONMEZandClaude Opus 5
8242797ece
The standalone service in server/ was never deployed anywhere, and keeping it alongside a Vercel app would mean maintaining two implementations of the same validation rules. It is deleted; web/ is the only ingest path now. Its routes live at /v1/... rather than under /api, so the Android client's URL building is unchanged and CONSUMPTION_API_URL stays a bare origin. Credentials are split in two. INGEST_TOKEN is baked into the published APK and must be assumed extractable — anyone can unzip an APK and read its strings — so it opens the PUT endpoints and nothing else. Reading the history needs the dashboard password, which is never compiled into anything and reaches the browser as an HMAC-signed httpOnly cookie. The MongoDB URI stays a server-side environment variable; the car has never held one and still does not. The dashboard is a phone-shaped reader for the same data: totals for energy taken and paid, a daily energy chart, an efficiency trend, and every DC session with its power/SOC curve. It reuses the head unit's OLED palette so the two read as one app. Every page is a server component and the charts are hand-rolled SVG, so the whole thing renders without shipping client JavaScript. MongoClient is cached on globalThis: a fresh client per request means a fresh pool per request, and Atlas starts refusing connections long before the traffic would justify it. Index creation moved to the first write of each warm lambda, since a serverless deployment has no boot step to hang it on. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
15 lines
531 B
Bash
15 lines
531 B
Bash
# MongoDB Atlas connection string. Never leaves the server.
|
|
MONGODB_URI=mongodb+srv://user:password@cluster.mongodb.net/?retryWrites=true&w=majority
|
|
MONGODB_DATABASE=fatihsmg4
|
|
|
|
# Write-only token the car sends as `Authorization: Bearer ...` on the PUT endpoints.
|
|
# Generate with: openssl rand -hex 32
|
|
INGEST_TOKEN=
|
|
|
|
# Password for the web dashboard. Anyone who knows it can read the history.
|
|
DASHBOARD_PASSWORD=
|
|
|
|
# Signs the session cookie. Rotating it logs every browser out.
|
|
# Generate with: openssl rand -hex 32
|
|
SESSION_SECRET=
|