BetterFrame/deploy/systemd/betterframe-server.service

[Unit]
Description=BetterFrame Server (BSB)
Documentation=https://github.com/BetterCorp/BetterFrame
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=betterframe
Group=betterframe
WorkingDirectory=/opt/betterframe/server
Environment=NODE_ENV=production
Environment=NODE_OPTIONS=--import tsx
ExecStart=/usr/bin/node --import tsx /opt/betterframe/node_modules/@bsb/base/lib/scripts/bsb-plugin-cli.js start
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/betterframe /var/log/betterframe
LoadCredential=betterframe-secret:/etc/betterframe/secret.key

[Install]
WantedBy=multi-user.target
feat: deployment artifacts + CEC relay + auth-check endpoint Deployment (deploy/): - systemd units for server (system) and kiosk (user session) - Angie/nginx proxy config — routes admin, api, ws, node-red - Dockerfile + docker-compose for containerized deployment - deploy/README.md with install instructions Auth: - /api/admin/_check endpoint for proxy auth_request subrequest - Returns 200 if admin session valid, 401/403 otherwise - Sets X-BetterFrame-User header for upstream CEC (Pi5 HDMI control): - kiosk/src/cec.rs wraps cec-ctl subprocess - Standby/wake/active-source commands - WS message types "standby" / "wake" dispatched to CEC - Admin UI: Wake/Standby buttons on kiosk edit page - Server sendToKiosk via coordinator 2026-05-10 20:45:56 +00:00			`[Unit]`
			`Description=BetterFrame Server (BSB)`
			`Documentation=https://github.com/BetterCorp/BetterFrame`
			`After=network-online.target`
			`Wants=network-online.target`

			`[Service]`
			`Type=simple`
			`User=betterframe`
			`Group=betterframe`
			`WorkingDirectory=/opt/betterframe/server`
			`Environment=NODE_ENV=production`
			`Environment=NODE_OPTIONS=--import tsx`
			`ExecStart=/usr/bin/node --import tsx /opt/betterframe/node_modules/@bsb/base/lib/scripts/bsb-plugin-cli.js start`
			`Restart=on-failure`
			`RestartSec=5`
			`StandardOutput=journal`
			`StandardError=journal`

			`# Security hardening`
			`NoNewPrivileges=true`
			`ProtectSystem=strict`
			`ProtectHome=true`
			`PrivateTmp=true`
			`ReadWritePaths=/var/lib/betterframe /var/log/betterframe`
			`LoadCredential=betterframe-secret:/etc/betterframe/secret.key`

			`[Install]`
			`WantedBy=multi-user.target`