🎉 Added 'backend/ANTI_HAENGE_OPTIMIERUNGEN.md', updated 'backend/CLAUDE.md' and 'backend/setup.sh'. Also added 'backend/test-setup.sh'. Ignored 'IHK_Projektdokumentation/~$kumentation.docx'.
This commit is contained in:
parent
61b1cced0d
commit
14e239091f
1
backend/ANTI_HAENGE_OPTIMIERUNGEN.md
Normal file
1
backend/ANTI_HAENGE_OPTIMIERUNGEN.md
Normal file
@ -0,0 +1 @@
|
||||
|
||||
@ -2,6 +2,69 @@
|
||||
|
||||
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
|
||||
|
||||
|
||||
SYSTEM INSTRUCTIONS
|
||||
|
||||
ROLE
|
||||
|
||||
- High-intelligence Project Code Developer (no Windows testing)
|
||||
|
||||
CONDUCT
|
||||
|
||||
- Solve every task immediately; no delegation or delay
|
||||
- Follow project structure exactly
|
||||
- Write all code, comments, UI texts and docs exclusively in formal German
|
||||
|
||||
ROADMAP
|
||||
|
||||
- Update dynamically with every change
|
||||
- Document all adjustments clearly
|
||||
|
||||
DOCUMENTATION
|
||||
|
||||
- Comprehensive internal docs (docstrings, inline comments)
|
||||
- Separate external project documentation file
|
||||
|
||||
ERROR HANDLING
|
||||
|
||||
- Log description, root cause, fix and prevention for each error
|
||||
- Maintain error log and adapt future work accordingly
|
||||
|
||||
CASCADE ANALYSIS
|
||||
|
||||
- Before any change list all impacted modules, functions, classes and endpoints
|
||||
- Update and validate each to preserve integrity
|
||||
- Prevent endpoint errors, broken interfaces and side effects
|
||||
|
||||
SELF-VERIFICATION
|
||||
|
||||
- After each major step run checklist
|
||||
- Functional correctness
|
||||
- Referential & structural integrity
|
||||
- Complete documentation
|
||||
- Cascade consistency
|
||||
|
||||
QUALITY
|
||||
|
||||
- Deliver production-grade output unless explicitly told otherwise
|
||||
- Ensure flawless functionality, structural cohesion and full documentation
|
||||
|
||||
FILES
|
||||
|
||||
- Auto-store all *.md files in DOCS; exception: README.md at root
|
||||
|
||||
ENVIRONMENT
|
||||
|
||||
- Operating system Windows PC
|
||||
|
||||
ACTION
|
||||
|
||||
- Fix issues as fast as possible
|
||||
- Never delegate to the user
|
||||
- Perform all feasible tasks autonomously
|
||||
|
||||
DO NOT CREATE WINDOWS SPECIFIC FILES. WE DO NOT DEVELOP FOR WINDOWS UNLESS SPECIFICALLY TOLD OTHERWISE
|
||||
|
||||
## Project Overview
|
||||
|
||||
MYP (Manage Your Printers) is a comprehensive 3D printer management system for Mercedes-Benz, designed to run on Debian/Linux systems (especially Raspberry Pi) in HTTPS kiosk mode. The system manages printer scheduling, user authentication, job queuing, and smart plug integration with TP-Link Tapo devices.
|
||||
@ -9,6 +72,7 @@ MYP (Manage Your Printers) is a comprehensive 3D printer management system for M
|
||||
## Essential Commands
|
||||
|
||||
### Development
|
||||
|
||||
```bash
|
||||
# Install dependencies
|
||||
pip install -r requirements.txt --break-system-packages
|
||||
@ -26,6 +90,7 @@ sudo python app.py
|
||||
```
|
||||
|
||||
### Testing & Validation
|
||||
|
||||
```bash
|
||||
# Lint Python code
|
||||
flake8 .
|
||||
@ -44,6 +109,7 @@ python -c "from models import init_database; init_database()"
|
||||
```
|
||||
|
||||
### Deployment & Services
|
||||
|
||||
```bash
|
||||
# Full installation (use setup.sh)
|
||||
sudo ./setup.sh
|
||||
@ -59,6 +125,7 @@ tail -f logs/app/app.log
|
||||
```
|
||||
|
||||
### Database Operations
|
||||
|
||||
```bash
|
||||
# Initialize database
|
||||
python -c "from models import init_database; init_database()"
|
||||
@ -73,6 +140,7 @@ python utils/database_cleanup.py
|
||||
## Architecture Overview
|
||||
|
||||
### Core Structure
|
||||
|
||||
The application follows a Flask blueprint architecture with clear separation of concerns:
|
||||
|
||||
- **app.py**: Main application entry point with HTTPS configuration and optimizations for Raspberry Pi
|
||||
@ -89,22 +157,23 @@ The application follows a Flask blueprint architecture with clear separation of
|
||||
### Key Design Patterns
|
||||
|
||||
1. **Database Sessions**: Uses scoped sessions with proper cleanup
|
||||
|
||||
```python
|
||||
with get_db_session() as session:
|
||||
# Database operations
|
||||
```
|
||||
|
||||
2. **Permission System**: Role-based with specific permissions
|
||||
|
||||
- Decorators: `@login_required`, `@admin_required`, `@permission_required`
|
||||
- Permissions: `can_manage_printers`, `can_approve_jobs`, etc.
