BetterCorp/BetterFrame
1
0
Fork 0
mirror of https://github.com/BetterCorp/BetterFrame.git synced 2026-05-26 23:26:34 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10
BetterFrame/deploy/systemd/betterframe-kiosk.service

67 lines
2.8 KiB
SYSTEMD
Raw Normal View History

feat: deployment artifacts + CEC relay + auth-check endpoint Deployment (deploy/): - systemd units for server (system) and kiosk (user session) - Angie/nginx proxy config — routes admin, api, ws, node-red - Dockerfile + docker-compose for containerized deployment - deploy/README.md with install instructions Auth: - /api/admin/_check endpoint for proxy auth_request subrequest - Returns 200 if admin session valid, 401/403 otherwise - Sets X-BetterFrame-User header for upstream CEC (Pi5 HDMI control): - kiosk/src/cec.rs wraps cec-ctl subprocess - Standby/wake/active-source commands - WS message types "standby" / "wake" dispatched to CEC - Admin UI: Wake/Standby buttons on kiosk edit page - Server sendToKiosk via coordinator
2026-05-10 20:45:56 +00:00
[Unit]
feat(deploy): Pi kiosk bring-up via cage + low-priv bfkiosk user Replace the user-mode kiosk service with a system unit that runs cage (single-app Wayland compositor) on tty1 as a dedicated unprivileged user. No desktop, no display manager, auto-restart on crash via Restart=always. setup-pi-kiosk.sh provisions the user, installs cage + seatd, disables any display manager, points default.target at multi-user, drops the PAM stack, and enables the service. Idempotent. Screen wake "auto-login": with no DM and no lockscreen, DPMS-driven sleep just turns the panel back on — the kiosk process is already running.
2026-05-13 01:11:06 +00:00
Description=BetterFrame Kiosk (cage + betterframe-kiosk)
feat: deployment artifacts + CEC relay + auth-check endpoint Deployment (deploy/): - systemd units for server (system) and kiosk (user session) - Angie/nginx proxy config — routes admin, api, ws, node-red - Dockerfile + docker-compose for containerized deployment - deploy/README.md with install instructions Auth: - /api/admin/_check endpoint for proxy auth_request subrequest - Returns 200 if admin session valid, 401/403 otherwise - Sets X-BetterFrame-User header for upstream CEC (Pi5 HDMI control): - kiosk/src/cec.rs wraps cec-ctl subprocess - Standby/wake/active-source commands - WS message types "standby" / "wake" dispatched to CEC - Admin UI: Wake/Standby buttons on kiosk edit page - Server sendToKiosk via coordinator
2026-05-10 20:45:56 +00:00
Documentation=https://github.com/BetterCorp/BetterFrame
feat(deploy): Pi kiosk bring-up via cage + low-priv bfkiosk user Replace the user-mode kiosk service with a system unit that runs cage (single-app Wayland compositor) on tty1 as a dedicated unprivileged user. No desktop, no display manager, auto-restart on crash via Restart=always. setup-pi-kiosk.sh provisions the user, installs cage + seatd, disables any display manager, points default.target at multi-user, drops the PAM stack, and enables the service. Idempotent. Screen wake "auto-login": with no DM and no lockscreen, DPMS-driven sleep just turns the panel back on — the kiosk process is already running.
