grabowski
7e642555b4
Phase 4 of docs/RUST_REWRITE.md. Since 2026-10-18 ping-collector (rust/) collects, forecasts, notifies (ntfy + Matrix) and serves the website/API; nothing in production ran the Python service code any more. Removed (~17k lines): the FastAPI app (web_api, schemas, health_check, metrics, postgres_history, forecast_history, thaiwater), the Python RID collector and CLI (water_scraper_v3, main, run.py), the notifier and Matrix alerting (notify, alerting), the multi-backend adapters (SQLite, MySQL, InfluxDB, VictoriaMetrics) with demo databases, models/validators/exceptions/ logging/rate limiter, ml/skill.py (served by Rust now), the migration tooling (api_parity, collector_parity, e2e_notify, install_collector.sh, gen_notify_cases.py, spikes/rust-forecast), Docker/compose/Grafana files, sql/, the release workflow and the docs for all of that. Their tests went with them. Kept in Python: src/ml (training, evaluation harness, export; predict.py as the reference the Rust forecaster is tested against), the HII and RID-dam clients/stores for the archive backfills (their live collectors removed), the backfill scripts, retrain.sh + timer, forecast_parity.py. - PostgreSQL only: src/config.py is database_url() from POSTGRES_* / .env; the stores lost their sqlite/mysql branches (and the 2026-08 column migration). The database tests run against a throwaway schema from TEST_DATABASE_URL (tests/conftest.py pg_url, skipped without it), as the Rust tests do; CI gets a PostgreSQL service. 100 tests (66 without a DB). - The notifier settings moved from src/notify.py into src/ml/export.py; flood_config.json regenerates byte-identical. - tests/test_dashboard.py checks every path the dashboard fetches against ping-collector's router. - Dependencies: fastapi, uvicorn, pydantic, influxdb, pymysql, psutil, schedule, sphinx, pyinstaller, mypy, pytest-asyncio dropped; python-dotenv 1.1.1 explicit (it came in through uvicorn[standard]). - Formatting contract extended to scripts/ and tests/ (reformatted once). - scripts/install.sh is the one installer (fresh host or update, in place in a checkout without touching its ownership): binary, units, uv sync, .env defaults, removes the retired water-monitor.service and any old --alert-check cron job, dry run + forecast check, restart, readiness wait. - Docs, CLAUDE.md, CONTRIBUTING.md, .env.example, Makefile, unit comments and Rust doc comments updated to the Rust service.