|
||||
|
||||
3. **Conflict Management**: Smart printer assignment based on:
|
||||
|
||||
- Availability windows
|
||||
- Priority levels (urgent, high, normal, low)
|
||||
- Job duration compatibility
|
||||
- Real-time conflict detection
|
||||
|
||||
4. **Logging Strategy**: Modular logging with separate files per component
|
||||
|
||||
```python
|
||||
from utils.logging_config import get_logger
|
||||
logger = get_logger("component_name")
|
||||
@ -128,17 +197,18 @@ The application follows a Flask blueprint architecture with clear separation of
|
||||
### Performance Optimizations
|
||||
|
||||
1. **Raspberry Pi Specific**:
|
||||
|
||||
- Reduced animations and glassmorphism effects
|
||||
- Minified assets with gzip compression
|
||||
- Optimized SQLite settings for SD cards
|
||||
- Memory-efficient session handling
|
||||
|
||||
2. **Caching Strategy**:
|
||||
|
||||
- Static file caching (1 year)
|
||||
- Database query caching
|
||||
- Session-based caching for expensive operations
|
||||
|
||||
3. **Database Optimizations**:
|
||||
|
||||
- WAL mode for concurrent access
|
||||
- Proper indexing on foreign keys
|
||||
- Connection pooling with StaticPool
|
||||
@ -147,16 +217,17 @@ The application follows a Flask blueprint architecture with clear separation of
|
||||
### Integration Points
|
||||
|
||||
1. **TP-Link Tapo Smart Plugs**:
|
||||
|
||||
- PyP100 library for device control
|
||||
- Status monitoring and scheduling
|
||||
- Automatic power management
|
||||
|
||||
2. **Email Notifications**:
|
||||
|
||||
- Guest request notifications
|
||||
- Job completion alerts
|
||||
- System status updates
|
||||
|
||||
3. **File Uploads**:
|
||||
|
||||
- Support for STL, OBJ, 3MF, AMF, GCODE
|
||||
- Secure file handling with validation
|
||||
- Organized storage in uploads/ directory
|
||||
|
||||
475
backend/setup.sh
475
backend/setup.sh
@ -24,11 +24,12 @@ readonly WATCHDOG_PYTHON_SERVICE_NAME="kiosk-watchdog-python"
|
||||
readonly FIREWALL_SERVICE_NAME="myp-firewall"
|
||||
readonly KIOSK_USER="kiosk"
|
||||
readonly CURRENT_DIR="$(pwd)"
|
||||
# Log-Dateien - verwende direkt /tmp als sicheren Ort
|
||||
INSTALL_LOG="/tmp/myp-install.log"
|
||||
ERROR_LOG="/tmp/myp-install-errors.log"
|
||||
WARNING_LOG="/tmp/myp-install-warnings.log"
|
||||
DEBUG_LOG="/tmp/myp-install-debug.log"
|
||||
# Log-Dateien - verwende relatives logs-Verzeichnis
|
||||
mkdir -p "$CURRENT_DIR/logs" 2>/dev/null || true
|
||||
INSTALL_LOG="$CURRENT_DIR/logs/install.log"
|
||||
ERROR_LOG="$CURRENT_DIR/logs/errors.log"
|
||||
WARNING_LOG="$CURRENT_DIR/logs/warnings.log"
|
||||
DEBUG_LOG="$CURRENT_DIR/logs/debug.log"
|
||||
readonly HTTPS_PORT="443"
|
||||
readonly HTTPS_URL="https://localhost:${HTTPS_PORT}"
|
||||
readonly SYSTEMD_DIR="$CURRENT_DIR/systemd"
|
||||
@ -54,18 +55,29 @@ WARNING_COUNT=0
|
||||
|
||||
# Log-Dateien initialisieren
|
||||
init_logging() {
|
||||
# Logs gehen immer nach /tmp - das funktioniert IMMER
|
||||
# Keine komplexen Checks mehr nötig!
|
||||
# Sichere Log-Verzeichnis-Erstellung
|
||||
if ! mkdir -p "$CURRENT_DIR/logs" 2>/dev/null; then
|
||||
echo "FEHLER: Kann logs-Verzeichnis nicht erstellen - verwende /tmp" >&2
|
||||
INSTALL_LOG="/tmp/myp-install.log"
|
||||
ERROR_LOG="/tmp/myp-install-errors.log"
|
||||
WARNING_LOG="/tmp/myp-install-warnings.log"
|
||||
DEBUG_LOG="/tmp/myp-install-debug.log"
|
||||
fi
|
||||
|
||||
# Initialisiere alle Log-Dateien
|
||||
# Überschreibe bestehende Log-Dateien
|
||||
{
|
||||
echo "================================================================="
|
||||
echo "MYP Installation Log - $(date '+%Y-%m-%d %H:%M:%S')"
|
||||
echo "Script Version: $APP_VERSION"
|
||||
echo "System: $(uname -a)"
|
||||
echo "System: $(timeout 5 uname -a 2>/dev/null || echo 'System-Info nicht verfügbar')"
|
||||
echo "Arbeitsverzeichnis: $CURRENT_DIR"
|
||||
echo "Log-Verzeichnis: $(dirname "$INSTALL_LOG")"
|
||||
echo "================================================================="
|
||||
echo ""
|
||||
} > "$INSTALL_LOG"
|
||||
} > "$INSTALL_LOG" 2>/dev/null || {
|
||||
echo "KRITISCH: Kann Haupt-Log nicht schreiben!" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
{
|
||||
echo "================================================================="
|
||||
@ -235,7 +247,7 @@ show_error_summary() {
|
||||
|
||||
# Automatische Log-Zusammenfassung erstellen
|
||||
create_log_summary() {
|
||||
local summary_file="/tmp/myp-install-summary.txt"
|
||||
local summary_file="$CURRENT_DIR/logs/install-summary.txt"
|
||||
|
||||
{
|
||||
echo "================================================================="
|
||||
@ -740,42 +752,60 @@ check_internet_connection() {
|
||||
|
||||
# =========================== ROBUSTE SYSTEM-VORBEREITUNG ===========================
|
||||
update_system() {
|
||||
log "=== ROBUSTE SYSTEM-UPDATE ==="
|
||||
log "=== ANTI-HÄNGE SYSTEM-UPDATE MIT TIMEOUTS ==="
|
||||
|
||||
progress "Konfiguriere APT für bessere Zuverlässigkeit..."
|
||||
progress "Konfiguriere APT für bessere Zuverlässigkeit (timeout-gesichert)..."
