🐛 Backend: Enhanced HTTPS Only Service Management & Debug Fixes 🎉
This commit is contained in:
@ -1,319 +0,0 @@
|
||||
#!/bin/bash
|
||||
# MYP Connection Refused Debug & Fix Script
|
||||
# Diagnostiziert und behebt Connection Refused Probleme auf Raspberry Pi
|
||||
|
||||
set -e
|
||||
|
||||
# Farben für Output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
CYAN='\033[0;36m'
|
||||
NC='\033[0m'
|
||||
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
echo -e "${CYAN}MYP CONNECTION REFUSED - DEBUG & FIX${NC}"
|
||||
echo -e "${CYAN}Raspberry Pi Diagnose und Reparatur${NC}"
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
echo ""
|
||||
|
||||
# Basis-Informationen sammeln
|
||||
echo -e "${BLUE}📊 SYSTEM-INFORMATIONEN:${NC}"
|
||||
echo -e " 🖥️ Hostname: $(hostname)"
|
||||
echo -e " 🌐 IP-Adressen: $(hostname -I | tr ' ' '\n' | head -3 | tr '\n' ' ')"
|
||||
echo -e " ⏰ Zeit: $(date)"
|
||||
echo -e " 👤 Benutzer: $(whoami)"
|
||||
echo ""
|
||||
|
||||
# 1. SERVICE-STATUS PRÜFEN
|
||||
echo -e "${YELLOW}🔍 1. SERVICE-STATUS DIAGNOSE${NC}"
|
||||
echo "=================================================="
|
||||
|
||||
services=("myp-https" "myp-app" "myp-kiosk" "kiosk-watchdog")
|
||||
|
||||
for service in "${services[@]}"; do
|
||||
echo -e "${BLUE}Prüfe Service: $service${NC}"
|
||||
|
||||
if systemctl is-enabled "$service" >/dev/null 2>&1; then
|
||||
echo -e " ✅ Service ist aktiviert"
|
||||
else
|
||||
echo -e " ❌ Service ist NICHT aktiviert"
|
||||
fi
|
||||
|
||||
if systemctl is-active "$service" >/dev/null 2>&1; then
|
||||
echo -e " ✅ Service läuft"
|
||||
else
|
||||
echo -e " ❌ Service läuft NICHT"
|
||||
echo -e " 📋 Status: $(systemctl is-active "$service" 2>/dev/null || echo 'unknown')"
|
||||
fi
|
||||
|
||||
# Zeige letzte Logs
|
||||
echo -e " 📝 Letzte Logs:"
|
||||
journalctl -u "$service" --no-pager -n 3 --since "5 minutes ago" 2>/dev/null | sed 's/^/ /' || echo " Keine Logs verfügbar"
|
||||
echo ""
|
||||
done
|
||||
|
||||
# 2. PORT-STATUS PRÜFEN
|
||||
echo -e "${YELLOW}🔍 2. PORT-STATUS DIAGNOSE${NC}"
|
||||
echo "=================================================="
|
||||
|
||||
ports=("443" "5000" "80")
|
||||
|
||||
for port in "${ports[@]}"; do
|
||||
echo -e "${BLUE}Prüfe Port: $port${NC}"
|
||||
|
||||
# Prüfe ob Port belegt ist
|
||||
if netstat -tulpn 2>/dev/null | grep -q ":$port "; then
|
||||
echo -e " ✅ Port $port ist belegt"
|
||||
process=$(netstat -tulpn 2>/dev/null | grep ":$port " | awk '{print $7}' | head -1)
|
||||
echo -e " 📋 Prozess: $process"
|
||||
else
|
||||
echo -e " ❌ Port $port ist FREI (sollte belegt sein!)"
|
||||
fi
|
||||
|
||||
# Teste Verbindung
|
||||
if timeout 3 bash -c "</dev/tcp/localhost/$port" 2>/dev/null; then
|
||||
echo -e " ✅ Verbindung zu localhost:$port erfolgreich"
|
||||
else
|
||||
echo -e " ❌ Verbindung zu localhost:$port FEHLGESCHLAGEN"
|
||||
fi
|
||||
echo ""
|
||||
done
|
||||
|
||||
# 3. MYP-APP SPEZIFISCHE DIAGNOSE
|
||||
echo -e "${YELLOW}🔍 3. MYP-APP DIAGNOSE${NC}"
|
||||
echo "=================================================="
|
||||
|
||||
APP_DIR="/opt/myp"
|
||||
|
||||
echo -e "${BLUE}Prüfe MYP-Installation:${NC}"
|
||||
if [ -d "$APP_DIR" ]; then
|
||||
echo -e " ✅ MYP-Verzeichnis existiert: $APP_DIR"
|
||||
|
||||
if [ -f "$APP_DIR/app.py" ]; then
|
||||
echo -e " ✅ app.py gefunden"
|
||||
else
|
||||
echo -e " ❌ app.py FEHLT!"
