torqueDASH-Next

A self-hosted dashboard for Torque Pro vehicle telemetry. Torque Pro streams live OBD-II data from your car over HTTPS; torqueDASH-Next stores it in a time-series database and renders it in a React dashboard — live gauges, a route map, session replays, and per-session summaries. All data stays on your own server.

Features

Real-time telemetry playback	Watch your drive unfold — gauges, chart, and map all move in sync with a single playback cursor.
GPS route map	Leaflet map with color-coded speed traces and an animated position marker that follows the playback head.
Multi-series overlay chart	Toggle any combination of PIDs on a shared time axis with per-unit-group y-axes (ECharts + LTTB sampling for large datasets).
CSV export	Download any session with auto-discovered PID columns — ready for Excel, Google Sheets, or Python notebooks.
BYOK AI analysis	Connect your own LLM (OpenAI, Anthropic, DeepSeek, Ollama, or any OpenAI-compatible endpoint) for per-session diagnostic insights.
DeepSeek first-class	deepseek-v4-flash / deepseek-v4-pro with chain-of-thought Thinking Mode and configurable reasoning effort (High / Max).
PID decode engine	Auto-discovers every OBD-II parameter from Torque's values JSONB — no schema changes when you add new PIDs.
Session management	Auto-named trips (Trip DDMMYYYY HH:MM AM/PM), inline rename, shareable links, freeform notes with auto-save.
Multi-vehicle support	Define named vehicle profiles (make, model, year, engine size), assign sessions to vehicles, filter session list by vehicle.
Cross-vehicle analysis history	Browse and export all AI analyses across sessions and vehicles in one view — paginated, filterable, exportable as Markdown.
Configurable data retention	Opt-in TimescaleDB retention policy auto-deletes telemetry older than 90/120/180/365 days — off by default (all data kept indefinitely), toggled from the Settings page.
API-key upload auth	Token authentication is required for Torque Pro uploads (UPLOAD_API_TOKEN — the 2026 security baseline); requests presenting a matching token also skip the per-IP rate limiter so reconnect bursts are never throttled.
React Router v8	Frontend routing on react-router 8.3.0 (exact pin, replacing react-router-dom), resolving the remaining react-router Dependabot advisories including the v8-CSRF advisory fixed only in 8.3.0.

Quick start

# Download the production files
mkdir -p ~/torquedash && cd ~/torquedash
curl -O https://raw.githubusercontent.com/moesix/torque-dash-next/master/docker-compose.yml
curl -O https://raw.githubusercontent.com/moesix/torque-dash-next/master/.env.example

# Create your .env and edit with your settings
cp .env.example .env
nano .env

# Generate an upload API token (required for production) and set it in .env
openssl rand -hex 24  # for UPLOAD_API_TOKEN

# Start the stack
docker compose up -d

Then open http://localhost:8080.

The app will not start without DATABASE_URL and SESSION_KEYS. Generate them with openssl rand -base64 24 and openssl rand -hex 24 respectively. As of 2026, UPLOAD_API_TOKEN is the required security baseline for uploads: generate it with openssl rand -hex 24 and set it in .env, or generate one from the Settings page after first login. See the full config reference below.

Connect Torque Pro

In Torque Pro → Settings → Web Preferences:

Setting	Value
Server URL	https://<your-host>/api/upload
Email address	The email you registered with
Broadcast as HTTP	Header: Authorization: bearer <UPLOAD_API_TOKEN>

After creating all user accounts, disable public registration via the Settings UI or set DISABLE_REGISTRATION=true in your .env file.