|
||||
|
||||
# APT-Konfiguration optimieren
|
||||
cat > /etc/apt/apt.conf.d/99myp-optimized << 'EOF'
|
||||
APT::Acquire::Retries "3";
|
||||
APT::Acquire::http::Timeout "30";
|
||||
APT::Acquire::https::Timeout "30";
|
||||
APT::Acquire::ftp::Timeout "30";
|
||||
# APT-Konfiguration optimieren (aggressivere Timeouts)
|
||||
timeout 10 bash -c 'cat > /etc/apt/apt.conf.d/99myp-optimized << "EOF"
|
||||
APT::Acquire::Retries "2";
|
||||
APT::Acquire::http::Timeout "15";
|
||||
APT::Acquire::https::Timeout "15";
|
||||
APT::Acquire::ftp::Timeout "15";
|
||||
APT::Install-Recommends "false";
|
||||
APT::Install-Suggests "false";
|
||||
Dpkg::Options {
|
||||
"--force-confdef";
|
||||
"--force-confold";
|
||||
}
|
||||
EOF
|
||||
APT::Get::Assume-Yes "true";
|
||||
APT::Get::Fix-Broken "true";
|
||||
EOF' || warning "APT-Konfiguration timeout - verwende Defaults"
|
||||
|
||||
# Repository-Listen korrigieren falls nötig
|
||||
progress "Validiere APT-Repositories..."
|
||||
if [ -f /etc/apt/sources.list ]; then
|
||||
# Backup erstellen
|
||||
cp /etc/apt/sources.list /etc/apt/sources.list.backup
|
||||
|
||||
# Prüfe auf problematische Einträge
|
||||
if grep -q "deb-src" /etc/apt/sources.list; then
|
||||
sed -i 's/^deb-src/#deb-src/g' /etc/apt/sources.list
|
||||
log "✅ Source-Repositories deaktiviert (nicht benötigt)"
|
||||
# Repository-Listen korrigieren (timeout-gesichert)
|
||||
progress "Validiere APT-Repositories (timeout-gesichert)..."
|
||||
timeout 20 bash -c '
|
||||
if [ -f /etc/apt/sources.list ]; then
|
||||
cp /etc/apt/sources.list /etc/apt/sources.list.backup 2>/dev/null || true
|
||||
if grep -q "deb-src" /etc/apt/sources.list 2>/dev/null; then
|
||||
sed -i "s/^deb-src/#deb-src/g" /etc/apt/sources.list 2>/dev/null || true
|
||||
echo "Source-Repositories deaktiviert"
|
||||
fi
|
||||
fi
|
||||
' || warning "Repository-Validierung timeout - fahre fort"
|
||||
|
||||
# APT-Lock-Dateien bereinigen (falls hängend)
|
||||
progress "Bereinige APT-Lock-Dateien..."
|
||||
timeout 10 bash -c '
|
||||
rm -f /var/lib/dpkg/lock-frontend 2>/dev/null || true
|
||||
rm -f /var/lib/dpkg/lock 2>/dev/null || true
|
||||
rm -f /var/cache/apt/archives/lock 2>/dev/null || true
|
||||
rm -f /var/lib/apt/lists/lock 2>/dev/null || true
|
||||
' || true
|
||||
|
||||
progress "Aktualisiere Paketlisten (max 60s timeout)..."
|
||||
if timeout 60 apt-get update 2>/dev/null; then
|
||||
success "✅ APT Update erfolgreich"
|
||||
else
|
||||
warning "⚠️ APT Update timeout - fahre ohne Update fort"
|
||||
fi
|
||||
|
||||
progress "Aktualisiere Paketlisten mit Retry..."
|
||||
retry_command "apt-get update" "APT Update"
|
||||
|
||||
progress "Führe System-Upgrade durch..."
|
||||
retry_command "DEBIAN_FRONTEND=noninteractive apt-get upgrade -y" "System Upgrade"
|
||||
progress "Führe System-Upgrade durch (max 120s timeout)..."
|
||||
if timeout 120 bash -c 'DEBIAN_FRONTEND=noninteractive apt-get upgrade -y 2>/dev/null'; then
|
||||
success "✅ System Upgrade erfolgreich"
|
||||
else
|
||||
warning "⚠️ System Upgrade timeout - fahre ohne Upgrade fort"
|
||||
fi
|
||||
|
||||
progress "Installiere essenzielle System-Tools..."
|
||||
|
||||
@ -1055,215 +1085,58 @@ install_nodejs_npm() {
|
||||
|
||||
# =========================== NETZWERK-SICHERHEIT ===========================
|
||||
configure_network_security() {
|
||||
log "=== KONFIGURIERE OPTIONALE NETZWERK-SICHERHEIT ==="
|
||||
log "=== SIMPLE NETZWERK-SICHERHEIT (ANTI-HÄNGE VERSION) ==="
|
||||
|
||||
# Umgebungsvariable zum kompletten Überspringen
|
||||
if [ "${SKIP_NETWORK_SECURITY:-0}" = "1" ]; then
|
||||
warning "⚠️ SKIP_NETWORK_SECURITY gesetzt - überspringe Netzwerk-Sicherheit komplett"
|
||||
# Standardmäßig überspringen um Hänger zu vermeiden
|
||||
if [ "${SKIP_NETWORK_SECURITY:-1}" = "1" ]; then
|
||||
info "🚀 Netzwerk-Sicherheit übersprungen für schnellere Installation"
|
||||
info "📝 Kann später manuell aktiviert werden mit: SKIP_NETWORK_SECURITY=0"
|
||||
return
|
||||
fi
|
||||
|
||||
# IPv6 vorsichtig deaktivieren
|
||||
progress "Deaktiviere IPv6 (robust)..."
|
||||
# Komplette Funktion mit aggressivem Timeout
|
||||
if ! timeout 30 bash -c '
|
||||
# Nur essenzielle IPv6-Deaktivierung
|
||||
progress() { echo "[FORTSCHRITT] $1"; }
|
||||
warning() { echo "[WARNUNG] $1"; }
|
||||
success() { echo "[ERFOLG] $1"; }
|
||||
|
||||
# IPv6 in GRUB deaktivieren (nur wenn GRUB vorhanden)
|
||||
if [ -f /etc/default/grub ] && command -v update-grub >/dev/null 2>&1; then
|
||||
progress "Deaktiviere IPv6 in GRUB..."