|
||||
fi
|
||||
|
||||
if [ -f "$APP_DIR/requirements.txt" ]; then
|
||||
echo -e " ✅ requirements.txt gefunden"
|
||||
else
|
||||
echo -e " ❌ requirements.txt FEHLT!"
|
||||
fi
|
||||
|
||||
# Prüfe Berechtigungen
|
||||
echo -e " 📋 Berechtigungen: $(ls -ld "$APP_DIR" | awk '{print $1, $3, $4}')"
|
||||
|
||||
else
|
||||
echo -e " ❌ MYP-Verzeichnis FEHLT: $APP_DIR"
|
||||
fi
|
||||
|
||||
# 4. PYTHON-UMGEBUNG PRÜFEN
|
||||
echo -e "${YELLOW}🔍 4. PYTHON-UMGEBUNG DIAGNOSE${NC}"
|
||||
echo "=================================================="
|
||||
|
||||
echo -e "${BLUE}Python-Installation:${NC}"
|
||||
if command -v python3 >/dev/null 2>&1; then
|
||||
echo -e " ✅ Python3: $(python3 --version)"
|
||||
else
|
||||
echo -e " ❌ Python3 NICHT GEFUNDEN!"
|
||||
fi
|
||||
|
||||
if command -v python3.11 >/dev/null 2>&1; then
|
||||
echo -e " ✅ Python3.11: $(python3.11 --version)"
|
||||
else
|
||||
echo -e " ❌ Python3.11 NICHT GEFUNDEN!"
|
||||
fi
|
||||
|
||||
echo -e "${BLUE}Kritische Python-Module:${NC}"
|
||||
critical_modules=("flask" "requests" "werkzeug" "jinja2")
|
||||
|
||||
for module in "${critical_modules[@]}"; do
|
||||
if python3 -c "import $module" 2>/dev/null; then
|
||||
version=$(python3 -c "import $module; print(getattr($module, '__version__', 'unknown'))" 2>/dev/null)
|
||||
echo -e " ✅ $module: $version"
|
||||
else
|
||||
echo -e " ❌ $module FEHLT!"
|
||||
fi
|
||||
done
|
||||
|
||||
# 5. SSL-ZERTIFIKAT PRÜFEN
|
||||
echo -e "${YELLOW}🔍 5. SSL-ZERTIFIKAT DIAGNOSE${NC}"
|
||||
echo "=================================================="
|
||||
|
||||
SSL_DIR="$APP_DIR/ssl"
|
||||
CERT_FILE="$SSL_DIR/cert.pem"
|
||||
KEY_FILE="$SSL_DIR/key.pem"
|
||||
|
||||
if [ -d "$SSL_DIR" ]; then
|
||||
echo -e " ✅ SSL-Verzeichnis existiert"
|
||||
|
||||
if [ -f "$CERT_FILE" ]; then
|
||||
echo -e " ✅ SSL-Zertifikat gefunden"
|
||||
|
||||
# Prüfe Zertifikat-Gültigkeit
|
||||
if openssl x509 -in "$CERT_FILE" -noout -checkend 86400 2>/dev/null; then
|
||||
echo -e " ✅ Zertifikat ist gültig"
|
||||
expiry=$(openssl x509 -in "$CERT_FILE" -noout -enddate 2>/dev/null | cut -d= -f2)
|
||||
echo -e " 📅 Läuft ab: $expiry"
|
||||
else
|
||||
echo -e " ❌ Zertifikat ist ABGELAUFEN oder UNGÜLTIG!"
|
||||
fi
|
||||
else
|
||||
echo -e " ❌ SSL-Zertifikat FEHLT: $CERT_FILE"
|
||||
fi
|
||||
|
||||
if [ -f "$KEY_FILE" ]; then
|
||||
echo -e " ✅ SSL-Key gefunden"
|
||||
echo -e " 📋 Key-Berechtigungen: $(ls -l "$KEY_FILE" | awk '{print $1, $3, $4}')"
|
||||
else
|
||||
echo -e " ❌ SSL-Key FEHLT: $KEY_FILE"
|
||||
fi
|
||||
else
|
||||
echo -e " ❌ SSL-Verzeichnis FEHLT: $SSL_DIR"
|
||||
fi
|
||||
|
||||
# 6. FIREWALL-STATUS
|
||||
echo -e "${YELLOW}🔍 6. FIREWALL-DIAGNOSE${NC}"
|
||||
echo "=================================================="
|
||||
|
||||
if command -v ufw >/dev/null 2>&1; then
|
||||
echo -e "${BLUE}UFW Firewall:${NC}"
|
||||
ufw_status=$(ufw status 2>/dev/null | head -1)
|
||||
echo -e " 📋 Status: $ufw_status"
|
||||
|
||||
if echo "$ufw_status" | grep -q "active"; then
|
||||
echo -e " 🔥 Firewall ist AKTIV - prüfe Ports..."
