kyleandClaude Sonnet 5.5
880bdd3f44
ROS never leaves the robot, by the owner's decision: the firewall drops domain 42's DDS ports on every interface but loopback (usb0 included), discovery is pinned to LOCALHOST, and hermes_mcp is the only bridge to the outside. PipeWire 1.0.5 runs as hermes's user services with its network server on TCP 4713; the firewall, loaded at boot before it, is the protection. Verified from talos: 4713 connects over usb0 and times out over Wi-Fi. CONTEXT.md brought up to date: the face service, gaze, recognition, the firewall, and what is left. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs
18 lines
808 B
Plaintext
18 lines
808 B
Plaintext
# ~/.config/pipewire/pipewire-pulse.conf.d/50-network-server.conf (on the Pi)
|
|
#
|
|
# Lets the host reach the robot's microphone and speaker over the USB link, using the
|
|
# PulseAudio protocol that pipewire-pulse speaks.
|
|
#
|
|
# This replaces the default address list, so "unix:native" must stay in it.
|
|
# It listens on every interface and is unauthenticated: anyone who can reach port 4713 could
|
|
# listen to the microphone. The protection is the firewall (pi/nftables-robot.nft, loaded at boot
|
|
# by robot-firewall.service), which accepts 4713 only on usb0 from 10.55.0.1 and drops it on every
|
|
# other interface, Wi-Fi included. Do not enable this without that firewall loaded.
|
|
|
|
pulse.properties = {
|
|
server.address = [
|
|
"unix:native"
|
|
{ address = "tcp:4713" client.access = "unrestricted" }
|
|
]
|
|
}
|