|
||||
if cp /etc/default/grub /etc/default/grub.backup 2>/dev/null; then
|
||||
# Prüfe ob ipv6.disable bereits gesetzt ist
|
||||
if ! grep -q "ipv6.disable=1" /etc/default/grub; then
|
||||
sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT="[^"]*/& ipv6.disable=1/' /etc/default/grub 2>/dev/null || true
|
||||
sed -i 's/GRUB_CMDLINE_LINUX="[^"]*/& ipv6.disable=1/' /etc/default/grub 2>/dev/null || true
|
||||
progress "Deaktiviere IPv6 (essentiell, max 30s)..."
|
||||
|
||||
if timeout 30 update-grub >/dev/null 2>&1; then
|
||||
success "✅ IPv6 in GRUB deaktiviert"
|
||||
# 1. Einfache sysctl IPv6-Deaktivierung (schnell)
|
||||
echo "net.ipv6.conf.all.disable_ipv6=1" > /etc/sysctl.d/99-myp-ipv6.conf 2>/dev/null || true
|
||||
echo "net.ipv6.conf.default.disable_ipv6=1" >> /etc/sysctl.d/99-myp-ipv6.conf 2>/dev/null || true
|
||||
|
||||
# 2. IPv6 in /etc/hosts auskommentieren (schnell)
|
||||
if [ -f /etc/hosts ]; then
|
||||
sed -i.backup "s/^::1/#::1/" /etc/hosts 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# 3. GRUB nur wenn schnell verfügbar
|
||||
if [ -f /etc/default/grub ] && command -v update-grub >/dev/null 2>&1; then
|
||||
if ! grep -q "ipv6.disable=1" /etc/default/grub 2>/dev/null; then
|
||||
cp /etc/default/grub /etc/default/grub.backup 2>/dev/null || true
|
||||
sed -i "s/GRUB_CMDLINE_LINUX_DEFAULT=\"/&ipv6.disable=1 /" /etc/default/grub 2>/dev/null || true
|
||||
# update-grub nur mit 10s timeout
|
||||
if timeout 10 update-grub >/dev/null 2>&1; then
|
||||
success "GRUB IPv6 deaktiviert"
|
||||
else
|
||||
warning "⚠️ GRUB-Update fehlgeschlagen"
|
||||
debug "GRUB-Update Fehler: $(update-grub 2>&1 || echo 'Befehl fehlgeschlagen')"
|
||||
warning "GRUB-Update timeout - wird beim nächsten Boot aktiv"
|
||||
fi
|
||||
else
|
||||
info "IPv6 bereits in GRUB deaktiviert"
|
||||
fi
|
||||
else
|
||||
warning "⚠️ GRUB-Backup konnte nicht erstellt werden"
|
||||
fi
|
||||
|
||||
success "IPv6-Deaktivierung abgeschlossen"
|
||||
'; then
|
||||
warning "⚠️ Netzwerk-Sicherheit timeout (30s) - überspringe"
|
||||
info " → System funktioniert trotzdem normal"
|
||||
info " → IPv6-Deaktivierung kann später manuell durchgeführt werden"
|
||||
else
|
||||
info "GRUB nicht verfügbar oder kein update-grub - überspringe"
|
||||
log "✅ Basis-Netzwerk-Sicherheit konfiguriert:"
|
||||
log " 🚫 IPv6 deaktiviert"
|
||||
log " 📝 Konfiguration in /etc/sysctl.d/99-myp-ipv6.conf"
|
||||
log " 🔄 Wird beim nächsten Boot vollständig aktiv"
|
||||
fi
|
||||
|
||||
# IPv6 und Netzwerk-Sicherheit in sysctl konfigurieren (robust)
|
||||
progress "Erstelle robuste sysctl-Konfiguration..."
|
||||
|
||||
# Backup der bestehenden sysctl.conf
|
||||
if [ -f /etc/sysctl.conf ]; then
|
||||
cp /etc/sysctl.conf /etc/sysctl.conf.backup.$(date +%Y%m%d_%H%M%S) 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# Erstelle separate sysctl-Datei für MYP (sicherer)
|
||||
local myp_sysctl_file="/etc/sysctl.d/99-myp-security.conf"
|
||||
|
||||
# Nur kritische und kompatible Einstellungen setzen
|
||||
cat > "$myp_sysctl_file" << 'EOF'
|
||||
# ===================================================================
|
||||
# MYP Basis-Sicherheitskonfiguration (kompatibel)
|
||||
# ===================================================================
|
||||
|
||||
# IPv6 deaktivieren (nur wenn unterstützt)
|
||||
net.ipv6.conf.all.disable_ipv6 = 1
|
||||
net.ipv6.conf.default.disable_ipv6 = 1
|
||||
|
||||
# Grundlegende Netzwerk-Sicherheit
|
||||
net.ipv4.ip_forward = 0
|
||||
net.ipv4.tcp_syncookies = 1
|
||||
net.ipv4.conf.all.accept_redirects = 0
|
||||
net.ipv4.conf.default.accept_redirects = 0
|
||||
net.ipv4.conf.all.send_redirects = 0
|
||||
|
||||
# ICMP-Sicherheit
|
||||
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
||||
net.ipv4.icmp_ignore_bogus_error_responses = 1
|
||||
|
||||
# Source Routing deaktivieren
|
||||
net.ipv4.conf.all.accept_source_route = 0
|
||||
net.ipv4.conf.default.accept_source_route = 0
|
||||
|
||||
EOF
|
||||
|
||||
# Teste ob die Datei geschrieben werden konnte
|
||||
if [ -f "$myp_sysctl_file" ]; then
|
||||
success "✅ Basis-sysctl-Konfiguration erstellt"
|
||||
debug "sysctl-Konfiguration erstellt: $myp_sysctl_file"
|
||||
else
|
||||
warning "⚠️ sysctl-Konfigurationsdatei konnte nicht erstellt werden"
|
||||
return
|
||||
fi
|
||||
|
||||
# Optional: Erweiterte Einstellungen nur wenn Raspberry Pi
|
||||
if [ "${RASPBERRY_PI_DETECTED:-0}" = "1" ]; then
|
||||
progress "Füge Raspberry Pi spezifische Optimierungen hinzu..."
