Project Control — pjt2-scada

Continue prompt

{
  "project": "pjt2-scada",
  "mission": "Operate and maintain the live 9-container Perum Jasa Tirta II RG1 pump station SCADA telemetry and admin stack on VM101, ensure automated daily SQL backups and InfluxDB telemetry health, and execute pending backlog enhancements (Telegram alarm notifications, HMI Sinoptik integration, and validating IaC templates in SINERGI/Proxmox) without disrupting active telemetry.",
  "read_first": [
    "/data/vault/wiki/projects/pjt2-scada.md",
    "/data/vault/wiki/projects/Proxmox.md",
    "/data/vault/wiki/projects/pjt-cawang.md",
    "/data/vault/wiki/hot.md",
    "/data/vault/wiki/log.md",
    "output/census-latest.json"
  ],
  "verification_anchor": {
    "command": "curl -s http://192.168.1.201:8081/api/fleet/live | head -c 120 && echo '' && docker ps --filter \"name=scada\" --filter \"name=grafana\" --filter \"name=influxdb\" --filter \"name=postgres\" --filter \"name=nodered\" --filter \"name=mosquitto\" --filter \"name=runtime-tracker\" --format \"table {{.Names}}\t{{.Status}}\t{{.Ports}}\"",
    "expect": "JSON object containing live pump telemetry (e.g. {\"pumps\":{\"p01\":{\"display_name\":\"Pompa 1\"...}}}) and 9 active containers on VM101: scada-admin (Up on 8081), grafana (Up on 3000), influxdb (Up on 8086), postgres (Up on 5432), nodered (Up on 1880), scada-hmi (Up on 8080), mosquitto (Up on 1883/9001), scada-simulator (Up), and runtime-tracker (Up)."
  },
  "project_context": {
    "what_it_is": "Industrial IoT SCADA monitoring and administration stack for Perum Jasa Tirta II River Gate 1 (RG1) pump station, monitoring 17 pumps (p01–p17) across operational and telemetry metrics (vibrasi, temperatur, speed, level_oli, pintu_buang, limpasan, running_state, flow_est, running_hours) with time-series historical data in InfluxDB, operational data in PostgreSQL, and an authenticated FastAPI admin webapp.",
    "domain_notes": "The architecture spans two nodes: VM100 (Windows 11 SCADA Edge gateway running Siemens WinCC, Kepware KEPServerEX OPC server, Mosquitto, and an HTTP file server on port 8090) and VM101 (Ubuntu Linux SCADA Backend hosting 9 Docker containers on the iiot_iiot network). Telemetry flows from field PLCs -> KEPServerEX (OPC-UA/Modbus) -> Mosquitto MQTT (VM100:1883) -> Node-RED (VM101) -> InfluxDB + PostgreSQL -> Admin Webapp (VM101:8081) / HMI Wall Display (VM101:8080) / Grafana (VM101:3000). Client naming convention requires using 'Perum Jasa Tirta II' (never colloquial 'Cawang' alone) on all user-facing deliverables. The admin webapp uses a mixed language glossary (Bahasa Indonesia for operational terms, English for admin/technical controls)."
  },
  "tech_stack": {
    "backend_and_admin_app": "FastAPI + Jinja2 (server-rendered multi-page app with dark industrial theme, session-cookie auth with bcrypt hashes, roles: admin and viewer)",
    "databases": "PostgreSQL 16 (operational DB `scada`, user `scada`, raw text() SQL queries via SQLAlchemy) + InfluxDB 2.7 (bucket `mqtt`, org `pjt2`, queried via Flux in influx.py)",
    "telemetry_and_pipeline": "Eclipse Mosquitto (MQTT broker on ports 1883/9001), Node-RED (MQTT subscriber pipeline writing to InfluxDB + PostgreSQL), Python 3 background daemons (scada-simulator, runtime-tracker)",
    "frontend_and_visualization": "Jinja2 templates with dark industrial CSS tokens (admin.css), Nginx static server (scada-hmi wall display on port 8080), Grafana (dashboards on port 3000 / external ZeroTier port 13000)",
    "edge_gateway_node": "Windows 11 (VM100 / W11-SCADA) with Siemens WinCC SCADA runtime, Kepware KEPServerEX OPC server, and standalone PowerShell HttpListener file server on port 8090",
    "infrastructure_and_deployment": "Docker Compose on VM101 (9 containers on iiot_iiot network), Proxmox DNAT port forwards, daily automated PostgreSQL backup cron (/opt/iiot/backups/scada_YYYY-MM-DD.sql.gz)"
  },
  "current_state": {
