julian
96acd6b662
Camera snapshots were stored RAW — the camera's full-res JPEG straight into the BLOB, no resize/recompress. Measured on the dev DB: 300 snapshots = 81.7 MB = ~72% of the 114 MB SQLite file (the big ones 2688×1520 / ~600 KB, Hikvision main stream). They dominated the appliance's single backed-up DB file. Re-encode on capture (snapshot.ts): - Downscale each frame to SNAPSHOT_MAX_EDGE (1280px long edge) + recompress at SNAPSHOT_JPEG_QUALITY (80) via sharp (libvips, Apache-2.0) before storage — ~6-10× smaller (verified 2688×1520 → 1280×724, ~8×), plate still readable, clean image/jpeg (drops the camera's charset cruft). STORAGE-ONLY: recognition keeps the ORIGINAL full-res bytes (downscaling hurts OCR). Fail-soft — a re-encode error stores the original, never drops the snapshot or blocks the (already-open) path. sharp lives in apps/server (owns the capture path), where bcrypt already establishes the native-dep pattern. Disk-pressure retention (snapshot-retention.ts) — a SAFETY VALVE, not the daily mechanism (the re-encode does that). Daily check reads the DB filesystem used% (statfs on db.$client.name); no-op unless ≥ SNAPSHOT_DISK_HIGH_PCT (70). Over the mark: delete the OLDEST until an estimated SNAPSHOT_DISK_FREE_TARGET_PCT (10%) of disk is freed — never below SNAPSHOT_MIN_KEEP (500) — then VACUUM once to return space to the OS. A DELETE only frees SQLite pages (disk doesn't drop until VACUUM), so the loop is driven by estimated freed bytes (SUM(length(bytes))), not a live disk re-read; the prune owns the DB-locking VACUUM, run daily off-peak. diskUsage is injectable for tests. None of this touches the signed ledger — snapshots are unsigned/advisory, referenced only by id. Tests: encodeForStorage (downscale / clean-type / no-enlarge / fail-soft) + pruneSnapshots (no-op below mark / delete-oldest-to-target + VACUUM / MIN_KEEP floor / skip-VACUUM-when-empty). All four snapshot env knobs documented in the komodo env reference. Full workspace build/lint/test green; the prune smoke-verified on a scratch DB copy (file shrank after VACUUM). Existing ~81.7 MB of raw snapshots are unchanged (a one-off re-encode backfill is a separate optional follow-up). Updated entry-exit-points + technology-stack wiki. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
108 lines
9.3 KiB
Bash
108 lines
9.3 KiB
Bash
# Komodo Stack environment — the COMPLETE reference of every env the booth stack reads:
|
|
# required, image-selection, set-by-compose (don't override), and the optional tunables
|
|
# with their code defaults. Under Komodo, plain env lives in the Stack definition
|
|
# (komodo/resources.toml); the two SECRETS come from Core's secret store, PER BOOTH and
|
|
# UNIQUE. This file is DOCUMENTATION — never fill in real secrets here. See
|
|
# wiki/decisions/fleet-deployment-komodo.md.
|
|
#
|
|
# A minimal working Stack only needs: REGISTRY, TAG, the two secrets, COOKIE_SECURE=0,
|
|
# VISION_ENABLED=1, WS_ALLOWED_ORIGINS. Everything under "OPTIONAL TUNABLES" has a safe
|
|
# default in code — set one only to override it.
|
|
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# IMAGE SELECTION (picks which container image to pull — not server runtime env)
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
REGISTRY=git.infra.msai.al/mca/parking_solution
|
|
# IMMUTABLE per-commit tag. Manual + pinned. Bump per deploy. Never the moving `dev`
|
|
# on a PRODUCTION booth (a staging booth may track `dev`).
|
|
TAG=dev-830993b
|
|
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# REQUIRED (no safe default — the server refuses to boot / login breaks without)
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# Login signing secret (>=32 chars, no change-me/insecure/dev-only). openssl rand -hex 32.
|
|
JWT_SECRET=[[booth_<name>_jwt_secret]]
|
|
# Ledger-signing HMAC key — the anti-fraud root. DISTINCT per booth; never reuse. If unset
|
|
# it falls back to JWT_SECRET (warned). openssl rand -hex 32.
|
|
EVENT_SIGNING_KEY=[[booth_<name>_event_signing_key]]
|
|
# CRITICAL on the plain-HTTP booth LAN: cookies are Secure (HTTPS-only) by DEFAULT, so
|
|
# without =0 the auth cookie never sends and operators CANNOT log in. Set 1 only behind TLS.
|
|
COOKIE_SECURE=0
|
|
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# COMMONLY SET (have defaults, but you usually want these explicit on a booth)
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# Turn the ANPR/vision call on. Default "" (off-ish). Set 1 to enable. (Prod compose also