|
||||
for port in 443 5000 80; do
|
||||
if ufw status 2>/dev/null | grep -q "$port"; then
|
||||
echo -e " ✅ Port $port ist geöffnet"
|
||||
else
|
||||
echo -e " ❌ Port $port ist BLOCKIERT!"
|
||||
fi
|
||||
done
|
||||
else
|
||||
echo -e " ✅ Firewall ist inaktiv"
|
||||
fi
|
||||
else
|
||||
echo -e " ℹ️ UFW nicht installiert"
|
||||
fi
|
||||
|
||||
# 7. AUTOMATISCHE REPARATUR-VERSUCHE
|
||||
echo ""
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
echo -e "${CYAN}🔧 AUTOMATISCHE REPARATUR-VERSUCHE${NC}"
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
|
||||
echo -e "${YELLOW}Reparatur 1: Services neu starten${NC}"
|
||||
for service in "myp-https" "myp-app"; do
|
||||
if systemctl is-enabled "$service" >/dev/null 2>&1; then
|
||||
echo -e " 🔄 Starte $service neu..."
|
||||
if systemctl restart "$service" 2>/dev/null; then
|
||||
echo -e " ✅ $service erfolgreich neu gestartet"
|
||||
sleep 2
|
||||
if systemctl is-active "$service" >/dev/null 2>&1; then
|
||||
echo -e " ✅ $service läuft jetzt"
|
||||
else
|
||||
echo -e " ❌ $service läuft immer noch nicht"
|
||||
fi
|
||||
else
|
||||
echo -e " ❌ Fehler beim Neustart von $service"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo -e "${YELLOW}Reparatur 2: Manuelle App-Start-Versuche${NC}"
|
||||
if [ -f "$APP_DIR/app.py" ]; then
|
||||
echo -e " 🐍 Teste Python-App direkt..."
|
||||
cd "$APP_DIR"
|
||||
|
||||
# Teste verschiedene Python-Versionen
|
||||
for python_cmd in "python3.11" "python3" "python"; do
|
||||
if command -v "$python_cmd" >/dev/null 2>&1; then
|
||||
echo -e " 🧪 Teste mit $python_cmd..."
|
||||
timeout 10 "$python_cmd" -c "
|
||||
import sys
|
||||
sys.path.insert(0, '/opt/myp')
|
||||
try:
|
||||
from app import app
|
||||
print('✅ App-Import erfolgreich')
|
||||
app.run(host='0.0.0.0', port=5000, debug=False)
|
||||
except Exception as e:
|
||||
print(f'❌ App-Fehler: {e}')
|
||||
import traceback
|
||||
traceback.print_exc()
|
||||
" 2>&1 | head -10 | sed 's/^/ /'
|
||||
break
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${YELLOW}Reparatur 3: SSL-Zertifikate regenerieren${NC}"
|
||||
if [ ! -f "$CERT_FILE" ] || ! openssl x509 -in "$CERT_FILE" -noout -checkend 86400 2>/dev/null; then
|
||||
echo -e " 🔐 Regeneriere SSL-Zertifikate..."
|
||||
|
||||
if [ -f "/opt/myp/fix_ssl_raspberry.sh" ]; then
|
||||
echo -e " 🛠️ Führe SSL-Fix aus..."
|
||||
chmod +x "/opt/myp/fix_ssl_raspberry.sh"
|
||||
"/opt/myp/fix_ssl_raspberry.sh" 2>&1 | tail -5 | sed 's/^/ /'
|
||||
else
|
||||
echo -e " ⚠️ SSL-Fix-Skript nicht gefunden - manuelle SSL-Erstellung..."
|
||||
mkdir -p "$SSL_DIR"
|
||||
cd "$SSL_DIR"
|
||||
|
||||
# Einfache SSL-Zertifikat-Erstellung
|
||||
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \
|
||||
-subj "/C=DE/ST=BW/L=Stuttgart/O=Mercedes/CN=m040tbaraspi001" 2>/dev/null && \
|
||||
echo -e " ✅ SSL-Zertifikate erstellt" || \
|
||||
echo -e " ❌ SSL-Erstellung fehlgeschlagen"
|
||||
fi
|
||||
fi
|
||||
|
||||
# 8. FINAL-TEST
|
||||
echo ""
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
echo -e "${CYAN}🎯 FINAL-VERBINDUNGSTEST${NC}"
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
|
||||
echo -e "${BLUE}Teste Verbindungen nach Reparatur:${NC}"
|
||||
|
||||
for url in "http://localhost:5000" "https://localhost:443" "http://127.0.0.1:5000"; do
|
||||
echo -e " 🌐 Teste: $url"
|
||||
if timeout 5 curl -s -o /dev/null -w "%{http_code}" "$url" 2>/dev/null | grep -q "200\|302\|404"; then
|
||||
echo -e " ✅ $url ist erreichbar!"