    "summary": "All 9 SCADA containers on VM101 (scada-admin, grafana, influxdb, postgres, nodered, scada-hmi, mosquitto, scada-simulator, runtime-tracker) are healthy and actively operational (Up 6+ days). Production deployment resides at /opt/iiot (untracked by git) with automated daily PostgreSQL backups verified active (e.g. /opt/iiot/backups/scada_2026-08-25.sql.gz). The admin webapp UI redesign (14 dark industrial templates, reset-runtime, inline alarm ACKs, audit logging) is fully deployed and verified. Codebase in Gitea is hosted under SINERGI/PJT2-W4-SCADA (24 KB, last commit 2026-07-14) and related IaC repo SINERGI/Proxmox (472 KB, updated 2026-08-19). On VM100, HTTP file server (port 8090) is active after guest SMB changes were reverted to preserve RDP access.",
    "source_of_this_status": "output/census-latest.json (containers, opt_deployments, gitea_repos) + vault pages /data/vault/wiki/projects/pjt2-scada.md, /data/vault/wiki/projects/Proxmox.md, /data/vault/wiki/hot.md, and /data/vault/wiki/log.md (§2026-07-14 UI redesign, §2026-08-18/19 VM100 setup and SMB revert)"
  },
  "repo_locations": {
    "gitea_remote_scada": "http://localhost:3001/SINERGI/PJT2-W4-SCADA.git (internal Gitea repo, 24 KB, default branch main, updated 2026-07-14T10:13:56Z)",
    "gitea_remote_proxmox_iac": "http://localhost:3001/SINERGI/Proxmox.git (internal Gitea repo, 472 KB, default branch main, updated 2026-08-19T18:21:44Z; contains docker-compose.yml, admin/, provisioning/, postgres-init/, simulator scripts)",
    "vm101_production_deployment": "/opt/iiot (untracked production deployment directory on VM101 host containing admin/ FastAPI app, backups/, nodered data, etc.)",
    "local_clone": "none (no working tree clone exists in /data/project; clone from SINERGI/PJT2-W4-SCADA or SINERGI/Proxmox if codebase editing is required)",
    "windows_local_staging": "C:\\pjt2-scada\\ (local workstation staging directory used with vm101_ssh.py to deploy to /opt/iiot/admin/)",
    "vm100_edge_scripts": "C:\\Shared-http\\server.ps1 on VM100 (PowerShell HTTP file server on port 8090 serving C:\\Shared)"
  },
  "key_files": {
    "/data/vault/wiki/projects/pjt2-scada.md": "Primary Obsidian project documentation detailing architecture, 9 containers, database/Influx schemas, routes, template tuple indices, and deployment runbooks",
    "/data/vault/wiki/projects/Proxmox.md": "Vault documentation stub for SINERGI/Proxmox Gitea repo containing infra-as-code and docker-compose definitions for the SCADA stack",
    "/opt/iiot/admin/main.py": "FastAPI main application module defining all API endpoints, auth decorators, and UI page routes",
    "/opt/iiot/admin/auth.py": "Authentication module handling session cookies, bcrypt verification, role checks (admin/viewer), and log_audit()",
    "/opt/iiot/admin/database.py": "SQLAlchemy database connection setup executing raw text() SQL queries against PostgreSQL",
    "/opt/iiot/admin/influx.py": "InfluxDB client and Flux query helpers for pump telemetry metrics",
    "/opt/iiot/admin/alarms.py": "SCADA alarm evaluation logic and acknowledgement handlers",
    "/opt/iiot/admin/exports.py": "Telemetry and report export handlers generating CSV and XLSX streams",
    "/opt/iiot/admin/static/css/admin.css": "CSS design tokens and dark industrial theme styling matching the HMI wall display",
    "/opt/iiot/backups/": "Directory containing automated daily PostgreSQL gzip SQL dumps (e.g. scada_2026-08-25.sql.gz)",
    "C:\\pjt2-scada\\vm101_ssh.py": "Windows Python 3.12 Paramiko SSH script for deploying files (--put) and restarting containers on VM101",
    "C:\\Shared-http\\server.ps1": "Standalone PowerShell HttpListener file server running on VM100 (port 8090) serving C:\\Shared"
  },
  "next_steps": [
    "Maintain and monitor continuous health across the 9 production SCADA containers on VM101 (`docker ps` for scada-admin, grafana, influxdb, postgres, nodered, scada-hmi, mosquitto, scada-simulator, runtime-tracker).",
    "Verify automated daily PostgreSQL backup creation and integrity under `/opt/iiot/backups/` (`scada_YYYY-MM-DD.sql.gz`).",
