3f2823a764
The PHP app runs on Cafe24 shared web hosting -- calling it 'cloud' was misleading. Renames the directory, the edge client module, and every doc/script/identifier that used the term. - cloud/ -> server/ (incl. server/deploy/build_cafe24_package.sh paths) - edge/cloudclient.py -> edge/serverclient.py, CloudClient -> ServerClient - cloud/docs/cloud-deploy.md -> server/docs/server-deploy.md - CLOUD_* env/config keys -> SERVER_* - tests renamed to match Tests: PHP 109 pass (4 skipped), pytest 167 pass. dist/ regenerated.
73 lines
3.6 KiB
Desktop File
73 lines
3.6 KiB
Desktop File
# move-detect edge daemon — systemd unit (Raspberry Pi 5, air-gapped/폐쇄망).
|
|
# Install: copy to /etc/systemd/system/, fill /etc/move-detect/edge.env, then
|
|
# sudo systemctl daemon-reload && sudo systemctl enable --now move-detect-edge
|
|
# The daemon tolerates the server being offline (events buffer in the local queue
|
|
# and flush on reconnect), so this unit only *wants* the network, not requires it.
|
|
|
|
[Unit]
|
|
Description=move-detect edge daemon (workplace-safety AI CCTV)
|
|
Documentation=file:/opt/move-detect/docs/pilot-runbook.md
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
# Never stop retrying. This MUST live in [Unit]: systemd's parser table knows
|
|
# Unit.StartLimitIntervalSec but only Service.StartLimitInterval (no "Sec"), so in
|
|
# [Service] it is an unknown key — silently ignored, leaving the default 5-starts/10s
|
|
# limit to defeat Restart=always below.
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
# Type=exec, not simple: with simple, systemd marks the start job done the instant fork()
|
|
# returns, so an exec-step failure (226/NAMESPACE, 216/GROUP, 217/USER, 203/EXEC) never
|
|
# reaches `systemctl enable --now` and the installer reports success over a dead daemon.
|
|
Type=exec
|
|
# Dedicated unprivileged account; must be in the groups that own the camera and
|
|
# the Hailo accelerator device nodes.
|
|
User=movedetect
|
|
Group=movedetect
|
|
SupplementaryGroups=video render plugdev
|
|
|
|
WorkingDirectory=/opt/move-detect
|
|
EnvironmentFile=/etc/move-detect/edge.env
|
|
# Run the package straight from source (no pip build step needed offline).
|
|
Environment=PYTHONPATH=/opt/move-detect/src
|
|
ExecStart=/opt/move-detect/venv/bin/python -m edge
|
|
|
|
# Unattended resilience: always restart; the loop also isolates per-frame and
|
|
# periodic-op exceptions internally so a single glitch never exits the process.
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# Writable state (offline queue sqlite lives here; keep QUEUE_DB pointed at it).
|
|
# systemd creates/owns /var/lib/move-detect for the service user.
|
|
StateDirectory=move-detect
|
|
StateDirectoryMode=0750
|
|
|
|
# Camera + accelerator device access. Once ANY DeviceAllow= is present, systemd denies every
|
|
# unlisted device node, so the CSI camera needs its nodes explicitly:
|
|
# char-video4linux USB UVC (/dev/video*) AND the CSI capture nodes
|
|
# char-media picamera2/libcamera opens /dev/media* to configure the CSI pipeline (Pi 5)
|
|
# char-dma_heap libcamera allocates capture buffers from the dma-heap on Pi 5
|
|
# Without char-media + char-dma_heap a Hailo Pi with a CSI camera is denied its own camera by this
|
|
# unit's policy. (OFF-HW: verify on the Pi — `journalctl` shows a libcamera EPERM/open failure.)
|
|
#
|
|
# NOTE: DeviceAllow= takes a device-node path OR a `char-<group>`/`block-<group>` name — NOT a
|
|
# directory. `/dev/dma_heap/` (a directory, trailing slash) is rejected at cgroup-realize time and
|
|
# silently dropped, leaving dma-heap DENIED under this deny-by-default policy. Use the char group
|
|
# (dma_heap appears in /proc/devices as a char device) so the whole /dev/dma_heap/* set is allowed.
|
|
DeviceAllow=/dev/hailo0 rw
|
|
DeviceAllow=char-video4linux rw
|
|
DeviceAllow=char-media rw
|
|
DeviceAllow=char-dma_heap rw
|
|
|
|
# Conservative hardening (loosen if it blocks device access on your image).
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
# Do NOT add ReadWritePaths=/var/lib/move-detect here. StateDirectory= above already emits
|
|
# a recursive read-write bind mount for that exact path, which outranks a ReadWritePaths=
|
|
# entry for the same path and drops it before any path is resolved. It is dead config: it
|
|
# can neither cause nor fix a state-dir problem.
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|