|
||||
else
|
||||
echo -e " ❌ $url nicht erreichbar"
|
||||
fi
|
||||
done
|
||||
|
||||
# 9. EMPFEHLUNGEN
|
||||
echo ""
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
echo -e "${CYAN}💡 EMPFEHLUNGEN${NC}"
|
||||
echo -e "${CYAN}=========================================================${NC}"
|
||||
|
||||
echo -e "${GREEN}Nächste Schritte:${NC}"
|
||||
echo -e "1. ${BLUE}Service-Logs prüfen:${NC}"
|
||||
echo -e " journalctl -u myp-https -f"
|
||||
echo -e " journalctl -u myp-app -f"
|
||||
echo ""
|
||||
echo -e "2. ${BLUE}Manuelle App-Start zum Debugging:${NC}"
|
||||
echo -e " cd /opt/myp"
|
||||
echo -e " python3 app.py"
|
||||
echo ""
|
||||
echo -e "3. ${BLUE}Port-Verfügbarkeit prüfen:${NC}"
|
||||
echo -e " netstat -tulpn | grep -E ':(443|5000|80)'"
|
||||
echo ""
|
||||
echo -e "4. ${BLUE}Firewall-Ports öffnen (falls nötig):${NC}"
|
||||
echo -e " sudo ufw allow 443"
|
||||
echo -e " sudo ufw allow 5000"
|
||||
echo ""
|
||||
echo -e "5. ${BLUE}Setup-Skript erneut ausführen:${NC}"
|
||||
echo -e " cd /opt/myp && sudo ./setup.sh"
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}🏁 Connection Refused Diagnose abgeschlossen!${NC}"
|
||||
@ -1,112 +0,0 @@
|
||||
#!/bin/bash
|
||||
# MYP Quick Fix - Connection Refused
|
||||
# Schnelle Reparatur der häufigsten Verbindungsprobleme
|
||||
|
||||
set -e
|
||||
|
||||
# Farben
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
RED='\033[0;31m'
|
||||
NC='\033[0m'
|
||||
|
||||
echo -e "${BLUE}🚀 MYP QUICK FIX - Connection Refused${NC}"
|
||||
echo "=============================================="
|
||||
|
||||
# 1. Services stoppen und neu starten (HTTPS-Only)
|
||||
echo -e "${YELLOW}🔄 Schritt 1: Services neu starten${NC}"
|
||||
services=("myp-kiosk" "myp-production" "myp-https" "myp-app")
|
||||
|
||||
for service in "${services[@]}"; do
|
||||
if systemctl is-enabled "$service" >/dev/null 2>&1; then
|
||||
echo " Stoppe $service..."
|
||||
systemctl stop "$service" 2>/dev/null || true
|
||||
sleep 1
|
||||
echo " Starte $service..."
|
||||
systemctl start "$service" 2>/dev/null || true
|
||||
sleep 2
|
||||
|
||||
if systemctl is-active "$service" >/dev/null 2>&1; then
|
||||
echo -e " ✅ $service läuft"
|
||||
else
|
||||
echo -e " ❌ $service Fehler"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
# 2. Firewall für HTTPS-Only konfigurieren
|
||||
echo -e "${YELLOW}🔥 Schritt 2: Firewall für HTTPS-Only${NC}"
|
||||
if command -v ufw >/dev/null 2>&1; then
|
||||
ufw allow 443 >/dev/null 2>&1 || true
|
||||
ufw deny 5000 >/dev/null 2>&1 || true
|
||||
ufw deny 80 >/dev/null 2>&1 || true
|
||||
echo " ✅ Port 443 (HTTPS) geöffnet"
|
||||
echo " ✅ Port 5000/80 (HTTP) blockiert"
|
||||
fi
|
||||
|
||||
# 3. SSL-Zertifikate prüfen/erstellen
|
||||
echo -e "${YELLOW}🔐 Schritt 3: SSL-Zertifikate prüfen${NC}"
|
||||
SSL_DIR="/opt/myp/ssl"
|
||||
mkdir -p "$SSL_DIR"
|
||||
|
||||
if [ ! -f "$SSL_DIR/cert.pem" ] || [ ! -f "$SSL_DIR/key.pem" ]; then
|
||||
echo " Erstelle SSL-Zertifikate..."