    "Read and catalog the `SINERGI/Proxmox` Gitea repository (472 KB) to verify whether it serves as the complete Infrastructure-as-Code source for `/opt/iiot` and upgrade its vault status from `seed`.",
    "Execute backlog feature items when scheduled: implement Telegram alarm notifications for critical pump threshold events, and integrate HMI Sinoptik diagrams into the admin webapp.",
    "Clean up historical temporary diagnostic scripts from Windows staging directory `C:\\pjt2-scada\\` (`verify.py`, `check_final.py`, `fix_viewer_and_maint.py`, `test_reset.py`, etc.).",
    "Maintain VM100 file sharing via the port 8090 PowerShell HTTP server without re-enabling Guest SMB (to avoid breaking RDP/LSA)."
  ],
  "constraints": [
    "Never run `docker prune` on VM101 — 13 production SCADA containers and the agent fleet are co-tenant on this host.",
    "SQLAlchemy parameter syntax: In `text()` SQL queries, never use PostgreSQL `::jsonb` type casting (SQLAlchemy named-parameter parser misinterprets `::` as parameter names); always use explicit `CAST(:param AS jsonb)`.",
    "JSONB serialization: In `auth.py`, `log_audit()` must json-encode the detail payload string (`json.dumps(detail)`) before inserting into `audit_log.detail`.",
    "Bcrypt hash safety: Never embed bcrypt password hashes in raw bash command strings or f-string SSH commands (`$` gets expanded by bash); stage SQL to a file, upload, and pipe via `psql -f`.",
    "Pump ID format: Pump IDs must strictly use lowercase identifiers `p01` through `p17` (never uppercase `P01` or integers), which violate foreign key constraints.",
    "Role check constraint: Role field in `users` table is strictly constrained to `'admin'` or `'viewer'`; no other role strings are accepted by PostgreSQL.",
    "HMI wall display isolation: Never modify `hmi*.html` templates or `/hmi` route on VM101 (used by live control room display).",
    "Windows Python environment: When executing Windows helper scripts (`vm101_ssh.py`), always use full path `C:\\Users\\dimas\\AppData\\Local\\Programs\\Python\\Python312\\python.exe` (default PATH python resolves to empty Hermes venv lacking paramiko).",
    "Windows SMB Guest policy: Never re-enable `ForceGuest=1` on VM100 (`W11-SCADA`); doing so forces all network logons through Guest and completely breaks RDP authentication. VM100 file sharing must strictly use the PowerShell HTTP server on port 8090.",
    "Client naming convention: User-facing labels and reports must always use official name 'Perum Jasa Tirta II' (never colloquial 'Cawang' alone).",
    "Template context tuple indices: Most Jinja2 templates expect tuple indices from raw SQL rows (e.g. `pumps[0]=id`, `pumps[1]=display_name`), except `alarms.html` which uses attribute access (`p.pump_id`, `p.display_name`)."
  ],
  "known_staleness_warning": "The primary vault page (/data/vault/wiki/projects/pjt2-scada.md) has frontmatter updated: 2026-07-14 (though bottom sections contain updates up to 2026-08-19). Gitea repo SINERGI/PJT2-W4-SCADA shows no commits since 2026-07-14, but production runtime is actively maintained on VM101 with daily database backups. The ZeroTier port forwarding table in the vault had an older entry listing Grafana on port 3000, which was corrected in later notes: external port 3000 forwards to Gitea (internal 3001), while Grafana is accessed externally on port 13000 (internal 3000). The relationship between /opt/iiot and the newly discovered SINERGI/Proxmox repo (updated 2026-08-19) remains unconfirmed until an in-depth codebase audit is performed.",
  "handoff_metadata": {
    "created": "2026-08-25",
    "created_by": "project-control automated continue-prompt generator",
    "all_facts_sourced_from": "census-latest.json + /data/vault/wiki/projects/pjt2-scada.md + /data/vault/wiki/projects/Proxmox.md + /data/vault/wiki/projects/pjt-cawang.md + /data/vault/wiki/projects/_index.md + /data/vault/wiki/hot.md + /data/vault/wiki/log.md + /data/project/project-control/output/judgment-2026-08-25.md"
  }
}