|
|
# forces VISION_RECOGNIZER=fast_alpr on the vision container.)
|
|
VISION_ENABLED=1
|
|
# Extra origins the booth WebSocket (/api/ws) accepts beyond same-origin. Comma-separated,
|
|
# e.g. http://parksystems.msai.al. Blank = only the same-origin booth URL. Default "".
|
|
WS_ALLOWED_ORIGINS=
|
|
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# SET BY COMPOSE — do NOT put these in the Stack (the compose files own them)
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# VISION_URL=http://127.0.0.1:8089 # prod override (host-net server → loopback vision)
|
|
# DATABASE_URL=/data/parking.sqlite # the mounted volume (the signed ledger)
|
|
# VISION_RECOGNIZER=fast_alpr # prod override on the vision container
|
|
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# OPTIONAL TUNABLES — all have code defaults; set only to override. (defaults shown)
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# --- networking / process ---
|
|
# PORT=3000 # server listen port
|
|
# HOST=0.0.0.0 # bind interface (127.0.0.1 = loopback only)
|
|
# BACKEND_HOST_IP= # override the auto-picked IP devices push back to
|
|
# # (multi-NIC hosts; usually auto-detected fine)
|
|
# WEB_DIST_DIR= # where the built SPA lives (the image sets it)
|
|
# --- logging ---
|
|
# LOG_LEVEL=info # debug|info|warn|error
|
|
# LOG_RETENTION_DAYS=30 # app_logs auto-purge age
|
|
# LOG_RETENTION_MAX_ROWS=50000 # app_logs row cap
|
|
# RECYCLE_BIN_RETENTION_DAYS=30 # soft-deleted items auto-purge age (0 = keep forever)
|
|
# --- snapshots (camera evidence; stored re-encoded, then pruned under disk pressure) ---
|
|
# SNAPSHOT_MAX_EDGE=1280 # downscale long edge (px) before storing
|
|
# SNAPSHOT_JPEG_QUALITY=80 # stored JPEG quality (recognition uses full-res original)
|
|
# Disk-pressure prune (daily safety valve; deletes oldest + VACUUM only when the disk is tight):
|
|
# SNAPSHOT_DISK_HIGH_PCT=70 # prune only when the DB's filesystem is ≥ this % used
|
|
# SNAPSHOT_DISK_FREE_TARGET_PCT=10 # try to free ~this % of the disk per run
|
|
# SNAPSHOT_MIN_KEEP=500 # never prune below this many snapshots (floor)
|
|
# SNAPSHOT_PRUNE_BATCH=200 # delete oldest in batches of this many
|
|
# --- device monitor / lane ---
|
|
# DEVICE_POLL_MS=8000 # device health poll interval
|
|
# PRINTER_POLL_MS=5000 # printer status poll interval
|
|
# LANE_BUSY_TTL_MS=30000 # how long a lane stays "busy" after a vehicle push
|
|
# CAPTURE_TTL_MS=30000 # snapshot evidence cache TTL
|
|
# --- ANPR / vision (server side) ---
|
|
# VISION_URL is compose-set (above). These are the knobs you may tweak per booth:
|
|
# VISION_TIMEOUT_MS=1500 # per /analyze call timeout
|
|
# VISION_MIN_CONFIDENCE=0.5 # advisory floor (telemetry/lane); below = low_confidence
|
|
# VISION_ENTRY_MIN_CONFIDENCE=0.85 # STRICT barrier-driving floor (auto entry/exit). A
|
|
# # read below this is ignored (falls back to card/QR).
|
|
# ANPR_DEBOUNCE_MS=12000 # same plate/camera within this = one presentation
|
|
# ANPR_POLL_MS=1000 # poll-until-confident: re-pull a fresh frame every N ms
|
|
# ANPR_POLL_WINDOW_MS=8000 # ...for this long AFTER THE LAST vehicle push (sliding:
|
|
# # a car arriving mid-loop extends it). RAISE if a slow
|
|
# # barrier means the car waits >8s before reading clean.
|
|
# ANPR_POLL_MAX_MS=30000 # hard ceiling on one loop from start (so a continuously
|
|
# # busy lane can't slide the window forever)
|
|
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# VISION CONTAINER env (the Python ANPR service — its OWN process, prefix VISION_)
|
|
# Mostly compose-set; documented here for completeness. (defaults shown)
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# VISION_RECOGNIZER=fast_alpr # stub | fast_alpr (prod compose forces fast_alpr)
|
|
# VISION_HOST=0.0.0.0 # bind (prod publishes 127.0.0.1 only — see compose)
|
|
# VISION_PORT=8089
|
|
# VISION_DETECTOR_MODEL=yolo-v9-t-384-license-plate-end2end
|
|
# VISION_OCR_MODEL=cct-xs-v2-global-model
|
|
# VISION_MIN_CONFIDENCE=0.5 # the Python service's own floor (keep ~in sync w/ server)
|
|
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# SECRETS — referenced by name in resources.toml, stored in Core (never inline here)
|
|
# ════════════════════════════════════════════════════════════════════════════
|
|
# JWT_SECRET -> [[booth_<name>_jwt_secret]] (login)
|
|
# EVENT_SIGNING_KEY -> [[booth_<name>_event_signing_key]] (ledger signing — fraud root)
|
|
# periphery passkey -> [[periphery_passkey_booth_<name>]] (agent onboarding)
|
|
# registry account -> [[gitea_registry_account]] (image pull)
|