Logan CusanoandClaude Opus 5.5
aa5b71d853
Backend (c2-core):
- app/internal/cameras/: provider interface, licence model, per-provider
catalog cache; one adapter per source in design-canvas/camera-sources.md.
Implemented: 511NY (legacy shape + tolerant XML inventory parser, 511x
endpoints UNVERIFIED), Caltrans, DelDOT, Ontario 511, DriveBC, Calgary,
TfL, NSW, Fintraffic. Stubs: NYC DOT, Westchester DPW, TRANSCOM, CTroads,
511NJ, Austin, TxDOT, MD CHART, WSDOT, Tallinn, Tarktee, Warendorf,
TrafficLand, Windy, EarthCam.
- Every provider defaults OFF (config/camera_providers). Gated licences
(agreement required / unverified / non-commercial / paid) need an explicit
acknowledgement stored with who/when and written to audit_log; the audit
write is a precondition. Stubs and prohibited sources cannot be enabled.
Ack is bound to the licence status it was given for.
- GET /cameras (signed-in), GET/PUT /admin/camera-providers (admin only).
- /traffic/511 follows the ny511 provider switch and returns the DAA credit
+ NYSDOT as-is disclaimer; 511NY event descriptions no longer truncated
("may not alter the substance of a report").
Frontend:
- LiveView becomes the ops wall: Region > Incident > Camera drill-down,
worst-first rail (MapView), KPIs, transcript ticker, scrubber incident
bands, auto-tour, deep links (#inc=&cam=&tour), Esc steps up.
- Incident panel: nearest cameras (path-weighted), fused situational context
(ADS-B, AIS, 511NY events, NEXRAD tile sample), units, call spine.
- MapView keeps every layer; adds Camera Viewsheds (approx.) overlay and a
nearest-camera layer for the selected incident.
- CameraFeed hygiene: hidden-tab/off-screen gating, 2 concurrent HLS cap,
last good frame + stale badge, frozen-frame signature, HLS stall watchdog,
provider attribution rendered on the imagery.
- Camera/event popups show source credit, update time and the disclaimer.
- Admin > Camera providers tab with licence status, health, gated confirm.
- Camera detection is not built (blocked on #199/#200); seam only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
64 lines
2.6 KiB
Bash
64 lines
2.6 KiB
Bash
# MQTT broker (usually the mosquitto container on this host)
|
|
MQTT_BROKER=mosquitto
|
|
MQTT_PORT=1883
|
|
# Use the c2-core credential — must match MQTT_C2_USER/MQTT_C2_PASS in the
|
|
# top-level .env
|
|
MQTT_USER=drb-c2-core
|
|
MQTT_PASS=change-me-c2
|
|
|
|
# Same value as the top-level .env's MOSQUITTO_DYNSEC_PASSWORD — lets
|
|
# c2-core log in as mosquitto's built-in dynsec "admin" client to
|
|
# administer node MQTT credentials. See app/internal/dynsec.py.
|
|
MQTT_DYNSEC_ADMIN_PASS=change-me-dynsec-admin-min-12-chars
|
|
|
|
# GCP — path to service account JSON inside the container
|
|
GCP_CREDENTIALS_PATH=/app/gcp-key.json
|
|
|
|
# Firestore database name (use "(default)" if you didn't create a named database)
|
|
FIRESTORE_DATABASE=c2-server
|
|
|
|
# GCS bucket for audio storage
|
|
GCS_BUCKET=your-bucket-name
|
|
|
|
# How long (seconds) before a node is marked offline if no checkin received
|
|
NODE_OFFLINE_THRESHOLD=90
|
|
|
|
# Google Maps — for geocoding location strings extracted from transcripts
|
|
# Enable "Geocoding API" in Cloud Console for this key
|
|
GOOGLE_MAPS_API_KEY=
|
|
NY511_API_KEY=
|
|
# 511NY feed base URL from the DAA grant (default: legacy 511ny.org/api, dead since the 511x cutover)
|
|
NY511_API_BASE=
|
|
# Ontario 511 developer key (camera provider "ontario511"; providers default OFF)
|
|
ONTARIO511_API_KEY=
|
|
|
|
# OpenAI — for transcription (Whisper), intelligence extraction, embeddings, and summaries
|
|
OPENAI_API_KEY=
|
|
SUMMARY_INTERVAL_MINUTES=15
|
|
CORRELATION_WINDOW_HOURS=4
|
|
EMBEDDING_SIMILARITY_THRESHOLD=0.82
|
|
|
|
# Browser origins allowed to call this API cross-origin (JSON list). The only
|
|
# browser caller is the frontend's Archive page (GET /calls/search). Set this
|
|
# to the exact origin the frontend is served from — scheme + host, no path.
|
|
# Defaults to https://drb.cusano.net. A "*" entry works for local dev but is
|
|
# logged as a probable misconfiguration and never gets a credentialed response.
|
|
CORS_ORIGINS=["https://drb.cusano.net"]
|
|
|
|
# Fleet-wide token edge nodes present as X-Enrollment-Token on first boot
|
|
# (POST /nodes/enroll). Shared across every node — NOT a per-node secret.
|
|
# Generate with: openssl rand -hex 32
|
|
ENROLLMENT_TOKEN=
|
|
|
|
# Shared key the Discord bot presents to reach C2 without Firebase.
|
|
# Generate with: openssl rand -hex 32
|
|
SERVICE_KEY=
|
|
|
|
# Agent/automation key for the unattended work session's headless routes
|
|
# (GET/PUT /admin/features). DELIBERATELY a different value from SERVICE_KEY —
|
|
# reusing the bot's key would make both principals indistinguishable in
|
|
# audit_log, which is the whole point of server-26#64. Leave blank to keep the
|
|
# agent path closed; the routes still take a Firebase admin token either way.
|
|
# Generate with: openssl rand -hex 32
|
|
AGENT_SERVICE_KEY=
|