36b1f94571
- P5-2 [H] build_offline_bundle.sh native branch hard-fails when uname -m != TARGET_ARCH (an x86 build was producing an aarch64-named tarball of x86_64 wheels). - P5-5 [H] systemd unit adds DeviceAllow char-media + /dev/dma_heap for the CSI camera — picamera2/libcamera on Pi 5 needs them or the unit denies its own camera. OFF-HW: verify on Pi. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW
68 lines
3.2 KiB
Desktop File
68 lines
3.2 KiB
Desktop File
# move-detect edge daemon — systemd unit (Raspberry Pi 5, air-gapped/폐쇄망).
|
|
# Install: copy to /etc/systemd/system/, fill /etc/move-detect/edge.env, then
|
|
# sudo systemctl daemon-reload && sudo systemctl enable --now move-detect-edge
|
|
# The daemon tolerates the cloud being offline (events buffer in the local queue
|
|
# and flush on reconnect), so this unit only *wants* the network, not requires it.
|
|
|
|
[Unit]
|
|
Description=move-detect edge daemon (workplace-safety AI CCTV)
|
|
Documentation=file:/opt/move-detect/docs/pilot-runbook.md
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
# Never stop retrying. This MUST live in [Unit]: systemd's parser table knows
|
|
# Unit.StartLimitIntervalSec but only Service.StartLimitInterval (no "Sec"), so in
|
|
# [Service] it is an unknown key — silently ignored, leaving the default 5-starts/10s
|
|
# limit to defeat Restart=always below.
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
# Type=exec, not simple: with simple, systemd marks the start job done the instant fork()
|
|
# returns, so an exec-step failure (226/NAMESPACE, 216/GROUP, 217/USER, 203/EXEC) never
|
|
# reaches `systemctl enable --now` and the installer reports success over a dead daemon.
|
|
Type=exec
|
|
# Dedicated unprivileged account; must be in the groups that own the camera and
|
|
# the Hailo accelerator device nodes.
|
|
User=movedetect
|
|
Group=movedetect
|
|
SupplementaryGroups=video render plugdev
|
|
|
|
WorkingDirectory=/opt/move-detect
|
|
EnvironmentFile=/etc/move-detect/edge.env
|
|
# Run the package straight from source (no pip build step needed offline).
|
|
Environment=PYTHONPATH=/opt/move-detect/src
|
|
ExecStart=/opt/move-detect/venv/bin/python -m edge
|
|
|
|
# Unattended resilience: always restart; the loop also isolates per-frame and
|
|
# periodic-op exceptions internally so a single glitch never exits the process.
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# Writable state (offline queue sqlite lives here; keep QUEUE_DB pointed at it).
|
|
# systemd creates/owns /var/lib/move-detect for the service user.
|
|
StateDirectory=move-detect
|
|
StateDirectoryMode=0750
|
|
|
|
# Camera + accelerator device access. Once ANY DeviceAllow= is present, systemd denies every
|
|
# unlisted device node, so the CSI camera needs its nodes explicitly:
|
|
# char-video4linux USB UVC (/dev/video*) AND the CSI capture nodes
|
|
# char-media picamera2/libcamera opens /dev/media* to configure the CSI pipeline (Pi 5)
|
|
# /dev/dma_heap/* libcamera allocates capture buffers from the dma-heap on Pi 5
|
|
# Without char-media + dma_heap a Hailo Pi with a CSI camera is denied its own camera by this
|
|
# unit's policy. (OFF-HW: verify on the Pi — `journalctl` shows a libcamera EPERM/open failure.)
|
|
DeviceAllow=/dev/hailo0 rw
|
|
DeviceAllow=char-video4linux rw
|
|
DeviceAllow=char-media rw
|
|
DeviceAllow=/dev/dma_heap/ rw
|
|
|
|
# Conservative hardening (loosen if it blocks device access on your image).
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
# Do NOT add ReadWritePaths=/var/lib/move-detect here. StateDirectory= above already emits
|
|
# a recursive read-write bind mount for that exact path, which outranks a ReadWritePaths=
|
|
# entry for the same path and drops it before any path is resolved. It is dead config: it
|
|
# can neither cause nor fix a state-dir problem.
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|