|
||||
cd "$SSL_DIR"
|
||||
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \
|
||||
-subj "/C=DE/ST=BW/L=Stuttgart/O=Mercedes/CN=m040tbaraspi001" >/dev/null 2>&1
|
||||
chmod 644 cert.pem
|
||||
chmod 600 key.pem
|
||||
echo " ✅ SSL-Zertifikate erstellt"
|
||||
else
|
||||
echo " ✅ SSL-Zertifikate vorhanden"
|
||||
fi
|
||||
|
||||
# 4. Python-Abhängigkeiten prüfen
|
||||
echo -e "${YELLOW}🐍 Schritt 4: Python-Module prüfen${NC}"
|
||||
cd /opt/myp
|
||||
if [ -f "requirements.txt" ]; then
|
||||
python3 -m pip install -r requirements.txt --break-system-packages --quiet >/dev/null 2>&1 || true
|
||||
echo " ✅ Python-Module aktualisiert"
|
||||
fi
|
||||
|
||||
# 5. App manuell testen
|
||||
echo -e "${YELLOW}🧪 Schritt 5: App-Test${NC}"
|
||||
cd /opt/myp
|
||||
timeout 5 python3 -c "
|
||||
import sys
|
||||
sys.path.insert(0, '/opt/myp')
|
||||
try:
|
||||
from app import app
|
||||
print(' ✅ App-Import erfolgreich')
|
||||
except Exception as e:
|
||||
print(f' ❌ App-Import-Fehler: {e}')
|
||||
" 2>/dev/null || echo " ⚠️ App-Test unvollständig"
|
||||
|
||||
# 6. Verbindungstest (HTTPS-Only)
|
||||
echo -e "${YELLOW}🌐 Schritt 6: HTTPS-Verbindungstest${NC}"
|
||||
sleep 3
|
||||
|
||||
# Teste nur HTTPS Port 443
|
||||
if timeout 3 bash -c "</dev/tcp/localhost/443" 2>/dev/null; then
|
||||
echo -e " ✅ Port 443 (HTTPS) erreichbar"
|
||||
else
|
||||
echo -e " ❌ Port 443 (HTTPS) nicht erreichbar"
|
||||
fi
|
||||
|
||||
# Prüfe dass HTTP-Ports blockiert sind
|
||||
if timeout 3 bash -c "</dev/tcp/localhost/5000" 2>/dev/null; then
|
||||
echo -e " ⚠️ Port 5000 noch offen (sollte blockiert sein)"
|
||||
else
|
||||
echo -e " ✅ Port 5000 korrekt blockiert"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}🏁 Quick Fix abgeschlossen!${NC}"
|
||||
echo ""
|
||||
echo -e "${BLUE}Teste jetzt:${NC}"
|
||||
echo " Browser: https://localhost"
|
||||
echo " Kiosk sollte sich verbinden können"
|
||||
echo ""
|
||||
echo -e "${BLUE}Falls Problem weiterhin besteht:${NC}"
|
||||
echo " sudo ./debug_connection_refused.sh"
|
||||
@ -1,11 +1,15 @@
|
||||
#!/bin/bash
|
||||
# MYP HTTPS-Only Setup - Das einzige Skript das du brauchst!
|
||||
# Löst ALLE Probleme automatisch:
|
||||
# - ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||
# - Port 5000 blockieren
|
||||
# - Nur Port 443 (HTTPS)
|
||||
# - Kiosk automatisch starten
|
||||
# - Firewall sichern
|
||||
# MYP SUPER-SKRIPT - Das EINZIGE Skript für ALLES!
|
||||
# Intelligente Erkennung und Behebung aller MYP-Probleme:
|
||||
#
|
||||
# ✅ ERR_SSL_KEY_USAGE_INCOMPATIBLE behebt
|
||||
# ✅ Port 5000 blockiert, nur Port 443 öffnet
|
||||
# ✅ Graphical session target not found behebt
|
||||
# ✅ Connection refused automatisch repariert
|
||||
# ✅ Kiosk automatisch konfiguriert (Desktop/Headless)
|
||||
# ✅ Firewall intelligent konfiguriert
|
||||
# ✅ Alle Services automatisch repariert
|
||||
# ✅ Selbstdiagnose und automatische Problemlösung
|
||||
#
|
||||
# Verwendung: sudo ./setup_https_only.sh
|
||||
|
||||
@ -22,16 +26,19 @@ NC='\033[0m'
|
||||
|
||||
# Banner
|
||||
echo -e "${CYAN}${BOLD}"
|
||||
echo "╔══════════════════════════════════════════════════════════════╗"
|
||||
echo "║ MYP HTTPS-ONLY SETUP ║"
|
||||
echo "║ Das einzige Skript das du brauchst! ║"
|
||||
echo "║ ║"
|
||||
echo "║ ✅ SSL Browser-Kompatibilität (ERR_SSL_KEY_USAGE_INCOMPATIBLE) ║"
|
||||
echo "║ ✅ Nur Port 443 (HTTPS) - Port 5000 blockiert ║"
|
||||
echo "║ ✅ Automatischer Kiosk-Start ║"
