ske087
23cd8f2df5
A device with no internet could not set itself up: the auto-install needed PyPI. The rdm6300 and pyserial wheels now ship inside the package, so first start works with no network at all. Both wheels are pure Python (py3-none-any / py2.py3-none-any), which is what makes this possible - the same files work on armv7l, aarch64 and x86_64. This is the difference from the workstation app's Files/repository cache, which held aarch64 manylinux binaries and so could not be committed; that cache only ever existed on the Pi devices. - bundled_wheel_dir() locates them; ensure_dependencies() prefers them automatically, so the service needs no --wheel-dir. - verify_wheels() checks SHA256SUMS before installing. A wheel that fails its checksum is refused rather than installed, then PyPI is tried, and if that is unreachable it reports exit 2 instead of proceeding unverified. - local_wheel_missing() falls back to PyPI when the bundle does not cover a requirement, instead of attempting a --no-index install that must fail. - An explicit --wheel-dir that is incomplete or unverified is called out, not silently swapped for PyPI. Verified end to end: built wheel and sdist both contain the wheels; a venv with no rdm6300 self-provisions with a dead proxy and no PIP_NO_INDEX; and a tampered wheel is refused with nothing installed.
57 lines
1.8 KiB
Desktop File
57 lines
1.8 KiB
Desktop File
[Unit]
|
|
Description=RDM card reader HTTP bridge (serves card taps for web login)
|
|
Documentation=file:/opt/rdm-card-reader/README.md
|
|
# The serial device must exist before we start, otherwise the reader opens the
|
|
# wrong tty or none at all.
|
|
After=dev-serial.device network-online.target
|
|
Wants=network-online.target
|
|
|
|
# Do not restart forever if the reader is genuinely absent. These are [Unit]
|
|
# options, not [Service] - systemd ignores them in the wrong section.
|
|
StartLimitIntervalSec=60
|
|
StartLimitBurst=5
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=rdmcard
|
|
Group=dialout
|
|
WorkingDirectory=/opt/rdm-card-reader
|
|
|
|
# --serve exposes the card on http://127.0.0.1:8765/api/card
|
|
# --port points at the udev alias, so the reader is the same device every boot.
|
|
# Autodetect refuses to guess if more than one USB adapter is present, which is
|
|
# the safe behaviour: a wrong guess means authenticating the wrong person.
|
|
# The wheels for rdm6300 and pyserial are bundled inside the package, so no
|
|
# --wheel-dir is needed here: the install works with no internet.
|
|
ExecStart=/opt/rdm-card-reader/.venv/bin/rdm-card-reader \
|
|
--serve \
|
|
--port /dev/rdm-reader \
|
|
--mode login \
|
|
--allow-origin https://your.web.app
|
|
|
|
Restart=always
|
|
RestartSec=3
|
|
|
|
# The bridge only needs to read the serial port and listen on loopback.
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=true
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
DeviceAllow=/dev/rdm-reader rw
|
|
DevicePolicy=closed
|
|
|
|
# stdout/stderr go here; watch with: journalctl -u rdm-card-reader -f
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=rdm-card-reader
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|