kyleandClaude Sonnet 5.5
dba756f3a6
DDS has no authentication, and /camera/* and /vision/faces carry video and
recognised names. Discovery now defaults to this machine only
(ROBOT_ROS_DISCOVERY=SUBNET to opt in; a ${VAR:-default} on ROS's own variable
never applied, since its setup script already exports SUBNET), and the firewall
drops domain 42's DDS ports on every interface but usb0 and loopback. The
detector's startup log prints a count of enrolled people, not their names.
robot-firewall.service loads the rules before networking at every boot: they had
only been loaded at runtime and were gone after each reboot, which has to be fixed
before the PipeWire network server opens port 4713.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs
16 lines
373 B
Desktop File
16 lines
373 B
Desktop File
[Unit]
|
|
Description=Robot firewall: audio, MCP and webhook ports only over the USB link
|
|
Before=network-pre.target
|
|
Wants=network-pre.target
|
|
DefaultDependencies=no
|
|
After=local-fs.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/sbin/nft -f /usr/local/etc/robot-firewall.nft
|
|
ExecStop=/usr/sbin/nft delete table inet robot
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|