julian
e67f0ccef0
The operator's category choice is a hypothesis, not truth (user, 2026-09-06): each wash order with a vehicle read queues a package for a trusted reviewer over the private overlay (Netbird); the verdict becomes the phase-B training label and the per-operator error rate. wiki/concepts/vision-review-outbox.md. - Boxes: the vision service returns the vehicle bbox; snapshot.ts stores the vehicle and plate boxes on the read as FRACTIONS of the analysed frame (the stored snapshot is a downscaled copy); vehicleForIdentity() returns them. - carwash_review_outbox (migration 0031) + review-outbox.ts: crop = detector box + 8 % margin, ≤ 640 px, plate blurred in place from the plate box; payload carries a pseudonymous booth id and a keyed operator hash — no site name, no plate, no OSD, no bystanders; multipart POST with a per-booth bearer; 2xx → sent (image dropped); 400/404/413/415/422 → abandoned; anything else → backoff 1 min·2^n capped 6 h; voided orders and items older than 14 days abandoned unsent. Nothing queued while unconfigured. - Enqueue is fire-and-forget off the intake path in createOrder; the loop runs every CARWASH_REVIEW_INTERVAL_SEC (60) and stops on close. - GET /api/carwash/review/status (site:read) + a "Remote review" line in Setup → Car wash. - Env CARWASH_REVIEW_URL / _TOKEN / _BOOTH_ID (all three or off) documented in .env.example and forwarded by compose. - Tests: review-outbox.test.ts (crop + blur on a synthetic frame, config/pseudonyms, queue/drain/backoff/abandon, through the app). Wiki: new concept page, index, venue-modules As built, log. The collector is not built. Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU
