🐛 Backend Database Cleanup & Log Update 🎉
This commit is contained in:
parent
f398bf896a
commit
3287b4558b
Binary file not shown.
Binary file not shown.
@ -1141,3 +1141,10 @@ WHERE users.id = ?
|
||||
2025-06-01 14:09:35 - [app] app - [INFO] INFO - Admin-Check für Funktion api_admin_system_health: User authenticated: True, User ID: 1, Is Admin: True
|
||||
2025-06-01 14:10:35 - [app] app - [INFO] INFO - Admin-Check für Funktion api_admin_system_health: User authenticated: True, User ID: 1, Is Admin: True
|
||||
2025-06-01 14:11:35 - [app] app - [INFO] INFO - Admin-Check für Funktion api_admin_system_health: User authenticated: True, User ID: 1, Is Admin: True
|
||||
2025-06-01 14:12:35 - [app] app - [INFO] INFO - Admin-Check für Funktion api_admin_system_health: User authenticated: True, User ID: 1, Is Admin: True
|
||||
2025-06-01 14:13:35 - [app] app - [INFO] INFO - Admin-Check für Funktion api_admin_system_health: User authenticated: True, User ID: 1, Is Admin: True
|
||||
2025-06-01 14:14:35 - [app] app - [INFO] INFO - Admin-Check für Funktion api_admin_system_health: User authenticated: True, User ID: 1, Is Admin: True
|
||||
2025-06-01 14:15:35 - [app] app - [INFO] INFO - Admin-Check für Funktion api_admin_system_health: User authenticated: True, User ID: 1, Is Admin: True
|
||||
2025-06-01 14:16:35 - [app] app - [INFO] INFO - Admin-Check für Funktion api_admin_system_health: User authenticated: True, User ID: 1, Is Admin: True
|
||||
2025-06-01 14:17:35 - [app] app - [INFO] INFO - Admin-Check für Funktion api_admin_system_health: User authenticated: True, User ID: 1, Is Admin: True
|
||||
2025-06-01 14:17:45 - [app] app - [INFO] INFO - Admin-Check für Funktion api_admin_system_health: User authenticated: True, User ID: 1, Is Admin: True
|
||||
|
||||
@ -1326,3 +1326,35 @@
|
||||
2025-06-01 14:11:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:11:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:11:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:12:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:12:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:12:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:12:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:13:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:13:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:13:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:13:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:14:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:14:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:14:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:14:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:15:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:15:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:15:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:15:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:16:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:16:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:16:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:16:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:17:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:17:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:17:35 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:17:35 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:17:38 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:17:38 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:17:38 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:17:38 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:17:48 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:17:48 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
2025-06-01 14:17:48 - [printer_monitor] printer_monitor - [INFO] INFO - 🔄 Aktualisiere Live-Druckerstatus...
|
||||
2025-06-01 14:17:48 - [printer_monitor] printer_monitor - [INFO] INFO - ℹ️ Keine aktiven Drucker gefunden
|
||||
|
||||
@ -3659,3 +3659,27 @@
|
||||
2025-06-01 14:11:35 - [printers] printers - [INFO] INFO - 🔄 Live-Status-Abfrage von Benutzer Administrator (ID: 1)
|
||||
2025-06-01 14:11:35 - [printers] printers - [INFO] INFO - ✅ Live-Status-Abfrage erfolgreich: 0 Drucker
