nils/mg4

Files

T

nilsandClaude Opus 5.5 a5db5604d3 Code review fixes: app 2.9.0, server 2.2.0

Telemetry no longer loses queued batches. The server drops a bad value,
or a sample without a plausible time, instead of rejecting the batch,
and answers 200 with what it dropped. The app sends only values inside
the server's ranges (speed as a magnitude, so reversing is fine) and no
samples before the head unit's clock is set.

Server:
- Pairing hands out and accepts a token only after the device is saved;
  a failed save leaves the request pending.
- A paired token serves only the installation id it was paired with
  (403 otherwise); the shared INGEST_TOKEN still serves any.
- Wrong-password lockouts and open pairing requests are limited per
  client address (last X-Forwarded-For entry), so a stranger cannot
  lock the owner out; a car starting again replaces its own request.
- ABRP forwarding skips samples stamped ahead of the server's clock,
  which used to stop it until a restart.

App:
- Settings written to plaintext during a keystore failure move back
  into encrypted storage; the stored installation id wins.
- The installation id is derived from ANDROID_ID on first start, so a
  reinstall finds its history; a stored or imported id still wins.
- The scanned config file is deleted after import (it holds the token).
- GPS stops while live telemetry is off or the server unconfigured, and
  pauses while parked and idle, keeping the fix the car parked with.
- Range estimates use the monotonic clock.
- One HTTP helper (ServerHttp) for telemetry, sync and pairing.
- Last Turkish strings translated; mise logs shows the NilsMG4 tags.

Grafana reads InfluxDB with its own read-only token (new grafana-influx
Secret, created by hand as described in k8s/README.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

2026-10-18 00:36:19 +02:00

3.8 KiB

Raw Blame History

Kubernetes manifests — car.k8s.stinnesbeck.com

Plain manifests for the car server, InfluxDB 2 and Grafana. They are only files: nothing here is applied automatically. Apply them yourself.

File	What
`namespace.yaml`	Namespace `mg4`
`influxdb.yaml`	InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana
`server.yaml`	Go server Deployment (1 replica, non-root, read-only root filesystem) and Service
`grafana.yaml`	Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned
`grafana/`	The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging)
`ingress.yaml`	Traefik `IngressRoute`s for car.k8s.stinnesbeck.com and Grafana, TLS from Traefik's default certificate
`secrets/secrets.example.yaml`	Template for the Secrets; placeholders only, not in `kustomization.yaml`
`secrets/secrets.yaml`	Your filled-in copy — gitignored, never committed
`kustomization.yaml`	Everything except the Secrets; generates the Grafana ConfigMaps

Before the first apply

Check ingress.yaml: Grafana's host (placeholder car-grafana.k8s.stinnesbeck.com). Both routes use the traefik-internal class, and both hosts must be covered by Traefik's default certificate.
Create the Secrets. cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml (gitignored), replace every CHANGE-ME there (openssl rand -hex 32): influxdb-auth, mg4-server (ingest token, approval password for pairing, your ABRP API key and user token), grafana-admin and grafana-influx (see below). Keep the template itself on placeholders only.
Registry access. The mg4-server package on git.stinnesbeck.com is public, so no pull secret is needed. If you make it private, add an imagePullSecrets entry to server.yaml.

Apply

kubectl apply -f k8s/namespace.yaml
kubectl apply -f k8s/secrets/secrets.yaml
kubectl apply -k k8s/

Use -k, not -f k8s/: plain -f applies the files without kustomize, so the Grafana ConfigMaps (datasource and dashboards) are never created and Grafana does not start.

Grafana's InfluxDB token

Grafana reads InfluxDB with a token that can only read the mg4 bucket, from the grafana-influx Secret. InfluxDB has to create that token, so it is a step of its own:

With InfluxDB running, create the token. The influx CLI in the pod is already signed in as admin:

kubectl -n mg4 exec influxdb-0 -- sh -c \
  'influx auth create --org mg4 --description grafana-read-only --json \
     --read-bucket "$(influx bucket find --name mg4 --hide-headers | cut -f1)"'

Copy the "token" value from the output into grafana-influx → token in k8s/secrets/secrets.yaml, apply that file, and restart Grafana: kubectl -n mg4 rollout restart deployment/grafana.

Until the Secret exists, Grafana does not start (the container waits for the missing Secret). On a fresh install, apply everything once without Grafana working, create the token, then apply the Secret.

Notes

InfluxDB's setup mode runs only on an empty volume. Changing admin-token in the Secret later does not change the token inside InfluxDB.
The server uses the InfluxDB admin token; a token scoped to read/write on the mg4 bucket can replace it later. Grafana has its own read-only token (below).
The dashboards are read-only in Grafana's UI. Change the JSON in grafana/dashboards/; the ConfigMap name changes with its content, which rolls Grafana.
The server image is pinned by digest in server.yaml. To upgrade, push a new tag and put its digest there (skopeo inspect docker://git.stinnesbeck.com/nils/mg4-server:<tag>).

3.8 KiB Raw Blame History