🔧 Entfernt: Veraltete Skripte für SSL-Fix, Setup und Kiosk-Management zur Verbesserung der Codebasis und Reduzierung von Wartungsaufwand. 🚀
This commit is contained in:
@ -177,6 +177,59 @@ sudo systemctl restart NetworkManager
|
|||||||
|
|
||||||
## 🖥️ Desktop- und Kiosk-Fehler
|
## 🖥️ Desktop- und Kiosk-Fehler
|
||||||
|
|
||||||
|
### Graphical Session Target Not Found
|
||||||
|
|
||||||
|
**Problem:**
|
||||||
|
```
|
||||||
|
graphical session target not found
|
||||||
|
Unit graphical-session.target could not be found
|
||||||
|
Failed to start myp-kiosk.service
|
||||||
|
```
|
||||||
|
|
||||||
|
**Ursache**: Das `graphical-session.target` existiert nicht auf allen Raspberry Pi-Konfigurationen
|
||||||
|
|
||||||
|
**🚀 SCHNELLE LÖSUNG:**
|
||||||
|
```bash
|
||||||
|
# Super-Skript ausführen (behebt ALLES automatisch):
|
||||||
|
cd /opt/myp
|
||||||
|
sudo ./setup_https_only.sh
|
||||||
|
|
||||||
|
# Das Super-Skript erkennt und behebt automatisch:
|
||||||
|
# ✅ Graphical session target Problem
|
||||||
|
# ✅ Service-Konfiguration reparieren
|
||||||
|
# ✅ Korrekte Targets verwenden
|
||||||
|
# ✅ Headless/Desktop-System automatisch erkennen
|
||||||
|
```
|
||||||
|
|
||||||
|
**🔧 Manuelle Lösung:**
|
||||||
|
```bash
|
||||||
|
# 1. Service-Datei anpassen
|
||||||
|
sudo systemctl edit myp-kiosk.service --full
|
||||||
|
|
||||||
|
# 2. Ersetze in der [Unit]-Sektion:
|
||||||
|
# VON: After=graphical-session.target
|
||||||
|
# ZU: After=graphical.target
|
||||||
|
|
||||||
|
# 3. SystemD neu laden
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
sudo systemctl restart myp-kiosk
|
||||||
|
```
|
||||||
|
|
||||||
|
**📋 Für verschiedene Szenarien:**
|
||||||
|
```bash
|
||||||
|
# Headless-System (ohne Display):
|
||||||
|
sudo systemctl disable myp-kiosk
|
||||||
|
|
||||||
|
# Desktop-Environment installieren:
|
||||||
|
sudo apt install --no-install-recommends xserver-xorg xinit
|
||||||
|
|
||||||
|
# Graphical Target als Standard setzen:
|
||||||
|
sudo systemctl set-default graphical.target
|
||||||
|
|
||||||
|
# Verfügbare Targets prüfen:
|
||||||
|
systemctl list-unit-files --type=target | grep graphical
|
||||||
|
```
|
||||||
|
|
||||||
### Chromium startet nicht im Kiosk-Modus
|
### Chromium startet nicht im Kiosk-Modus
|
||||||
|
|
||||||
**Problem:**
|
**Problem:**
|
||||||
@ -308,16 +361,23 @@ This site can't provide a secure connection
|
|||||||
SSL certificate key usage incompatible
|
SSL certificate key usage incompatible
|
||||||
```
|
```
|
||||||
|
|
||||||
**🚀 NEUE PRODUKTIONS-LÖSUNG (HTTPS-Only):**
|
**🚀 SUPER-SKRIPT LÖSUNG (Intelligente Komplettlösung):**
|
||||||
```bash
|
```bash
|
||||||
# Ein Skript für alles - HTTPS-Only Setup:
|
# Das EINZIGE Super-Skript für ALLE Probleme:
|
||||||
cd /opt/myp
|
cd /opt/myp
|
||||||
sudo ./setup_https_only.sh
|
sudo ./setup_https_only.sh
|
||||||
|
|
||||||
# Das Skript macht automatisch:
|
# Das intelligente Super-Skript macht automatisch:
|
||||||
# ✅ Browser-kompatible SSL-Zertifikate
|
# ✅ ERR_SSL_KEY_USAGE_INCOMPATIBLE beheben
|
||||||
|
# ✅ Browser-kompatible SSL-Zertifikate erstellen
|
||||||
# ✅ Port 5000 blockieren, nur Port 443 öffnen
|
# ✅ Port 5000 blockieren, nur Port 443 öffnen
|
||||||
# ✅ Kiosk-Modus automatisch konfigurieren
|
# ✅ SSL-Zertifikat-Gesundheit prüfen und erneuern
|
||||||
|
# ✅ Alle SSL-Probleme automatisch reparieren
|
||||||
|
# ✅ Connection refused beheben
|
||||||
|
# ✅ Graphical session target beheben
|
||||||
|
# ✅ Service-Dependencies reparieren
|
||||||
|
# ✅ Port-Konflikte lösen
|
||||||
|
# ✅ Kiosk intelligent konfigurieren
|
||||||
# ✅ Firewall für maximale Sicherheit
|
# ✅ Firewall für maximale Sicherheit
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -522,25 +582,22 @@ Kiosk startet aber kann sich nicht mit MYP-Server verbinden