|
||||
2025-06-01 14:11:35 - [printers] printers - [INFO] INFO - ✅ API-Live-Drucker-Status-Abfrage 'get_live_printer_status' erfolgreich in 4.07ms
|
||||
2025-06-01 14:12:35 - [printers] printers - [INFO] INFO - 🔄 Live-Status-Abfrage von Benutzer Administrator (ID: 1)
|
||||
2025-06-01 14:12:35 - [printers] printers - [INFO] INFO - ✅ Live-Status-Abfrage erfolgreich: 0 Drucker
|
||||
2025-06-01 14:12:35 - [printers] printers - [INFO] INFO - ✅ API-Live-Drucker-Status-Abfrage 'get_live_printer_status' erfolgreich in 4.91ms
|
||||
2025-06-01 14:13:35 - [printers] printers - [INFO] INFO - 🔄 Live-Status-Abfrage von Benutzer Administrator (ID: 1)
|
||||
2025-06-01 14:13:35 - [printers] printers - [INFO] INFO - ✅ Live-Status-Abfrage erfolgreich: 0 Drucker
|
||||
2025-06-01 14:13:35 - [printers] printers - [INFO] INFO - ✅ API-Live-Drucker-Status-Abfrage 'get_live_printer_status' erfolgreich in 4.09ms
|
||||
2025-06-01 14:14:35 - [printers] printers - [INFO] INFO - 🔄 Live-Status-Abfrage von Benutzer Administrator (ID: 1)
|
||||
2025-06-01 14:14:35 - [printers] printers - [INFO] INFO - ✅ Live-Status-Abfrage erfolgreich: 0 Drucker
|
||||
2025-06-01 14:14:35 - [printers] printers - [INFO] INFO - ✅ API-Live-Drucker-Status-Abfrage 'get_live_printer_status' erfolgreich in 3.30ms
|
||||
2025-06-01 14:15:35 - [printers] printers - [INFO] INFO - 🔄 Live-Status-Abfrage von Benutzer Administrator (ID: 1)
|
||||
2025-06-01 14:15:35 - [printers] printers - [INFO] INFO - ✅ Live-Status-Abfrage erfolgreich: 0 Drucker
|
||||
2025-06-01 14:15:35 - [printers] printers - [INFO] INFO - ✅ API-Live-Drucker-Status-Abfrage 'get_live_printer_status' erfolgreich in 5.15ms
|
||||
2025-06-01 14:16:35 - [printers] printers - [INFO] INFO - 🔄 Live-Status-Abfrage von Benutzer Administrator (ID: 1)
|
||||
2025-06-01 14:16:35 - [printers] printers - [INFO] INFO - ✅ Live-Status-Abfrage erfolgreich: 0 Drucker
|
||||
2025-06-01 14:16:35 - [printers] printers - [INFO] INFO - ✅ API-Live-Drucker-Status-Abfrage 'get_live_printer_status' erfolgreich in 3.65ms
|
||||
2025-06-01 14:17:35 - [printers] printers - [INFO] INFO - 🔄 Live-Status-Abfrage von Benutzer Administrator (ID: 1)
|
||||
2025-06-01 14:17:35 - [printers] printers - [INFO] INFO - ✅ Live-Status-Abfrage erfolgreich: 0 Drucker
|
||||
2025-06-01 14:17:35 - [printers] printers - [INFO] INFO - ✅ API-Live-Drucker-Status-Abfrage 'get_live_printer_status' erfolgreich in 4.89ms
|
||||
2025-06-01 14:17:38 - [printers] printers - [INFO] INFO - 🔄 Live-Status-Abfrage von Benutzer Administrator (ID: 1)
|
||||
2025-06-01 14:17:38 - [printers] printers - [INFO] INFO - ✅ Live-Status-Abfrage erfolgreich: 0 Drucker
|
||||
2025-06-01 14:17:38 - [printers] printers - [INFO] INFO - ✅ API-Live-Drucker-Status-Abfrage 'get_live_printer_status' erfolgreich in 1.86ms
|
||||
2025-06-01 14:17:48 - [printers] printers - [INFO] INFO - 🔄 Live-Status-Abfrage von Benutzer Administrator (ID: 1)
|
||||
2025-06-01 14:17:48 - [printers] printers - [INFO] INFO - ✅ Live-Status-Abfrage erfolgreich: 0 Drucker
|
||||
2025-06-01 14:17:48 - [printers] printers - [INFO] INFO - ✅ API-Live-Drucker-Status-Abfrage 'get_live_printer_status' erfolgreich in 9.35ms
|
||||
|
||||
489
backend/setup.sh
489
backend/setup.sh
@ -283,6 +283,128 @@ EOF
|
||||
log "✅ Autologin für $KIOSK_USER konfiguriert"
|
||||
}
|
||||
|
||||
configure_kiosk_autostart() {
|
||||
log "=== KONFIGURIERE AUTOMATISCHEN KIOSK-START ==="
|
||||
|
||||
# Erstelle .bashrc für automatischen X-Server und Browser-Start
|
||||
progress "Konfiguriere automatischen Kiosk-Start für $KIOSK_USER..."
|
||||
|
||||
local kiosk_home="/home/$KIOSK_USER"
|
||||
|
||||
# .bashrc für automatischen Start erstellen
|
||||
cat > "$kiosk_home/.bashrc" << 'EOF'
|
||||
# Automatischer Kiosk-Start beim Login
|
||||
if [ -z "$DISPLAY" ] && [ "$XDG_VTNR" = "1" ]; then
|
||||
echo "Starte Kiosk-Modus..."
|
||||
|
||||
# X-Server im Hintergrund starten
|
||||
startx /home/kiosk/.xinitrc -- :0 vt1 &
|
||||
|
||||
# Warte bis X-Server bereit ist
|
||||
sleep 5
|
||||
|
||||
# Setze DISPLAY-Variable
|
||||
export DISPLAY=:0
|
||||
|
||||
# Warte auf HTTPS-Backend
|
||||
echo "Warte auf HTTPS-Backend..."
