kyle/hermes-bot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keep ROS traffic off the LAN; load the firewall at boot

Browse Source 
DDS has no authentication, and /camera/* and /vision/faces carry video and
recognised names. Discovery now defaults to this machine only
(ROBOT_ROS_DISCOVERY=SUBNET to opt in; a ${VAR:-default} on ROS's own variable
never applied, since its setup script already exports SUBNET), and the firewall
drops domain 42's DDS ports on every interface but usb0 and loopback. The
detector's startup log prints a count of enrolled people, not their names.

robot-firewall.service loads the rules before networking at every boot: they had
only been loaded at runtime and were gone after each reboot, which has to be fixed
before the PipeWire network server opens port 4713.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs
This commit is contained in:
kyle
2026-10-04 23:15:56 -07:00
co-authored by Claude Sonnet 5.5
parent cf711060d0
commit dba756f3a6
5 changed files with 38 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pi/robot-env.sh
+5 -2
View File
@@ -3,11 +3,14 @@
# - the Raspberry Pi libcamera fork ahead of ROS's own copy (same soname, but ROS's crashes in the
# Pi image plugin: see CONTEXT.md)
# - ~/venv's site-packages first: Blinka/Adafruit for the display, OpenCV 4.10 for YuNet
# - a fixed ROS domain and subnet-only discovery, matching the host-side podman shell
# - a fixed ROS domain (42), discovery on this machine only. DDS has no authentication and the
# camera and recognised names travel on it: set ROBOT_ROS_DISCOVERY=SUBNET only to
# reach it from a host over the USB link (the firewall drops DDS ports on every other interface)
source /opt/ros/jazzy/setup.bash
[ -f "$HOME/camera_ws/install/setup.bash" ] && source "$HOME/camera_ws/install/setup.bash"
[ -f "$HOME/ros_ws/install/setup.bash" ] && source "$HOME/ros_ws/install/setup.bash"
export LD_LIBRARY_PATH="/opt/libcamera-rpi/lib/aarch64-linux-gnu:${LD_LIBRARY_PATH:-}"
export PYTHONPATH="$HOME/venv/lib/python3.12/site-packages:${PYTHONPATH:-}"
export ROS_DOMAIN_ID="${ROS_DOMAIN_ID:-42}"
export ROS_AUTOMATIC_DISCOVERY_RANGE="${ROS_AUTOMATIC_DISCOVERY_RANGE:-SUBNET}"
# ROS's own setup script exports SUBNET, so a ${VAR:-default} on the ROS variable would never apply
export ROS_AUTOMATIC_DISCOVERY_RANGE="${ROBOT_ROS_DISCOVERY:-LOCALHOST}"