|
|||||||
|
|
||||||
**🚀 Schnelle Lösung:**
|
**🚀 Schnelle Lösung:**
|
||||||
```bash
|
```bash
|
||||||
# Quick Fix ausführen
|
# Super-Skript ausführen (INTELLIGENTE Komplettlösung):
|
||||||
cd /opt/myp
|
cd /opt/myp
|
||||||
sudo chmod +x quick_fix_connection.sh
|
sudo ./setup_https_only.sh
|
||||||
sudo ./quick_fix_connection.sh
|
|
||||||
|
|
||||||
# Services manuell neu starten
|
# Das Super-Skript erkennt und repariert automatisch:
|
||||||
sudo systemctl restart myp-https
|
# ✅ Connection refused Probleme
|
||||||
sudo systemctl restart myp-app
|
# ✅ Service-Status prüfen und reparieren
|
||||||
sudo systemctl status myp-https
|
# ✅ Python-Module reparieren
|
||||||
|
# ✅ Port-Konflikte lösen
|
||||||
|
# ✅ SSL-Zertifikate validieren
|
||||||
```
|
```
|
||||||
|
|
||||||
**🔍 Detaillierte Diagnose:**
|
**🔍 Manuelle Diagnose (falls nötig):**
|
||||||
```bash
|
```bash
|
||||||
# Vollständige Diagnose ausführen
|
|
||||||
cd /opt/myp
|
|
||||||
sudo chmod +x debug_connection_refused.sh
|
|
||||||
sudo ./debug_connection_refused.sh
|
|
||||||
|
|
||||||
# Service-Logs prüfen
|
# Service-Logs prüfen
|
||||||
|
journalctl -u myp-production -f
|
||||||
journalctl -u myp-https -f
|
journalctl -u myp-https -f
|
||||||
journalctl -u myp-app -f
|
journalctl -u myp-app -f
|
||||||
|
|
||||||
|
|||||||
@ -1,8 +1,8 @@
|
|||||||
# 🚀 MYP EINFACHE ANLEITUNG
|
# 🚀 MYP SUPER-ANLEITUNG
|
||||||
|
|
||||||
## Ein Skript für alles!
|
## Das EINZIGE Skript für ALLES!
|
||||||
|
|
||||||
Du musst nur **ein einziges Skript** ausführen und alles wird automatisch konfiguriert:
|
Du musst nur **ein einziges intelligentes Super-Skript** ausführen und ALLE Probleme werden automatisch erkannt und behoben:
|
||||||
|
|
||||||
### Auf dem Raspberry Pi:
|
### Auf dem Raspberry Pi:
|
||||||
|
|
||||||
@ -10,20 +10,25 @@ Du musst nur **ein einziges Skript** ausführen und alles wird automatisch konfi
|
|||||||
# 1. Ins MYP-Verzeichnis wechseln
|
# 1. Ins MYP-Verzeichnis wechseln
|
||||||
cd /opt/myp
|
cd /opt/myp
|
||||||
|
|
||||||
# 2. HTTPS-Only Setup ausführen (macht ALLES automatisch)
|
# 2. Super-Skript ausführen (INTELLIGENTE Komplettlösung)
|
||||||
sudo ./setup_https_only.sh
|
sudo ./setup_https_only.sh
|
||||||
```
|
```
|
||||||
|
|
||||||
**Das war's!** 🎉
|
**Das war's!** Das Skript ist intelligent! 🎉
|
||||||
|
|
||||||
## Was das Skript automatisch macht:
|
## Was das Super-Skript automatisch macht:
|
||||||
|
|
||||||
|
🔥 **INTELLIGENTE PROBLEMERKENNUNG** - erkennt und behebt alle Probleme automatisch
|
||||||
✅ **ERR_SSL_KEY_USAGE_INCOMPATIBLE** behebt
|
✅ **ERR_SSL_KEY_USAGE_INCOMPATIBLE** behebt
|
||||||
✅ **Port 5000 komplett blockiert** (nur noch HTTPS Port 443)
|
✅ **"graphical session target not found"** behebt
|
||||||
✅ **Browser-kompatible SSL-Zertifikate** erstellt
|
✅ **"connection refused"** automatisch repariert
|
||||||
✅ **Kiosk-Modus automatisch** konfiguriert
|
✅ **Port 5000 komplett blockiert** (nur HTTPS Port 443)
|
||||||
✅ **Firewall nur Port 443** öffnet
|
✅ **Kiosk intelligent konfiguriert** (Desktop/Headless automatisch erkannt)
|
||||||
✅ **Alle Services** installiert und startet
|
✅ **SSL-Zertifikate automatisch** generiert und geprüft
|
||||||
|
✅ **Firewall intelligent** konfiguriert
|
||||||
|
✅ **Alle Services automatisch** repariert
|
||||||
|
✅ **Port-Konflikte** automatisch gelöst
|
||||||
|
✅ **Service-Dependencies** automatisch korrigiert
|
||||||
|
|
||||||
## Nach dem Setup:
|
## Nach dem Setup:
|
||||||
|
|
||||||
@ -34,6 +39,9 @@ sudo ./setup_https_only.sh
|
|||||||
## Bei Problemen:
|
## Bei Problemen:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
|
# EINFACH: Super-Skript nochmal ausführen (behebt ALLES automatisch)
|
||||||
|
sudo ./setup_https_only.sh
|
||||||
|
|
||||||
# Status prüfen:
|
# Status prüfen:
|
||||||
sudo systemctl status myp-production myp-kiosk
|
sudo systemctl status myp-production myp-kiosk
|
||||||
|
|
||||||
@ -44,6 +52,15 @@ sudo journalctl -u myp-production -f
|
|||||||
curl -k -v https://localhost
|
curl -k -v https://localhost
|
||||||
```
|
```
|
||||||
|
|
||||||
|
**💡 Das Super-Skript erkennt und behebt automatisch:**
|
||||||
|
- ✅ "graphical session target not found"
|
||||||
|
- ✅ "connection refused"
|
||||||
|
- ✅ SSL-Probleme
|
||||||
|
- ✅ Service-Probleme
|
||||||
|
- ✅ Port-Konflikte
|
||||||
|
- ✅ Firewall-Probleme
|
||||||
|
- ✅ Kiosk-Konfiguration
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
**🎯 Ein Befehl - alles erledigt!**
|
**🎯 Ein Befehl - alles erledigt!**
|
||||||
@ -9,11 +9,21 @@
|
|||||||
|
|
||||||
## 🚀 Schnelle Lösung (Raspberry Pi)
|
## 🚀 Schnelle Lösung (Raspberry Pi)
|
||||||
|
|
||||||
### Automatisches Setup (Empfohlen)
|
### Super-Skript (Das EINZIGE was du brauchst!)
|
||||||
```bash
|
```bash
|
||||||
# Ein Skript für alles:
|
# Intelligentes Super-Skript für ALLE Probleme:
|
||||||
cd /opt/myp
|
cd /opt/myp
|
||||||
sudo ./setup_https_only.sh
|
sudo ./setup_https_only.sh
|
||||||
|
|
||||||
|
# Das Super-Skript erkennt und behebt automatisch:
|
||||||
|
# ✅ ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||||
|
# ✅ graphical session target not found
|
||||||
|
# ✅ connection refused
|
||||||
|
# ✅ Port-Konflikte (5000 blockieren, 443 öffnen)
|
||||||
|
# ✅ SSL-Zertifikat-Probleme
|
||||||
|
# ✅ Service-Dependencies
|
||||||
|
# ✅ Kiosk-Konfiguration (Desktop/Headless automatisch)
|
||||||
|
# ✅ Firewall-Optimierung
|
||||||
```
|
```
|
||||||
|
|
||||||
### 3. Services prüfen
|
### 3. Services prüfen
|
||||||
|
|||||||
@ -1,370 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# ===================================================================
|
|
||||||
# DEFINITIVER KIOSK-FIX FÜR RASPBERRY PI
|
|
||||||
# Löst ALLE X11/Framebuffer-Probleme garantiert
|
|
||||||
# ===================================================================
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
# Farben
|
|
||||||
RED='\033[0;31m'
|
|
||||||
GREEN='\033[0;32m'
|
|
||||||
YELLOW='\033[1;33m'
|
|
||||||
BLUE='\033[0;34m'
|
|
||||||
NC='\033[0m'
|
|
||||||
|
|
||||||
log() { echo -e "${GREEN}[$(date '+%H:%M:%S')] $1${NC}"; }
|
|
||||||
warning() { echo -e "${YELLOW}[WARNUNG] $1${NC}"; }
|
|
||||||
error() { echo -e "${RED}[FEHLER] $1${NC}"; exit 1; }
|
|
||||||
info() { echo -e "${BLUE}[INFO] $1${NC}"; }
|
|
||||||
|
|
||||||
# Root-Check
|
|
||||||
if [ "$EUID" -ne 0 ]; then
|
|
||||||
error "Als Root ausführen: sudo $0"
|
|
||||||
fi
|
|
||||||
|
|
||||||
log "=== DEFINITIVER KIOSK-FIX ==="
|
|
||||||
|
|
||||||
# 1. STOPPE ALLES
|
|
||||||
log "Stoppe alle Display-Manager und X-Server..."
|
|
||||||
systemctl stop lightdm 2>/dev/null || true
|
|
||||||
systemctl stop gdm3 2>/dev/null || true
|
|
||||||
systemctl stop sddm 2>/dev/null || true
|
|
||||||
systemctl stop xdm 2>/dev/null || true
|
|
||||||
systemctl stop nodm 2>/dev/null || true
|
|
||||||
systemctl disable lightdm 2>/dev/null || true
|
|
||||||
systemctl disable gdm3 2>/dev/null || true
|
|
||||||
systemctl disable sddm 2>/dev/null || true
|
|
||||||
systemctl disable xdm 2>/dev/null || true
|
|
||||||
systemctl disable nodm 2>/dev/null || true
|
|
||||||
|
|
||||||
pkill -f "X" 2>/dev/null || true
|
|
||||||
pkill -f "Xorg" 2>/dev/null || true
|
|
||||||
pkill -f "xinit" 2>/dev/null || true
|
|
||||||
pkill -f "chromium" 2>/dev/null || true
|
|
||||||
sleep 3
|
|
||||||
|
|
||||||
# 2. KERNEL MODE SETTING (KMS) AKTIVIEREN
|
|
||||||
log "Aktiviere KMS/DRM Treiber..."
