a72ea18130
헤드리스 Pi 콘솔/journalctl에서 한글이 깨져 보이는 문제로, Pi 번들(02/03/04)에 들어가는 모든 소스의 사람-대상 텍스트를 영어로 전환. 코드·식별자·설정키·경로·숫자·hex·서명 스킴·f-string 플레이스홀더는 불변. - raspberry_pi4/, raspberry_pi4_sht30/: 로그·주석·문서·센서명·위치 영어화 - tools/make_deploy_bundles.py: 생성 템플릿(config_local.py/setup.sh/SETUP.md/PI_META 위치) 영어화 - tools/harden_pi.sh, tools/set_network.sh: echo/주석 영어화 - WIRING.html: 영어화 + SHT30 전압 경고 정정 반영 - 서버 번들(01, php/)은 한글 유지(브라우저 대시보드, Pi에서 안 깨짐) - 전 파이썬/셸 문법검사 통과, JSON 본문 서명 무영향
74 lines
3.2 KiB
Desktop File
74 lines
3.2 KiB
Desktop File
# =============================================================================
|
|
# /etc/systemd/system/leak-sensor.service
|
|
# Service that auto-runs the leak-detection monitor at Raspberry Pi 4 boot
|
|
#
|
|
# Installation:
|
|
# sudo cp systemd/leak-sensor.service /etc/systemd/system/
|
|
# sudo systemctl daemon-reload
|
|
# sudo systemctl enable leak-sensor
|
|
# sudo systemctl start leak-sensor
|
|
# sudo systemctl status leak-sensor
|
|
#
|
|
# NOTE: Adjust the WorkingDirectory/ExecStart paths to match the actual deployment path.
|
|
# The values below assume deployment under /home/pi/raspberry_pi4.
|
|
# =============================================================================
|
|
|
|
[Unit]
|
|
Description=e-con 5C-08 Leak Sensor Monitor v2 (Pi 4, with Camera)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=pi
|
|
Group=pi
|
|
# rpi-lgpio needs the gpio group to access /dev/gpiochip0 (root:gpio 660); the camera needs the video group.
|
|
SupplementaryGroups=video gpio
|
|
WorkingDirectory=/home/pi/raspberry_pi4
|
|
ExecStart=/home/pi/raspberry_pi4/venv/bin/python leak_sensor.py
|
|
Restart=always
|
|
RestartSec=10
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=leak-sensor
|
|
|
|
# Environment variables
|
|
Environment=PYTHONUNBUFFERED=1
|
|
# lgpio (rpi-lgpio backend) creates a .lgd-nfy notification pipe in the working
|
|
# directory on add_event_detect. Since ProtectHome=read-only below makes /home
|
|
# read-only, the lgpio working directory is moved to PrivateTmp's writable /tmp.
|
|
# (Otherwise leak interrupt registration fails -> daemon crash-loops -> no leak detection.) LG_WD is the env var the lg library reads.
|
|
# NOTE: This hardening assumes the chardev backend (python3-rpi-lgpio). Reverting to
|
|
# the sysfs-based python3-rpi.gpio conflicts with ProtectKernelTunables/ProtectHome,
|
|
# so do not change the backend (keep the python3-rpi-lgpio pin in vendor.sh/install.sh).
|
|
Environment=LG_WD=/tmp
|
|
|
|
# Isolate leak-capture temp files to the process-private /tmp (prevents exposure via shared /tmp)
|
|
PrivateTmp=true
|
|
|
|
# -- Sandboxing (hardening) -- blocks root escalation / filesystem tampering if the daemon is compromised --------
|
|
# User=pi is a NOPASSWD sudo account, so NoNewPrivileges blocks the setuid(sudo) escalation path.
|
|
NoNewPrivileges=true
|
|
# Root filesystem read-only + only /var/log writable (including log rotation). /tmp is PrivateTmp.
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/log
|
|
# /home is read-only (reads its own code/config_local.py only; blocks writes and access to other accounts' homes).
|
|
ProtectHome=read-only
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
RestrictRealtime=true
|
|
# HTTPS(POST) + local sockets (DNS/journal) only. Camera/GPIO are /dev char (not sockets), so unaffected.
|
|
# AF_NETLINK required -- glibc getaddrinfo/NSS uses netlink to enumerate local addresses
|
|
# (omitting it makes DNS resolution fail intermittently -> server POST impossible). AF_INET/6=HTTPS, AF_UNIX=DNS/journal.
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
# NOTE: PrivateDevices is not used -- it would hide /dev/gpiochip* and the camera node, breaking operation.
|
|
|
|
# Restart cap (stop after 5 failures within 10 minutes)
|
|
StartLimitBurst=5
|
|
StartLimitInterval=600s
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|