MotoTracker — Multi-Device GPS Tracking Dashboard

Screenshots

A multi-device, multi-user GPS tracking platform built around the LilyGO T-SIM7000G — a compact board combining an ESP32 microcontroller with a SIM7000G cellular/GPS modem, an SD card slot, and an 18650 battery holder. The tracker sends GPS coordinates, speed, temperature, and battery voltage to a self-hosted server over 2G/NB-IoT/CAT-M cellular.

The MotoTracker web dashboard runs on a Raspberry Pi (Apache + PHP + MySQL) and aggregates GPS feeds from multiple sources in one UI: the on-board firmware, any Traccar-tracked device (phone, ST-901L, etc.) pulled from the Home Assistant Traccar add-on, or any other client that POSTs to the HTTP ingest endpoint. Each device is owned by a user, drawn in its own colour, and replayable on an interactive Leaflet map.

Operators get a full admin panel for user and device management, and every user gets a password-less read-only embed token that can be dropped into a Home Assistant iframe Lovelace card without forcing a login. Raw GPS fixes are road-snapped and gap-filled with OSRM for clean, map-aligned tracks.

Firmware Features (LilyGO T-SIM7000G)

• Live mode: GPS always on, sends 1 point/second via HTTP GET with keep-alive TCP connection
• Batch mode: deep sleep 60 s between fixes, RTC memory batches 5 points per wake — low power
• SD offline buffer: up to 100 000 points (~27 h at 1 pt/s) stored on SD when network is unavailable; auto-recovered on reconnect
• Battery protection: auto-sleeps below 3.3 V to prevent over-discharge
• WiFi config portal: AP-mode setup screen for runtime configuration; values are stored in /config.json on the SD card and override the compiled defaults
• Compact HTTP protocol: short parameter names (k, v, la, lo, s, t, h, b, ts) to minimise cellular overhead
• Per-device API key: the firmware authenticates with a write-scoped key tied to a single user — leaking a key cannot be used to write into another user's devices

Dashboard Features

• Device picker: select a single device or "All devices" view; each device gets its own polyline colour with an endpoint marker
• Speed-coloured route: single-device view draws the polyline green→red by speed
• Ride stats: total distance, duration, average and max speed, temperature, battery voltage
• Ride replay: animated playback with adjustable speed slider
• Ride history: grouped by device + date, last 200 rides
• GPX export: download any device's day as a standard GPX track file
• Live tracking: auto-refreshes every 2 s when viewing today's ride
• Per-device cleanup: rename, recolour, or range-delete points (everything or just stationary jitter); deletes cascade to interpolated children in a transaction

Multi-User & Admin Panel

• BCrypt-hashed passwords with a forced "must change password" flag on first login
• Per-user device scoping: regular users only see their own devices; admins see every active device
• Admin actions: reset password, rotate write API key, rotate read-only embed token, soft-disable a user (refuses self-disable), reassign a device to a different owner without losing history
• Soft-disable model: users are deactivated via users.active=0 instead of being deleted, so historical data and audit trails are preserved
• Atomic provisioning: a CLI tool creates a user and their first device in a single DB transaction with rollback on failure

Home Assistant & Traccar Integration

On the production deployment, phones and OBD trackers send their positions to the Home Assistant Traccar add-on, and a pair of background workers running on the MotoTracker host pull and road-snap those positions into the MotoTracker database — every Traccar device gets a matching MotoTracker device the first time it is seen.

• Pull worker (every 2 min): logs into Traccar via cookie auth, fetches recent positions, and idempotently inserts raw rows using a unique (device_id, traccar_pos_id) index — re-running after a crash cannot double-insert
• Snap + interpolate worker (every 5 min): POSTs raw rows to OSRM /match to flip them to snapped, then inserts interpolated children sampled along OSRM /route between consecutive fixes — bounded by gap range, max points per gap, and a sanity ratio against straight-line distance
• Three-source schema: points.source distinguishes raw / snapped / interpolated; UI and exports treat them uniformly, but parent_id cascades so cleaning a stretch of raw history also purges its interpolated fill
• Auto-device creation: new Traccar IDs are inserted as HA_<traccar_id> owned by the first admin via INSERT … ON DUPLICATE KEY UPDATE id = LAST_INSERT_ID(id)
• Driven by systemd timers with the 2-min / 5-min cadence offset deliberately so raw rows always land before the next snap pass

Read-Only Embed Tokens (HA Iframes)

Every user owns a read_api_key that can be passed to the dashboard via ?token=… or Authorization: Bearer …. In token mode the UI hides logout, the admin link, and the device-settings modal, and 401s do not redirect to the login page (which would loop inside an iframe). The token survives across browser sessions, works inside iframes that block third-party cookies, and can be revoked instantly from the admin panel — all without touching the user's password.

Mutating endpoints (device/update.php, device/delete_points.php, anything under admin/) bail out with 403 read_only_token. Even if the token belongs to an admin, its scope stays bounded to that user's read endpoints.

Technical Details

• Hardware: LilyGO T-SIM7000G (ESP32 + SIM7000G, GPS 1 Hz, SD card, 18650 battery)
• Firmware: Arduino C++ — TinyGSM, ArduinoHttpClient, ArduinoJson v7; multi-file split (config.h, config_local.h, types.h, protocol_*.h, wifi_config.h, …)
• Connectivity: 2G GSM / NB-IoT / CAT-M (HTTP, no TLS — avoids 2–5 s TLS overhead on SIM7000G)
• Backend: PHP 7.4+, MySQL 5.7+, Leaflet.js 1.9.4, Font Awesome 6.5
• Schema: users, devices, points (with source ENUM and parent_id), grown by SQL migrations
• Workers: Python 3 (requests, pymysql) for Traccar pull and OSRM snap/interpolate; both driven by systemd timers
• Server: Raspberry Pi running Apache on local network with DDNS
• 3D case: custom-designed enclosure for the LilyGO T-SIM7000G with a 3D-printed power button cap — PLA or PETG

3D-Printed Case

Custom enclosure designed for the LilyGO T-SIM7000G board. Available on Thingiverse.

Source code: github.com/ArturKos/MotoTracker