2026-05-13 01:11:06 +00:00
After=systemd-user-sessions.service plymouth-quit-wait.service network-online.target seatd.service
feat: deployment artifacts + CEC relay + auth-check endpoint Deployment (deploy/): - systemd units for server (system) and kiosk (user session) - Angie/nginx proxy config — routes admin, api, ws, node-red - Dockerfile + docker-compose for containerized deployment - deploy/README.md with install instructions Auth: - /api/admin/_check endpoint for proxy auth_request subrequest - Returns 200 if admin session valid, 401/403 otherwise - Sets X-BetterFrame-User header for upstream CEC (Pi5 HDMI control): - kiosk/src/cec.rs wraps cec-ctl subprocess - Standby/wake/active-source commands - WS message types "standby" / "wake" dispatched to CEC - Admin UI: Wake/Standby buttons on kiosk edit page - Server sendToKiosk via coordinator
2026-05-10 20:45:56 +00:00
Wants=network-online.target
feat(deploy): Pi kiosk bring-up via cage + low-priv bfkiosk user Replace the user-mode kiosk service with a system unit that runs cage (single-app Wayland compositor) on tty1 as a dedicated unprivileged user. No desktop, no display manager, auto-restart on crash via Restart=always. setup-pi-kiosk.sh provisions the user, installs cage + seatd, disables any display manager, points default.target at multi-user, drops the PAM stack, and enables the service. Idempotent. Screen wake "auto-login": with no DM and no lockscreen, DPMS-driven sleep just turns the panel back on — the kiosk process is already running.
2026-05-13 01:11:06 +00:00
Conflicts=getty@tty1.service
After=getty@tty1.service
fix(systemd): move StartLimit* keys to [Unit] section systemd ignored them in [Service] and warned at load. Moving to [Unit] makes the 10-burst / 60s rate limit actually take effect.
2026-05-13 01:25:54 +00:00
# After 10 fast restarts in 60s, back off so a broken binary doesn't burn CPU.
StartLimitIntervalSec=60
StartLimitBurst=10
feat: deployment artifacts + CEC relay + auth-check endpoint Deployment (deploy/): - systemd units for server (system) and kiosk (user session) - Angie/nginx proxy config — routes admin, api, ws, node-red - Dockerfile + docker-compose for containerized deployment - deploy/README.md with install instructions Auth: - /api/admin/_check endpoint for proxy auth_request subrequest - Returns 200 if admin session valid, 401/403 otherwise - Sets X-BetterFrame-User header for upstream CEC (Pi5 HDMI control): - kiosk/src/cec.rs wraps cec-ctl subprocess - Standby/wake/active-source commands - WS message types "standby" / "wake" dispatched to CEC - Admin UI: Wake/Standby buttons on kiosk edit page - Server sendToKiosk via coordinator
2026-05-10 20:45:56 +00:00
[Service]
Type=simple
feat(deploy): Pi kiosk bring-up via cage + low-priv bfkiosk user Replace the user-mode kiosk service with a system unit that runs cage (single-app Wayland compositor) on tty1 as a dedicated unprivileged user. No desktop, no display manager, auto-restart on crash via Restart=always. setup-pi-kiosk.sh provisions the user, installs cage + seatd, disables any display manager, points default.target at multi-user, drops the PAM stack, and enables the service. Idempotent. Screen wake "auto-login": with no DM and no lockscreen, DPMS-driven sleep just turns the panel back on — the kiosk process is already running.
2026-05-13 01:11:06 +00:00
User=bfkiosk
Group=bfkiosk
fix(deploy): drop nonexistent 'seat' supplementary group systemd refuses to spawn the unit with code=216/GROUP when any group in SupplementaryGroups= doesn't exist. Debian's seatd uses -g video — there is no 'seat' group on the system. Removing it lets cage start; the video group already covers seatd access.
2026-05-13 01:23:49 +00:00
SupplementaryGroups=video render input audio
feat(deploy): Pi kiosk bring-up via cage + low-priv bfkiosk user Replace the user-mode kiosk service with a system unit that runs cage (single-app Wayland compositor) on tty1 as a dedicated unprivileged user. No desktop, no display manager, auto-restart on crash via Restart=always. setup-pi-kiosk.sh provisions the user, installs cage + seatd, disables any display manager, points default.target at multi-user, drops the PAM stack, and enables the service. Idempotent. Screen wake "auto-login": with no DM and no lockscreen, DPMS-driven sleep just turns the panel back on — the kiosk process is already running.
