CarWatch v0.3.0 — one screen, in the car, and locked down

23 commits since v0.2.0. The headline is that the car's cloud data now works on the road, not only parked at home, and the dashboard is a single screen you can mount.

The car reaches home from anywhere

The Mercedes cloud panel reads a Home Assistant at your house. Previously that only worked on home wifi — in the car, on a phone hotspot, the panel was blank. The install guide now documents Tailscale as the path: the Pi and your home machine join one private network, the address never changes, and Home Assistant is never published to the internet. Free, no domain, no open ports. Nabu Casa is listed as the alternative for people who also want Alexa or cloud backups.

Security

Three fixes, all found and closed today:

• Dashboard auth bypass (found by @codexmb): a request without proxy headers skipped the token entirely. Those headers come from the client, so anyone could omit them. Now the unspoofable socket peer is required as well.
• Foreign-LAN access: the first fix still trusted any private network. A car roams onto café and hotel wifi where every other guest is equally "local", so token-free access is now limited to loopback and your own tailnet.
• HA token leak: the token could be sent to a target outside your own network.

Two hardening items are filed as issues rather than silently carried: the dashboard token travels in the URL (#12), and /api/update runs code behind that same token (#13).

The dashboard

One screen, no scrolling, sized for a large phone in a mount. OBD on the left with its own staleness badge, Mercedes me on the right marked read-only, both cars as tabs. Installs to the home screen as a fullscreen app, so there is no browser chrome in the car.

Repository

The two WOLFBOX firmware images (48 MB, half the repo) are gone; the research that used them stays, with the vendor link and SHA-256 checksums so it can be reproduced from bit-identical files. .gitignore now refuses .env, *.key and *.pem. The project has an AGPL-3.0 licence file, and still has zero third-party Python dependencies — clone it and it runs.

Honest limitations

• Readings update while the car is awake, not while it sleeps. Driving, the values track the car — hybrid charge moved 75.7% → 75.3% → 71.8% across one trip. Parked with the ignition off the OBD dongle sleeps, reads fail, and the age badge climbs into the minutes until the car wakes again. The age badge is always the truth about how current the numbers are.
• Steering angle is not shipped. CAN 0x0500 byte 0 was believed to be the wheel; with the wheel held at full lock for 75 seconds the value moved by one unit, so it is something else. The dial is hidden until a signal is shown to follow the wheel.
• OBD reads need the ignition on — the dongle sleeps with the car.