Track: tracking for clients
White-label car tracking under your brand: the client link, tenant brand, subdomain and custom domain, privacy.
Track is a public page for a broker's client: where the car is now, which stages are done, when to expect handover, photos, documents, the next payment and the manager's contact. It is branded for your company by domain. It is the same code as "Where is my car" on the Vezemo site.
What the client sees
- Stage and timeline with dates: completed, current, upcoming with a forecast.
- Route. The position is schematic (no real map); vessel coordinates, if known, are shown as text.
- Photos from the auction, the port, after repair, if you marked them public.
- Documents to download, only if you allowed it in the tenant settings (
track_show_documents). - Next payment with a button leading to the cabinet.
- Manager contact: phone, email, Telegram.
- Notification subscription (a link to your Telegram bot) and a "share" button.
The page works without JavaScript: stage, timeline, route, photos and contacts come from the server. With JavaScript it refreshes by itself about every 20 seconds while the tab is active. A stage change in Desk appears without reloading.
How the client reaches the page
| Way | Address |
|---|---|
| Personal link (SMS, Telegram, email) | https://track.<your domain>/<token> |
| Search | https://track.<your domain>/: deal number and VIN |
The token is a random UUID that cannot be guessed. An invalid, unknown or foreign token, and an unknown domain, all show the same neutral 404 page with no hints. Search answers no faster than 400 ms regardless of the result, so that numbers cannot be probed.
About an access code
For now the VIN plays the role of the "code". A separate code from SMS or Telegram needs a new database field: see DECISIONS.md.
Tenant brand
The brand is set in tenant settings (tenants.brand):
| Field | What it does |
|---|---|
name | company name |
primary, accent, radius | colors and corner radius |
logoUrl | logo |
contacts.phone, contacts.email, contacts.telegram | the "Manager contact" block |
website | link to your site |
telegramBotUsername | without it the subscription block is not shown |
domain | custom Track domain (see below) |
A "Settings → Brand" screen in Desk is In development: for now the platform operator changes the brand.
Stages are configurable too: in settings.stages_override they can be renamed for the client, disabled or hidden (public: false). Track applies this automatically. More on stages: deal stages.
Tracking domain
There are three options, in the order Track uses to resolve the tenant from the address:
- The tenant's own domain, for example
track.broker.ua. Matchestenants.brand.domain. - A subdomain on our domain:
acme.<TRACK_DOMAIN>→ the tenant with slugacme. Nothing to do: a wildcard route and a wildcard certificate handle it. - Service mappings for development.
Connecting your own domain
You do this together with the platform operator.
Your step, in your DNS provider's panel:
- For a subdomain (
track.broker.ua) create a CNAME record pointing to theTRACK_CNAME_TARGETvalue (the operator gives it to you, for examplecname.<TRACK_DOMAIN>). - A CNAME is impossible at the zone apex: create an A record to the server IP instead.
The operator's step on the server:
~/rvauto2/releases/$(cat ~/rvauto2/state/current_tag)/infra/scripts/track-domains.sh add track.broker.uaThe script validates the name, checks DNS (dig; the domain is not added without correct DNS because Let's Encrypt limits failed attempts), appends the domain to the list and regenerates the Traefik config. Traefik picks it up without a restart and issues the certificate on the first request. Other commands: track-domains.sh remove|list|render.
Let's Encrypt limits: 50 certificates per week per registered domain and 5 failed validations per hour. Connect many domains over several days.
In development: automatic domain connection from Desk
For now the operator adds the domain manually with the script. A Traefik HTTP provider that reads domains from the tenants database is planned, and Desk will get a "Tracking domain" field with a DNS check.
A custom domain depends on the plan: see the plan table in For brokers.
Privacy and security
- The page has no lot prices, fees, margin, notes or internal identifiers. Only what you marked public is shown.
- Files (photos and documents) are served through a signed link valid for 15 minutes, only for this deal's files.
- Deal pages are not indexed by search engines (
noindex) and not cached (no-store). - There is a request rate limit and a separate "miss" counter per IP.
Limitations
- Live updates currently use polling (every ~20 s). Moving to SSE is In development.
- Storing notification subscriptions (email, Viber) on our side is In development. For now only the Telegram bot link works: the bot must handle
/start trk_<token>. - Cyrillic and Polish letters in the OG card (the messenger thumbnail) need an open-license font: Waiting on the owner. Without it the card renders Latin text only.
