Инструкция оператору

Серверная часть требует отдельной установки. Не перенастраивайте трекер до проверки доступности приёмника.

EDVADO Analyzer — operator installation, request823
=================================================
STATUS: source + interface prepared; TCP/DNS/firewall are NOT configured by deployment.
This is one integrated service. Stdlib Python3, no pip, no database, no containers.
Other EDVADO API, SMTP, Locavist and Configurator remain unchanged.
Public IMEI access is intentional, test devices ONLY. An operator-controlled
allowlist is mandatory and empty by default; no enumeration endpoint exists.

A. INSPECT FIRST on ngnix (Garick)
--------------------------------
ss -ltnp | grep -E ':(8766|9010) '
systemctl status edvado-analyzer.service --no-pager
sudo nginx -T
Inspect current sites, upstreams, TLS and firewall/NAT in their actual locations.
If this service/configuration already exists: back it up and review/merge it.
Do not replace the whole Nginx config or change existing API/mail routes.
Verify installed Python3 version and that external test.edvado.com reaches this
same host. 9010 is proposed, NOT confirmed free or externally reachable.
This guide does NOT authorize reconfiguring the active tracker.

B. INSTALL REVIEWED SOURCE (root privileges required)
---------------------------------------------------
Deployment stages inert source at /opt/edvado-api/app/analyzer.
Verify checksums against the approved local release manifest first. Source to
copy: __init__.py, protocol.py, service.py, tags.json, service unit template.
Keep old /opt/edvado-analyzer and unit/env backups before an update. Do not copy
private runtime files or real telemetry into deployment/Git/static directories.

New installation only, after checks:
  sudo useradd --system --no-create-home --shell /usr/sbin/nologin edvado-analyzer
  sudo install -d -o root -g root -m 0755 /opt/edvado-analyzer/analyzer
  sudo install -o root -g root -m 0644 /opt/edvado-api/app/analyzer/__init__.py /opt/edvado-analyzer/analyzer/
  sudo install -o root -g root -m 0644 /opt/edvado-api/app/analyzer/protocol.py /opt/edvado-analyzer/analyzer/
  sudo install -o root -g root -m 0644 /opt/edvado-api/app/analyzer/service.py /opt/edvado-analyzer/analyzer/
  sudo install -o root -g root -m 0644 /opt/edvado-api/app/analyzer/tags.json /opt/edvado-analyzer/analyzer/

Create /etc/edvado-analyzer.env locally, owned root:edvado-analyzer, mode0640:
  ANALYZER_TEST_IMEIS=<approved test IMEI; comma-separated, max10>
  ANALYZER_WEB_ORIGIN=https://test.edvado.com
  ANALYZER_PUBLIC_HOST=test.edvado.com
  ANALYZER_HTTP_PORT=8766
  ANALYZER_TCP_PORT=9010
  ANALYZER_TCP_BIND=0.0.0.0
No login/password/accounts are used. Do not publish the environment file or put
client devices into the test allowlist. The test IMEI is not hardcoded in source.
If 9010 is occupied, agree another port and update all instructions consistently.

Install the isolated launcher and unit, after source/checksum review:
  sudo install -o root -g root -m 0644 /opt/edvado-api/app/analyzer/run_analyzer.py /opt/edvado-analyzer/run_analyzer.py
  sudo install -o root -g root -m 0644 /opt/edvado-api/app/analyzer/edvado-analyzer.service.txt /etc/systemd/system/edvado-analyzer.service
  sudo systemd-analyze verify /etc/systemd/system/edvado-analyzer.service
The launcher adds only its root-owned sibling package to Python -I sys.path.
No virtualenv/pip or third-party runtime packages are required.