2026-05-13 01:11:06 +00:00
PAMName=cage
TTYPath=/dev/tty1
TTYReset=yes
TTYVHangup=yes
TTYVTDisallocate=yes
StandardInput=tty-fail
feat: deployment artifacts + CEC relay + auth-check endpoint Deployment (deploy/): - systemd units for server (system) and kiosk (user session) - Angie/nginx proxy config — routes admin, api, ws, node-red - Dockerfile + docker-compose for containerized deployment - deploy/README.md with install instructions Auth: - /api/admin/_check endpoint for proxy auth_request subrequest - Returns 200 if admin session valid, 401/403 otherwise - Sets X-BetterFrame-User header for upstream CEC (Pi5 HDMI control): - kiosk/src/cec.rs wraps cec-ctl subprocess - Standby/wake/active-source commands - WS message types "standby" / "wake" dispatched to CEC - Admin UI: Wake/Standby buttons on kiosk edit page - Server sendToKiosk via coordinator
2026-05-10 20:45:56 +00:00
StandardOutput=journal
StandardError=journal
feat(deploy): Pi kiosk bring-up via cage + low-priv bfkiosk user Replace the user-mode kiosk service with a system unit that runs cage (single-app Wayland compositor) on tty1 as a dedicated unprivileged user. No desktop, no display manager, auto-restart on crash via Restart=always. setup-pi-kiosk.sh provisions the user, installs cage + seatd, disables any display manager, points default.target at multi-user, drops the PAM stack, and enables the service. Idempotent. Screen wake "auto-login": with no DM and no lockscreen, DPMS-driven sleep just turns the panel back on — the kiosk process is already running.
2026-05-13 01:11:06 +00:00
UtmpIdentifier=tty1
UtmpMode=user
WorkingDirectory=/home/bfkiosk
EnvironmentFile=-/etc/default/betterframe-kiosk
Environment=XDG_SESSION_TYPE=wayland
Environment=XDG_SESSION_CLASS=user
Environment=GST_DEBUG=1
fix(kiosk): hide cursor inside WebViews + at compositor level WebView showed a grey/black half-square in the top-left — that's GDK's "none" cursor rendered by WebKit's own surface, which ignores the GTK-window CSS we set elsewhere. Inject a WebKit UserStyleSheet that applies cursor:none !important to every page + frame at User priority, overriding page-author CSS. For the boot gap (cage start → first kiosk frame), set XCURSOR_SIZE=1 and WLR_NO_HARDWARE_CURSORS=1 in the systemd unit. SW fallback honors the 1-pixel size; HW cursors don't, which is why a default arrow leaks through on some Pi GPUs.
2026-05-21 08:21:17 +00:00
# Cursor: cage/wlroots draws a sprite in the gap between compositor start
# and first kiosk frame. Collapse to 1px transparent + force software
# fallback so XCURSOR_SIZE actually applies (HW cursors ignore size on
# some GPUs, leaving a default white-arrow visible in the corner).
feat(harden): transparent cursor + full VT lockdown + auto-reboot + purge all setup wizards 1. Transparent cursor theme: 1x1 pixel Xcursor for every shape, set as system default via XCURSOR_THEME=betterframe-empty. Nuclear fix for Pi 5 GPU ignoring XCURSOR_SIZE. 2. Full VT lockdown: mask ALL gettys (tty1-6 + templates), logind NAutoVTs=0 + ReserveVT=0, mask emergency/rescue targets. Ctrl+Alt+Fx reaches nothing. No login screen ever. 3. Auto-reboot: FailureAction=reboot-force + StartLimitAction=reboot-force on kiosk unit. If cage/app can't stay running → system reboots rather than showing a blank screen or login prompt. 4. Purge ALL Pi setup wizards: piwiz, userconf-pi, rpi-first-boot-wizard, initial-setup, pi-greeter, rpd-plym-splash. Nuke autostart files, mask systemd units. "Configure your Raspberry" never shows.