|
||||
for i in {1..60}; do
|
||||
if curl -k -s https://localhost:443 >/dev/null 2>&1; then
|
||||
echo "HTTPS-Backend erreichbar"
|
||||
break
|
||||
fi
|
||||
echo "Warte... ($i/60)"
|
||||
sleep 2
|
||||
done
|
||||
|
||||
# Bildschirmschoner deaktivieren
|
||||
xset s off
|
||||
xset s noblank
|
||||
xset -dpms
|
||||
|
||||
# Mauszeiger verstecken
|
||||
unclutter -idle 0.1 -root -noevents &
|
||||
|
||||
# Browser im Kiosk-Modus starten
|
||||
if command -v chromium >/dev/null 2>&1; then
|
||||
BROWSER="chromium"
|
||||
elif command -v chromium-browser >/dev/null 2>&1; then
|
||||
BROWSER="chromium-browser"
|
||||
else
|
||||
BROWSER="firefox-esr"
|
||||
fi
|
||||
|
||||
echo "Starte $BROWSER im Kiosk-Modus..."
|
||||
|
||||
if [[ "$BROWSER" == "chromium"* ]]; then
|
||||
exec $BROWSER \
|
||||
--kiosk \
|
||||
--no-sandbox \
|
||||
--disable-infobars \
|
||||
--disable-session-crashed-bubble \
|
||||
--disable-restore-session-state \
|
||||
--disable-features=TranslateUI \
|
||||
--disable-extensions \
|
||||
--disable-plugins \
|
||||
--disable-popup-blocking \
|
||||
--disable-prompt-on-repost \
|
||||
--disable-sync \
|
||||
--disable-translate \
|
||||
--noerrdialogs \
|
||||
--no-first-run \
|
||||
--no-default-browser-check \
|
||||
--autoplay-policy=no-user-gesture-required \
|
||||
--start-fullscreen \
|
||||
--start-maximized \
|
||||
--user-data-dir=/home/kiosk/.chromium-kiosk \
|
||||
--disable-background-mode \
|
||||
--force-device-scale-factor=1.0 \
|
||||
--disable-pinch \
|
||||
--overscroll-history-navigation=0 \
|
||||
--disable-dev-shm-usage \
|
||||
--memory-pressure-off \
|
||||
--max_old_space_size=512 \
|
||||
--disable-background-timer-throttling \
|
||||
--disable-backgrounding-occluded-windows \
|
||||
--disable-renderer-backgrounding \
|
||||
--disable-features=VizDisplayCompositor \
|
||||
--enable-features=OverlayScrollbar \
|
||||
--hide-scrollbars \
|
||||
--ignore-certificate-errors \
|
||||
--ignore-ssl-errors \
|
||||
--ignore-certificate-errors-spki-list \
|
||||
--disable-web-security \
|
||||
--allow-running-insecure-content \
|
||||
--unsafely-treat-insecure-origin-as-secure=https://localhost:443 \
|
||||
https://localhost:443
|
||||
else
|
||||
exec firefox-esr \
|
||||
--kiosk \
|
||||
https://localhost:443
|
||||
fi
|
||||
fi
|
||||
EOF
|
||||
|
||||
# .xinitrc für X-Server-Konfiguration erstellen
|
||||
cat > "$kiosk_home/.xinitrc" << 'EOF'
|
||||
#!/bin/bash
|
||||
# Minimale X-Session für Kiosk-Modus
|
||||
exec openbox-session
|
||||
EOF
|
||||
|
||||
# Berechtigungen setzen
|
||||
chown "$KIOSK_USER:$KIOSK_USER" "$kiosk_home/.bashrc"
|
||||
chown "$KIOSK_USER:$KIOSK_USER" "$kiosk_home/.xinitrc"
|
||||
chmod +x "$kiosk_home/.xinitrc"
|
||||
|
||||
# Erstelle Kiosk-Verzeichnisse
|
||||
mkdir -p "$kiosk_home/.chromium-kiosk"
|
||||
chown -R "$KIOSK_USER:$KIOSK_USER" "$kiosk_home/.chromium-kiosk"
|
||||
|
||||
log "✅ Automatischer Kiosk-Start konfiguriert"
|
||||
info "Der Kiosk-Modus startet automatisch beim Login des $KIOSK_USER"
|
||||
}
|
||||
|
||||
# =========================== PYTHON & NODE.JS INSTALLATION ===========================
|
||||
install_python_dependencies() {
|
||||
log "=== PYTHON-ABHÄNGIGKEITEN INSTALLATION ==="
|
||||
@ -678,30 +800,24 @@ show_menu() {
|
||||
echo ""
|
||||
echo -e "${YELLOW}Bitte wählen Sie eine Option:${NC}"
|
||||
echo ""
|
||||
echo -e "${GREEN}1)${NC} Nur Abhängigkeiten installieren und System vorbereiten"
|
||||