|
||||
echo "║ ✅ Maximale Firewall-Sicherheit ║"
|
||||
echo "║ ✅ Standalone Flask (kein Proxy) ║"
|
||||
echo "╚══════════════════════════════════════════════════════════════╝"
|
||||
echo "╔═══════════════════════════════════════════════════════════════════╗"
|
||||
echo "║ MYP SUPER-SKRIPT ║"
|
||||
echo "║ Das EINZIGE Skript für ALLES! ║"
|
||||
echo "║ ║"
|
||||
echo "║ 🔥 Intelligente Problemerkennung und automatische Reparatur ║"
|
||||
echo "║ ✅ SSL Browser-Kompatibilität (ERR_SSL_KEY_USAGE_INCOMPATIBLE) ║"
|
||||
echo "║ ✅ Graphical session target not found behebt ║"
|
||||
echo "║ ✅ Connection refused automatisch repariert ║"
|
||||
echo "║ ✅ Nur Port 443 (HTTPS) - Port 5000 blockiert ║"
|
||||
echo "║ ✅ Kiosk intelligent konfiguriert (Desktop/Headless) ║"
|
||||
echo "║ ✅ Firewall automatisch optimiert ║"
|
||||
echo "║ ✅ Alle Services automatisch repariert ║"
|
||||
echo "╚═══════════════════════════════════════════════════════════════════╝"
|
||||
echo -e "${NC}"
|
||||
|
||||
# Prüfe Root-Berechtigung
|
||||
@ -355,8 +362,164 @@ fi
|
||||
# HTTPS-Webserver-Test
|
||||
if curl -k -s --connect-timeout 5 https://localhost >/dev/null 2>&1; then
|
||||
echo -e "${GREEN} ✅ HTTPS-Webserver antwortet${NC}"
|
||||
HTTPS_OK=true
|
||||
else
|
||||
echo -e "${RED} ❌ HTTPS-Webserver antwortet nicht${NC}"
|
||||
HTTPS_OK=false
|
||||
fi
|
||||
|
||||
# ===== INTELLIGENTE PROBLEMERKENNUNG UND REPARATUR =====
|
||||
echo ""
|
||||
echo -e "${BLUE}🔥 INTELLIGENTE PROBLEMERKENNUNG...${NC}"
|
||||
echo "=============================================="
|
||||
|
||||
PROBLEMS_DETECTED=false
|
||||
|
||||
# Problem 1: Graphical Session Target
|
||||
if systemctl status myp-kiosk 2>&1 | grep -q "graphical-session.target"; then
|
||||
echo -e "${YELLOW}🔧 Problem erkannt: Graphical Session Target${NC}"
|
||||
PROBLEMS_DETECTED=true
|
||||
|
||||
# Backup erstellen
|
||||
if [[ -f "/etc/systemd/system/myp-kiosk.service" ]]; then
|
||||
cp /etc/systemd/system/myp-kiosk.service /etc/systemd/system/myp-kiosk.service.backup.$(date +%s)
|
||||
|
||||
# Ersetze problematisches Target
|
||||
sed -i 's/graphical-session\.target/graphical.target/g' /etc/systemd/system/myp-kiosk.service
|
||||
sed -i 's/Requires=graphical\.target/Requires=myp-production.service/' /etc/systemd/system/myp-kiosk.service
|
||||
|
||||
# SystemD neu laden
|
||||
systemctl daemon-reload
|
||||
echo -e "${GREEN} ✅ Graphical Target Problem behoben${NC}"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Problem 2: Connection Refused
|
||||
if [[ "$HTTPS_OK" == "false" ]]; then
|
||||
echo -e "${YELLOW}🔧 Problem erkannt: Connection Refused${NC}"
|
||||
PROBLEMS_DETECTED=true
|
||||
|
||||
# Service Status prüfen und reparieren
|
||||
for service in "myp-production" "myp-https" "myp-app"; do
|
||||
if systemctl is-enabled "$service" >/dev/null 2>&1; then
|
||||
if ! systemctl is-active "$service" >/dev/null 2>&1; then
|
||||
echo " Repariere $service..."
|
||||
systemctl stop "$service" 2>/dev/null || true
|
||||
sleep 2
|
||||
systemctl start "$service" 2>/dev/null || true
|
||||
sleep 3
|
||||
|
||||
if systemctl is-active "$service" >/dev/null 2>&1; then
|
||||
echo -e "${GREEN} ✅ $service repariert${NC}"
|
||||
else
|
||||
echo -e "${RED} ❌ $service Reparatur fehlgeschlagen${NC}"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
# Python-Module prüfen
|
||||
if ! python3 -c "import flask" 2>/dev/null; then
|
||||
echo " Repariere Python-Module..."