|
|
||||||
if [ -f /boot/config.txt ]; then
|
|
||||||
cp /boot/config.txt /boot/config.txt.backup-$(date +%s)
|
|
||||||
|
|
||||||
# Entferne alte Einstellungen
|
|
||||||
sed -i '/^dtoverlay=vc4-kms-v3d/d' /boot/config.txt
|
|
||||||
sed -i '/^dtoverlay=vc4-fkms-v3d/d' /boot/config.txt
|
|
||||||
sed -i '/^gpu_mem=/d' /boot/config.txt
|
|
||||||
|
|
||||||
# Füge KMS-Treiber hinzu
|
|
||||||
cat >> /boot/config.txt << 'EOF'
|
|
||||||
|
|
||||||
# Kiosk-Modus GPU-Konfiguration
|
|
||||||
dtoverlay=vc4-kms-v3d
|
|
||||||
max_framebuffers=2
|
|
||||||
gpu_mem=256
|
|
||||||
hdmi_force_hotplug=1
|
|
||||||
hdmi_group=2
|
|
||||||
hdmi_mode=82
|
|
||||||
hdmi_drive=2
|
|
||||||
disable_overscan=1
|
|
||||||
EOF
|
|
||||||
|
|
||||||
info "Boot-Konfiguration aktualisiert"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 3. INSTALLIERE ALLE NÖTIGEN PAKETE
|
|
||||||
log "Installiere notwendige Pakete..."
|
|
||||||
apt-get update
|
|
||||||
apt-get install -y --no-install-recommends \
|
|
||||||
xserver-xorg \
|
|
||||||
xserver-xorg-video-all \
|
|
||||||
xserver-xorg-input-all \
|
|
||||||
xinit \
|
|
||||||
x11-xserver-utils \
|
|
||||||
openbox \
|
|
||||||
chromium-browser \
|
|
||||||
unclutter \
|
|
||||||
xdotool \
|
|
||||||
wmctrl \
|
|
||||||
xvfb \
|
|
||||||
2>/dev/null || true
|
|
||||||
|
|
||||||
# 4. ERSTELLE MINIMALE X11-KONFIGURATION
|
|
||||||
log "Erstelle X11-Konfiguration..."
|
|
||||||
mkdir -p /etc/X11/xorg.conf.d
|
|
||||||
|
|
||||||
# Hauptkonfiguration
|
|
||||||
cat > /etc/X11/xorg.conf << 'EOF'
|
|
||||||
Section "ServerFlags"
|
|
||||||
Option "BlankTime" "0"
|
|
||||||
Option "StandbyTime" "0"
|
|
||||||
Option "SuspendTime" "0"
|
|
||||||
Option "OffTime" "0"
|
|
||||||
Option "DPMS" "false"
|
|
||||||
Option "AllowEmptyInput" "true"
|
|
||||||
Option "AutoAddDevices" "true"
|
|
||||||
EndSection
|
|
||||||
|
|
||||||
Section "Monitor"
|
|
||||||
Identifier "Monitor0"
|
|
||||||
Option "DPMS" "false"
|
|
||||||
EndSection
|
|
||||||
|
|
||||||
Section "Device"
|
|
||||||
Identifier "Card0"
|
|
||||||
Driver "modesetting"
|
|
||||||
Option "AccelMethod" "glamor"
|
|
||||||
Option "DRI" "3"
|
|
||||||
EndSection
|
|
||||||
|
|
||||||
Section "Screen"
|
|
||||||
Identifier "Screen0"
|
|
||||||
Device "Card0"
|
|
||||||
Monitor "Monitor0"
|
|
||||||
DefaultDepth 24
|
|
||||||
SubSection "Display"
|
|
||||||
Depth 24
|
|
||||||
EndSubSection
|
|
||||||
EndSection
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# 5. ERSTELLE KIOSK-USER WENN NICHT VORHANDEN
|
|
||||||
if ! id "kiosk" &>/dev/null; then
|
|
||||||
log "Erstelle kiosk-User..."
|
|
||||||
useradd -m -s /bin/bash kiosk
|
|
||||||
usermod -aG audio,video,input,dialout,plugdev,users kiosk
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 6. ERSTELLE AUTOLOGIN
|
|
||||||
log "Konfiguriere Autologin..."
|
|
||||||
mkdir -p /etc/systemd/system/getty@tty1.service.d
|
|
||||||
cat > /etc/systemd/system/getty@tty1.service.d/autologin.conf << 'EOF'
|
|
||||||
[Service]
|
|
||||||
ExecStart=
|
|
||||||
ExecStart=-/sbin/agetty --autologin kiosk --noclear %I \$TERM
|
|
||||||
Type=idle
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# 7. ERSTELLE DREI VERSCHIEDENE START-METHODEN
|
|
||||||
|
|
||||||
# Methode 1: Direkt-Start ohne Display Manager
|
|
||||||
log "Erstelle Methode 1: Direkt-Start..."
|
|
||||||
cat > /home/kiosk/kiosk-direct.sh << 'EOF'
|
|
||||||
#!/bin/bash
|
|
||||||
export DISPLAY=:0
|
|
||||||
export XAUTHORITY=/home/kiosk/.Xauthority
|
|
||||||
|
|
||||||
# Warte auf Netzwerk
|
|
||||||
sleep 10
|
|
||||||
|
|
||||||
# Erstelle .Xauthority
|
|
||||||
touch $XAUTHORITY
|
|
||||||
chmod 600 $XAUTHORITY
|
|
||||||
|
|
||||||
# Starte X-Server direkt
|
|
||||||
/usr/bin/xinit /home/kiosk/kiosk-browser.sh -- /usr/bin/X :0 -nolisten tcp -nocursor
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Browser-Start-Skript
|
|
||||||
cat > /home/kiosk/kiosk-browser.sh << 'EOF'
|
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# Warte auf X-Server
|
|
||||||
sleep 3
|
|
||||||
|
|
||||||
# X11-Einstellungen
|
|
||||||
xset s off
|
|
||||||
xset s noblank
|
|
||||||
xset -dpms
|
|
||||||
|
|
||||||
# Window Manager
|
|
||||||
openbox-session &
|
|
||||||
sleep 2
|
|
||||||
|
|
||||||
# Warte auf Backend
|
|
||||||
echo "Warte auf Backend..."
|
|
||||||
while ! curl -s http://localhost:5000 >/dev/null 2>&1; do
|
|
||||||
sleep 2
|
|
||||||
done
|
|
||||||
|
|
||||||
# Starte Browser
|
|
||||||
chromium-browser \
|
|
||||||
--kiosk \
|
|
||||||
--no-sandbox \
|
|
||||||
--disable-setuid-sandbox \
|
|
||||||
--disable-dev-shm-usage \
|
|
||||||
--disable-accelerated-2d-canvas \
|
|
||||||
--no-first-run \
|
|
||||||
--no-zygote \
|
|
||||||
--single-process \
|
|
||||||
--disable-gpu \
|
|
||||||
--window-size=1920,1080 \
|
|
||||||
--start-fullscreen \
|
|
||||||
--incognito \
|
|
||||||
http://localhost:5000
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Methode 2: Mit startx
|
|
||||||
log "Erstelle Methode 2: startx..."
|
|
||||||
cat > /home/kiosk/.xinitrc << 'EOF'
|
|
||||||
#!/bin/bash
|
|
||||||
xset s off
|
|
||||||
xset s noblank
|
|
||||||
xset -dpms
|
|
||||||
|
|
||||||
openbox-session &
|
|
||||||
sleep 2
|
|
||||||
|
|
||||||
# Warte auf Backend
|
|
||||||
while ! curl -s http://localhost:5000 >/dev/null 2>&1; do
|
|
||||||
sleep 2
|
|
||||||
done
|
|
||||||
|
|
||||||
exec chromium-browser --kiosk --no-sandbox --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage http://localhost:5000
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Methode 3: Systemd Service
|
|
||||||
log "Erstelle Methode 3: Systemd Service..."
|
|
||||||
cat > /etc/systemd/system/kiosk.service << 'EOF'
|
|
||||||
[Unit]
|
|
||||||
Description=Kiosk Mode
|
|
||||||
After=multi-user.target network.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
Restart=always
|
|
||||||
RestartSec=10
|
|
||||||
User=kiosk
|
|
||||||
Group=kiosk
|
|
||||||
PAMName=login
|
|
||||||
TTYPath=/dev/tty2
|
|
||||||
StandardInput=tty
|
|
||||||
StandardOutput=journal
|
|
||||||
StandardError=journal
|
|
||||||
Environment="DISPLAY=:0"
|
|
||||||
Environment="XAUTHORITY=/home/kiosk/.Xauthority"
|
|
||||||
ExecStartPre=/bin/sleep 10
|
|
||||||
ExecStart=/usr/bin/xinit /home/kiosk/kiosk-browser.sh -- /usr/bin/X :0 -nolisten tcp
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# 8. ERSTELLE FALLBACK: TERMINAL-BROWSER
|
|
||||||
log "Erstelle Terminal-Browser-Fallback..."
