DEV Community: John Cheng

Fighting Wildfires with IoT and AI: A Father-Son Open Source Mission

John Cheng — Sat, 05 Sep 2026 05:28:39 +0000

🌲 Falling in Love with Nature—and Facing Wildfires

A while ago, my family and I moved to Canada.

Coming from a bustling industrial background in China, the first thing that struck us was the raw, breathtaking nature. The air is crisp, the lakes and tap water are crystal clear, and humans live side-by-side with wildlife in total harmony. In fact, in our quiet neighborhood, black bears occasionally drop by! They wander through the yard looking for berries or fallen apples, and then quietly move on without ever disrupting our daily routine.

It felt like paradise.

Except for one devastating problem that returns every summer: wildfires.

Year after year, millions of hectares of majestic forests are consumed by roaring fires. Smoke blankets the skies for hundreds of miles, turning the sun into an eerie orange disc, shutting down schools, and forcing families to evacuate.

Watching this repeat year after year broke our hearts. We asked ourselves: Can we use technology to make a difference before fires rage out of control?

🤝 The Father & Son Team: IoT Meets Computer Vision

I have spent decades working in industrial IoT hardware and embedded systems in China—designing rugged field sensors, remote telemetry units, and ultra-reliable communications.

Meanwhile, my son is currently studying Computer Science with a focus on Artificial Intelligence and Computer Vision.

One evening, looking out at the haze during wildfire season, we had an idea: What if we combined our strengths?

The Father (Edge Hardware & Firmware): Build an ultra-reliable, off-grid, low-power IoT sensing node capable of surviving years in remote wilderness.
The Son (Cloud Backend & Multi-Modal AI): Ingest real-time telemetry, filter sensor drift, and run lightweight AI vision models on remote camera snapshots to verify smoke columns and suppress false alarms.

That is how ForestFireGuard was born.

🎥 The Story in Video

I recently recorded a short video sharing our journey, our motivation, and why we decided to make this project 100% open source:

(If the embed doesn't load, you can watch it directly on YouTube.)

🛠️ The Engineering Challenge: Why Wildfire IoT is Hard

Building a wildfire detector for a warm living room is easy. Building one for an isolated boreal forest is an entirely different engineering beast:

Zero External Power: The node must run off a single primary battery and small solar cells for years.
Fragile Cellular Connectivity: In deep forests, 4G signals fluctuate or drop for days. Zero data loss is mandatory.
Severe Hardware RAM Constraints: Running on low-cost, low-power microcontrollers (STM32F030 with only 32KB SRAM) means you cannot allocate massive memory buffers for camera image payloads without risking stack overflows or fragmentation.

🏗️ How ForestFireGuard Works

Here is a look at the system architecture we engineered:

+-----------------------------------------------------------------------------------+
|                            EDGE NODE SUBSYSTEM (mcu/)                             |
|                                                                                   |
|  +--------------------+         +---------------------+                           |
|  | ESP32 Camera Node  |--UART-->|  SPI RAM (64KB)     | (High-Speed Image Cache)  |
|  | (VGA 640x480 JPEG) |         +----------+----------+                           |
|  +--------------------+                    |                                      |
|                                            v                                      |
|  +--------------------+         +---------------------+         +--------------+  |
|  |  Primary Sensors   |--I2C/-->|  SPI Flash (1MB)    |<--FRAM--|  Mainboard   |  |
|  | (GPS, AQ, Temp/Humi|  ADC    | (Append-Only Queue) |  (8KB)  | (STM32F030)  |  |
|  +--------------------+         +----------+----------+         +-------+------+  |
|                                            |                            |         |
+--------------------------------------------|----------------------------|---------+
                                             v                            | TLV
                                  +---------------------+                 v
                                  |   Network Module    |<----------------+
                                  | (EC800CN 4G Cat.1)  |
                                  +----------+----------+
                                             |
                                    MQTT / TCP Cellular
                                             v
+-----------------------------------------------------------------------------------+
|                        SERVER & AI SUBSYSTEM (service/ & Cloud)                   |
|                                                                                   |
|  +-----------------------------------------------------------------------------+  |
|  |                       IoT Ingress Service (service/)                        |  |
|  |                     (Receives 4G Payload & Stores to DB)                    |  |
|  +--------------------------------------+--------------------------------------+  |
|                                         |                                         |
|  =======================================|=======================================  |
|                 DATABASE LAYER (Delivery & Separation Boundary)                   |
|  =======================================|=======================================  |
|                                         v                                         |
|  +-----------------------------------------------------------------------------+  |
|  |                   Cloud AI Engine (Son's Pipeline)                          |  |
|  |  * Fetches real-time sensor metrics & VGA photos from DB                   |  |
|  |  * Runs Lightweight CV models (Smoke & Flame detection)                    |  |
|  |  * Dispatches verified high-confidence alerts to emergency channels        |  |
|  +-----------------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------------+