2026-05-22 19:38:42 +00:00
# Invisible cursor: transparent theme + 1px size + software fallback.
# Three layers because Pi 5 GPU ignores XCURSOR_SIZE for HW cursors.
Environment=XCURSOR_THEME=betterframe-empty
fix(kiosk): hide cursor inside WebViews + at compositor level WebView showed a grey/black half-square in the top-left — that's GDK's "none" cursor rendered by WebKit's own surface, which ignores the GTK-window CSS we set elsewhere. Inject a WebKit UserStyleSheet that applies cursor:none !important to every page + frame at User priority, overriding page-author CSS. For the boot gap (cage start → first kiosk frame), set XCURSOR_SIZE=1 and WLR_NO_HARDWARE_CURSORS=1 in the systemd unit. SW fallback honors the 1-pixel size; HW cursors don't, which is why a default arrow leaks through on some Pi GPUs.
2026-05-21 08:21:17 +00:00
Environment=XCURSOR_SIZE=1
Environment=WLR_NO_HARDWARE_CURSORS=1
Fix kiosk fan control state updates
2026-05-13 01:47:34 +00:00
# Let the unprivileged kiosk process control the Pi fan PWM sysfs files.
ExecStartPre=+/bin/sh -c 'for d in /sys/class/hwmon/hwmon*; do [ -e "$d/pwm1" ] || continue; chgrp bfkiosk "$d/pwm1" "$d/pwm1_enable" 2>/dev/null || true; chmod g+w "$d/pwm1" "$d/pwm1_enable" 2>/dev/null || true; done'
feat(ota): phase 3 — rollouts + automated rollback Rollouts (server side): - /admin/firmware/rollouts page lists + creates campaigns. Pick release, target kiosk_ids (empty = whole channel), percentage (1-100). - Active rollouts override channel-latest in /api/kiosk/firmware/check. - Deterministic bucket via sha256(rollout_id:kiosk_id) % 100 — same kiosk consistently lands in the same bucket across re-checks. - Pause / resume / complete state controls. Rollback (kiosk side): - Before swap, kiosk writes firmware-applying.json marker. - After clean boot + first successful heartbeat, marker deleted. - New ExecStartPre hook (/usr/local/sbin/betterframe-firmware-rollback.sh) runs every service start; stale marker (>120s) + .prev present → restore .prev. Pairs with systemd's StartLimit to catch crash loops.
2026-05-14 05:28:20 +00:00
ExecStartPre=+/usr/local/sbin/betterframe-firmware-rollback.sh
feat(deploy): Pi kiosk bring-up via cage + low-priv bfkiosk user Replace the user-mode kiosk service with a system unit that runs cage (single-app Wayland compositor) on tty1 as a dedicated unprivileged user. No desktop, no display manager, auto-restart on crash via Restart=always. setup-pi-kiosk.sh provisions the user, installs cage + seatd, disables any display manager, points default.target at multi-user, drops the PAM stack, and enables the service. Idempotent. Screen wake "auto-login": with no DM and no lockscreen, DPMS-driven sleep just turns the panel back on — the kiosk process is already running.
2026-05-13 01:11:06 +00:00
ExecStart=/usr/bin/cage -s -- /opt/betterframe/kiosk/betterframe-kiosk
Restart=always
RestartSec=2
feat(harden): transparent cursor + full VT lockdown + auto-reboot + purge all setup wizards 1. Transparent cursor theme: 1x1 pixel Xcursor for every shape, set as system default via XCURSOR_THEME=betterframe-empty. Nuclear fix for Pi 5 GPU ignoring XCURSOR_SIZE. 2. Full VT lockdown: mask ALL gettys (tty1-6 + templates), logind NAutoVTs=0 + ReserveVT=0, mask emergency/rescue targets. Ctrl+Alt+Fx reaches nothing. No login screen ever. 3. Auto-reboot: FailureAction=reboot-force + StartLimitAction=reboot-force on kiosk unit. If cage/app can't stay running → system reboots rather than showing a blank screen or login prompt. 4. Purge ALL Pi setup wizards: piwiz, userconf-pi, rpi-first-boot-wizard, initial-setup, pi-greeter, rpd-plym-splash. Nuke autostart files, mask systemd units. "Configure your Raspberry" never shows.