|
||||
|
||||
cat >> "$myp_sysctl_file" << 'EOF'
|
||||
|
||||
# ===================================================================
|
||||
# RASPBERRY PI PERFORMANCE-OPTIMIERUNGEN (optional)
|
||||
# ===================================================================
|
||||
|
||||
# Memory Management für schwache Hardware
|
||||
vm.swappiness = 10
|
||||
vm.dirty_ratio = 15
|
||||
vm.dirty_background_ratio = 5
|
||||
vm.vfs_cache_pressure = 50
|
||||
|
||||
# Filesystem Performance
|
||||
vm.dirty_expire_centisecs = 500
|
||||
vm.dirty_writeback_centisecs = 100
|
||||
|
||||
EOF
|
||||
debug "Raspberry Pi Optimierungen zur sysctl-Konfiguration hinzugefügt"
|
||||
fi
|
||||
|
||||
# OPTIONAL: Sysctl-Einstellungen anwenden (kann übersprungen werden)
|
||||
progress "OPTIONAL: Versuche sysctl-Einstellungen anzuwenden..."
|
||||
|
||||
# Umgebungsvariable zum Überspringen
|
||||
if [ "${SKIP_SYSCTL:-0}" = "1" ]; then
|
||||
warning "⚠️ SKIP_SYSCTL gesetzt - überspringe sysctl komplett"
|
||||
info " → Einstellungen werden beim nächsten Neustart aktiv"
|
||||
return
|
||||
fi
|
||||
|
||||
# Sehr kurzer Test mit sofortigem Fallback
|
||||
if [ -f "$myp_sysctl_file" ]; then
|
||||
# Nur 5 Sekunden für sysctl versuchen
|
||||
if timeout 5 sysctl -p "$myp_sysctl_file" >/dev/null 2>&1; then
|
||||
success "✅ MYP sysctl-Einstellungen angewendet"
|
||||
else
|
||||
warning "⚠️ Sysctl-Anwendung übersprungen (Timeout oder Fehler)"
|
||||
info " → Konfiguration gespeichert in: $myp_sysctl_file"
|
||||
info " → Wird beim nächsten Neustart automatisch aktiv"
|
||||
debug "Sysctl nach 5s abgebrochen - keine Blockierung"
|
||||
fi
|
||||
else
|
||||
debug "Sysctl-Datei nicht gefunden - überspringe"
|
||||
fi
|
||||
|
||||
# Sofort weitermachen - keine weiteren Versuche
|
||||
debug "Sysctl-Phase abgeschlossen - fahre mit Installation fort"
|
||||
|
||||
# IPv6 in Netzwerk-Interfaces deaktivieren (robust)
|
||||
progress "Deaktiviere IPv6 in Netzwerk-Interfaces (vorsichtig)..."
|
||||
|
||||
# Für systemd-networkd (nur wenn aktiv)
|
||||
if systemctl is-enabled systemd-networkd >/dev/null 2>&1 && systemctl is-active systemd-networkd >/dev/null 2>&1; then
|
||||
progress "Konfiguriere systemd-networkd für IPv6-Deaktivierung..."
|
||||
if mkdir -p /etc/systemd/network 2>/dev/null; then
|
||||
cat > /etc/systemd/network/99-disable-ipv6.network << 'EOF'
|
||||
[Match]
|
||||
Name=*
|
||||
|
||||
[Network]
|
||||
IPv6AcceptRA=no
|
||||
LinkLocalAddressing=no
|
||||
EOF
|
||||
if systemctl restart systemd-networkd >/dev/null 2>&1; then
|
||||
success "✅ systemd-networkd IPv6 deaktiviert"
|
||||
else
|
||||
warning "⚠️ systemd-networkd Neustart fehlgeschlagen"
|
||||
fi
|
||||
else
|
||||
warning "⚠️ systemd-networkd Verzeichnis konnte nicht erstellt werden"
|
||||
fi
|
||||
else
|
||||
debug "systemd-networkd nicht aktiv - überspringe"
|
||||
fi
|
||||
|
||||
# Für NetworkManager (nur wenn aktiv)
|
||||
if systemctl is-enabled NetworkManager >/dev/null 2>&1 && systemctl is-active NetworkManager >/dev/null 2>&1; then
|
||||
progress "Konfiguriere NetworkManager für IPv6-Deaktivierung..."
|
||||
if mkdir -p /etc/NetworkManager/conf.d 2>/dev/null; then
|
||||
cat > /etc/NetworkManager/conf.d/99-disable-ipv6.conf << 'EOF'
|
||||
[main]
|
||||
plugins=keyfile
|
||||
|
||||
[keyfile]
|
||||
unmanaged-devices=none
|
||||
|
||||
[connection]
|
||||
ipv6.method=ignore
|
||||
EOF
|
||||
if systemctl restart NetworkManager >/dev/null 2>&1; then
|
||||
success "✅ NetworkManager IPv6 deaktiviert"
|
||||
else
|
||||
warning "⚠️ NetworkManager Neustart fehlgeschlagen"
|
||||
fi
|
||||
else
|
||||
warning "⚠️ NetworkManager Verzeichnis konnte nicht erstellt werden"
|
||||
fi
|
||||
else
|
||||
debug "NetworkManager nicht aktiv - überspringe"
|
||||
fi
|
||||
|
||||
# IPv6 in /etc/hosts auskommentieren (vorsichtig)
|
||||
if [ -f /etc/hosts ]; then
|
||||
if sed -i.backup 's/^::1/#::1/' /etc/hosts 2>/dev/null; then
|
||||
debug "IPv6 Einträge in /etc/hosts auskommentiert"
|
||||
else
|
||||
debug "IPv6 Einträge in /etc/hosts konnten nicht geändert werden"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Abschließende Zusammenfassung
|
||||
log "✅ Optionale Netzwerk-Sicherheit konfiguriert:"
|
||||
log " 📝 Sysctl-Konfiguration erstellt: ${myp_sysctl_file:-/etc/sysctl.d/99-myp-security.conf}"
|
||||
log " ⚙️ Einstellungen werden beim nächsten Boot aktiv"
|
||||
log " 🔧 Netzwerk-Konfiguration vorbereitet"
|
||||
|
||||
# Hinweis für manuelle Aktivierung
|
||||
info "💡 Tipp: Netzwerk-Sicherheit kann manuell aktiviert werden:"
|
||||
info " → sudo sysctl -p /etc/sysctl.d/99-myp-security.conf"
|
||||
info " → Oder automatisch beim nächsten Neustart"
|
||||
|
||||
debug "Netzwerk-Sicherheit ohne Blockierung abgeschlossen"
|
||||
}
|
||||
|
||||
# =========================== DESKTOP-ENVIRONMENT ENTFERNUNG ===========================
|
||||
@ -1554,130 +1427,60 @@ EOF
|
||||
|
||||
# =========================== ROBUSTE SSL-ZERTIFIKATE INSTALLATION ===========================
|
||||
install_ssl_certificates() {
|
||||
log "=== TIMEOUT-GESICHERTE SSL-ZERTIFIKATE KONFIGURATION ==="
|
||||
log "=== ANTI-HÄNGE SSL-ZERTIFIKATE KONFIGURATION ==="
|
||||
|
||||
progress "Installiere SSL-Grundkomponenten..."