103 lines
4.0 KiB
Bash
103 lines
4.0 KiB
Bash
#!/usr/bin/env bash
|
|
# Install ntfy (https://ntfy.sh) as the public notification server for the
|
|
# Ping River Monitor. Run as root on the monitor VPS. Idempotent.
|
|
#
|
|
# NTFY_DOMAIN=ntfy.buildfor.life bash scripts/install_ntfy.sh
|
|
#
|
|
# What it does:
|
|
# - installs the ntfy .deb from the official GitHub release (single Go
|
|
# binary, ~30 MB RSS, sqlite message cache)
|
|
# - writes /etc/ntfy/server.yml: listens on the Tailscale address only
|
|
# (the reverse proxy is another VPS on the tailnet; nothing is exposed
|
|
# on a public interface), anonymous READ on all topics, WRITE only with
|
|
# a token. Override with NTFY_LISTEN=host:port.
|
|
# - creates the `monitor` publishing user + token, writes NTFY_SERVER /
|
|
# NTFY_TOKEN into /opt/thailand-water-monitor/.env if not present
|
|
#
|
|
# Reverse proxy (on the Caddy VPS, over Tailscale):
|
|
# ntfy.buildfor.life {
|
|
# reverse_proxy <this host's tailscale ip>:2586
|
|
# }
|
|
# Caddy passes websockets and keeps long-poll connections open by default;
|
|
# subscribers hold one open. ntfy runs with behind-proxy: true so rate
|
|
# limits key on X-Forwarded-For, not on the proxy's address.
|
|
set -euo pipefail
|
|
|
|
NTFY_DOMAIN="${NTFY_DOMAIN:?set NTFY_DOMAIN, e.g. ntfy.buildfor.life}"
|
|
NTFY_VERSION="${NTFY_VERSION:-2.28.0}"
|
|
MONITOR_DIR="${MONITOR_DIR:-/opt/thailand-water-monitor}"
|
|
TS_IP="$(tailscale ip -4 2>/dev/null | head -1 || true)"
|
|
LISTEN="${NTFY_LISTEN:-${TS_IP:-127.0.0.1}:2586}"
|
|
echo "ntfy will listen on ${LISTEN}"
|
|
|
|
if ! command -v ntfy >/dev/null || [[ "$(ntfy --version 2>/dev/null | awk '{print $3}')" != "$NTFY_VERSION" ]]; then
|
|
tmp=$(mktemp -d)
|
|
curl -fsSL -o "$tmp/ntfy.deb" \
|
|
"https://github.com/binwiederhier/ntfy/releases/download/v${NTFY_VERSION}/ntfy_${NTFY_VERSION}_linux_amd64.deb"
|
|
dpkg -i "$tmp/ntfy.deb"
|
|
rm -rf "$tmp"
|
|
fi
|
|
|
|
install -d -m 755 /var/cache/ntfy /var/lib/ntfy
|
|
cat > /etc/ntfy/server.yml <<EOF
|
|
# Ping River Monitor notification server. Managed by scripts/install_ntfy.sh.
|
|
base-url: "https://${NTFY_DOMAIN}"
|
|
listen-http: "${LISTEN}"
|
|
behind-proxy: true
|
|
|
|
# Messages are kept so a phone that was offline still gets the crossing.
|
|
cache-file: "/var/cache/ntfy/cache.db"
|
|
cache-duration: "72h"
|
|
|
|
# Everyone may subscribe; only the monitor (token) may publish.
|
|
auth-file: "/var/lib/ntfy/user.db"
|
|
auth-default-access: "read-only"
|
|
|
|
# The monitor publishes a handful of messages per flood; be strict with
|
|
# everything else so the box cannot be used as a free relay.
|
|
visitor-request-limit-burst: 30
|
|
visitor-request-limit-replenish: "10s"
|
|
visitor-subscription-limit: 60
|
|
visitor-message-daily-limit: 200
|
|
attachment-cache-dir: ""
|
|
enable-signup: false
|
|
enable-login: false
|
|
enable-metrics: false
|
|
EOF
|
|
|
|
systemctl enable --now ntfy
|
|
systemctl restart ntfy
|
|
sleep 1
|
|
curl -fsS "http://${LISTEN}/v1/health" >/dev/null && echo "ntfy up on ${LISTEN}"
|
|
|
|
# Publishing identity for the monitor
|
|
if ! ntfy user list 2>/dev/null | grep -q '^user monitor (role'; then
|
|
NTFY_PASSWORD="$(openssl rand -base64 24)" ntfy user add --role=user monitor
|
|
fi
|
|
ntfy access monitor 'ping-*' write-only >/dev/null
|
|
# 'ping-*' read stays anonymous via auth-default-access
|
|
|
|
token=$(ntfy token list monitor 2>/dev/null | awk '/^- tk_/{print $2; exit}') # '- tk_xxx (label), ...'
|
|
if [[ -z "$token" ]]; then
|
|
token=$(ntfy token add --label "water-monitor" monitor | grep -oE 'tk_[A-Za-z0-9]+' | head -1) # 'token tk_xxx created for user monitor'
|
|
fi
|
|
|
|
env_file="${MONITOR_DIR}/.env"
|
|
if [[ -f "$env_file" ]] && ! grep -q '^NTFY_SERVER=' "$env_file"; then
|
|
{
|
|
echo ""
|
|
echo "# ntfy public notifications (scripts/install_ntfy.sh)"
|
|
echo "NTFY_SERVER=https://${NTFY_DOMAIN}"
|
|
echo "NTFY_PUBLISH_URL=http://${LISTEN}"
|
|
echo "NTFY_TOPIC_PREFIX=ping"
|
|
echo "NTFY_TOKEN=${token}"
|
|
} >> "$env_file"
|
|
echo "wrote NTFY_* to ${env_file}; restart ping-collector to enable"
|
|
else
|
|
echo "NTFY_TOKEN=${token}"
|
|
fi
|
|
|
|
echo
|
|
echo "Subscribe test (anonymous read): curl -s 'http://${LISTEN}/ping-status/json?poll=1'"
|
|
echo "Publish test (needs token): curl -s -H 'Authorization: Bearer ${token}' -d 'hello' http://${LISTEN}/ping-status"
|