2ffa74b639
Offline-installable bundle (wheelhouse + model + source) built on a machine with internet and installed on the air-gapped Pi with --no-index (zero fetches), plus a systemd unit (auto-restart, device access, hardening) and env template. Runs the package from source via python -m edge (no offline build backend). Drift-guard test keeps the env template in sync with what the daemon reads and rejects inline comments that systemd EnvironmentFile= would fold into values.
50 lines
1.8 KiB
Desktop File
50 lines
1.8 KiB
Desktop File
# move-detect edge daemon — systemd unit (Raspberry Pi 5, air-gapped/폐쇄망).
|
|
# Install: copy to /etc/systemd/system/, fill /etc/move-detect/edge.env, then
|
|
# sudo systemctl daemon-reload && sudo systemctl enable --now move-detect-edge
|
|
# The daemon tolerates the cloud being offline (events buffer in the local queue
|
|
# and flush on reconnect), so this unit only *wants* the network, not requires it.
|
|
|
|
[Unit]
|
|
Description=move-detect edge daemon (workplace-safety AI CCTV)
|
|
Documentation=file:/opt/move-detect/docs/pilot-runbook.md
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
# Dedicated unprivileged account; must be in the groups that own the camera and
|
|
# the Hailo accelerator device nodes.
|
|
User=movedetect
|
|
Group=movedetect
|
|
SupplementaryGroups=video render plugdev
|
|
|
|
WorkingDirectory=/opt/move-detect
|
|
EnvironmentFile=/etc/move-detect/edge.env
|
|
# Run the package straight from source (no pip build step needed offline).
|
|
Environment=PYTHONPATH=/opt/move-detect/src
|
|
ExecStart=/opt/move-detect/venv/bin/python -m edge
|
|
|
|
# Unattended resilience: always restart; the loop also isolates per-frame and
|
|
# periodic-op exceptions internally so a single glitch never exits the process.
|
|
Restart=always
|
|
RestartSec=5
|
|
StartLimitIntervalSec=0
|
|
|
|
# Writable state (offline queue sqlite lives here; keep QUEUE_DB pointed at it).
|
|
# systemd creates/owns /var/lib/move-detect for the service user.
|
|
StateDirectory=move-detect
|
|
StateDirectoryMode=0750
|
|
|
|
# Camera + accelerator device access (USB UVC = /dev/video*, Hailo = /dev/hailo0).
|
|
DeviceAllow=/dev/hailo0 rw
|
|
DeviceAllow=char-video4linux rw
|
|
|
|
# Conservative hardening (loosen if it blocks device access on your image).
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/move-detect
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|