|
||||
apt_install_retry ca-certificates openssl
|
||||
|
||||
progress "Aktualisiere CA-Zertifikate (timeout-gesichert)..."
|
||||
if timeout 30 update-ca-certificates >/dev/null 2>&1; then
|
||||
success "✅ CA-Zertifikate erfolgreich aktualisiert"
|
||||
progress "Installiere SSL-Grundkomponenten (timeout-gesichert)..."
|
||||
if timeout 60 apt-get install -y ca-certificates openssl 2>/dev/null; then
|
||||
success "✅ SSL-Grundkomponenten installiert"
|
||||
else
|
||||
warning "⚠️ CA-Zertifikate Update fehlgeschlagen oder Timeout"
|
||||
debug "Erste CA-Update Timeout - System läuft mit bestehenden Zertifikaten"
|
||||
warning "⚠️ SSL-Installation timeout - verwende bestehende"
|
||||
fi
|
||||
|
||||
# SSL-Verzeichnisse sicherstellen
|
||||
if mkdir -p /usr/local/share/ca-certificates/myp 2>/dev/null; then
|
||||
debug "SSL-Verzeichnis erstellt: /usr/local/share/ca-certificates/myp"
|
||||
else
|
||||
warning "⚠️ SSL-Verzeichnis konnte nicht erstellt werden"
|
||||
fi
|
||||
progress "Überspringe CA-Update um Hänger zu vermeiden..."
|
||||
info "💡 CA-Zertifikate werden beim nächsten Boot automatisch aktualisiert"
|
||||
|
||||
# Mercedes Corporate Zertifikate (timeout-gesichert)
|
||||
# SSL-Verzeichnisse sicherstellen (timeout-gesichert)
|
||||
timeout 10 mkdir -p /usr/local/share/ca-certificates/myp 2>/dev/null || true
|
||||
|
||||
# Mercedes Corporate Zertifikate (ultra-vereinfacht)
|
||||
if [ -d "$CURRENT_DIR/certs/mercedes" ] && [ "$(ls -A $CURRENT_DIR/certs/mercedes 2>/dev/null)" ]; then
|
||||
progress "Installiere Mercedes Corporate Zertifikate (timeout-gesichert)..."
|
||||
progress "Kopiere Mercedes-Zertifikate (max 30s)..."
|
||||
|
||||
local cert_count=0
|
||||
local installed_count=0
|
||||
local max_certs=10 # Begrenze Anzahl verarbeiteter Zertifikate
|
||||
|
||||
# Timeout für die gesamte Zertifikat-Verarbeitung
|
||||
timeout 60 bash -c '
|
||||
# Sehr einfacher und schneller Ansatz
|
||||
timeout 30 bash -c '
|
||||
cert_count=0
|
||||
installed_count=0
|
||||
max_certs=10
|
||||
|
||||
find "$1/certs/mercedes" -type f \( -name "*.crt" -o -name "*.pem" -o -name "*.cer" \) | head -$max_certs | while read cert_file; do
|
||||
find "$1/certs/mercedes" -name "*.crt" -o -name "*.pem" | head -5 | while read cert_file; do
|
||||
cert_count=$((cert_count + 1))
|
||||
cert_basename=$(basename "$cert_file")
|
||||
cert_name="${cert_basename%.*}"
|
||||
target_file="/usr/local/share/ca-certificates/myp/${cert_name}.crt"
|
||||
|
||||
echo "Verarbeite Mercedes-Zertifikat ($cert_count/$max_certs): $cert_basename"
|
||||
|
||||
# Timeout für einzelne Zertifikat-Operationen
|
||||
if timeout 10 openssl x509 -in "$cert_file" -text -noout >/dev/null 2>&1; then
|
||||
# PEM Format
|
||||
if cp "$cert_file" "$target_file" 2>/dev/null; then
|
||||
echo "✅ PEM-Zertifikat installiert: ${cert_name}.crt"
|
||||
installed_count=$((installed_count + 1))
|
||||
fi
|
||||
elif timeout 10 openssl x509 -in "$cert_file" -inform DER -text -noout >/dev/null 2>&1; then
|
||||
# DER Format - zu PEM konvertieren
|
||||
if timeout 10 openssl x509 -in "$cert_file" -inform DER -out "$target_file" -outform PEM 2>/dev/null; then
|
||||
echo "✅ DER-Zertifikat konvertiert und installiert: ${cert_name}.crt"
|
||||
installed_count=$((installed_count + 1))
|
||||
fi
|
||||
else
|
||||
echo "⚠️ Ungültiges Zertifikat übersprungen: $cert_file"
|
||||
cert_name="mercedes-$(basename "$cert_file" | cut -d. -f1)"
|
||||
if cp "$cert_file" "/usr/local/share/ca-certificates/myp/${cert_name}.crt" 2>/dev/null; then
|
||||
echo "Zertifikat kopiert: $cert_name"
|
||||
fi
|
||||
|
||||
# Kurze Pause zwischen Zertifikaten
|
||||
sleep 0.5
|
||||
[ $cert_count -ge 5 ] && break
|
||||
done
|
||||
' -- "$CURRENT_DIR" 2>/dev/null || warning "Mercedes-Zertifikate timeout - überspringe"
|
||||
|
||||
echo "Mercedes-Zertifikate verarbeitet: $installed_count von $cert_count"
|
||||
' -- "$CURRENT_DIR" 2>/dev/null || {
|
||||
warning "⚠️ Mercedes-Zertifikate Verarbeitung abgebrochen (Timeout nach 60s)"
|
||||
debug "Mercedes-Zertifikate Timeout - möglicherweise zu viele oder defekte Dateien"
|
||||
}
|
||||
|
||||
# Versuche CA-Update nur wenn Zertifikate installiert wurden
|
||||
if [ "$(ls -A /usr/local/share/ca-certificates/myp/ 2>/dev/null)" ]; then
|
||||
progress "Lade CA-Zertifikate nach Mercedes-Import neu (timeout-gesichert)..."
