rothmanandClaude Opus 5.5
eb0242c182
Services (daynivo-kiosk-*, daynivo-network-guard, daynivo-boot-import), programs in /usr/lib/daynivo-kiosk, folders /etc, /var/lib, /var/log and /var/cache daynivo-kiosk*, the system user daynivo, DAYNIVO_* settings, the plymouth theme, network profiles daynivo-eth0/wlan0, the image stage and its first user daynivoadmin. install.sh moves a kiosk installed up to 1.2.x over once: old services stopped and removed, folders moved (configuration, password, browser profile, logs) with symlinks under the old names, the voxip user renamed with the same uid, network profiles renamed unless a change awaits confirmation, and old leftovers removed. Tested by upgrading a configured 1.2.0 installation in a container, and running the install a second time. Old names keep working where people type or place them: voxip-config.json, voxip-authorized_keys, voxip-network-reset, voxip-kiosk-ctl, and VOXIP_DEFAULT_URL / VOXIP_DEVICE_NAME for image builds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
1.1 KiB
Desktop File
32 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=Daynivo Kiosk Manager (webbeheer)
|
|
Documentation=file:///usr/share/doc/daynivo-kiosk/README.md
|
|
After=network.target daynivo-boot-import.service
|
|
StartLimitIntervalSec=300
|
|
StartLimitBurst=10
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=daynivo
|
|
Group=daynivo
|
|
# systemd-journal: read logs; video: vcgencmd (voltage/throttling)
|
|
SupplementaryGroups=systemd-journal video
|
|
ExecStart=/usr/lib/daynivo-kiosk/daynivo-kiosk-manager
|
|
Restart=always
|
|
RestartSec=3
|
|
UMask=0027
|
|
LogsDirectory=daynivo-kiosk
|
|
LogsDirectoryMode=0750
|
|
SyslogIdentifier=daynivo-kiosk-manager
|
|
# No NoNewPrivileges/ProtectSystem/ProtectHome: the helper started through
|
|
# "sudo -n daynivo-kiosk-helper" inherits this unit's mount namespace and must
|
|
# be able to write /etc (hostname, NetworkManager profiles). The web process
|
|
# itself runs unprivileged as user daynivo and can only write its own dirs.
|
|
# Also no ProtectKernelTunables/ProtectKernelModules/LockPersonality,
|
|
# RestrictSUIDSGID, SystemCall*, ...: for a non-root unit those imply
|
|
# NoNewPrivileges, and sudo then refuses to run (tests/test_units.py).
|
|
ProtectControlGroups=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|