echo -e " ${BLUE}→ Python, Node.js, SSL-Zertifikate, minimaler Test${NC}"
|
||||
echo -e "${GREEN}1)${NC} Abhängigkeiten installieren und System für manuelles Testen vorbereiten"
|
||||
echo -e " ${BLUE}→ Python, Node.js, SSL-Zertifikate, Anwendung deployed, minimaler Test${NC}"
|
||||
echo -e " ${BLUE}→ System bereit für manuelle Tests und Entwicklung${NC}"
|
||||
echo ""
|
||||
echo -e "${GREEN}2)${NC} Finale Installation mit kompletter Kiosk-Modus-Konfiguration"
|
||||
echo -e " ${BLUE}→ Desktop entfernen, Autologin, Services aktivieren${NC}"
|
||||
echo -e "${GREEN}2)${NC} Vollständige Kiosk-Installation mit Remote-Zugang"
|
||||
echo -e " ${BLUE}→ Komplette Produktionsinstallation mit automatischem Kiosk-Start${NC}"
|
||||
echo -e " ${BLUE}→ RDP (root:744563017196A), SSH (user:raspberry), Firewall${NC}"
|
||||
echo -e " ${BLUE}→ Automatischer Login und Kiosk-Modus beim Boot${NC}"
|
||||
echo ""
|
||||
echo -e "${GREEN}3)${NC} Nur Services installieren/aktualisieren"
|
||||
echo -e " ${BLUE}→ Systemd-Services aus systemd/ Verzeichnis kopieren${NC}"
|
||||
echo ""
|
||||
echo -e "${GREEN}4)${NC} Remote-Zugang konfigurieren (RDP + SSH + Firewall)"
|
||||
echo -e " ${BLUE}→ SSH (user:raspberry), RDP (root:744563017196A), firewalld${NC}"
|
||||
echo ""
|
||||
echo -e "${GREEN}5)${NC} System-Test durchführen"
|
||||
echo -e " ${BLUE}→ HTTPS-Verbindung, SSL-Zertifikat, Remote-Zugang testen${NC}"
|
||||
echo ""
|
||||
echo -e "${GREEN}6)${NC} Beenden"
|
||||
echo -e "${GREEN}3)${NC} Beenden"
|
||||
echo ""
|
||||
echo -e "${CYAN}=================================================================${NC}"
|
||||
echo -n "Ihre Wahl [1-6]: "
|
||||
echo -n "Ihre Wahl [1-3]: "
|
||||
}
|
||||
|
||||
# =========================== INSTALLATIONS-MODI ===========================
|
||||
install_dependencies_only() {
|
||||
log "=== MODUS: NUR ABHÄNGIGKEITEN INSTALLIEREN ==="
|
||||
log "=== MODUS: ABHÄNGIGKEITEN INSTALLIEREN FÜR MANUELLES TESTEN ==="
|
||||
|
||||
check_root
|
||||
check_debian_system
|
||||
@ -730,114 +846,62 @@ install_dependencies_only() {
|
||||
cd "$CURRENT_DIR"
|
||||
|
||||
success "✅ Abhängigkeiten-Installation abgeschlossen!"
|
||||
info "Das System ist bereit für die finale Kiosk-Installation (Option 2)"
|
||||
info "Das System ist bereit für manuelle Tests und Entwicklung"
|
||||
info "HTTPS-Backend kann manuell gestartet werden mit:"
|
||||
info " cd /opt/myp && python3 app.py"
|
||||
}
|
||||
|
||||
install_full_kiosk() {
|
||||
log "=== MODUS: FINALE KIOSK-INSTALLATION ==="
|
||||
|
||||
check_root
|
||||
check_debian_system
|
||||
|
||||
# Führe zuerst Abhängigkeiten-Installation durch (falls noch nicht geschehen)
|
||||
if [ ! -d "$APP_DIR" ] || [ ! -f "$APP_DIR/app.py" ]; then
|
||||
warning "Anwendung noch nicht deployed - führe Abhängigkeiten-Installation durch..."
|
||||
install_dependencies_only
|
||||
fi
|
||||
|
||||
remove_desktop_environments
|
||||
install_minimal_x11
|
||||
create_kiosk_user
|
||||
configure_autologin
|
||||
install_systemd_services
|
||||
enable_and_start_services
|
||||
|
||||
# Frage nach Remote-Zugang
|
||||
echo ""
|
||||
echo -n "Remote-Zugang (RDP + SSH + Firewall) konfigurieren? [j/N]: "
|
||||
read -r configure_remote
|
||||
|
||||
if [[ "$configure_remote" =~ ^[Jj]$ ]]; then
|
||||
install_remote_access
|
||||
configure_firewall
|
||||
fi
|
||||
|
||||
test_application
|
||||
cleanup_old_files
|
||||
|
||||
success "✅ Finale Kiosk-Installation abgeschlossen!"