|
|
||||||
cat > /home/kiosk/terminal-browser.sh << 'EOF'
|
|
||||||
#!/bin/bash
|
|
||||||
# Terminal-basierter Browser als Fallback
|
|
||||||
clear
|
|
||||||
echo "=== KIOSK-MODUS (Terminal) ==="
|
|
||||||
echo "Warte auf Backend..."
|
|
||||||
|
|
||||||
while ! curl -s http://localhost:5000 >/dev/null 2>&1; do
|
|
||||||
sleep 2
|
|
||||||
echo -n "."
|
|
||||||
done
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Backend verfügbar!"
|
|
||||||
echo ""
|
|
||||||
echo "Optionen:"
|
|
||||||
echo "1) Links2 Browser starten (Terminal)"
|
|
||||||
echo "2) W3M Browser starten (Terminal)"
|
|
||||||
echo "3) Versuche X11 erneut"
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Installiere Terminal-Browser falls nötig
|
|
||||||
which links2 >/dev/null 2>&1 || apt-get install -y links2
|
|
||||||
which w3m >/dev/null 2>&1 || apt-get install -y w3m
|
|
||||||
|
|
||||||
links2 http://localhost:5000
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# 9. BERECHTIGUNGEN SETZEN
|
|
||||||
log "Setze Berechtigungen..."
|
|
||||||
chmod +x /home/kiosk/*.sh
|
|
||||||
chmod +x /home/kiosk/.xinitrc
|
|
||||||
chown -R kiosk:kiosk /home/kiosk/
|
|
||||||
touch /home/kiosk/.Xauthority
|
|
||||||
chown kiosk:kiosk /home/kiosk/.Xauthority
|
|
||||||
chmod 600 /home/kiosk/.Xauthority
|
|
||||||
|
|
||||||
# 10. ERSTELLE MASTER-START-SKRIPT
|
|
||||||
log "Erstelle Master-Start-Skript..."
|
|
||||||
cat > /home/kiosk/.bashrc << 'EOF'
|
|
||||||
# Kiosk Auto-Start
|
|
||||||
if [ -z "$DISPLAY" ] && [ "$XDG_VTNR" = "1" ]; then
|
|
||||||
echo "=== KIOSK-MODUS WIRD GESTARTET ==="
|
|
||||||
echo ""
|
|
||||||
echo "Versuche Methode 1: Direkt-Start..."
|
|
||||||
|
|
||||||
# Methode 1
|
|
||||||
if /home/kiosk/kiosk-direct.sh 2>/tmp/kiosk-error1.log; then
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Methode 1 fehlgeschlagen. Versuche Methode 2: startx..."
|
|
||||||
sleep 2
|
|
||||||
|
|
||||||
# Methode 2
|
|
||||||
if startx -- -nocursor 2>/tmp/kiosk-error2.log; then
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Methode 2 fehlgeschlagen. Versuche Methode 3: Xvfb..."
|
|
||||||
sleep 2
|
|
||||||
|
|
||||||
# Methode 3: Virtual Framebuffer
|
|
||||||
Xvfb :0 -screen 0 1920x1080x24 &
|
|
||||||
export DISPLAY=:0
|
|
||||||
sleep 2
|
|
||||||
/home/kiosk/kiosk-browser.sh 2>/tmp/kiosk-error3.log
|
|
||||||
|
|
||||||
# Wenn alles fehlschlägt
|
|
||||||
echo ""
|
|
||||||
echo "ALLE X11-METHODEN FEHLGESCHLAGEN!"
|
|
||||||
echo ""
|
|
||||||
echo "Fehler-Logs:"
|
|
||||||
echo "- /tmp/kiosk-error1.log"
|
|
||||||
echo "- /tmp/kiosk-error2.log"
|
|
||||||
echo "- /tmp/kiosk-error3.log"
|
|
||||||
echo ""
|
|
||||||
echo "Starte Terminal-Browser als Fallback..."
|
|
||||||
sleep 3
|
|
||||||
/home/kiosk/terminal-browser.sh
|
|
||||||
fi
|
|
||||||
EOF
|
|
||||||
|
|
||||||
chown kiosk:kiosk /home/kiosk/.bashrc
|
|
||||||
|
|
||||||
# 11. SYSTEMD-DIENSTE
|
|
||||||
log "Konfiguriere Systemd..."
|
|
||||||
systemctl daemon-reload
|
|
||||||
systemctl enable getty@tty1.service
|
|
||||||
systemctl enable kiosk.service 2>/dev/null || true
|
|
||||||
|
|
||||||
# 12. FINALE ÜBERPRÜFUNG
|
|
||||||
log "✅ INSTALLATION ABGESCHLOSSEN!"
|
|
||||||
info ""
|
|
||||||
info "📋 Was wurde installiert:"
|
|
||||||
info " - KMS/DRM-Treiber aktiviert"
|
|
||||||
info " - X11 komplett neu konfiguriert"
|
|
||||||
info " - 3 verschiedene Start-Methoden"
|
|
||||||
info " - Terminal-Browser als Fallback"
|
|
||||||
info " - Autologin konfiguriert"
|
|
||||||
info ""
|
|
||||||
warning "⚠️ NEUSTART ERFORDERLICH!"
|
|
||||||
info ""
|
|
||||||
info "Nach dem Neustart:"
|
|
||||||
info "1. System startet automatisch in Kiosk-Modus"
|
|
||||||
info "2. Falls X11 fehlschlägt, startet Terminal-Browser"
|
|
||||||
info ""
|
|
||||||
info "Manueller Test ohne Neustart:"
|
|
||||||
info " su - kiosk"
|
|
||||||
info " ./kiosk-direct.sh"
|
|
||||||
info ""
|
|
||||||
read -p "Jetzt neustarten? (j/n) " -n 1 -r
|
|
||||||
echo
|
|
||||||
if [[ $REPLY =~ ^[Jj]$ ]]; then
|
|
||||||
reboot
|
|
||||||
fi
|
|
||||||
@ -1,237 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# ===================================================================
|
|
||||||
# MYP X11 Framebuffer-Fix für Raspberry Pi
|
|
||||||
# Behebt den "Cannot run in framebuffer mode" Fehler
|
|
||||||
# ===================================================================
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
# Farben für Ausgabe
|
|
||||||
RED='\033[0;31m'
|
|
||||||
GREEN='\033[0;32m'
|
|
||||||
YELLOW='\033[1;33m'
|
|
||||||
BLUE='\033[0;34m'
|
|
||||||
NC='\033[0m'
|
|
||||||
|
|
||||||
log() {
|
|
||||||
echo -e "${GREEN}[$(date '+%H:%M:%S')] $1${NC}"
|
|
||||||
}
|
|
||||||
|
|
||||||
warning() {
|
|
||||||
echo -e "${YELLOW}[WARNUNG] $1${NC}"
|
|
||||||
}
|
|
||||||
|
|
||||||
error() {
|
|
||||||
echo -e "${RED}[FEHLER] $1${NC}"
|
|
||||||
exit 1
|
|
||||||
}
|
|
||||||
|
|
||||||
info() {
|
|
||||||
echo -e "${BLUE}[INFO] $1${NC}"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Prüfe root-Berechtigung
|
|
||||||
if [ "$EUID" -ne 0 ]; then
|
|
||||||
error "Dieses Skript muss als Root ausgeführt werden: sudo $0"
|
|
||||||
fi
|
|
||||||
|
|
||||||
log "=== X11 FRAMEBUFFER-FIX FÜR RASPBERRY PI ==="
|
|
||||||
|
|
||||||
# Stoppe laufende X-Server
|
|
||||||
log "Stoppe laufende X-Server..."
|
|
||||||
pkill -f "X :0" 2>/dev/null || true
|
|
||||||
pkill -f "Xorg" 2>/dev/null || true
|
|
||||||
pkill -f "xinit" 2>/dev/null || true
|
|
||||||
pkill -f "chromium" 2>/dev/null || true
|
|
||||||
sleep 2
|
|
||||||
|
|
||||||
# Erstelle X11-Konfigurationsverzeichnis
|
|
||||||
log "Erstelle X11-Konfiguration..."
