a72ea18130
헤드리스 Pi 콘솔/journalctl에서 한글이 깨져 보이는 문제로, Pi 번들(02/03/04)에 들어가는 모든 소스의 사람-대상 텍스트를 영어로 전환. 코드·식별자·설정키·경로·숫자·hex·서명 스킴·f-string 플레이스홀더는 불변. - raspberry_pi4/, raspberry_pi4_sht30/: 로그·주석·문서·센서명·위치 영어화 - tools/make_deploy_bundles.py: 생성 템플릿(config_local.py/setup.sh/SETUP.md/PI_META 위치) 영어화 - tools/harden_pi.sh, tools/set_network.sh: echo/주석 영어화 - WIRING.html: 영어화 + SHT30 전압 경고 정정 반영 - 서버 번들(01, php/)은 한글 유지(브라우저 대시보드, Pi에서 안 깨짐) - 전 파이썬/셸 문법검사 통과, JSON 본문 서명 무영향
66 lines
2.5 KiB
Desktop File
66 lines
2.5 KiB
Desktop File
# =============================================================================
|
|
# /etc/systemd/system/sht30-sensor.service
|
|
# Service that auto-runs the temperature/humidity (SHT30) monitor on Raspberry Pi 4 boot (Module 2)
|
|
#
|
|
# Installation:
|
|
# sudo cp systemd/sht30-sensor.service /etc/systemd/system/
|
|
# sudo systemctl daemon-reload
|
|
# sudo systemctl enable sht30-sensor
|
|
# sudo systemctl start sht30-sensor
|
|
# sudo systemctl status sht30-sensor
|
|
#
|
|
# * Adjust the WorkingDirectory/ExecStart paths to match the actual deployment path.
|
|
# The example below assumes deployment under /home/pi/raspberry_pi4_sht30.
|
|
# =============================================================================
|
|
|
|
[Unit]
|
|
Description=SHT30 Temp/Humidity Sensor Monitor v2 (Pi 4, Module 2)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=pi
|
|
Group=pi
|
|
# i2c group required to access /dev/i2c-1
|
|
SupplementaryGroups=i2c
|
|
WorkingDirectory=/home/pi/raspberry_pi4_sht30
|
|
ExecStart=/home/pi/raspberry_pi4_sht30/venv/bin/python sht30_sensor.py
|
|
Restart=always
|
|
RestartSec=10
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=sht30-sensor
|
|
|
|
# Environment variables
|
|
Environment=PYTHONUNBUFFERED=1
|
|
|
|
# Process-private /tmp isolation
|
|
PrivateTmp=true
|
|
|
|
# -- Sandboxing (hardening) -- blocks root escalation and filesystem tampering if the daemon is compromised --------
|
|
# User=pi is a NOPASSWD sudo account, so NoNewPrivileges blocks the setuid(sudo) escalation path.
|
|
NoNewPrivileges=true
|
|
# Root filesystem read-only + only /var/log writable (including log rotation). /tmp is PrivateTmp.
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/log
|
|
# /home is read-only (reads own code/config_local.py only; blocks writes and access to other accounts' homes).
|
|
ProtectHome=read-only
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
RestrictRealtime=true
|
|
# HTTPS(POST) + local sockets (DNS/journal) only. I2C is unaffected since /dev/i2c-1 is a char device (not a socket).
|
|
# AF_NETLINK required -- glibc getaddrinfo/NSS uses netlink to enumerate local addresses
|
|
# (omitting it makes DNS resolution intermittently fail -> server POST impossible). AF_INET/6=HTTPS, AF_UNIX=DNS/journal.
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
# * Do not use PrivateDevices -- it hides /dev/i2c-1 and makes the sensor inaccessible.
|
|
|
|
# Restart cap (stop after 5 failures within 10 minutes)
|
|
StartLimitBurst=5
|
|
StartLimitInterval=600s
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|