Detail

Observed Signals

Containers: 9 active containers: scada-admin (iiot_scada-admin, Up 6 days, healthy, port 0.0.0.0:8081->8081/tcp), grafana (grafana/grafana:latest, Up 6 days, healthy, port 0.0.0.0:3000->3000/tcp), influxdb (influxdb:2.7, Up 6 days, healthy, port 0.0.0.0:8086->8086/tcp), postgres (postgres:16-alpine, Up 6 days, healthy, port 0.0.0.0:5432->5432/tcp), nodered (nodered/node-red:latest, Up 6 days, healthy, port 0.0.0.0:1880->1880/tcp), scada-hmi (nginx:alpine, Up 6 days, port 0.0.0.0:8080->80/tcp), mosquitto (eclipse-mosquitto:latest, Up 6 days, ports 0.0.0.0:1883->1883/tcp, 0.0.0.0:9001->9001/tcp), scada-simulator (python:3-slim, Up 6 days), runtime-tracker (python:3-slim, Up 6 days).
Deployments: /opt/iiot (last_touched_iso: 2026-08-25T02:00:01.958221+00:00, active file: /opt/iiot/backups/scada_2026-08-25.sql.gz).
Git Repos & Local Clones: Gitea repository SINERGI/PJT2-W4-SCADA (24 KB, updated_at: 2026-07-14T10:13:56Z).
Vault Documentation: pjt2-scada.md (status: active, updated 2026-07-14).

1. What's Left

Continuous telemetry ingestion and operational health monitoring for 17 pump stations at Perum Jasa Tirta II RG1, maintaining automated daily PostgreSQL backups, and executing scheduled backlog enhancements (Telegram alarm notifications for critical pump threshold events, HMI Sinoptik diagram integration, and aligning deployment with SINERGI/Proxmox IaC templates).

2. Continue / Drop Suggestion

Continue — Mission-critical industrial telemetry and operational control stack with 9 healthy containers and verified automated daily SQL backups.

3. Dynamic Milestone Estimate

Delivery Window: 2–4 weeks (late September 2026) for routine operational review and backup audit cycle.
Confidence: Medium (controller estimate, revised 2026-08-25; runtime fully active with daily backups, git repository in stable maintenance).