Melvin Strobl 72c1d73e96 Camera permission and review fixes (openpanel C3, C4)
C4: a device's `viewers` (superusers by default, or members) covers the
image and video messages its ports publish. Anyone else gets none of their
values on the socket, in the catalogue or a flow's state, 403 for their
history, for the frames they hold (the last 8 included) and for TURN
credentials, no bytes when asking for them, and `bye: forbidden` for a live
view. A device credential stays bounded by its dashboards. The device page
sets it in its Camera section, and a tile the viewer may not see says
"No access to this camera" and asks the camera for nothing.

C3:
- A volatile upload is held to MAX_FRAME_BYTES (4 MiB, 413 above it, read
  without extra copies), and so is a frame on a device's socket.
- A frame the engine holds in memory is written to the ring directory
  before a local worker is handed it, so load_artifact finds it.
- A socket the bus dropped events for catches up with a snapshot, demand
  included, and a device's credential is checked again per frame, cached by
  the flow store revision and its nonce, so a lost event never keeps an
  unpaired device's frames coming.
- A report is at most 64 KB once its named config_schemas are put in place.
- A device away for 60 s has its true bool messages set to false.
- Refused frames are logged by fixed keys, a frame is named after its
  message, `fluksio serve` waits 5 s for open connections, a tile with a
  stream URL creates no demand, the 8-name cap keeps the newest names.
- Every container's log rotates (json-file, 3 x 10 MB).
2026-10-17 09:20:04 +02:00
2026-02-03 21:43:09 +01:00
2026-10-15 17:18:12 +02:00

Fluksio App

Fluksio is a node-based automation software that brings trust and reliability to your flow. It just works and looks good.

The core of Fluksio: a node-based, test-driven automation software built to scale. This repo holds the FastAPI backend, the flow engine, and the dashboard SPA, built into one image that serves all three on one port.

Layout

backend/        FastAPI + SQLModel + Alembic + SQLite
  fluksio/flow/ the flow engine (nodes, pipeline, state backends, controller)
  fluksio/cli.py  `fluksio serve` / `enroll` / `worker`
worker/         the `fluksio-worker` distribution: the agent and the node runner
frontend/       React 19 + TanStack Router + Tailwind 4 + shadcn/ui
docs/           the public documentation site (zensical), served on docs.${DOMAIN}
compose.yml     the single container, as the getting-started guide runs it
docker/         the operator stack: compose.yml → compose.dev.yml → compose.local.yml (+ compose.traefik.yml)
scripts/        generate-client.sh, test.sh

Install without Docker

Get started quickly by running

pip install fluksio
fluksio serve

Then, head over to fluksio.com, sign up and add a new instance. Using the code provided, run

fluksio enroll <code>

and you're ready to rock.

Fluksio is distributed at it's heart. A machine that should only run nodes for an engine elsewhere installs less:

pip install fluksio-worker
FLUKSIO_WORKER_TOKEN=… fluksio-worker --url wss://api.fluksio.com/api/v1/workers/attach --labels gpu

Getting started

Needs Docker with Compose v2, on x86-64 or arm64 such as a Raspberry Pi 4 or 5.

docker compose up -d           # http://localhost:8080
docker compose logs fluksio    # the admin password, printed once

Optional features (MQTT, InfluxDB, mail, …) are build-time extras; see EXTRAS in compose.yml.

For development, with hot reload behind Traefik on port 80 (also needs make and openssl):

make init          # once: .env with generated secrets, `proxy` network, prints the admin login
make dev-local     # full stack at http://app.localhost
make down          # stop it

Without Docker:

make install       # uv sync + bun install
make dev-utils     # proxy and mailcatcher only
make dev-backend   # FastAPI on :8000, hot reload
make dev-frontend  # Vite on :5173
make test           # pytest + Playwright (the e2e half on its own stack, behind make dev's Traefik)
make lint           # ruff + mypy + biome
make generate-client  # regenerate the frontend SDK from the OpenAPI schema

make help lists every target.

Documentation

The public site lives in docs/ and is built with zensical:

make docs-serve   # live preview on :8000
make docs         # static build into ./site

It is served at docs.${DOMAIN} by the docs service in docker/compose.yml, and .gitea/workflows/docs.yml builds it with --strict on every push.

License

Copyright (C) 2026 Melvin Strobl - GNU Affero General Public License v3.0 or later. See LICENSE.

S
Description
No description provided
Readme AGPL-3.0
9.4 MiB
Languages
Python 58.6%
TypeScript 38.7%
CSS 1.5%
JavaScript 0.4%
HTML 0.3%
Other 0.4%