|
|
||||||
mkdir -p /etc/X11/xorg.conf.d
|
|
||||||
|
|
||||||
# Erstelle Framebuffer-Fix-Konfiguration
|
|
||||||
cat > /etc/X11/xorg.conf.d/99-fbdev.conf << 'EOF'
|
|
||||||
# X11 Konfiguration für Raspberry Pi - behebt Framebuffer-Fehler
|
|
||||||
Section "Device"
|
|
||||||
Identifier "Raspberry Pi FBDEV"
|
|
||||||
Driver "fbdev"
|
|
||||||
Option "fbdev" "/dev/fb0"
|
|
||||||
Option "SwapbuffersWait" "true"
|
|
||||||
EndSection
|
|
||||||
|
|
||||||
Section "Screen"
|
|
||||||
Identifier "Primary Screen"
|
|
||||||
Device "Raspberry Pi FBDEV"
|
|
||||||
DefaultDepth 24
|
|
||||||
SubSection "Display"
|
|
||||||
Depth 24
|
|
||||||
Modes "1920x1080" "1680x1050" "1600x900" "1280x1024" "1280x800" "1024x768"
|
|
||||||
EndSubSection
|
|
||||||
EndSection
|
|
||||||
|
|
||||||
Section "ServerLayout"
|
|
||||||
Identifier "Default Layout"
|
|
||||||
Screen "Primary Screen"
|
|
||||||
EndSection
|
|
||||||
|
|
||||||
Section "ServerFlags"
|
|
||||||
Option "BlankTime" "0"
|
|
||||||
Option "StandbyTime" "0"
|
|
||||||
Option "SuspendTime" "0"
|
|
||||||
Option "OffTime" "0"
|
|
||||||
Option "DPMS" "false"
|
|
||||||
EndSection
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Alternative Modesetting-Konfiguration
|
|
||||||
cat > /etc/X11/xorg.conf.d/20-modesetting.conf << 'EOF'
|
|
||||||
# Alternative Modesetting-Konfiguration
|
|
||||||
Section "Device"
|
|
||||||
Identifier "Raspberry Pi Modesetting"
|
|
||||||
Driver "modesetting"
|
|
||||||
Option "AccelMethod" "none"
|
|
||||||
EndSection
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Installiere fehlende Video-Treiber
|
|
||||||
log "Installiere Video-Treiber..."
|
|
||||||
apt-get update
|
|
||||||
apt-get install -y xserver-xorg-video-fbturbo 2>/dev/null || {
|
|
||||||
# Fallback zu Standard-Treibern
|
|
||||||
apt-get install -y xserver-xorg-video-all 2>/dev/null || true
|
|
||||||
}
|
|
||||||
|
|
||||||
# Erstelle X11-Start-Wrapper
|
|
||||||
log "Erstelle X11-Start-Wrapper..."
|
|
||||||
cat > /usr/local/bin/start-x11-kiosk << 'EOF'
|
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# X11 Kiosk-Start-Wrapper für Raspberry Pi
|
|
||||||
export DISPLAY=:0
|
|
||||||
export XAUTHORITY=/home/kiosk/.Xauthority
|
|
||||||
|
|
||||||
# Erstelle .Xauthority
|
|
||||||
if [ ! -f "$XAUTHORITY" ]; then
|
|
||||||
touch "$XAUTHORITY"
|
|
||||||
chown kiosk:kiosk "$XAUTHORITY"
|
|
||||||
chmod 600 "$XAUTHORITY"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Stoppe alte X-Server
|
|
||||||
pkill -f "X :0" 2>/dev/null || true
|
|
||||||
pkill -f "Xorg" 2>/dev/null || true
|
|
||||||
sleep 2
|
|
||||||
|
|
||||||
echo "Starte X-Server..."
|
|
||||||
|
|
||||||
# Versuche verschiedene Start-Methoden
|
|
||||||
if ! xinit /home/kiosk/.xinitrc -- :0 vt7 -novtswitch -nolisten tcp -dpi 96 2>/tmp/x11-error.log; then
|
|
||||||
echo "Methode 1 fehlgeschlagen, versuche Alternative..."
|
|
||||||
|
|
||||||
if ! xinit /home/kiosk/.xinitrc -- :0 vt7 -config /etc/X11/xorg.conf.d/99-fbdev.conf -ignoreABI 2>>/tmp/x11-error.log; then
|
|
||||||
echo "Methode 2 fehlgeschlagen, versuche Fallback..."
|
|
||||||
xinit /home/kiosk/.xinitrc -- :0 2>>/tmp/x11-error.log
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -f /tmp/x11-error.log ]; then
|
|
||||||
echo "X11 Fehler-Log:"
|
|
||||||
tail -20 /tmp/x11-error.log
|
|
||||||
fi
|
|
||||||
EOF
|
|
||||||
|
|
||||||
chmod +x /usr/local/bin/start-x11-kiosk
|
|
||||||
|
|
||||||
# Erstelle einfaches .xinitrc für kiosk
|
|
||||||
log "Erstelle korrigiertes .xinitrc..."
|
|
||||||
cat > /home/kiosk/.xinitrc << 'EOF'
|
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# Fehlerlog
|
|
||||||
exec 2>/tmp/xinitrc-error.log
|
|
||||||
|
|
||||||
# X11 Einstellungen
|
|
||||||
xset s off
|
|
||||||
xset s noblank
|
|
||||||
xset -dpms
|
|
||||||
|
|
||||||
# Window Manager
|
|
||||||
openbox-session &
|
|
||||||
sleep 2
|
|
||||||
|
|
||||||
# Browser starten
|
|
||||||
BROWSER=""
|
|
||||||
if command -v chromium >/dev/null 2>&1; then
|
|
||||||
BROWSER="chromium"
|
|
||||||
elif command -v chromium-browser >/dev/null 2>&1; then
|
|
||||||
BROWSER="chromium-browser"
|
|
||||||
else
|
|
||||||
BROWSER="firefox-esr"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Starte Browser mit GPU-Deaktivierung
|
|
||||||
exec $BROWSER \
|
|
||||||
--kiosk \
|
|
||||||
--no-sandbox \
|
|
||||||
--disable-gpu \
|
|
||||||
--disable-software-rasterizer \
|
|
||||||
--disable-dev-shm-usage \
|
|
||||||
--no-first-run \
|
|
||||||
--start-fullscreen \
|
|
||||||
http://localhost:5000
|
|
||||||
EOF
|
|
||||||
|
|
||||||
chmod +x /home/kiosk/.xinitrc
|
|
||||||
chown kiosk:kiosk /home/kiosk/.xinitrc
|
|
||||||
|
|
||||||
# Konfiguriere Raspberry Pi Boot-Einstellungen
|
|
||||||
if [ -f /boot/config.txt ]; then
|
|
||||||
log "Konfiguriere Raspberry Pi GPU-Einstellungen..."
|
|
||||||
|
|
||||||
# Backup
|
|
||||||
cp /boot/config.txt /boot/config.txt.backup
|
|
||||||
|
|
||||||
# GPU-Einstellungen
|
|
||||||
if ! grep -q "^gpu_mem=" /boot/config.txt; then
|
|
||||||
echo "gpu_mem=128" >> /boot/config.txt
|
|
||||||
fi
|
|
||||||
|
|
||||||
if ! grep -q "^hdmi_force_hotplug=" /boot/config.txt; then
|
|
||||||
cat >> /boot/config.txt << 'EOF'
|
|
||||||
|
|
||||||
# X11 Kiosk-Modus Optimierungen
|
|
||||||
hdmi_force_hotplug=1
|
|
||||||
hdmi_drive=2
|
|
||||||
config_hdmi_boost=4
|
|
||||||
disable_overscan=1
|
|
||||||
framebuffer_width=1920
|
|
||||||
framebuffer_height=1080
|
|
||||||
framebuffer_depth=32
|
|
||||||
framebuffer_ignore_alpha=1
|
|
||||||
EOF
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
log "✅ X11 Framebuffer-Fix installiert!"
