feat: Überarbeitung des Kiosk-Installationsskripts zur Vereinfachung der Installation ohne venv/nginx und Verbesserung der Benutzerinteraktion durch klare Fehlermeldungen und Anweisungen. Entfernen nicht benötigter Dateien und Anpassung der Service-Konfiguration für bessere Wartbarkeit.

This commit is contained in:
2025-05-27 08:54:04 +02:00
parent aa40816ba0
commit 77a29a7989
16 changed files with 144 additions and 1675 deletions

View File

@@ -1,48 +1,14 @@
[Unit]
Description=MYP Backend Service (Python 3.11)
Documentation=https://github.com/myp-project/backend
After=network-online.target
Wants=network-online.target
Before=myp-kiosk.service
Description=MYP Backend Python Service
After=network.target
[Service]
Type=simple
User=myp
Group=myp
User=user
WorkingDirectory=/opt/myp/backend/app
Environment=PYTHONPATH=/opt/myp/backend/app
Environment=FLASK_ENV=production
Environment=FLASK_APP=app.py
Environment=PYTHONUNBUFFERED=1
Environment=PYTHONDONTWRITEBYTECODE=1
ExecStartPre=/bin/sleep 5
ExecStart=/opt/myp/backend/venv/bin/python3.11 app.py --host 0.0.0.0 --port 443 --cert certs/backend.crt --key certs/backend.key
ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/bin/python3.11 app.py --host 192.168.0.105 --port 80
Restart=always
RestartSec=10
TimeoutStartSec=60
TimeoutStopSec=30
StandardOutput=journal
StandardError=journal
SyslogIdentifier=myp-backend
# Sicherheitseinstellungen
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictSUIDSGID=true
ReadWritePaths=/opt/myp/backend/app/logs
ReadWritePaths=/opt/myp/backend/app/database
ReadWritePaths=/opt/myp/backend/app/uploads
# Ressourcenlimits
MemoryMax=1G
CPUQuota=80%
RestartSec=5
[Install]
WantedBy=multi-user.target