Key Technical Highlights:

3-Tier Storage for Zero Data Loss:
- 64KB SPI RAM caches incoming JPEG images from the ESP32 camera without touching the STM32's tiny 32KB internal SRAM.
- 1MB SPI Flash operates in append-only mode as an indestructible flight data recorder.
- 8KB Ferroelectric RAM (FRAM) records non-volatile read/write pointers with near-infinite endurance. If the battery dies or connection drops, transmission resumes seamlessly upon reboot.
Time-Multiplexed Power Gating: All power-hungry modules (4G modem, camera, gas sensors) sit behind independent MOSFET switches. The STM32 powers them on sequentially, preventing destructive peak current surges.
Clean Architecture Boundary: The PostgreSQL/Timescale database serves as the strict contract boundary. I ensure rock-solid data ingestion from the field into the DB; my son pulls from the DB for AI training, validation, and real-time inference.

🌍 Why We Are Making It 100% Open Source

Wildfires don't respect borders or patents. Communities in Canada, the US, Southern Europe, Australia, and South America are all battling the same threat.

We believe that by sharing our schematics, PCB gerbers, STM32 firmware, and cloud code with the global developer community, we can help local forestry teams, researchers, and volunteers deploy affordable, early-warning sensor meshes.

💻 Join Us on GitHub!

The project source code is available now on GitHub:
👉 Check out AI part on GitHub (Alex)
👉 Check out Hardware on GitHub(John)

We would love to hear your feedback:

What sensors would you prioritize for forest deployment?
Have you tackled similar memory and power constraints on Cortex-M0 devices?
Want to help with PCB design, embedded C refactoring, or computer vision models?

Drop a comment below or open an issue on GitHub. Let’s build technology that makes a real-world difference together! 🌲🔥🚒

Building an Images Repository - Harbor

John Cheng — Sun, 19 Nov 2023 13:53:59 +0000

Harbor is designed for storing container images and is generally deployed in an intranet environment to provide image services for containers running within the intranet.

Harbor is open source and can be found on GitHub at: https://github.com/goharbor/harbor

Step 1: Testing Environment

For testing purposes, set up a new virtual machine with CentOS 7.9 and make some modifications to the test environment:

Disable the firewall, install iptables, and temporarily disable it:

systemctl stop firewalld
systemctl disable firewalld
yum install iptables-services -y
systemctl stop iptables
systemctl disable iptables
iptables -F

Disable SELinux:

setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

Synchronize system time:

ntpdata cn.pool.ntp.org
crontab -e

Insert the following entry to synchronize every hour:

* */1 * * * /usr/sbin/ntpdate cn.pool.ntp.org

Install common components:

yum install -y yum-utils device-mapper-persistent-data lvm2 wget net-tools nfs-utils lrzsz gcc gcc-c++ make cmake libxml2-devel openssl-devel curl curl-devel unzip sudo ntp libaio-devel vim ncurses-devel autoconf automake zlib-devel python-devel epel-release openssh-server socat ipvsadm conntrack

Set up the repository:

yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

Enable system forwarding:

echo "net.bridge.bridge-nf-call-ip6tables = 1" >> /etc/sysctl.conf
echo "net.bridge.bridge-nf-call-iptables = 1" >> /etc/sysctl.conf
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p

Step 2: Install Docker and Download Docker Compose

Install the latest version of Docker:

yum install -y docker-ce

Enable Docker:

systemctl enable docker --now

Download Docker Compose:

wget https://github.com/docker/compose/releases/download/v2.23.1/docker-compose-linux-x86_64
mv docker-compose-linux-x86_64 /usr/bin/docker-compose
chmod +x /usr/bin/docker-compose

Step 3: Create Certificates

During the certificate creation process, ensure consistency in country code and city code. The hostname must match the local machine.

mkdir /data/ssl -p
cd /data/ssl/
openssl genrsa -out ca.key 3072
openssl req -new -x509 -days 3650 -key ca.key -out ca.pem
openssl genrsa -out harbor.key 3072
openssl req -new -key harbor.key -out harbor.csr
openssl x509 -req -in harbor.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out harbor.pem -days 3650