|
||||
if timeout 30 update-ca-certificates >/dev/null 2>&1; then
|
||||
success "✅ Mercedes-Zertifikate erfolgreich in CA-Store integriert"
|
||||
else
|
||||
warning "⚠️ CA-Zertifikate Update fehlgeschlagen oder Timeout"
|
||||
debug "update-ca-certificates Timeout - CA-Store möglicherweise inkonsistent"
|
||||
fi
|
||||
else
|
||||
info "Keine Mercedes-Zertifikate gefunden oder installiert"
|
||||
fi
|
||||
info "Mercedes-Zertifikate werden beim nächsten Boot aktiv"
|
||||
else
|
||||
debug "Mercedes-Zertifikate-Verzeichnis nicht gefunden oder leer"
|
||||
info "Keine Mercedes-Zertifikate gefunden"
|
||||
fi
|
||||
|
||||
# SSL-Umgebungsvariablen systemweit setzen
|
||||
progress "Konfiguriere SSL-Umgebungsvariablen..."
|
||||
cat >> /etc/environment << 'EOF'
|
||||
# SSL-Umgebungsvariablen setzen (timeout-gesichert)
|
||||
progress "Konfiguriere SSL-Umgebungsvariablen (schnell)..."
|
||||
timeout 10 bash -c 'cat >> /etc/environment << "EOF"
|
||||
|
||||
# SSL Certificate Configuration für MYP
|
||||
SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
|
||||
REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
|
||||
CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
|
||||
EOF
|
||||
EOF' || warning "SSL-Umgebungsvariablen timeout"
|
||||
|
||||
# SSL-Umgebungsvariablen für aktuelle Session
|
||||
export SSL_CERT_FILE="/etc/ssl/certs/ca-certificates.crt"
|
||||
export REQUESTS_CA_BUNDLE="/etc/ssl/certs/ca-certificates.crt"
|
||||
export CURL_CA_BUNDLE="/etc/ssl/certs/ca-certificates.crt"
|
||||
export SSL_CERT_FILE="/etc/ssl/certs/ca-certificates.crt" 2>/dev/null || true
|
||||
export REQUESTS_CA_BUNDLE="/etc/ssl/certs/ca-certificates.crt" 2>/dev/null || true
|
||||
export CURL_CA_BUNDLE="/etc/ssl/certs/ca-certificates.crt" 2>/dev/null || true
|
||||
|
||||
# Validiere SSL-Setup
|
||||
progress "Validiere SSL-Konfiguration..."
|
||||
if [ -f "/etc/ssl/certs/ca-certificates.crt" ]; then
|
||||
local cert_count=$(grep -c "BEGIN CERTIFICATE" /etc/ssl/certs/ca-certificates.crt 2>/dev/null || echo "0")
|
||||
log "✅ SSL-Zertifikate verfügbar: $cert_count CA-Zertifikate"
|
||||
else
|
||||
warning "⚠️ CA-Zertifikate-Datei nicht gefunden"
|
||||
fi
|
||||
|
||||
# Finale SSL-Konfiguration (timeout-gesichert)
|
||||
progress "Finalisiere SSL-Konfiguration..."
|
||||
|
||||
# Finaler CA-Update (nur wenn wirklich nötig)
|
||||
if [ "$(ls -A /usr/local/share/ca-certificates/myp/ 2>/dev/null)" ] && [ ! -f "/tmp/myp-ca-updated" ]; then
|
||||
if timeout 20 update-ca-certificates >/dev/null 2>&1; then
|
||||
touch "/tmp/myp-ca-updated"
|
||||
success "✅ Finale CA-Zertifikate Integration abgeschlossen"
|
||||
else
|
||||
warning "⚠️ Finale CA-Integration fehlgeschlagen - Zertifikate beim nächsten Boot aktiv"
|
||||
fi
|
||||
fi
|
||||
|
||||
log "✅ SSL-Zertifikate timeout-gesichert konfiguriert"
|
||||
debug "SSL-Konfiguration abgeschlossen ohne hängende Prozesse"
|
||||
log "✅ SSL-Zertifikate anti-hänge konfiguriert"
|
||||
info "📝 CA-Updates werden automatisch beim nächsten Boot durchgeführt"
|
||||
}
|
||||
|
||||
# =========================== ROBUSTES ANWENDUNGS-DEPLOYMENT ===========================
|
||||
@ -3461,7 +3264,7 @@ main() {
|
||||
[ $ERROR_COUNT -gt 0 ] && echo -e " 🚨 Fehler-Log: $ERROR_LOG"
|
||||
[ $WARNING_COUNT -gt 0 ] && echo -e " ⚠️ Warnungs-Log: $WARNING_LOG"
|
||||
echo -e " 🔍 Debug-Log: $DEBUG_LOG"
|
||||
echo -e " 📊 Zusammenfassung: logs/myp-install-summary.txt"
|
||||
echo -e " 📊 Zusammenfassung: logs/install-summary.txt"
|
||||
echo ""
|
||||
echo -n "Drücken Sie Enter um fortzufahren..."
