ContWatch 2.0

[BlueManCZ]

ContWatch v2 is a ground-up rewrite of both the backend and frontend. The core domain — IoT data aggregation, real-time monitoring, and device control — remains the same, but the entire stack has been replaced and features that were incomplete or backend-only in v1 are now fully realized.

Backend

	v1	v2
Framework	Flask + Flask-SocketIO + eventlet	FastAPI + async Socket.IO
ORM	PonyORM	Async SQLAlchemy 2.0
Database	PostgreSQL (or MySQL)	PostgreSQL + TimescaleDB (hypertables, continuous aggregates)
Package manager	pip / requirements.txt	uv
Migrations	None	Alembic
Auth	None	JWT with refresh tokens, silent refresh, account lockout, optional Turnstile CAPTCHA
API contract	Flask blueprints returning JSON	OpenAPI schema from Pydantic models, consumed by frontend codegen (Orval)
Tests	None	pytest

Frontend

	v1	v2
Rendering	Flask/Jinja2 server-rendered HTML templates	Vite + React 19 SPA
JavaScript	TypeScript bundled with Webpack	TypeScript with Vite
Styling	SASS with BEM components	Tailwind CSS 4 + shadcn/ui (base-vega)
Routing	Flask routes serving HTML pages	TanStack Router (file-based)
Data fetching	Socket.IO + manual DOM manipulation	TanStack Query + auto-generated hooks via Orval
Client state	Direct DOM updates	Zustand
i18n	None (single language)	i18next (EN + CS)
Charts	Chart.js (inline)	Chart.js with React wrappers

What Changed

Dashboard — v1 had a basic overview page with handler status tiles rendered via Jinja2 templates. v2 has a fully interactive dashboard with live-updating tiles, switches, sliders, buttons, and sparklines in a responsive grid, plus a widget wizard for bulk-adding widgets from auto-detected devices.

Workflow editor — v1 had the workflow engine in the backend (event listeners, routines with conditions, barriers, payload modifiers, actions) configured through server-rendered HTML dialogs. v2 replaces this with a visual ReactFlow node graph editor with 9 node types (handler listener, attribute reader/listener, evaluator, condition, aggregator, negation, logger, display, action performer), cycle validation, and auto-save.

Analytics — v1 had an inspector page with Chart.js charts and a date selector, rendered as a Flask template. v2 rebuilds this as a React SPA with daily stats views powered by TimescaleDB continuous aggregates, multi-attribute comparison, configurable time ranges, and out-of-range data detection with bulk cleanup.

Handler types — v1 had 4 types (Serial, HTTP, Shelly Plug, Jiabaida BMS). The Must PV/PH Inverter was added shortly before v2. v2 carries all forward, splits Shelly into Gen1/Gen2 variants, and adds a Shelly Duo handler. New device auto-detection wizard, per-handler action confirmation, and live status indicators with trend detection.

User management — v1 had no authentication. v2 adds multi-user JWT auth with admin/user roles, refresh tokens, account lockout, rate limiting on login, and optional Turnstile CAPTCHA.

System stats — New page showing server uptime, CPU/memory usage, database size, data ingestion rate, and connected Socket.IO clients.

Logs — v1 had a backend logger. v2 adds a frontend log viewer with level/source filtering and bulk clear.

Deployment — v1 had no containerization — just a run.py entry point and an nginx.conf sample. v2 has a full Docker Compose setup with TimescaleDB, healthchecks, device passthrough for serial ports, a build-stage frontend container, and Nginx reverse proxy with WebSocket support. Security headers (CSP, HSTS, X-Frame-Options) are enforced via FastAPI middleware.

i18n — v1 was English-only with no i18n framework. v2 has full i18next integration with English and Czech translations, including proper plural forms.

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[mrlubos]

@BlueManCZ proč jste si vybrali Orval? Nelíbil se vám výstup z @hey-api?