|
||||
info "Das System wird beim nächsten Neustart automatisch im Kiosk-Modus starten"
|
||||
warning "⚠️ Neustart empfohlen: sudo reboot"
|
||||
}
|
||||
|
||||
install_services_only() {
|
||||
log "=== MODUS: NUR SERVICES INSTALLIEREN ==="
|
||||
|
||||
check_root
|
||||
install_systemd_services
|
||||
|
||||
# Frage ob Services aktiviert werden sollen
|
||||
echo ""
|
||||
echo -n "Services aktivieren und starten? [j/N]: "
|
||||
read -r activate_services
|
||||
|
||||
if [[ "$activate_services" =~ ^[Jj]$ ]]; then
|
||||
enable_and_start_services
|
||||
else
|
||||
info "Services installiert aber nicht aktiviert"
|
||||
info "Manuell aktivieren mit: sudo systemctl enable $HTTPS_SERVICE_NAME"
|
||||
fi
|
||||
|
||||
success "✅ Service-Installation abgeschlossen!"
|
||||
}
|
||||
|
||||
install_remote_access_only() {
|
||||
log "=== MODUS: NUR REMOTE-ZUGANG KONFIGURIEREN ==="
|
||||
install_full_production_system() {
|
||||
log "=== MODUS: VOLLSTÄNDIGE KIOSK-INSTALLATION MIT REMOTE-ZUGANG ==="
|
||||
|
||||
check_root
|
||||
check_debian_system
|
||||
check_internet_connection
|
||||
|
||||
# Führe zuerst Abhängigkeiten-Installation durch (falls noch nicht geschehen)
|
||||
if [ ! -d "$APP_DIR" ] || [ ! -f "$APP_DIR/app.py" ]; then
|
||||
warning "Anwendung noch nicht deployed - führe Abhängigkeiten-Installation durch..."
|
||||
update_system
|
||||
install_python_dependencies
|
||||
install_nodejs_npm
|
||||
install_ssl_certificates
|
||||
install_python_packages
|
||||
deploy_application
|
||||
install_npm_dependencies
|
||||
generate_ssl_certificate
|
||||
fi
|
||||
|
||||
# Desktop-Environments entfernen und minimale X11 installieren
|
||||
remove_desktop_environments
|
||||
install_minimal_x11
|
||||
|
||||
# Remote-Zugang konfigurieren
|
||||
install_remote_access
|
||||
configure_firewall
|
||||
test_remote_access
|
||||
|
||||
success "✅ Remote-Zugang-Konfiguration abgeschlossen!"
|
||||
info "Zugang verfügbar über:"
|
||||
info " 📡 SSH: ssh user@<ip-adresse> (Passwort: raspberry)"
|
||||
info " 🖥️ RDP: <ip-adresse>:3389 (Benutzer: root, Passwort: 744563017196A)"
|
||||
}
|
||||
# Kiosk-Benutzer und Autologin konfigurieren
|
||||
create_kiosk_user
|
||||
configure_autologin
|
||||
configure_kiosk_autostart
|
||||
|
||||
run_system_test() {
|
||||
log "=== MODUS: SYSTEM-TEST ==="
|
||||
# Services installieren und aktivieren
|
||||
install_systemd_services
|
||||
enable_and_start_services
|
||||
|
||||
# System-Test
|
||||
test_application
|
||||
|
||||
# Zusätzliche Tests
|
||||
progress "Prüfe Service-Status..."
|
||||
|
||||
local services=("$HTTPS_SERVICE_NAME" "$KIOSK_SERVICE_NAME" "$WATCHDOG_SERVICE_NAME" "$FIREWALL_SERVICE_NAME")
|
||||
|
||||
for service in "${services[@]}"; do
|
||||
if systemctl is-enabled --quiet "$service" 2>/dev/null; then
|
||||
if systemctl is-active --quiet "$service"; then
|
||||
success "✅ $service: aktiv und läuft"
|
||||
else
|
||||
warning "⚠️ $service: aktiviert aber läuft nicht"
|
||||
fi
|
||||
else
|
||||
info "ℹ️ $service: nicht aktiviert"
|
||||
fi
|
||||
done
|
||||
|
||||
# Remote-Zugang testen (falls konfiguriert)
|
||||
if systemctl is-enabled --quiet ssh 2>/dev/null || systemctl is-enabled --quiet xrdp 2>/dev/null; then
|
||||
test_remote_access
|
||||
else
|
||||
info "ℹ️ Remote-Zugang nicht konfiguriert"
|
||||
fi
|
||||
|
||||
success "✅ System-Test abgeschlossen!"
|
||||
# Aufräumen
|
||||
cleanup_old_files
|
||||
|
||||
success "✅ Vollständige Kiosk-Installation abgeschlossen!"
