Rev 2026-07-30 TCEC Access Control System Documentation

CHAPTER 06Maintenance Guide

Routine tasks, troubleshooting procedures, and development roadmap.

6.1 Routine Check Schedule

FrequencyTaskHow
DailyAccess log is updatingOpen prox.tcec.ca — new entries should appear
DailyNest Mini availableHA → Devices → media_player.therese_office_122a
WeeklyHA backup written to QNAP1QNAP1 web UI → ha_backups_pi5 — check timestamps
WeeklyAppDaemon log reviewHA → Add-ons → AppDaemon → Log — look for ERROR/WARNING
MonthlyQNAP1 storage and drive healthSMART warnings on drives 1 and 4 · volume 93% full — plan migration
MonthlyTest swipe on each active readerSwipe known card — verify Granted/Denied is logged correctly on the Access Log page. Strikes are not yet fired by the new system — see Chapter 1.
MonthlyVerify ElevenLabs and Twilio keys activegrep elevenlabs and grep twilio in apps.yaml; test announcement from HA Developer Tools

6.2 SSH and Log Tailing

SSH details: Key-based auth as root, local IP only — ha.tcec.ca/prox.tcec.ca are HTTPS-only via the Nabu Casa proxy and do not accept SSH. HAOS is minimal: rsync is not installed, use scp/SFTP.
ssh -i ~/Desktop/id_rsa root@192.168.191.121

# AppDaemon log (last 200 lines)
ha apps logs a0d7b954_appdaemon --lines 200

# Or via HA UI: Settings → Add-ons → AppDaemon → Log

For recent access events, use the Access Log page on prox.tcec.ca rather than querying the database directly — it has date/door/tenant/company filters built in.

6.3 apps.yaml — Preservation Rule

🛑
WARNING — Keys Lost on Rewrite: Before any apps.yaml edit, read the current file and confirm both ElevenLabs keys exist under both prox_card and prox_ui. Verify again after writing.
# Check before editing
grep elevenlabs /addon_configs/a0d7b954_appdaemon/apps/apps.yaml
# Should return 4 lines — api_key and voice_id under both prox_card and prox_ui

grep twilio /addon_configs/a0d7b954_appdaemon/apps/apps.yaml
# Should return 9 lines — sid, token, from under prox_card, prox_ui, and motion_monitor

6.4 Hot-Reloading AppDaemon Apps

# Reload after editing a Python file
touch /addon_configs/a0d7b954_appdaemon/apps/prox_card.py

# Reload after apps.yaml change
touch /addon_configs/a0d7b954_appdaemon/apps/apps.yaml

If hot reload does not take effect: HA → Settings → Add-ons → AppDaemon → Restart.

Duplicate Entry Bug: A duplicate entry at the top of apps.yaml without a class: line causes silent parse failures — the app shows no startup message. Always lint apps.yaml after edits.

6.5 Patch App Pattern

# 1. Write patch app
vi /addon_configs/a0d7b954_appdaemon/apps/patch_xyz.py

# 2. Register in apps.yaml
# patch_xyz:
#   module: patch_xyz
#   class: PatchXyz

# 3. Trigger load
touch /addon_configs/a0d7b954_appdaemon/apps/apps.yaml

# 4. Verify ran, clean up — remove from apps.yaml, delete file
rm /addon_configs/a0d7b954_appdaemon/apps/patch_xyz.py

6.6 Updating the Documentation

Each chapter is a self-contained HTML file (inline CSS, no build step or shared JS) tracked in the local git repo at ~/tcec-access-control/manual/ and served from /homeassistant/www/manual/ on the Pi via prox_ui.py's serve_manual route. To update a chapter:

6.7 Kiosk Troubleshooting (Pi 4)

ssh oracle@192.168.191.109

ps aux | grep chromium          # Is Chromium running?
bash /home/oracle/kiosk-watchdog.sh &  # Restart watchdog
nmcli connection show netplan-wlan0-EIS  # Check WiFi
sudo reboot                     # Reboot if needed
Known Limitation: On-screen keyboards cannot appear over Chromium --start-fullscreen. This is an OS constraint, not a bug.

6.8 Backup and Recovery

# Manual DB backup — always take one before running a migration
scp -i ~/Desktop/id_rsa root@192.168.191.121:/addon_configs/a0d7b954_appdaemon/prox_cards.db \
  ~/tcec-access-control/prox_cards_backup_$(date +%Y%m%d).db

A FileZilla copy of prox_cards.db works just as well and is the preferred method — always take one before running a schema migration. Migrations are done in-place via a temporary AppDaemon app (write it, register in apps.yaml, trigger via reload, confirm it ran, then remove it and the file) — never by export/reimport.

6.9 Development Roadmap

PriorityTaskDetail
1 — NowResolve hardware issues blocking cutoverSchema and access logic are ready (doors.ha_entity, group_permissions); once hardware issues are resolved, wire access-granted events to the correct Waveshare relay switch entity and cut doors over from the AS-400 one at a time. See Chapter 1.
2Viking C-4000 LOG BUSUSB-to-serial adapter; 1200 baud ASCII; deploy VikingEntryLogger; map slot numbers via TENANT_MAP.
3Blue Iris HA integrationCreate Blue Iris user (requires desktop at 192.168.191.80); complete motion/snapshot triggers.
4Blue Iris → QNAP1 storageRedirect recordings to blueiris_recordings share — requires physical or RDP access to Blue Iris PC.
5QNAP1 drive replacementDrives 1 and 4 have SMART warnings; 93% full. Migrate to spare drives before failure.
6Full alarm systemMulti-step arming, presence-based siren, post-siren audio loop, report-not-completed flag.
← Previous5 · User ManualNext →7 · Network Reference