- requirements.txt: bump floors past known CVEs (flask>=2.3.2 fixes
CVE-2023-30861, requests>=2.32.0 fixes CVE-2023-32681 + CVE-2024-35195,
redis>=5.0 fixes CVE-2023-28858/9).
- LICENSE: add MIT text (README claimed MIT but the file was missing).
- /api/1/debug/redis-keys: require auth. Was unauthenticated info-disclosure
on the LAN/AP side.
Previous values (***REMOVED***, ***REMOVED***, ***REMOVED***)
were inline defaults across adamaps + adacam-api + varroa. The ingest key
was briefly anon-visible during the 2026-05-27 Forgejo public-flip when
adacam-api + varroa were public for a short window before the leak was
spotted.
New values live in Vaultwarden:
- AdaMaps — API_KEY (ingest)
- AdaMaps — READ_KEY
Validators now hard-fail at boot if the env var is missing. Service is
on hold today; when it resumes, both env vars must be set.
odc-api.db confirmed present on device. framekms table has:
latitude, longitude, altitude, hdop, satellites_used, time
NOT lat_deg/lon_deg/alt_m/num_satellites as previously assumed.
Redis fallback retained, supports both field naming conventions.
API response format unchanged (still returns lat_deg/lon_deg for Varroa compat).
CRITICAL:
- frames.py: FRAMES_DIR corrected to /tmp/adacam/pics
- frames.py: graceful handling when capture not started
IMPORTANT:
- wigle.py: added GET /api/1/wigle/config endpoint for Varroa
- app.py: added GET /api/1/debug/redis-keys endpoint for GPS troubleshooting
- install.sh: removed python validation that runs from wrong directory
Clean Python Flask replacement for odc-api (434k lines Node.js → ~350 lines Python)
- GET /api/1/landmarks/last/{N} - last N detections from SQLite
- POST /api/1/landmarks - ingest detections + forward to AdaMaps
- GET /api/1/gnssConcise/latestValid - GPS fix from Redis
- GET /api/1/status - device status
- GET /api/1/deviceinfo - device identity
- GET /api/1/recording/frames/latest - latest frame path
No /api/1/cmd - that's the CVE, it's gone.
Includes:
- SQLite for local storage + offline queue
- Background thread for AdaMaps retry
- systemd service unit
- install.sh for device deployment