|
||||
info "Das System ist vollständig konfiguriert:"
|
||||
info " 🖥️ Automatischer Kiosk-Modus beim Boot"
|
||||
info " 📡 SSH: ssh user@<ip> (Passwort: raspberry)"
|
||||
info " 🖥️ RDP: <ip>:3389 (Benutzer: root, Passwort: 744563017196A)"
|
||||
info " 🔒 Firewall: 192.168.0.0/16 + localhost + m040tbaraspi001"
|
||||
warning "⚠️ Neustart erforderlich für automatischen Kiosk-Start: sudo reboot"
|
||||
}
|
||||
|
||||
# =========================== RDP & SSH ZUGANG ===========================
|
||||
@ -967,9 +1031,34 @@ configure_firewall() {
|
||||
|
||||
# Zone definieren
|
||||
firewall-cmd --permanent --new-zone=myp-backend 2>/dev/null || true
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=192.168.0.0/24
|
||||
|
||||
# Nur HTTPS für API & Kiosk zulassen
|
||||
# Erweiterte Netzwerk-Quellen definieren
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=192.168.0.0/16
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=127.0.0.1/32
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=::1/128
|
||||
|
||||
# Lokaler Hostname hinzufügen (falls auflösbar)
|
||||
local local_hostname=$(hostname)
|
||||
if [ -n "$local_hostname" ]; then
|
||||
progress "Füge lokalen Hostname hinzu: $local_hostname"
|
||||
# Versuche IP-Adresse des lokalen Hostnames zu ermitteln
|
||||
local local_ip=$(getent hosts "$local_hostname" | awk '{print $1}' | head -1 2>/dev/null || true)
|
||||
if [ -n "$local_ip" ]; then
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source="$local_ip/32" 2>/dev/null || true
|
||||
fi
|
||||
fi
|
||||
|
||||
# Remote-Hostname m040tbaraspi001 hinzufügen (falls auflösbar)
|
||||
progress "Füge Remote-Hostname hinzu: m040tbaraspi001"
|
||||
local remote_ip=$(getent hosts "m040tbaraspi001" | awk '{print $1}' | head -1 2>/dev/null || true)
|
||||
if [ -n "$remote_ip" ]; then
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source="$remote_ip/32" 2>/dev/null || true
|
||||
log "✅ Remote-Hostname m040tbaraspi001 hinzugefügt: $remote_ip"
|
||||
else
|
||||
info "Remote-Hostname m040tbaraspi001 nicht auflösbar - überspringe"
|
||||
fi
|
||||
|
||||
# HTTPS für API & Kiosk zulassen
|
||||
firewall-cmd --permanent --zone=myp-backend --add-port=443/tcp
|
||||
|
||||
# SSH für Wartung
|
||||
@ -986,13 +1075,15 @@ configure_firewall() {
|
||||
|
||||
# Firewall-Status anzeigen
|
||||
progress "Firewall-Konfiguration:"
|
||||
firewall-cmd --list-all-zones | grep -A 10 "myp-backend" || true
|
||||
firewall-cmd --list-all-zones | grep -A 15 "myp-backend" || true
|
||||
|
||||
log "✅ Firewall konfiguriert:"
|
||||
log " 🔒 Zone: myp-backend (192.168.0.0/24)"
|
||||
log " 🌐 HTTPS: Port 443/tcp"
|
||||
log " 📡 SSH: Port 22/tcp"
|
||||
log " 🖥️ RDP: Port 3389/tcp"
|
||||
log " 🔒 Zone: myp-backend"
|
||||
log " 🌐 Netzwerk: 192.168.0.0/16"
|
||||
log " 🏠 Localhost: 127.0.0.1, ::1"
|
||||
log " 🖥️ Lokaler Host: $local_hostname"
|
||||
log " 📡 Remote Host: m040tbaraspi001"
|
||||
log " 🔌 Ports: 443/tcp (HTTPS), 22/tcp (SSH), 3389/tcp (RDP)"
|
||||
}
|
||||
|
||||
# =========================== REMOTE-ZUGANG TESTEN ===========================
|
||||
@ -1044,6 +1135,150 @@ test_remote_access() {
|
||||
log "✅ Remote-Zugang-Test abgeschlossen"
|
||||
}
|
||||
|
||||
# =========================== NETZWERK-SICHERHEIT ===========================
|
||||
configure_network_security() {
|
||||
log "=== KONFIGURIERE ERWEITERTE NETZWERK-SICHERHEIT ==="
|
||||
|
||||
# IPv6 vollständig deaktivieren
|
||||
progress "Deaktiviere IPv6..."