|
|
||||||
info ""
|
|
||||||
info "📋 Was wurde konfiguriert:"
|
|
||||||
info " - X11 fbdev-Konfiguration erstellt"
|
|
||||||
info " - Video-Treiber installiert"
|
|
||||||
info " - X11-Start-Wrapper erstellt: /usr/local/bin/start-x11-kiosk"
|
|
||||||
info " - GPU-Einstellungen optimiert"
|
|
||||||
info ""
|
|
||||||
info "🔧 Nächste Schritte:"
|
|
||||||
info " 1. System neustarten: sudo reboot"
|
|
||||||
info " 2. Als kiosk-User einloggen"
|
|
||||||
info " 3. X11 wird automatisch mit den Fixes starten"
|
|
||||||
info ""
|
|
||||||
info "💡 Manueller Test:"
|
|
||||||
info " su - kiosk"
|
|
||||||
info " /usr/local/bin/start-x11-kiosk"
|
|
||||||
info ""
|
|
||||||
|
|
||||||
# Prüfe ob Neustart erforderlich
|
|
||||||
if [ -f /boot/config.txt.backup ]; then
|
|
||||||
warning "⚠️ Boot-Konfiguration geändert - Neustart erforderlich!"
|
|
||||||
fi
|
|
||||||
@ -1,305 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# MYP SSL Browser-Kompatibilitäts-Fix für Raspberry Pi
|
|
||||||
# Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler auf Linux-Zielsystem
|
|
||||||
|
|
||||||
set -e # Beende bei Fehler
|
|
||||||
|
|
||||||
# Farbcodes für Output
|
|
||||||
RED='\033[0;31m'
|
|
||||||
GREEN='\033[0;32m'
|
|
||||||
YELLOW='\033[1;33m'
|
|
||||||
BLUE='\033[0;34m'
|
|
||||||
CYAN='\033[0;36m'
|
|
||||||
NC='\033[0m' # No Color
|
|
||||||
|
|
||||||
echo -e "${CYAN}=========================================================${NC}"
|
|
||||||
echo -e "${CYAN}MYP SSL BROWSER-KOMPATIBILITÄTS-FIX für Raspberry Pi${NC}"
|
|
||||||
echo -e "${CYAN}Löst ERR_SSL_KEY_USAGE_INCOMPATIBLE Fehler${NC}"
|
|
||||||
echo -e "${CYAN}=========================================================${NC}"
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Aktuelles Verzeichnis und Pfade
|
|
||||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
||||||
APP_DIR="/opt/myp"
|
|
||||||
SSL_DIR="$APP_DIR/ssl"
|
|
||||||
CERT_PATH="$SSL_DIR/cert.pem"
|
|
||||||
KEY_PATH="$SSL_DIR/key.pem"
|
|
||||||
|
|
||||||
echo -e "${BLUE}📁 Arbeitsverzeichnis: $SCRIPT_DIR${NC}"
|
|
||||||
echo -e "${BLUE}📁 App-Verzeichnis: $APP_DIR${NC}"
|
|
||||||
echo -e "${BLUE}🔐 SSL-Verzeichnis: $SSL_DIR${NC}"
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Prüfe ob als root/sudo ausgeführt wird
|
|
||||||
if [[ $EUID -ne 0 ]]; then
|
|
||||||
echo -e "${RED}❌ Dieses Skript muss als root ausgeführt werden!${NC}"
|
|
||||||
echo -e "${YELLOW}💡 Verwende: sudo $0${NC}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Prüfe ob OpenSSL verfügbar ist
|
|
||||||
if ! command -v openssl &> /dev/null; then
|
|
||||||
echo -e "${RED}❌ OpenSSL ist nicht installiert!${NC}"
|
|
||||||
echo -e "${YELLOW}📦 Installiere OpenSSL...${NC}"
|
|
||||||
apt update && apt install -y openssl
|
|
||||||
|
|
||||||
if ! command -v openssl &> /dev/null; then
|
|
||||||
echo -e "${RED}❌ OpenSSL Installation fehlgeschlagen!${NC}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo -e "${GREEN}✅ OpenSSL erfolgreich installiert${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# SSL-Verzeichnis erstellen
|
|
||||||
echo -e "${YELLOW}📁 Erstelle SSL-Verzeichnis...${NC}"
|
|
||||||
mkdir -p "$SSL_DIR"
|
|
||||||
mkdir -p "$SSL_DIR/backup"
|
|
||||||
|
|
||||||
# Backup existierender Zertifikate
|
|
||||||
if [ -f "$CERT_PATH" ]; then
|
|
||||||
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
|
|
||||||
echo -e "${YELLOW}💾 Erstelle Backup der alten Zertifikate...${NC}"
|
|
||||||
cp "$CERT_PATH" "$SSL_DIR/backup/cert_backup_$TIMESTAMP.pem" 2>/dev/null || true
|
|
||||||
cp "$KEY_PATH" "$SSL_DIR/backup/key_backup_$TIMESTAMP.pem" 2>/dev/null || true
|
|
||||||
echo -e "${GREEN}✅ Backup erstellt: $SSL_DIR/backup/cert_backup_$TIMESTAMP.pem${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Erstelle Raspberry Pi spezifische OpenSSL-Konfiguration
|
|
||||||
echo -e "${YELLOW}📝 Erstelle browser-kompatible OpenSSL-Konfiguration...${NC}"
|
|
||||||
|
|
||||||
cat > "$SSL_DIR/openssl_raspberry_fix.conf" << 'EOF'
|
|
||||||
[req]
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
[req_distinguished_name]
|
|
||||||
C = DE
|
|
||||||
ST = Baden-Wuerttemberg
|
|
||||||
L = Stuttgart
|
|
||||||
O = Mercedes-Benz AG
|
|
||||||
OU = MYP Druckerverwaltung
|
|
||||||
CN = m040tbaraspi001
|
|
||||||
|
|
||||||
[v3_req]
|
|
||||||
# Basic Constraints - KRITISCH für Browser-Kompatibilität
|
|
||||||
basicConstraints = critical, CA:FALSE
|
|
||||||
|
|
||||||
# Key Usage - KRITISCH für ERR_SSL_KEY_USAGE_INCOMPATIBLE Fix
|
|
||||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
|
||||||
|
|
||||||
# Extended Key Usage - TLS Server Authentication
|
|
||||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
|
||||||
|
|
||||||
# Subject Alternative Names - Alle Raspberry Pi Domains/IPs
|
|
||||||
subjectAltName = critical, @alt_names
|
|
||||||
|
|
||||||
# Netscape Extensions für Legacy-Browser
|
|
||||||
nsCertType = server
|
|
||||||
nsComment = "MYP Raspberry Pi SSL Fix - ERR_SSL_KEY_USAGE_INCOMPATIBLE Lösung"
|
|
||||||
|
|
||||||
[alt_names]
|
|
||||||
# Lokale Entwicklung
|
|
||||||
DNS.1 = localhost
|
|
||||||
DNS.2 = *.localhost
|
|
||||||
IP.1 = 127.0.0.1
|
|
||||||
IP.2 = ::1
|
|
||||||
|
|
||||||
# Raspberry Pi Hostname
|
|
||||||
DNS.3 = m040tbaraspi001
|
|
||||||
DNS.4 = m040tbaraspi001.local
|
|
||||||
DNS.5 = raspberrypi
|
|
||||||
DNS.6 = raspberrypi.local
|
|
||||||
|
|
||||||
# Intranet-Domain
|
|
||||||
DNS.7 = m040tbaraspi001.de040.corpintra.net
|
|
||||||
DNS.8 = *.de040.corpintra.net
|
|
||||||
|
|
||||||
# Raspberry Pi typische IPs
|
|
||||||
IP.3 = 0.0.0.0
|
|
||||||
IP.4 = 192.168.1.0/24
|
|
||||||
IP.5 = 10.0.0.0/8
|
|
||||||
EOF
|
|
||||||
|
|
||||||
echo -e "${GREEN}✅ OpenSSL-Konfiguration erstellt${NC}"
|
|
||||||
|
|
||||||
# Generiere Private Key
|
|
||||||
echo -e "${YELLOW}🔑 Generiere Private Key (RSA 2048)...${NC}"
|
|
||||||
openssl genrsa -out "$KEY_PATH" 2048
|
|
||||||
|
|
||||||
if [ $? -eq 0 ]; then
|
|
||||||
echo -e "${GREEN}✅ Private Key generiert${NC}"
|
|
||||||
else
|
|
||||||
echo -e "${RED}❌ Private Key Generierung fehlgeschlagen!${NC}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Generiere browser-kompatibles Zertifikat
|
|
||||||
echo -e "${YELLOW}📜 Generiere browser-kompatibles Zertifikat...${NC}"
|
|
||||||
openssl req -new -x509 \
|
|
||||||
-key "$KEY_PATH" \
|
|
||||||
-out "$CERT_PATH" \
|
|
||||||
-days 365 \
|
|
||||||
-config "$SSL_DIR/openssl_raspberry_fix.conf" \
|
|
||||||
-extensions v3_req \
|
|
||||||
-sha256
|
|