|
||||
python3 -m pip install flask flask-login flask-sqlalchemy werkzeug --break-system-packages --quiet 2>/dev/null || true
|
||||
echo -e "${GREEN} ✅ Python-Module repariert${NC}"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Problem 3: Service Dependencies
|
||||
echo -e "${YELLOW}🔧 Prüfe Service-Dependencies...${NC}"
|
||||
if [[ -f "/etc/systemd/system/myp-kiosk.service" ]]; then
|
||||
# Prüfe ob kiosk auf production wartet
|
||||
if ! grep -q "After=.*myp-production" /etc/systemd/system/myp-kiosk.service; then
|
||||
sed -i 's/After=\(.*\)/After=\1 myp-production.service/' /etc/systemd/system/myp-kiosk.service
|
||||
systemctl daemon-reload
|
||||
echo -e "${GREEN} ✅ Kiosk-Dependencies repariert${NC}"
|
||||
PROBLEMS_DETECTED=true
|
||||
fi
|
||||
fi
|
||||
|
||||
# Problem 4: Headless System Detection
|
||||
echo -e "${YELLOW}🔧 Erkenne System-Typ...${NC}"
|
||||
if ! DISPLAY=:0 xset q >/dev/null 2>&1 && ! systemctl list-unit-files --type=target | grep -q "graphical.target"; then
|
||||
echo -e "${YELLOW} ⚠️ Headless-System erkannt - deaktiviere Kiosk${NC}"
|
||||
systemctl disable myp-kiosk 2>/dev/null || true
|
||||
systemctl stop myp-kiosk 2>/dev/null || true
|
||||
echo -e "${GREEN} ✅ Kiosk für Headless-Betrieb deaktiviert${NC}"
|
||||
PROBLEMS_DETECTED=true
|
||||
elif systemctl list-unit-files --type=target | grep -q "graphical.target"; then
|
||||
echo -e "${GREEN} ✅ Desktop-System erkannt - Kiosk verfügbar${NC}"
|
||||
systemctl enable myp-kiosk 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# Problem 5: SSL Certificate Health Check
|
||||
echo -e "${YELLOW}🔧 Prüfe SSL-Zertifikat-Gesundheit...${NC}"
|
||||
SSL_DIR="$MYP_DIR/ssl"
|
||||
if [[ -f "$SSL_DIR/cert.pem" ]]; then
|
||||
# Prüfe Ablaufdatum
|
||||
if ! openssl x509 -in "$SSL_DIR/cert.pem" -noout -checkend 2592000 >/dev/null 2>&1; then
|
||||
echo -e "${YELLOW} ⚠️ SSL-Zertifikat läuft in 30 Tagen ab - erneuere...${NC}"
|
||||
PROBLEMS_DETECTED=true
|
||||
|
||||
# Regeneriere Zertifikat
|
||||
openssl req -new -x509 \
|
||||
-key "$SSL_DIR/key.pem" \
|
||||
-out "$SSL_DIR/cert.pem" \
|
||||
-days 365 \
|
||||
-subj "/C=DE/ST=BW/L=Stuttgart/O=Mercedes/CN=m040tbaraspi001" \
|
||||
-extensions v3_req \
|
||||
-sha256 2>/dev/null
|
||||
|
||||
echo -e "${GREEN} ✅ SSL-Zertifikat erneuert${NC}"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Problem 6: Port Conflicts
|
||||
echo -e "${YELLOW}🔧 Prüfe Port-Konflikte...${NC}"
|
||||
if netstat -tulpn 2>/dev/null | grep -q ":443.*LISTEN" && ! netstat -tulpn 2>/dev/null | grep ":443.*python"; then
|
||||
echo -e "${YELLOW} ⚠️ Port 443 von anderem Service belegt${NC}"
|
||||
CONFLICTING_SERVICE=$(netstat -tulpn 2>/dev/null | grep ":443.*LISTEN" | awk '{print $7}' | cut -d'/' -f2)
|
||||
if [[ "$CONFLICTING_SERVICE" =~ ^(apache2|nginx|httpd)$ ]]; then
|
||||
echo " Stoppe konfligierende Webserver: $CONFLICTING_SERVICE"
|
||||
systemctl stop "$CONFLICTING_SERVICE" 2>/dev/null || true
|
||||
systemctl disable "$CONFLICTING_SERVICE" 2>/dev/null || true
|
||||
echo -e "${GREEN} ✅ Port-Konflikt behoben${NC}"
|
||||
PROBLEMS_DETECTED=true
|
||||
fi
|
||||
fi
|
||||
|
||||
# Finale Validierung
|
||||
echo ""
|
||||
echo -e "${BLUE}🔍 FINALE VALIDIERUNG...${NC}"
|
||||
echo "=============================================="
|
||||
|
||||
# Test finale HTTPS-Verbindung
|
||||
sleep 3
|
||||
if curl -k -s --connect-timeout 10 https://localhost >/dev/null 2>&1; then
