USB-AIO für automatische Geräteprüfung

live/autologin.conf

@@ -0,0 +1,7 @@
+[Unit]
+Requires=intake-prepare.service
+After=intake-prepare.service
+
+[Service]
+ExecStart=
+ExecStart=-/usr/bin/agetty --autologin intake --noclear %I $TERM

live/intake-login.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Sourced on autologin on tty1; no system service owns the compositor.
+[[ "$(tty)" == /dev/tty1 ]] || return 0
+[[ -z "${WAYLAND_DISPLAY:-}" ]] || return 0
+export WLR_RENDERER_ALLOW_SOFTWARE=1
+export XDG_SESSION_TYPE=wayland
+if [[ ! -w /mnt/intake-data ]]; then
+  printf '\nCS-R Intake: data partition not writable; no scan can be saved.\n' >&2
+  printf 'Press Enter for diagnostic console...'
+  read -r _
+  return 0
+fi
+if command -v cage >/dev/null && [[ -x /usr/local/bin/intake-gui ]]; then
+  cage -- /usr/local/bin/intake-gui --data /mnt/intake-data
+  printf '\nGUI exited. You are at the diagnostic terminal (tty1).\n' >&2
+else
+  printf '\nCage or GUI missing. Attempting controller fallback.\n' >&2
+  /usr/local/bin/intake-controller --data /mnt/intake-data || true
+fi

live/intake-prepare.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Prepare CS-R Intake data and kiosk user
+After=local-fs.target systemd-udev-settle.service
+Before=getty@tty1.service
+Wants=systemd-udev-settle.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/intake-prepare
+RemainAfterExit=yes
+TimeoutStartSec=45
+
+[Install]
+WantedBy=multi-user.target

live/intake-prepare.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+# Run as root once per boot. NEVER write to internal devices.
+DATA=/mnt/intake-data
+if ! id intake &>/dev/null; then
+  useradd --create-home --home-dir /home/intake --shell /bin/bash --user-group intake
+fi
+install -d -o intake -g intake -m 0700 /home/intake
+# Read protected DMI fields once as root; provide a boot-local, read-only snapshot.
+install -d -o root -g intake -m 0750 /run/csr-intake
+for field in product_uuid product_serial; do
+  if [[ -r /sys/class/dmi/id/$field ]]; then
+    install -o root -g intake -m 0440 "/sys/class/dmi/id/$field" "/run/csr-intake/$field"
+  fi
+done
+if [[ -r /sys/firmware/dmi/tables/DMI ]]; then
+  install -o root -g intake -m 0440 /sys/firmware/dmi/tables/DMI /run/csr-intake/DMI
+fi
+install -d -m 0755 "$DATA"
+part=$(blkid -L INTAKE_DATA || true)
+if [[ -z "$part" ]]; then
+  echo 'CS-R ERROR: INTAKE_DATA not found; scans must not run.' >&2
+else
+  if ! mountpoint -q "$DATA"; then
+    mount -o rw,nosuid,nodev "$part" "$DATA"
+  fi
+  for d in config database reports checklists inspections final-reports diagnostics; do
+    mkdir -p "$DATA/$d"
+    chown -R intake:intake "$DATA/$d"
+  done
+  chown intake:intake "$DATA"
+  [[ ! -f "$DATA/active-inspection.txt" ]] || chown intake:intake "$DATA/active-inspection.txt"
+  chmod 0750 "$DATA"
+  # Only provision when absent; the user can rotate credentials on persistent media.
+  if [[ -d /etc/csr-intake ]]; then
+    for f in inventory.json inventory-api-key workshop.json; do
+      if [[ -f /etc/csr-intake/$f && ! -e "$DATA/config/$f" ]]; then
+        install -o intake -g intake -m 0600 "/etc/csr-intake/$f" "$DATA/config/$f"
+      fi
+    done
+  fi
+  [[ ! -f "$DATA/config/inventory-api-key" ]] || chmod 0600 "$DATA/config/inventory-api-key"
+  # Workshop TLS certificates stay on persistent media, alongside inventory config.
+  # Preserve certificate and hostname verification for Python and curl.
+  if [[ -f "$DATA/config/inventory-server.crt" ]]; then
+    install -D -m 0644 "$DATA/config/inventory-server.crt" /etc/ca-certificates/trust-source/anchors/csr-inventory.crt
+    update-ca-trust
+  fi
+fi
+install -o intake -g intake -m 0644 /usr/local/bin/intake-login /home/intake/.bash_profile
+# .bash_profile sourced by the user's real console login.