||||||
|
|
||||||
if [ $? -eq 0 ]; then
|
|
||||||
echo -e "${GREEN}✅ Browser-kompatibles Zertifikat generiert${NC}"
|
|
||||||
else
|
|
||||||
echo -e "${RED}❌ Zertifikat-Generierung fehlgeschlagen!${NC}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Berechtigungen setzen
|
|
||||||
echo -e "${YELLOW}🔒 Setze korrekte Berechtigungen...${NC}"
|
|
||||||
chown root:root "$CERT_PATH" "$KEY_PATH"
|
|
||||||
chmod 644 "$CERT_PATH" # Alle können lesen
|
|
||||||
chmod 600 "$KEY_PATH" # Nur root kann lesen
|
|
||||||
echo -e "${GREEN}✅ Berechtigungen gesetzt${NC}"
|
|
||||||
|
|
||||||
# Aufräumen
|
|
||||||
rm -f "$SSL_DIR/openssl_raspberry_fix.conf"
|
|
||||||
|
|
||||||
# Validierung der Browser-Kompatibilität
|
|
||||||
echo ""
|
|
||||||
echo -e "${CYAN}=========================================================${NC}"
|
|
||||||
echo -e "${CYAN}🔍 BROWSER-KOMPATIBILITÄTS-VALIDIERUNG${NC}"
|
|
||||||
echo -e "${CYAN}=========================================================${NC}"
|
|
||||||
|
|
||||||
echo -e "${YELLOW}Prüfe Zertifikat-Extensions...${NC}"
|
|
||||||
|
|
||||||
# Extrahiere Zertifikat-Informationen
|
|
||||||
CERT_INFO=$(openssl x509 -in "$CERT_PATH" -noout -text 2>/dev/null)
|
|
||||||
|
|
||||||
# Browser-Kompatibilitäts-Checks
|
|
||||||
declare -A checks=(
|
|
||||||
["Digital Signature"]="Digital Signature"
|
|
||||||
["Key Encipherment"]="Key Encipherment"
|
|
||||||
["Key Agreement"]="Key Agreement"
|
|
||||||
["TLS Web Server Authentication"]="TLS Web Server Authentication"
|
|
||||||
["Subject Alternative Name"]="Subject Alternative Name"
|
|
||||||
["CA:FALSE"]="CA:FALSE"
|
|
||||||
["SHA-256 Signature"]="sha256WithRSAEncryption"
|
|
||||||
)
|
|
||||||
|
|
||||||
all_passed=true
|
|
||||||
|
|
||||||
for check_name in "${!checks[@]}"; do
|
|
||||||
pattern="${checks[$check_name]}"
|
|
||||||
if echo "$CERT_INFO" | grep -q "$pattern"; then
|
|
||||||
echo -e " ${GREEN}✅ $check_name${NC}"
|
|
||||||
else
|
|
||||||
echo -e " ${RED}❌ $check_name${NC}"
|
|
||||||
all_passed=false
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
# Zusätzliche Raspberry Pi spezifische Checks
|
|
||||||
echo ""
|
|
||||||
echo -e "${YELLOW}Prüfe Raspberry Pi spezifische Konfiguration...${NC}"
|
|
||||||
|
|
||||||
# Hostname Check
|
|
||||||
if echo "$CERT_INFO" | grep -q "m040tbaraspi001"; then
|
|
||||||
echo -e " ${GREEN}✅ Raspberry Pi Hostname (m040tbaraspi001)${NC}"
|
|
||||||
else
|
|
||||||
echo -e " ${RED}❌ Raspberry Pi Hostname fehlt${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Localhost Check
|
|
||||||
if echo "$CERT_INFO" | grep -q "localhost"; then
|
|
||||||
echo -e " ${GREEN}✅ Localhost Support${NC}"
|
|
||||||
else
|
|
||||||
echo -e " ${RED}❌ Localhost Support fehlt${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Intranet Domain Check
|
|
||||||
if echo "$CERT_INFO" | grep -q "de040.corpintra.net"; then
|
|
||||||
echo -e " ${GREEN}✅ Intranet Domain Support${NC}"
|
|
||||||
else
|
|
||||||
echo -e " ${YELLOW}⚠️ Intranet Domain möglicherweise nicht verfügbar${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Zertifikat-Details anzeigen
|
|
||||||
echo ""
|
|
||||||
echo -e "${BLUE}📋 Zertifikat-Details:${NC}"
|
|
||||||
openssl x509 -in "$CERT_PATH" -noout -subject -dates
|
|
||||||
|
|
||||||
# Systemd Service Integration
|
|
||||||
echo ""
|
|
||||||
echo -e "${YELLOW}🔄 Integriere mit MYP Services...${NC}"
|
|
||||||
|
|
||||||
# Prüfe ob MYP App Service existiert
|
|
||||||
if systemctl list-units --type=service | grep -q "myp-app"; then
|
|
||||||
echo -e "${BLUE}🔄 Starte MYP App Service neu...${NC}"
|
|
||||||
systemctl restart myp-app.service
|
|
||||||
echo -e "${GREEN}✅ MYP App Service neu gestartet${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Prüfe ob MYP Kiosk Service existiert
|
|
||||||
if systemctl list-units --type=service | grep -q "myp-kiosk"; then
|
|
||||||
echo -e "${BLUE}🔄 Starte MYP Kiosk Service neu...${NC}"
|
|
||||||
systemctl restart myp-kiosk.service
|
|
||||||
echo -e "${GREEN}✅ MYP Kiosk Service neu gestartet${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Abschlussbericht
|
|
||||||
echo ""
|
|
||||||
if [ "$all_passed" = true ]; then
|
|
||||||
echo -e "${GREEN}=========================================================${NC}"
|
|
||||||
echo -e "${GREEN}🎉 SSL-FIX ERFOLGREICH ABGESCHLOSSEN!${NC}"
|
|
||||||
echo -e "${GREEN}=========================================================${NC}"
|
|
||||||
else
|
|
||||||
echo -e "${YELLOW}=========================================================${NC}"
|
|
||||||
echo -e "${YELLOW}⚠️ SSL-FIX ABGESCHLOSSEN (mit Warnungen)${NC}"
|
|
||||||
echo -e "${YELLOW}=========================================================${NC}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo -e "${CYAN}📊 ERGEBNIS:${NC}"
|
|
||||||
echo -e " 📄 Zertifikat: $CERT_PATH"
|
|
||||||
echo -e " 🔑 Private Key: $KEY_PATH"
|
|
||||||
echo -e " 📅 Gültig bis: $(date -d '+365 days' '+%Y-%m-%d')"
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
echo -e "${CYAN}🌐 NÄCHSTE SCHRITTE:${NC}"
|
|
||||||
echo -e "${BLUE}1. Browser-Cache auf CLIENT-SYSTEM leeren:${NC}"
|
|
||||||
echo -e " • Chrome/Edge: Strg+Shift+Del → 'Gesamte Zeit' → alle Optionen"
|
|
||||||
echo -e " • Firefox: Strg+Shift+Del → 'Alles' auswählen"
|
|
||||||
echo ""
|
|
||||||
echo -e "${BLUE}2. Zugriff testen:${NC}"
|
|
||||||
echo -e " • Lokal: https://localhost:5000"
|
|
||||||
echo -e " • Intranet: https://m040tbaraspi001.de040.corpintra.net"
|
|
||||||
echo ""
|
|
||||||
echo -e "${BLUE}3. Bei SSL-Warnung im Browser:${NC}"
|
|
||||||
echo -e " • 'Erweitert' → 'Weiter zu [hostname] (unsicher)'"
|
|
||||||
echo ""
|
|
||||||
echo -e "${GREEN}💡 Der Fehler ERR_SSL_KEY_USAGE_INCOMPATIBLE sollte behoben sein!${NC}"
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# System-Info für Debugging
|
|
||||||
echo -e "${BLUE}🔍 System-Informationen:${NC}"
|
|
||||||
echo -e " 📟 Hostname: $(hostname)"
|
|
||||||
echo -e " 🌐 IP-Adressen: $(hostname -I | tr ' ' '\n' | head -3 | tr '\n' ' ')"
|
|
||||||
echo -e " 🐧 OS: $(cat /etc/os-release | grep PRETTY_NAME | cut -d'"' -f2)"
|
|
||||||
echo -e " 🔐 OpenSSL: $(openssl version)"
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Firewall-Check
|
|
||||||
if command -v ufw &> /dev/null; then
|
|
||||||
echo -e "${YELLOW}🔥 Prüfe Firewall (UFW)...${NC}"
|
|
||||||
ufw_status=$(ufw status | grep "Status:")
|
|
||||||
if echo "$ufw_status" | grep -q "active"; then
|
|
||||||
echo -e " 🔥 UFW aktiv - prüfe HTTPS Port 443..."
