ske087
c0a354b98e
- keyboard.py: emulate a commercial USB RFID reader by typing card ids into the focused window via a /dev/uinput virtual keyboard - led.py / bridge.py: drive the status LED from card events - cli.py, card.py: wire up the new options and event flow - deploy: harden install.sh and the systemd unit - README: document keyboard mode, LED support, and deployment Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
68 lines
2.5 KiB
Desktop File
68 lines
2.5 KiB
Desktop File
[Unit]
|
|
Description=RDM card reader HTTP bridge (serves card taps for web login)
|
|
Documentation=file:/opt/rdm-card-reader/README.md
|
|
# The serial device must exist before we start, otherwise the reader opens the
|
|
# wrong tty or none at all. install.sh rewrites this line for the device given
|
|
# with --device, since only it knows whether the reader is on the on-board UART
|
|
# (/dev/serial0, the default) or a USB adapter (/dev/rdm-reader).
|
|
After=dev-serial0.device network-online.target
|
|
Wants=network-online.target
|
|
|
|
# Do not restart forever if the reader is genuinely absent. These are [Unit]
|
|
# options, not [Service] - systemd ignores them in the wrong section.
|
|
StartLimitIntervalSec=60
|
|
StartLimitBurst=5
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=rdmcard
|
|
Group=dialout
|
|
WorkingDirectory=/opt/rdm-card-reader
|
|
|
|
# --serve runs the HTTP bridge, which is what makes the reader available as an
|
|
# API on http://127.0.0.1:8765. --port points at the device the reader is
|
|
# actually wired to; install.sh rewrites this line from --device, and only it
|
|
# knows whether that is a USB adapter (/dev/rdm-reader) or the on-board UART
|
|
# (/dev/serial0). --led-pin is rewritten from --led-pin for the same reason.
|
|
# Autodetect refuses to guess if more than one USB adapter is present, which is
|
|
# the safe behaviour: a wrong guess means authenticating the wrong person.
|
|
# The wheels for rdm6300 and pyserial are bundled inside the package, so no
|
|
# --wheel-dir is needed here: the install works with no internet.
|
|
ExecStart=/opt/rdm-card-reader/.venv/bin/rdm-card-reader \
|
|
--serve \
|
|
--port /dev/serial0 \
|
|
--mode login \
|
|
--led-pin 23 \
|
|
--led-mode presence \
|
|
--heartbeat 2.0
|
|
Restart=always
|
|
RestartSec=3
|
|
|
|
# The bridge reads the serial port, drives the status LED and listens on
|
|
# loopback. DeviceAllow is rewritten by install.sh alongside --port: with
|
|
# DevicePolicy=closed a device missing from this list is denied outright, and
|
|
# omitting the GPIO chip leaves the LED dark while everything else works.
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=true
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
DeviceAllow=/dev/serial0 rw
|
|
DeviceAllow=/dev/gpiochip0 rw
|
|
DeviceAllow=/dev/gpiochip4 rw
|
|
DevicePolicy=closed
|
|
|
|
# stdout/stderr go here; watch with: journalctl -u rdm-card-reader -f
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=rdm-card-reader
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|