|
||||
|
||||
# IPv6 in GRUB deaktivieren
|
||||
if [ -f /etc/default/grub ]; then
|
||||
cp /etc/default/grub /etc/default/grub.backup
|
||||
sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT="[^"]*/& ipv6.disable=1/' /etc/default/grub
|
||||
sed -i 's/GRUB_CMDLINE_LINUX="[^"]*/& ipv6.disable=1/' /etc/default/grub
|
||||
update-grub 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# IPv6 in sysctl deaktivieren
|
||||
cat >> /etc/sysctl.conf << 'EOF'
|
||||
|
||||
# ===================================================================
|
||||
# MYP Netzwerk-Sicherheitskonfiguration
|
||||
# ===================================================================
|
||||
|
||||
# IPv6 vollständig deaktivieren
|
||||
net.ipv6.conf.all.disable_ipv6 = 1
|
||||
net.ipv6.conf.default.disable_ipv6 = 1
|
||||
net.ipv6.conf.lo.disable_ipv6 = 1
|
||||
|
||||
# IP-Spoofing-Schutz aktivieren
|
||||
net.ipv4.conf.all.rp_filter = 1
|
||||
net.ipv4.conf.default.rp_filter = 1
|
||||
|
||||
# Source-Routing deaktivieren (verhindert IP-Spoofing)
|
||||
net.ipv4.conf.all.accept_source_route = 0
|
||||
net.ipv4.conf.default.accept_source_route = 0
|
||||
|
||||
# ICMP-Redirects ignorieren (verhindert Man-in-the-Middle)
|
||||
net.ipv4.conf.all.accept_redirects = 0
|
||||
net.ipv4.conf.default.accept_redirects = 0
|
||||
net.ipv4.conf.all.send_redirects = 0
|
||||
|
||||
# Secure ICMP-Redirects ignorieren
|
||||
net.ipv4.conf.all.secure_redirects = 0
|
||||
net.ipv4.conf.default.secure_redirects = 0
|
||||
|
||||
# SYN-Flood-Schutz aktivieren
|
||||
net.ipv4.tcp_syncookies = 1
|
||||
net.ipv4.tcp_max_syn_backlog = 2048
|
||||
net.ipv4.tcp_synack_retries = 2
|
||||
net.ipv4.tcp_syn_retries = 5
|
||||
|
||||
# TCP-RFC-Compliance (verhindert aggressive Paketwiederholungen)
|
||||
net.ipv4.tcp_retries1 = 3
|
||||
net.ipv4.tcp_retries2 = 15
|
||||
net.ipv4.tcp_orphan_retries = 3
|
||||
|
||||
# TCP-Window-Skalierung optimieren (geringere Netzwerkauslastung)
|
||||
net.ipv4.tcp_window_scaling = 1
|
||||
net.ipv4.tcp_rmem = 4096 65536 16777216
|
||||
net.ipv4.tcp_wmem = 4096 65536 16777216
|
||||
net.core.rmem_max = 16777216
|
||||
net.core.wmem_max = 16777216
|
||||
net.core.netdev_max_backlog = 5000
|
||||
|
||||
# Broadcast-Pings ignorieren (verhindert Smurf-Angriffe)
|
||||
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
||||
|
||||
# Bogus ICMP-Antworten ignorieren
|
||||
net.ipv4.icmp_ignore_bogus_error_responses = 1
|
||||
|
||||
# Paketweiterleitung verhindern (Router-Funktionalität deaktivieren)
|
||||
net.ipv4.ip_forward = 0
|
||||
|
||||
# Martian-Pakete loggen (verdächtige Pakete)
|
||||
net.ipv4.conf.all.log_martians = 1
|
||||
net.ipv4.conf.default.log_martians = 1
|
||||
|
||||
# TCP-Timestamps deaktivieren (verhindert Fingerprinting)
|
||||
net.ipv4.tcp_timestamps = 0
|
||||
|
||||
# TCP-SACK deaktivieren (verhindert bestimmte Angriffe)
|
||||
net.ipv4.tcp_sack = 0
|
||||
|
||||
# TCP-Keepalive optimieren
|
||||
net.ipv4.tcp_keepalive_time = 7200
|
||||
net.ipv4.tcp_keepalive_probes = 9
|
||||
net.ipv4.tcp_keepalive_intvl = 75
|
||||
|
||||
# Memory-Limits für Netzwerk-Buffers
|
||||
net.core.rmem_default = 262144
|
||||
net.core.wmem_default = 262144
|
||||
|
||||
# Schutz vor Time-Wait-Assassination
|
||||
net.ipv4.tcp_rfc1337 = 1
|
||||
|
||||
EOF
|
||||
|
||||
# Sysctl-Einstellungen sofort anwenden
|
||||
sysctl -p || warning "Einige sysctl-Einstellungen konnten nicht angewendet werden"
|
||||
|
||||
# IPv6 in Netzwerk-Interfaces deaktivieren
|
||||
progress "Deaktiviere IPv6 in Netzwerk-Interfaces..."
