mirror of
https://github.com/ChuckBuilds/LEDMatrix.git
synced 2026-10-04 06:15:09 +00:00
ChuckandClaude Opus 5
f475038895
* fix(cache): web UI can read what the display service caches again ledmatrix-web.service carried CacheDirectory=ledmatrix. With User= set to the installing user, systemd re-owns /var/cache/ledmatrix and everything in it to that user and its primary group whenever the directory's owner differs -- for a directory root created, on the first start. That erased the root:ledmatrix setgid layout the installers set up, so every file the display service (root) wrote afterwards was root:root 0660 and unreadable by the web interface: WARNING - Permission denied loading cache for display_current_state ... Since #547 install_service.sh renders the web unit from the template, so every fresh install hit this. Measured on one rig: 392 unreadable files, and the web UI's display status, on-demand state and plugin health empty. Existing installs only receive `git pull`, never a reinstalled unit, so the fix for them is in the code the root display service runs: - DiskCache.set gives each file the directory's group (when the directory is group-writable) and 0660 on the open descriptor before the rename, independent of setgid. This also closes a window where a fresh file was visible as mkstemp's 0600. - DiskCache.share_existing_files repairs files an older version left behind, once per process from the cleanup thread. It works through O_NOFOLLOW descriptors and skips hard links and other users' files: the directory is writable by the web user, and root must not be steered into changing a file outside it. For new installs, the web unit drops CacheDirectory=/CacheDirectoryMode=, and install_web_service.sh stops replacing an existing directory's ledmatrix group with the user's group. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(web): on-demand and current-display status read the display's latest state Found testing the cache-permission fix on a rig: once the web interface could read display_on_demand_state at all, /display/on-demand/status kept answering "active" for over 100 seconds while the file on disk said "idle". Both status routes read the display service's keys through the web process's memory tier, which serves the first copy it read for the full max_age (120s). Read them with memory_ttl=0, as every other cross-process reader (plugin health/metrics, the on-demand mailbox) already does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(install): re-group the cache dir whenever the web user is outside its group install_web_service.sh replaced an existing cache directory's group only when it was root's. A directory in any other group the web user is not a member of -- root:ledmatrix, for a user who is not in ledmatrix -- was left alone, and every file root wrote there stayed unreadable to the web interface. Replace the group whenever the installing user is not in it. A directory whose group the user is already in (ledmatrix, or the user's own group where CacheDirectory= left it) is still left as it is: re-grouping a working directory strands the files already in it on the old group. When the group does change and root-owned JSON files carrying the old group are present, try-restart ledmatrix.service so DiskCache.share_existing_files re-groups them through its symlink- and hard-link-safe path, rather than a recursive chgrp. Verified under WSL's systemd for seven directory states (user group, ledmatrix member, ledmatrix non-member with and without root files, root:root, missing, unnamed gid); the previous version left the non-member case unchanged. Addresses CodeRabbit review on #593. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
38 lines
1.5 KiB
Desktop File
38 lines
1.5 KiB
Desktop File
# This is a template. Do not install it directly -- run
|
|
# scripts/install/install_web_service.sh (or install_service.sh, which
|
|
# renders this same file). Both substitute:
|
|
# __PROJECT_ROOT_DIR__ -> the directory the project is installed in
|
|
# __USER__ -> the user the web interface runs as
|
|
#
|
|
# This file is the only description of the unit. It used to be duplicated as
|
|
# an inline heredoc in both installers, which drifted apart; src/startup_validator.py
|
|
# compares the installed unit against this template, so a second copy means a
|
|
# permanent, unclearable drift warning on every boot.
|
|
|
|
[Unit]
|
|
Description=LED Matrix Web Interface Service
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=__USER__
|
|
WorkingDirectory=__PROJECT_ROOT_DIR__
|
|
Environment=USE_THREADING=1
|
|
ExecStart=/usr/bin/python3 __PROJECT_ROOT_DIR__/scripts/utils/start_web_conditionally.py
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
StandardOutput=syslog
|
|
StandardError=syslog
|
|
SyslogIdentifier=ledmatrix-web
|
|
# No CacheDirectory=. /var/cache/ledmatrix is shared with ledmatrix.service,
|
|
# which runs as root, and the installers set it up as root:ledmatrix 2775 so
|
|
# both services can read what the other writes. CacheDirectory= makes systemd
|
|
# re-own that directory and everything in it to this unit's User= and that
|
|
# user's primary group whenever the owner differs -- which, for a directory
|
|
# root created, is on the first start. That erased the shared group, and from
|
|
# then on the web interface could not read a single file the display wrote.
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|