cipher. All work

Case study · Sentri Systems

Tunnel ID System.
Who is inside, right now.

A personnel and vehicle tracking system for tunnel construction sites. Workers scan a fingerprint or a UHF RFID tag at the portal, and the site always knows who is inside.

Role
Developer. I took over a colleague's first version and upgraded it.
Status
In production at client tunnel sites. A newer dashboard version is in testing.
Client
Sushee Infra & Mining: access control across four tunnels, as listed on sentrisystems.co.in.
Stack
Python, Flask, SQLite, Raspberry Pi and Linux kiosks, ZKTeco fingerprint readers, TimeWatch UHF RFID readers, systemd, Tailscale, Cloudflare.

The problem

On a tunnel site the safety question is simple: who is inside right now? A paper register at the portal answers it slowly, and in an emergency the answer has to be immediate and trustworthy.

The sites are remote, some run on a cellular uplink, and the hardware has to keep working with nobody technical on hand.

How it works

Each scan toggles a person's state: the first scan is an entry, the next an exit. The site machine collects scans from every reader, keeps the record in SQLite and serves the dashboard on the local network.

On site

Readers at each portalZKTeco fingerprint, TimeWatch UHF RFID
Site machineRaspberry Pi or Linux kiosk: Flask, SQLite, device pollers
Kiosk screen and LED boardLive headcount at the portal

Sentri server

Admin consoleOne login for every site, admin and viewer roles
Demo dashboardsSeeded with sample data, login required

People

Site staffThe kiosk at the site
Managers and clientsThrough the console, behind Cloudflare Access
No site machine opens a port to the internet. Sites reach the server over a private Tailscale network.

What I built

Tracking

  • Workers and employees tracked separately, down to the entrance they used.
  • A vehicle module: tag registration, routing per reader, long-stay alerts and cycle times.
  • Long-stay alerts in the dashboard, with optional email.

Safety

  • Emergency mode: declare an emergency, freeze the roll call, and account for each person by scan or by hand.
  • Headcount confidence and peak-of-the-day figures, so the count says how much to trust it.
  • A health and safety reports tab, a fatigue watch and device-offline alerts.

Reliability

  • Automated daily database backups.
  • Fixed RFID readers stuck as "unknown", a fingerprint-reader deletion bug and a reconnect loop that never stopped.
  • Split one large dashboard file into separate route modules.

Dashboard and docs

  • Rebuilt the dashboard: navigation, check-out flow, reports, analytics, per-person profiles, search and a print layout.
  • Worked out the protocol of a Huidu LED board from captured traffic, so the portal shows live counts.
  • User manuals in English and Hindi for the dashboard and the fingerprint readers.

The admin console

Every site had its own dashboard and its own password. The console puts them all behind one login, on a separate server.

  • Two roles. Admins reach each site. Viewers get a read-only overview and never see or use a site password.
  • CSRF protection on every form, login throttling and session expiry.
  • Remote access goes through Cloudflare Tunnel, with Cloudflare Access email codes in front of the console. Tailscale access rules let invited viewers reach the console and nothing else.

The hard parts

SD cards that rot

Site machines run from SD cards, and they silently corrupt files. I check packages against their checksums to find damaged files, keep backups off the machines, and once rebuilt a dead site machine the same day without losing data.

A reader that ignores you

The UHF readers accept several connections but send tags down only one. A second connection looked healthy while receiving nothing, which explained "online" readers that never produced a scan.

An undocumented display

The LED board's protocol isn't published. I rebuilt it from captured traffic until the generated frames matched the vendor software byte for byte.

Remote, fragile links

Some sites sit on a cellular uplink. Tailscale gives each machine a stable private address, and I traced an SSH hang that ping didn't show to a packet-size (MTU) limit on the tunnel.

Security, by design

  • Site machines are never exposed to the internet. The only public entry points sit behind a login.
  • Viewers are read-only and never handle site credentials.
  • Login throttling uses the real client address from Cloudflare, so one attacker can't lock everyone out.

This page has no screenshots. The live dashboards hold real people's names and movements, so the diagram above is what I can share.

What I took from it

  • On site hardware, assume the disk is lying until a checksum says otherwise.
  • "Connected" is not "working". Watch for the data, not just the socket.
  • Access control is easier to get right in one place than on every site.