|
||||
|
||||
# Für systemd-networkd
|
||||
if systemctl is-enabled systemd-networkd 2>/dev/null; then
|
||||
mkdir -p /etc/systemd/network
|
||||
cat > /etc/systemd/network/99-disable-ipv6.network << 'EOF'
|
||||
[Match]
|
||||
Name=*
|
||||
|
||||
[Network]
|
||||
IPv6AcceptRA=no
|
||||
LinkLocalAddressing=no
|
||||
EOF
|
||||
systemctl restart systemd-networkd 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# Für NetworkManager
|
||||
if systemctl is-enabled NetworkManager 2>/dev/null; then
|
||||
cat > /etc/NetworkManager/conf.d/99-disable-ipv6.conf << 'EOF'
|
||||
[main]
|
||||
plugins=keyfile
|
||||
|
||||
[keyfile]
|
||||
unmanaged-devices=none
|
||||
|
||||
[connection]
|
||||
ipv6.method=ignore
|
||||
EOF
|
||||
systemctl restart NetworkManager 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# IPv6 in /etc/hosts auskommentieren
|
||||
sed -i 's/^::1/#::1/' /etc/hosts 2>/dev/null || true
|
||||
|
||||
log "✅ Erweiterte Netzwerk-Sicherheit konfiguriert:"
|
||||
log " 🚫 IPv6 vollständig deaktiviert"
|
||||
log " 🛡️ IP-Spoofing-Schutz aktiviert"
|
||||
log " 🔒 SYN-Flood-Schutz aktiviert"
|
||||
log " 📝 Verdächtige Pakete werden geloggt"
|
||||
log " 🚫 Paketweiterleitung deaktiviert"
|
||||
log " ⚡ TCP-Performance optimiert"
|
||||
log " 🔐 RFC-Compliance für TCP aktiviert"
|
||||
}
|
||||
|
||||
# =========================== HAUPTPROGRAMM ===========================
|
||||
main() {
|
||||
# Erstelle Log-Datei
|
||||
@ -1061,35 +1296,17 @@ main() {
|
||||
read -r
|
||||
;;
|
||||
2)
|
||||
install_full_kiosk
|
||||
install_full_production_system
|
||||
echo ""
|
||||
echo -n "Drücken Sie Enter um fortzufahren..."
|
||||
read -r
|
||||
;;
|
||||
3)
|
||||
install_services_only
|
||||
echo ""
|
||||
echo -n "Drücken Sie Enter um fortzufahren..."
|
||||
read -r
|
||||
;;
|
||||
4)
|
||||
install_remote_access_only
|
||||
echo ""
|
||||
echo -n "Drücken Sie Enter um fortzufahren..."
|
||||
read -r
|
||||
;;
|
||||
5)
|
||||
run_system_test
|
||||
echo ""
|
||||
echo -n "Drücken Sie Enter um fortzufahren..."
|
||||
read -r
|
||||
;;
|
||||
6)
|
||||
log "Setup-Skript beendet"
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
error "Ungültige Auswahl. Bitte wählen Sie 1-6."
|
||||
error "Ungültige Auswahl. Bitte wählen Sie 1-3."
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
@ -19,8 +19,26 @@ ExecStart=/bin/bash -c '\
|
||||
# Zone definieren (falls nicht vorhanden) \
|
||||
firewall-cmd --permanent --new-zone=myp-backend 2>/dev/null || true; \
|
||||
\
|
||||
# Quell-Netzwerk definieren \
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=192.168.0.0/24; \
|
||||
# Erweiterte Netzwerk-Quellen definieren \
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=192.168.0.0/16; \
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=127.0.0.1/32; \
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source=::1/128; \
|
||||
\
|
||||
# Lokaler Hostname hinzufügen (falls auflösbar) \
|
||||
LOCAL_HOSTNAME=$(hostname); \
|
||||
if [ -n "$LOCAL_HOSTNAME" ]; then \
|
||||
LOCAL_IP=$(getent hosts "$LOCAL_HOSTNAME" | awk "{print \$1}" | head -1 2>/dev/null || true); \
|
||||
if [ -n "$LOCAL_IP" ]; then \
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source="$LOCAL_IP/32" 2>/dev/null || true; \
|
||||
fi; \
|
||||
fi; \
|
||||
\
|
||||
# Remote-Hostname m040tbaraspi001 hinzufügen (falls auflösbar) \
|
||||
REMOTE_IP=$(getent hosts "m040tbaraspi001" | awk "{print \$1}" | head -1 2>/dev/null || true); \
|
||||
if [ -n "$REMOTE_IP" ]; then \
|
||||
firewall-cmd --permanent --zone=myp-backend --add-source="$REMOTE_IP/32" 2>/dev/null || true; \
|
||||
logger "MYP Firewall: Remote-Hostname m040tbaraspi001 hinzugefügt: $REMOTE_IP"; \
|
||||
fi; \
|
||||
\
|
||||
# HTTPS für API & Kiosk \
|
||||
firewall-cmd --permanent --zone=myp-backend --add-port=443/tcp; \
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user