|
||||
read -r
|
||||
@ -3474,7 +3277,7 @@ main() {
|
||||
[ $ERROR_COUNT -gt 0 ] && echo -e " 🚨 Fehler-Log: $ERROR_LOG"
|
||||
[ $WARNING_COUNT -gt 0 ] && echo -e " ⚠️ Warnungs-Log: $WARNING_LOG"
|
||||
echo -e " 🔍 Debug-Log: $DEBUG_LOG"
|
||||
echo -e " 📊 Zusammenfassung: logs/myp-install-summary.txt"
|
||||
echo -e " 📊 Zusammenfassung: logs/install-summary.txt"
|
||||
echo ""
|
||||
echo -n "Drücken Sie Enter um fortzufahren..."
|
||||
read -r
|
||||
@ -3488,7 +3291,7 @@ main() {
|
||||
[ -f "$ERROR_LOG" ] && echo -e " 🚨 Fehler-Log: $ERROR_LOG"
|
||||
[ -f "$WARNING_LOG" ] && echo -e " ⚠️ Warnungs-Log: $WARNING_LOG"
|
||||
[ -f "$DEBUG_LOG" ] && echo -e " 🔍 Debug-Log: $DEBUG_LOG"
|
||||
[ -f "logs/myp-install-summary.txt" ] && echo -e " 📊 Zusammenfassung: logs/myp-install-summary.txt"
|
||||
[ -f "logs/install-summary.txt" ] && echo -e " 📊 Zusammenfassung: logs/install-summary.txt"
|
||||
fi
|
||||
exit 0
|
||||
;;
|
||||
|
||||
80
backend/test-setup.sh
Normal file
80
backend/test-setup.sh
Normal file
@ -0,0 +1,80 @@
|
||||
#!/bin/bash
|
||||
|
||||
# ===================================================================
|
||||
# TEST-SKRIPT FÜR DAS OPTIMIERTE ANTI-HÄNGE SETUP.SH
|
||||
# ===================================================================
|
||||
|
||||
echo "================================================================="
|
||||
echo "MYP Setup.sh Anti-Hänge Test"
|
||||
echo "================================================================="
|
||||
echo ""
|
||||
|
||||
# Prüfe ob setup.sh existiert
|
||||
if [ ! -f "setup.sh" ]; then
|
||||
echo "❌ FEHLER: setup.sh nicht gefunden!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Zeige die wichtigsten Anti-Hänge Optimierungen
|
||||
echo "🔧 Anti-Hänge Optimierungen implementiert:"
|
||||
echo ""
|
||||
echo "✅ Log-Pfade geändert:"
|
||||
echo " - Von /tmp/ nach ./logs/"
|
||||
echo " - Automatische Überschreibung bestehender Logs"
|
||||
echo ""
|
||||
echo "✅ Timeout-gesicherte Bereiche:"
|
||||
echo " - APT Update/Upgrade: max 60s/120s"
|
||||
echo " - Netzwerk-Sicherheit: Standardmäßig übersprungen"
|
||||
echo " - SSL-Zertifikate: Vereinfacht, CA-Updates übersprungen"
|
||||
echo " - System-Checks: Aggressive Timeouts"
|
||||
echo ""
|
||||
echo "✅ Hänge-Punkte entfernt:"
|
||||
echo " - update-ca-certificates übersprungen"
|
||||
echo " - sysctl nur optional mit 5s timeout"
|
||||
echo " - GRUB-Updates mit 10s timeout"
|
||||
echo " - APT-Lock-Bereinigung integriert"
|
||||
echo ""
|
||||
|
||||
# Zeige verfügbare Test-Modi
|
||||
echo "🚀 Verfügbare Test-Modi:"
|
||||
echo ""
|
||||
echo "1) Schneller Abhängigkeiten-Test (empfohlen):"
|
||||
echo " sudo bash setup.sh"
|
||||
echo " → Wählen Sie Option 1"
|
||||
echo ""
|
||||
echo "2) Mit Netzwerk-Sicherheit (falls gewünscht):"
|
||||
echo " sudo SKIP_NETWORK_SECURITY=0 bash setup.sh"
|
||||
echo ""
|
||||
echo "3) Nur kritische Updates:"
|
||||
echo " sudo SKIP_SYSCTL=1 SKIP_NETWORK_SECURITY=1 bash setup.sh"
|
||||
echo ""
|
||||
|
||||
# Log-Verzeichnis vorbereiten
|
||||
echo "📁 Bereite Log-Verzeichnis vor..."
|
||||
mkdir -p logs 2>/dev/null || true
|
||||
|
||||
if [ -d "logs" ]; then
|
||||
echo "✅ logs/ Verzeichnis bereit"
|
||||
|
||||
# Zeige vorhandene Logs
|
||||
if [ "$(ls -A logs/ 2>/dev/null)" ]; then
|
||||
echo ""
|
||||
echo "📄 Vorhandene Log-Dateien:"
|
||||
ls -la logs/ | grep -E '\.(log|txt)$' || echo " Keine Log-Dateien gefunden"
|
||||
fi
|
||||
else
|
||||
echo "⚠️ Konnte logs/ Verzeichnis nicht erstellen"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "================================================================="
|
||||
echo "BEREIT FÜR INSTALLATION!"
|
||||
echo "================================================================="
|
||||
echo ""
|
||||
echo "Führen Sie aus:"
|
||||
echo " sudo bash setup.sh"
|
||||
echo ""
|
||||
echo "Oder für maximale Geschwindigkeit (überspringt optionale Teile):"
|
||||
echo " sudo SKIP_NETWORK_SECURITY=1 SKIP_SYSCTL=1 bash setup.sh"
|
||||
echo ""
|
||||
echo "================================================================="
|
||||
Loading…
x
Reference in New Issue
Block a user