nilsandClaude Opus 5.5
e5549dddb0
The car updates itself again, from this fork's own releases, while the repository stays private: - publish-car (flake) creates the pre-release car-<version> on the forge and attaches the APK and its .sha256. It needs a forge token that may write releases, from ~/.config/nilsmg4/forge-token or $FORGE_TOKEN; it is sent in a header and never printed. - The server relays releases and attachments (/v1/app/releases, /v1/app/assets/...), read with a read-only FORGE_TOKEN from its Secret, GitHub-shaped with download URLs back at itself. Redirects away from the forge are not followed; off (404) without a token. - The app asks its server with its own paired token, allows exactly the server's host, downloads the APK itself instead of through the DownloadManager (so the token stays in the app), verifies SHA-256 and package name, and tries a PackageInstaller session (it may install silently as the system user) before falling back to Downloads. OTA.md is rewritten for this flow; the k8s and server READMEs explain the new token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
55 lines
1.8 KiB
YAML
55 lines
1.8 KiB
YAML
# TEMPLATE ONLY — not part of kustomization.yaml. Copy it to k8s/secrets/secrets.yaml
|
|
# (gitignored), fill in real values there, and apply that file yourself. Never put real values
|
|
# in here. This folder is outside `kubectl apply -f k8s/`, which does not recurse.
|
|
#
|
|
# openssl rand -hex 32 for every token and password below
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: influxdb-auth
|
|
namespace: mg4
|
|
type: Opaque
|
|
stringData:
|
|
admin-password: CHANGE-ME-at-least-8-characters
|
|
admin-token: CHANGE-ME-openssl-rand-hex-32
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: mg4-server
|
|
namespace: mg4
|
|
type: Opaque
|
|
stringData:
|
|
# The car's write token, entered in the app. At least 24 characters, or the server
|
|
# refuses to start.
|
|
INGEST_TOKEN: CHANGE-ME-openssl-rand-hex-32
|
|
# Approves a car on your phone when it pairs by QR code (at least 12 characters). Leave it
|
|
# empty to switch pairing off; then only the INGEST_TOKEN above works.
|
|
APPROVAL_PASSWORD: CHANGE-ME-at-least-12-characters
|
|
# A forge token that can only READ the nils/mg4 repository, for app updates (the server
|
|
# relays the releases to the car; k8s/README.md, "App updates"). Leave it empty to switch
|
|
# updates off.
|
|
FORGE_TOKEN: CHANGE-ME-read-only-forge-token
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: grafana-admin
|
|
namespace: mg4
|
|
type: Opaque
|
|
stringData:
|
|
# Grafana's admin login (user "admin"). Only read on first start: change it in Grafana
|
|
# afterwards, or reset it with grafana cli.
|
|
admin-password: CHANGE-ME
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: grafana-influx
|
|
namespace: mg4
|
|
type: Opaque
|
|
stringData:
|
|
# A read-only InfluxDB token for the mg4 bucket, not the admin token. InfluxDB makes it;
|
|
# the command is in k8s/README.md ("Grafana's InfluxDB token").
|
|
token: CHANGE-ME-read-only-token-from-influx-auth-create
|