Initializare dupa curatare folder

deploy/rdm-card-reader.service

@@ -0,0 +1,56 @@
+[Unit]
+Description=RDM card reader HTTP bridge (serves card taps for web login)
+Documentation=file:/opt/rdm-card-reader/README.md
+# The serial device must exist before we start, otherwise the reader opens the
+# wrong tty or none at all.
+After=dev-serial.device network-online.target
+Wants=network-online.target
+
+# Do not restart forever if the reader is genuinely absent. These are [Unit]
+# options, not [Service] - systemd ignores them in the wrong section.
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=simple
+User=rdmcard
+Group=dialout
+WorkingDirectory=/opt/rdm-card-reader
+
+# --serve exposes the card on http://127.0.0.1:8765/api/card
+# --port points at the udev alias, so the reader is the same device every boot.
+# Autodetect refuses to guess if more than one USB adapter is present, which is
+# the safe behaviour: a wrong guess means authenticating the wrong person.
+# The wheels for rdm6300 and pyserial are bundled inside the package, so no
+# --wheel-dir is needed here: the install works with no internet.
+ExecStart=/opt/rdm-card-reader/.venv/bin/rdm-card-reader \
+    --serve \
+    --port /dev/rdm-reader \
+    --mode login \
+    --allow-origin https://your.web.app
+
+Restart=always
+RestartSec=3
+
+# The bridge only needs to read the serial port and listen on loopback.
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+DeviceAllow=/dev/rdm-reader rw
+DevicePolicy=closed
+
+# stdout/stderr go here; watch with: journalctl -u rdm-card-reader -f
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=rdm-card-reader
+
+[Install]
+WantedBy=multi-user.target