|
|
||||||
if ufw status | grep -q "443"; then
|
|
||||||
echo -e " ${GREEN}✅ Port 443 (HTTPS) ist geöffnet${NC}"
|
|
||||||
else
|
|
||||||
echo -e " ${YELLOW}⚠️ Port 443 (HTTPS) möglicherweise blockiert${NC}"
|
|
||||||
echo -e " 💡 Öffne mit: sudo ufw allow 443"
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
echo -e " ${GREEN}✅ UFW inaktiv - keine Firewall-Blockierung${NC}"
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo -e "${GREEN}🏁 SSL-Fix für Raspberry Pi abgeschlossen!${NC}"
|
|
||||||
@ -1,32 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# MYP Kiosk URL Ermittlung - HTTPS-Only
|
|
||||||
# Ermittelt die beste HTTPS-URL für den Kiosk-Modus
|
|
||||||
|
|
||||||
# Prioritäten für URL-Ermittlung:
|
|
||||||
# 1. Intranet-Domain (falls erreichbar)
|
|
||||||
# 2. Lokaler Hostname (falls erreichbar)
|
|
||||||
# 3. Localhost (Fallback)
|
|
||||||
|
|
||||||
# Teste Intranet-Domain
|
|
||||||
INTRANET_URL="https://m040tbaraspi001.de040.corpintra.net"
|
|
||||||
if curl -k -s --connect-timeout 2 --max-time 3 "$INTRANET_URL" >/dev/null 2>&1; then
|
|
||||||
echo "$INTRANET_URL"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Teste lokalen Hostname
|
|
||||||
HOSTNAME=$(hostname)
|
|
||||||
LOCAL_URL="https://$HOSTNAME"
|
|
||||||
if curl -k -s --connect-timeout 2 --max-time 3 "$LOCAL_URL" >/dev/null 2>&1; then
|
|
||||||
echo "$LOCAL_URL"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Teste localhost mit Port 443
|
|
||||||
if curl -k -s --connect-timeout 2 --max-time 3 "https://localhost:443" >/dev/null 2>&1; then
|
|
||||||
echo "https://localhost:443"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Fallback: localhost ohne Port
|
|
||||||
echo "https://localhost"
|
|
||||||
File diff suppressed because it is too large
Load Diff
6576
backend/setup.sh
6576
backend/setup.sh
File diff suppressed because it is too large
Load Diff
@ -329,6 +329,33 @@ else
|
|||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# Intelligente Kiosk-URL-Konfiguration
|
||||||
|
echo " Konfiguriere intelligente Kiosk-URL..."
|
||||||
|
if [[ -f "$MYP_DIR/systemd/myp-kiosk.service" ]]; then
|
||||||
|
# Intelligent URL detection function direkt in Service einbauen
|
||||||
|
cat > /tmp/url_detect_function << 'EOF'
|
||||||
|
# Intelligente URL-Ermittlung
|
||||||
|
detect_kiosk_url() {
|
||||||
|
# Prioritäten: 1. Intranet-Domain 2. Hostname 3. Localhost
|
||||||
|
if curl -k -s --connect-timeout 2 --max-time 3 "https://m040tbaraspi001.de040.corpintra.net" >/dev/null 2>&1; then
|
||||||
|
echo "https://m040tbaraspi001.de040.corpintra.net"
|
||||||
|
elif curl -k -s --connect-timeout 2 --max-time 3 "https://$(hostname)" >/dev/null 2>&1; then
|
||||||
|
echo "https://$(hostname)"
|
||||||
|
elif curl -k -s --connect-timeout 2 --max-time 3 "https://localhost:443" >/dev/null 2>&1; then
|
||||||
|
echo "https://localhost:443"
|
||||||
|
else
|
||||||
|
echo "https://localhost"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
TARGET_URL=$(detect_kiosk_url);
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Ersetze URL-Ermittlung im Kiosk-Service
|
||||||
|
sed -i '/TARGET_URL=.*get_kiosk_url/c\ TARGET_URL=$(detect_kiosk_url);' /etc/systemd/system/myp-kiosk.service 2>/dev/null || true
|
||||||
|
|
||||||
|
echo -e "${GREEN} ✅ Intelligente Kiosk-URL konfiguriert${NC}"
|
||||||
|
fi
|
||||||
|
|
||||||
# Kiosk Service starten
|
# Kiosk Service starten
|
||||||
echo " Starte myp-kiosk..."
|
echo " Starte myp-kiosk..."
|
||||||
systemctl start myp-kiosk
|
systemctl start myp-kiosk
|
||||||
|
|||||||
@ -1,43 +0,0 @@
|
|||||||
w#!/bin/bash
|
|
||||||
|
|
||||||
# Einfacher Syntax-Check für das Setup-Skript
|
|
||||||
echo "Prüfe Bash-Syntax von setup.sh..."
|
|
||||||
|
|
||||||
# Zähle if und fi Statements
|
|
||||||
if_count=$(grep -c "^\s*if\s\|^\s\+if\s" setup.sh)
|
|
||||||
fi_count=$(grep -c "^\s*fi\s*$\|^\s\+fi\s*$" setup.sh)
|
|
||||||
|
|
||||||
echo "if-Statements gefunden: $if_count"
|
|
||||||
echo "fi-Statements gefunden: $fi_count"
|
|
||||||
|
|
||||||
if [ "$if_count" -eq "$fi_count" ]; then
|
|
||||||
echo "✅ if/fi Balance: OK"
|
|
||||||
else
|
|
||||||
echo "❌ if/fi Balance: FEHLER - Ungleiche Anzahl"
|
|
||||||
echo "Differenz: $((fi_count - if_count))"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Prüfe auf verwaiste fi ohne Einrückung (außerhalb von Funktionen)
|
|
||||||
orphaned_fi=$(grep -n "^fi\s*$" setup.sh)
|
|
||||||
if [ -n "$orphaned_fi" ]; then
|
|
||||||
echo "❌ Verwaiste fi-Statements gefunden:"
|
|
||||||
echo "$orphaned_fi"
|
|
||||||
else
|
|
||||||
echo "✅ Keine verwaisten fi-Statements"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Prüfe auf ungeschlossene Funktionen
|
|
||||||
function_starts=$(grep -c "^[a-zA-Z_][a-zA-Z0-9_]*\s*()\s*{" setup.sh)
|
|
||||||
function_ends=$(grep -c "^}" setup.sh)
|
|
||||||
|
|
||||||
echo "Funktions-Starts: $function_starts"
|
|
||||||
echo "Funktions-Ends: $function_ends"
|
|
||||||
|
|
||||||
if [ "$function_starts" -eq "$function_ends" ]; then
|
|
||||||
echo "✅ Funktions-Balance: OK"
|
|
||||||
else
|
|
||||||
echo "❌ Funktions-Balance: FEHLER"
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Syntax-Check abgeschlossen."
|
|
||||||
Reference in New Issue
Block a user