|
||||
echo -e "${GREEN}✅ FINALE VALIDIERUNG: HTTPS funktioniert perfekt${NC}"
|
||||
elif timeout 5 bash -c '</dev/tcp/localhost/443' 2>/dev/null; then
|
||||
echo -e "${YELLOW}⚠️ Port 443 erreichbar, aber HTTPS-Response fehlt${NC}"
|
||||
systemctl restart myp-production 2>/dev/null || true
|
||||
sleep 5
|
||||
if curl -k -s --connect-timeout 5 https://localhost >/dev/null 2>&1; then
|
||||
echo -e "${GREEN}✅ HTTPS nach Neustart funktioniert${NC}"
|
||||
fi
|
||||
else
|
||||
echo -e "${RED}❌ Port 443 nicht erreichbar - prüfe Logs:${NC}"
|
||||
echo " journalctl -u myp-production -n 10 --no-pager"
|
||||
fi
|
||||
|
||||
# Kiosk-Test für Desktop-Systeme
|
||||
if systemctl is-active myp-kiosk >/dev/null 2>&1; then
|
||||
echo -e "${GREEN}✅ Kiosk-Service läuft${NC}"
|
||||
elif systemctl is-enabled myp-kiosk >/dev/null 2>&1 && DISPLAY=:0 xset q >/dev/null 2>&1; then
|
||||
echo -e "${YELLOW}⚠️ Kiosk aktiviert aber nicht gestartet - starte...${NC}"
|
||||
systemctl start myp-kiosk 2>/dev/null || true
|
||||
fi
|
||||
|
||||
if [[ "$PROBLEMS_DETECTED" == "true" ]]; then
|
||||
echo ""
|
||||
echo -e "${GREEN}🔧 PROBLEME AUTOMATISCH BEHOBEN!${NC}"
|
||||
echo -e "${CYAN} Das System wurde intelligent repariert und optimiert.${NC}"
|
||||
fi
|
||||
|
||||
# ===== SETUP ABGESCHLOSSEN =====
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
[Unit]
|
||||
Description=MYP Kiosk Browser Autostart (Chromium HTTPS) - Wartungsfreier Produktionsbetrieb
|
||||
Documentation=https://github.com/MYP-Druckerverwaltung
|
||||
After=graphical-session.target myp-production.service network-online.target
|
||||
Wants=myp-production.service network-online.target
|
||||
Requires=graphical-session.target
|
||||
After=graphical.target myp-production.service network-online.target
|
||||
Wants=myp-production.service network-online.target graphical.target
|
||||
Requires=myp-production.service
|
||||
StartLimitBurst=5
|
||||
StartLimitInterval=600
|
||||
|
||||
@ -23,16 +23,33 @@ WorkingDirectory=/home/kiosk
|
||||
ExecStartPre=/bin/bash -c '\
|
||||
echo "=== MYP Kiosk-Service startet $(date) ==="; \
|
||||
\
|
||||
# Prüfe ob X11 läuft \
|
||||
for i in {1..30}; do \
|
||||
# Prüfe ob X11 läuft oder starte es \
|
||||
if ! DISPLAY=:0 xset q >/dev/null 2>&1; then \
|
||||
echo "🔧 X11 nicht gefunden - versuche Start..."; \
|
||||
if command -v startx >/dev/null 2>&1; then \
|
||||
# Starte X11 im Hintergrund falls möglich \
|
||||
sudo -u pi startx &disown 2>/dev/null || true; \
|
||||
sleep 5; \
|
||||
fi; \
|
||||
fi; \
|
||||
\
|
||||
# Warte auf X11 Display \
|
||||
for i in {1..15}; do \
|
||||
if DISPLAY=:0 xset q >/dev/null 2>&1; then \
|
||||
echo "✅ X11 Display verfügbar"; \
|
||||
break; \
|
||||
fi; \
|
||||
echo "⏳ Warte auf X11 Display... ($i/30)"; \
|
||||
echo "⏳ Warte auf X11 Display... ($i/15)"; \
|
||||
sleep 2; \
|
||||
done; \
|
||||
\
|
||||
# Falls X11 nicht verfügbar - Headless-Modus \
|
||||
if ! DISPLAY=:0 xset q >/dev/null 2>&1; then \
|
||||
echo "⚠️ X11 nicht verfügbar - Kiosk-Modus wird übersprungen"; \
|
||||
echo "💡 Für grafischen Kiosk: sudo systemctl set-default graphical.target"; \
|
||||
exit 0; \
|
||||
fi; \
|
||||
\
|
||||
# Warte auf HTTPS-Backend (Port 443) \
|
||||
echo "🔍 Warte auf HTTPS Backend (Port 443)..."; \
|
||||
for i in {1..120}; do \
|
||||
|
||||
Reference in New Issue
Block a user