Screenshots

Session replay with overlay chart & GPS track

Session list & dashboard overview

AI-powered session analysis

Time-series map view

GPS map view

Mobile — login

Mobile — AI provider settings

Mobile — AI analysis

How it works

Layer	Stack
Backend	Node.js + Express 4, Sequelize 6, PostgreSQL / TimescaleDB 2.29
Frontend	React 19 + Vite 8 + TypeScript 7, Tailwind CSS 4, react-router 8, ECharts, Leaflet
Deploy	Docker Compose: db (TimescaleDB) + backend + frontend (nginx)

Configuration

Full environment variables reference

Variable	Default	Description
DATABASE_URL	REQUIRED	PostgreSQL/TimescaleDB connection string. App crashes on startup if missing.
POSTGRES_PASSWORD	REQUIRED	Database password for Docker deployments. Generate with openssl rand -base64 24.
SESSION_KEYS	REQUIRED	Comma-separated express-session secrets. App crashes on startup if missing.
PORT	3000	Backend HTTP port.
NODE_ENV	(unset)	Set to production to skip sequelize.sync() (use migrations instead).
COOKIE_SECURE	false	true to set Secure on session cookies (requires HTTPS).
COOKIE_SAMESITE	lax	SameSite policy for session cookies.
CORS_ORIGINS	(empty)	Comma-separated allowed origins for cross-origin API access. Also serves as the CSRF trust list.
PUBLIC_ORIGIN	(unset)	Overrides the expected CSRF origin. Set when nginx terminates HTTPS but forwards HTTP to the backend.
UPLOAD_API_TOKEN	REQUIRED for production	Uploads require Authorization: Bearer <token>; without a matching header they return 401. Set here — the env value wins and locks the Settings UI — or generate from the Settings page after first login.
UPLOAD_RATE_LIMIT_MAX	600	Max uploads per window per IP.
UPLOAD_RATE_LIMIT_WINDOW_MS	60000	Upload rate-limit window in milliseconds.
AUTH_RATE_LIMIT_MAX	10	Max login/register requests per window per IP.
AUTH_RATE_LIMIT_WINDOW_MS	60000	Auth rate-limit window in milliseconds.
WRITE_RATE_LIMIT_MAX	30	Max authenticated mutations per window per IP.
WRITE_RATE_LIMIT_WINDOW_MS	60000	Write rate-limit window in milliseconds.
READ_RATE_LIMIT_MAX	600	Max requests to all other /api routes per window per IP.
READ_RATE_LIMIT_WINDOW_MS	60000	Global /api rate-limit window in milliseconds.
DISABLE_REGISTRATION	(unset)	If true, public sign-up is disabled.
LLM_ENCRYPTION_KEY	(unset)	64-char hex key for AES-256-GCM encryption of LLM API keys at rest. Generate with openssl rand -hex 32. Required for AI analysis feature.

For detailed deployment instructions, troubleshooting, and reverse proxy setup, see docs/deployment.md.

Security

Upload authentication: Uploads require Authorization: Bearer <token> with your configured UPLOAD_API_TOKEN — token authentication is mandatory (the 2026 baseline), and email alone is never sufficient once a token exists. Email-only ingestion happens only when no token is configured anywhere (env or Settings UI) — a discouraged bootstrap mode that is insecure for production and should be closed off before exposing the server. If upgrading, add your token in Torque Pro → Settings → Advanced → HTTP Auth Token. Requests presenting a matching token bypass the upload rate limiter — the known uploader's reconnect bursts are never 429'd, and the exemption is keyed on the secret token, not a spoofable query param.

Password changes: Users can change their password via POST /api/users/change-password. This validates the current password, enforces a minimum length of 8 characters, and invalidates all other sessions. Bcrypt salt factor is 10.

Registration control: After creating accounts, disable public sign-up via the Settings UI toggle or DISABLE_REGISTRATION=true.

Docs

Document	Description
Deployment guide	Docker Compose setup, env vars, backup/restore, troubleshooting
Architecture	System topology, backend internals, data flow, API contract
Development	Contributing guide, known issues, manual setup, PID backfill

License

MIT — see LICENSE. This project is a modernization of, and is grateful for, the original torque-dash by David Krejci. Attribution is recorded in NOTICE.