kyleandClaude Sonnet 5.5
dba756f3a6
DDS has no authentication, and /camera/* and /vision/faces carry video and
recognised names. Discovery now defaults to this machine only
(ROBOT_ROS_DISCOVERY=SUBNET to opt in; a ${VAR:-default} on ROS's own variable
never applied, since its setup script already exports SUBNET), and the firewall
drops domain 42's DDS ports on every interface but usb0 and loopback. The
detector's startup log prints a count of enrolled people, not their names.
robot-firewall.service loads the rules before networking at every boot: they had
only been loaded at runtime and were gone after each reboot, which has to be fixed
before the PipeWire network server opens port 4713.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs
13 lines
588 B
Bash
Executable File
13 lines
588 B
Bash
Executable File
#!/bin/bash
|
|
# Load the robot firewall at every boot, before networking. Run as root from this directory.
|
|
# Re-runnable. Do this BEFORE enabling the PipeWire network server (4713 on all interfaces).
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
install -D -m 644 nftables-robot.nft /usr/local/etc/robot-firewall.nft
|
|
nft -c -f /usr/local/etc/robot-firewall.nft # refuse to install a broken ruleset
|
|
install -m 644 robot-firewall.service /etc/systemd/system/
|
|
systemctl daemon-reload
|
|
systemctl enable robot-firewall.service
|
|
systemctl restart robot-firewall.service
|
|
nft list table inet robot
|