C. NGINX (merge inside the existing test.edvado.com TLS server block)
-----------------------------------------------------------------
  location ^~ /analyzer-api/ {
      proxy_pass http://127.0.0.1:8766;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_connect_timeout 3s;
      proxy_read_timeout 15s;
      client_max_body_size 128;
      add_header Cache-Control "no-store" always;
      add_header X-Robots-Tag "noindex, nofollow" always;
      access_log off;
  }
Preserve inherited security headers; Nginx add_header inheritance must be reviewed.
Add a per-IP request limit using the existing site's rate-limit zones, or create
a separately named analyzer zone in the http context after inspection. Do not
copy a limit_req directive with an undefined zone. Recommended 3 requests/sec,
burst10. Existing routes /api/, forms, SMTP and application settings stay intact.
Disable caching at any CDN for /analyzer-api/. Avoid IMEI query strings in logs.
Review Nginx error-log policy as well: upstream errors can otherwise contain URLs.
Browser polling is5s. No WebSocket/SSE proxy setup needed for this implementation.
Static /analyzer/ is already in the existing test site's public directory.
Use nginx -t before an operator-approved reload; keep a rollback config backup.

D. NETWORK / START
------------------
Allow inbound TCP9010 to the receiver host in the EXISTING firewall and edge NAT.
Do not expose HTTP8766 (loopback only); no UDP port is required.
If test.edvado.com is behind an HTTP-only proxy/CDN, use a separate DNS-only
hostname such as analyzer.edvado.com pointing to the reachable gateway IP, and
set ANALYZER_PUBLIC_HOST accordingly. Verify the real route first. No made-up IP.
Web UI remains https://test.edvado.com/analyzer/; no extra DNS/TLS is needed for
that UI. The tracker connection is raw TCP, not an HTTPS URL.
  sudo systemctl daemon-reload
  sudo systemctl enable --now edvado-analyzer.service
  sudo systemctl status edvado-analyzer.service --no-pager
  curl -fsS http://127.0.0.1:8766/analyzer-api/health
  curl -fsS https://test.edvado.com/analyzer-api/health
Then verify9010 reachability from outside the LAN, not only localhost.
No telemetry or identities should be pasted into public logs/chats.

E. ACCEPTANCE WITH THE REAL DEVICE (after separate operator confirmation)
-----------------------------------------------------------------------
1.Open https://test.edvado.com/analyzer/ and enter the approved test IMEI.
2.Check that health reports the agreed server hostname/TCPport, open reception.
3.The person responsible for the test tracker backs up its settings and manually
  changes only the agreed destination (prefer an approved extra server if supported).
  This installation guide does not send any tracker command.
4.Observe HEADER, TCPconnection, DATA, receive time, history and packetcount.
5.Check actual CAN+LLS, filters, rawPACKAGE/PACKET, priorrecord/diff and CSV.
6.Compare a known real packet with the trusted decoder and source documentation.
7.CAN188 must be labelled testdata, not vehicle readings. RelativeLLS not litres.
8.Test mobile/desktop and both themes. Test expiredwindow/reconnect/duplicateACK.
Until these pass, status is "prepared for deployment", NOT live-device acceptance.

Operational limits / known limitations
-------------------------------------
Max10 allowlisteddevices,20TCPthreads,24HTTPthreads,200records/device,24hRAMretention,
10s HEADER timeout,15s watch-window checks (quiet authorised TCP stays connected),1MiB/min/connection,100packages/min/device. Maximum PACKET8192B,
connectionbuffer64KiB. Excess traffic rejected, not silently unlimited.
RAW/history disappear on restart; this is intentional for the initial testpilot.
Malformed length/checksum -> errorACK, no successfulACK/storage. ProtocolACK only,
no config/redirect/SMScommands. HEADER2/3/WiFi (0x23/24/25) accepted; HEADER1 not.
Duplicate immediately repeated PACKAGE is ACKed without another record.
Receivedrecords expose their own receive time separately from device time.
CommonGPS/power/IO/CAN/LLS decode; ambiguous80/155 and undocumentedvalues stayraw.
Source definition text available for162records; no invented semantic coverage.
DS/DS2 expose rawword+bits rather than choosing undocumented model-specific table.
PublicIMEI is not deviceauthentication: a malicious peer can spoof a known testID.
No customertraffic, no secrets in payloads; do not use as production monitoring.
No persistent database, no SUP/Configuratorintegration added in this scope.
A lostACK at processrestart can cause retransmission; dedup is boundedRAM only.

Rollback
--------
Stop/disable ONLY edvado-analyzer.service, remove ONLY its new proxy location and
firewall/NAT rule after checking no other service depends on them, validateNginx,
restore previous analyzer source/config backups. Leave existing site/API/mail
untouched. Restore tracker settings only by its responsible operator.