2026-05-22 19:38:42 +00:00
# If cage/kiosk exits or crashes and systemd can't restart it after the
# burst limit (10 in 60s per [Unit]), force a full system reboot. This
# covers scenarios where the app isn't foreground (e.g. cage died, VT
# switched, GPU fault) — the kiosk should NEVER show anything other than
# our app. A reboot is less alarming than a login prompt or blank screen.
FailureAction=reboot-force
StartLimitAction=reboot-force
feat: deployment artifacts + CEC relay + auth-check endpoint Deployment (deploy/): - systemd units for server (system) and kiosk (user session) - Angie/nginx proxy config — routes admin, api, ws, node-red - Dockerfile + docker-compose for containerized deployment - deploy/README.md with install instructions Auth: - /api/admin/_check endpoint for proxy auth_request subrequest - Returns 200 if admin session valid, 401/403 otherwise - Sets X-BetterFrame-User header for upstream CEC (Pi5 HDMI control): - kiosk/src/cec.rs wraps cec-ctl subprocess - Standby/wake/active-source commands - WS message types "standby" / "wake" dispatched to CEC - Admin UI: Wake/Standby buttons on kiosk edit page - Server sendToKiosk via coordinator
2026-05-10 20:45:56 +00:00
fix(kiosk): strip caps so WebKit's bwrap sandbox can start WebKitGTK launches bubblewrap for its web-content process; bwrap refuses to run when the parent process still carries unexpected CAP_* bits ("but not setuid, old file caps config?"). Setting CapabilityBoundingSet= + AmbientCapabilities= empty and NoNewPrivileges=yes gives bwrap a clean caps slate to drop from, so the sandbox initialises and web/dashboard cells render instead of crashing the kiosk.
2026-05-13 10:53:31 +00:00
# WebKitGTK uses bubblewrap for its web-content sandbox. bwrap aborts with
# "Unexpected capabilities but not setuid" when launched from a process that
# still carries CAP_* bits. Strip caps + lock NoNewPrivileges so WebKit's
# sandbox can initialise cleanly. Without this WebKit cells crash on load.
CapabilityBoundingSet=
AmbientCapabilities=
NoNewPrivileges=yes
# Fallback if the above isn't enough on a given distro (disables WebKit sandbox):
#Environment=WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1
feat: deployment artifacts + CEC relay + auth-check endpoint Deployment (deploy/): - systemd units for server (system) and kiosk (user session) - Angie/nginx proxy config — routes admin, api, ws, node-red - Dockerfile + docker-compose for containerized deployment - deploy/README.md with install instructions Auth: - /api/admin/_check endpoint for proxy auth_request subrequest - Returns 200 if admin session valid, 401/403 otherwise - Sets X-BetterFrame-User header for upstream CEC (Pi5 HDMI control): - kiosk/src/cec.rs wraps cec-ctl subprocess - Standby/wake/active-source commands - WS message types "standby" / "wake" dispatched to CEC - Admin UI: Wake/Standby buttons on kiosk edit page - Server sendToKiosk via coordinator
2026-05-10 20:45:56 +00:00
[Install]
feat(deploy): Pi kiosk bring-up via cage + low-priv bfkiosk user Replace the user-mode kiosk service with a system unit that runs cage (single-app Wayland compositor) on tty1 as a dedicated unprivileged user. No desktop, no display manager, auto-restart on crash via Restart=always. setup-pi-kiosk.sh provisions the user, installs cage + seatd, disables any display manager, points default.target at multi-user, drops the PAM stack, and enables the service. Idempotent. Screen wake "auto-login": with no DM and no lockscreen, DPMS-driven sleep just turns the panel back on — the kiosk process is already running.
2026-05-13 01:11:06 +00:00
WantedBy=multi-user.target
Reference in a new issue Copy permalink