Step 4: Download and Install Harbor

Create a directory:

mkdir /data/install
cd /data/install

Download and extract files:

wget https://github.com/goharbor/harbor/releases/download/v2.3.0-rc3/harbor-offline-installer-v2.3.0-rc3.tgz
tar zxvf harbor-offline-installer-v2.3.0-rc3.tgz -C /data/install

Modify the configuration file:

cp /data/install/harbor/harbor.yml.tmpl /data/install/harbor/harbor.yml
vim /data/install/harbor/harbor.yml

Modify the hostname, certificate, and private_key to actual values:

hostname: harbor # Adjust as needed

certificate: /data/ssl/harbor.pem
private_key: /data/ssl/harbor.key

Install Harbor:

/data/install/harbor/install.sh

Step 5: Web User Management on the Client

Access the IP or domain of this host to open the login page. Initial admin account information:
Username: admin
Password: Harbor12345

Step 6: Configure Docker on the Client

Modify /etc/docker/daemon.json:

vim /etc/docker/daemon.json

Add the following field in the client machine's /etc/docker/daemon.json:

"insecure-registries": "192.168.xxx.xxx", "hostname"

Restart the Docker service:

systemctl daemon-reload
systemctl restart docker

Step 7: Testing

Upload Test: Tag the image on the local machine in the format: ip/project_name/image_name

docker tag tomcat:latest 192.168.xxx.xxx/test/tomcat:v1
docker push 192.168.xxx.xxx/test/tomcat:v1

Download Test:

docker pull 192.168.xxx.xxx/test/tomcat:v1

Building a Private Repository

John Cheng — Sun, 19 Nov 2023 13:50:55 +0000

In the architecture of cloud services, multiple network planes are generally deployed, and the management plane is usually in the intranet environment, accessible through a jump server or VPN technology. This brings significant inconvenience to the installation, upgrade, or system upgrade of applications for the infrastructure of the server. Today, I will introduce a simple method to build a self-built Linux private repository.

Before we begin, you need to prepare a virtual host with dual network cards, or a physical host will work as well. The host should run the Linux operating system; here, we'll use CentOS 7.9 as an example. If you are using a Debian-based Linux system, just replace the commands with apt commands; the principle is exactly the same.

Once the system is installed, connect one network card to the external network and another to the intranet, complete the relevant configurations and tests. Now let's officially start building the private repository.

Step 1: Install and Configure Nginx

Install Nginx

sudo yum install -y nginx

This is a basic operation, and installing Nginx may require additional steps, such as installing the EPEL repository. If you encounter any issues installing Nginx, please search online for related tutorials.

Configure Nginx

Configuring Nginx is straightforward. Just add three lines under the server section:

vim /etc/nginx/nginx.conf

    server {
        autoindex on;    # Add this line
        autoindex_exact_size on;    # Add this line
        autoindex_localtime on;    # Add this line
        listen       80;    # Listening port

Then restart Nginx:

sudo systemctl restart nginx

Step 2: Create a Directory for Sync

This directory is configured in the /etc/nginx/nginx.conf file from the previous step. Here, we create it in the default working directory of Nginx:

mkdir -p /usr/share/nginx/html/rsync/

Step 3: Download Sources

You can download applications individually or synchronize downloads in batches.

Download a Single Application

As an example, let's download haproxy:

mkdir -p /usr/share/nginx/html/rsync/haproxy
sudo yum -y install --downloadonly --downloaddir=/usr/share/nginx/html/rsync/haproxy/ haproxy

Note: This method downloads only applications that have not been installed on the local machine before. If you try to download an application that has been previously installed, such as nginx, you will get nothing.

Batch Download

Here we use the EPEL repository as an example:

mkdir -p /usr/share/nginx/html/rsync/epel/7/x86_64/
rsync -vrt --bwlimit=3000 --exclude=debug/ rsync://rsync.mirrors.ustc.edu.cn/epel/7/x86_64/ /usr/share/nginx/html/rsync/epel/7/x86_64/

Create an Index

When creating the index for the first time, install createrepo:

sudo yum install -y createrepo

Create the index; you need to use this command every time you update the content.

createrepo /usr/share/nginx/html/rsync/

Usage

After these steps, the sync source is successfully installed. On the intranet host, modify the repo file's baseurl:

baseurl = http://xxx.xxx.xxx.xxx/rsync

Alternatively, transfer it to the relevant host and install using the following command:

sudo yum install -y http://xxx.xxx.xxx.xxx/rsync/haproxy/haproxy-1.5.18-9.el7_9.1.x86_64.rpm