102 lines
6.2 KiB
Bash
102 lines
6.2 KiB
Bash
# Copy this file to `.env` (same folder: apps/server/.env) and fill it in.
|
|
# The dev/start scripts load it automatically via Node's --env-file-if-exists.
|
|
#
|
|
# cp apps/server/.env.example apps/server/.env
|
|
#
|
|
# Required ----------------------------------------------------------------
|
|
# The server refuses to start without a strong JWT_SECRET (>=32 chars).
|
|
# Generate one with: openssl rand -hex 32
|
|
JWT_SECRET=
|
|
|
|
# Dedicated HMAC key for signing the append-only event ledger (>=16 chars).
|
|
# Generate with: openssl rand -hex 32
|
|
# If unset, the server falls back to JWT_SECRET (logged as a warning) — fine for
|
|
# dev, but set a dedicated key before production. Events store the key that signed
|
|
# them (keyId), so verifyChain still validates a chain that spans a key change.
|
|
EVENT_SIGNING_KEY=
|
|
|
|
# On-site encrypted DB backup (durability for the signed ledger). A daily timer + an admin
|
|
# "back up now" button write a consistent, AES-256-GCM-encrypted copy to the target. The
|
|
# TARGET DIRECTORY is chosen by the admin in the UI (Setup → Backup) and stored in the DB —
|
|
# NOT here. Only the encryption KEY is an env secret. RESTORE is an out-of-band runbook action,
|
|
# not a console call. See wiki/concepts/backup-recovery.md.
|
|
#
|
|
# Dedicated backup-encryption key (>=16 chars), SEPARATE from EVENT_SIGNING_KEY so it can
|
|
# rotate without fracturing the signed chain. Generate with: openssl rand -hex 32
|
|
# Escrow it offsite (alongside EVENT_SIGNING_KEY) — recovery needs both, and neither is ever
|
|
# stored inside the backup it unlocks. Backups stay a no-op until BOTH this key and an in-UI
|
|
# target directory are set. The target directory AND retention (keep-last / keep-daily) are
|
|
# admin-chosen in the UI (Setup → Backup), NOT env — only this key is an env secret.
|
|
# BACKUP_KEY=
|
|
|
|
# Optional ----------------------------------------------------------------
|
|
# PORT=3000
|
|
# HOST=0.0.0.0 # interface to bind. 127.0.0.1 = loopback only.
|
|
# LOG_LEVEL=info
|
|
# DATABASE_URL=./parking.sqlite
|
|
#
|
|
# Auth-cookie Secure flag. FAIL-SAFE: cookies are Secure (HTTPS-only) BY DEFAULT —
|
|
# you only ever opt OUT, never in. Set COOKIE_SECURE=0 for a plain-HTTP deployment
|
|
# (e.g. the LAN appliance serving the SPA same-origin over http, where a Secure
|
|
# cookie would never be sent and would lock operators out). Local dev over
|
|
# http://localhost MUST set this (the dev .env does). Leave unset in any TLS deploy.
|
|
# COOKIE_SECURE=0
|
|
|
|
# Recycle bin retention: a soft-deleted user/role/subscription/plan/tariff is auto-purged
|
|
# this many days after deletion (a 6-hourly sweep). Default 30. Set 0 to keep deleted
|
|
# items forever (manual purge only). See wiki/concepts/soft-delete.md.
|
|
# RECYCLE_BIN_RETENTION_DAYS=30
|
|
|
|
# First admin (seed once): pnpm --filter @parking/server seed-admin
|
|
# ADMIN_USER=admin
|
|
# ADMIN_PASS=
|
|
|
|
# Comma-separated extra origins allowed to open the booth WebSocket (/api/ws).
|
|
# In dev, set the Vite SPA origin. Same-origin is always allowed without this.
|
|
# The Tauri DESKTOP shell loads from tauri://localhost (Linux may also send
|
|
# http://tauri.localhost), which is NOT same-origin with the backend — add both
|
|
# so the desktop app's live feed connects. See apps/desktop.
|
|
# To open the dev SPA from another LAN device (phone over wifi), Vite must bind
|
|
# 0.0.0.0 (vite.config.ts) AND the host's LAN origin must be listed here, e.g.
|
|
# http://10.0.10.203:5173 — the WS handshake's Origin is that LAN address.
|
|
WS_ALLOWED_ORIGINS=http://localhost:5173,tauri://localhost,http://tauri.localhost
|
|
|
|
# Vision / ANPR (optional) -------------------------------------------------
|
|
# OFF by default. The Node SERVER's view of the vision microservice (apps/vision),
|
|
# which runs as a separate process with its OWN apps/vision/.env. Both sides share the
|
|
# VISION_ prefix but are different processes — keep the two .env files separate.
|
|
# See wiki/entities/opencv-anpr-service.md "Configuration".
|
|
# ANPR rides the entry/exit snapshot (button / QR / RFID triggers it) — no polling.
|
|
# VISION_ENABLED=1 # master switch — nothing runs without it
|
|
# VISION_URL=http://127.0.0.1:8089 # must match apps/vision VISION_HOST:VISION_PORT
|
|
# VISION_TIMEOUT_MS=1500 # per-request cap so a slow call can't hang the lane
|
|
# VISION_MIN_CONFIDENCE=0.5 # advisory confidence floor; keep in sync with the service
|
|
#
|
|
# ANPR subscriber-entry bridge (anpr-entry.ts): a subscriber's plate, read off a lane
|
|
# camera's vehicle detection, admits them through the gated SubscriptionFlow. Opt-in per
|
|
# camera (the camera's config.anpr checkbox in Setup); the camera must be BOUND to a relay.
|
|
# VISION_ENTRY_MIN_CONFIDENCE=0.85 # stricter floor for a BARRIER-driving read (near-miss → falls back to card/QR)
|
|
# ANPR_DEBOUNCE_MS=12000 # same plate/camera within this window = ONE presentation (camera re-fires ~1Hz)
|
|
|
|
# Venue modules --------------------------------------------------------------
|
|
# Comma-separated ids of the modules this site is ENTITLED to (a vendor/deployment
|
|
# decision — set in the Komodo stack env, never by a site role). The site admin then
|
|
# ACTIVATES within this set in Setup → Site; effective = entitled ∩ activated. Unset or
|
|
# blank = every registered module (parking,validation,carwash) — a DEV convenience. In
|
|
# Docker, docker-compose.yml forwards it with a default of parking,validation, so a booth
|
|
# is never entitled to a module its Komodo stack env does not name. Required modules
|
|
# (parking) are always on. See wiki/decisions/venue-modules.md.
|
|
#MODULES_ENTITLED=parking,validation
|
|
|
|
# Car Wash review outbox (wiki/concepts/vision-review-outbox.md) -------------------------
|
|
# The operator's category choice is a hypothesis: each wash order with a vehicle read queues
|
|
# the vehicle CROP (plate blurred) + the choice for a trusted remote reviewer, drained one-way
|
|
# over the private overlay (Netbird). All three or off. URL = the collector's ingest endpoint
|
|
# (reachable only over the overlay); TOKEN = this booth's own bearer token; BOOTH_ID = a
|
|
# pseudonymous label the reviewer maps to a site (NEVER the site name — it travels with every
|
|
# item). Set in the Komodo stack env, per booth. Nothing is queued while off.
|
|
# CARWASH_REVIEW_URL=
|
|
# CARWASH_REVIEW_TOKEN=
|
|
# CARWASH_REVIEW_BOOTH_ID=
|
|
# CARWASH_REVIEW_INTERVAL_SEC=60
|