ebcc49b474
Phase 5 — RPi Kiosk: - setup_kiosk.sh: full RPi OS Lite setup (X11, Chromium kiosk mode, auto-login, DPMS disabled, GPU memory split, screen rotation) - kiosk.service: systemd unit for reliable auto-start - update_kiosk.sh: reconfigure URL/rotation/resolution without re-setup - Handles both Bullseye and Bookworm RPi OS versions Phase 9 — Hardening + Deployment: - install.sh: full server setup (apt/pacman, vigilar user, venv, directories, permissions, mosquitto config, systemd units) - gen_cert.sh: TLS cert via mkcert or openssl fallback - gen_vapid_keys.sh: VAPID keys for Web Push notifications - setup_nut.sh: NUT configuration with USB UPS auto-detection - backup.sh: SQLite snapshot + config archive, cron-ready - uninstall.sh: clean removal with data preservation option - vigilar.service: hardened systemd unit (ProtectSystem, NoNewPrivileges, PrivateTmp, syscall filtering) - vigilar-mosquitto.conf: localhost-only MQTT broker config All scripts idempotent, bash -n validated, support Debian + Arch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
31 lines
701 B
Desktop File
31 lines
701 B
Desktop File
[Unit]
|
|
Description=Vigilar Kiosk (X11 + Chromium)
|
|
After=network-online.target systemd-user-sessions.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=vigilar
|
|
Group=vigilar
|
|
PAMName=login
|
|
TTYPath=/dev/tty1
|
|
StandardInput=tty
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
# Ensure we have access to the display hardware
|
|
SupplementaryGroups=video input render
|
|
|
|
Environment=HOME=/home/vigilar
|
|
Environment=XDG_RUNTIME_DIR=/run/user/1001
|
|
WorkingDirectory=/home/vigilar
|
|
|
|
ExecStartPre=/bin/bash -c 'source /home/vigilar/kiosk_config.txt'
|
|
ExecStart=/usr/bin/xinit /home/vigilar/.xinitrc -- /usr/bin/X :0 vt1 -keeptty -nocursor
|
|
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|