Skip to content

docs: kiosk-desktop post-merge audit — document self-service mode + fix stale agent systemd docs #107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thevladbog merged 2 commits into from
Jul 23, 2026
Merged

docs: kiosk-desktop post-merge audit — document self-service mode + fix stale agent systemd docs #107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3fbafb5
docs: document K2b self-service mode + point agent README at real sys…
Jul 23, 2026
e1e2a4f
docs: fix K2b-docs-audit PR CodeRabbit review round
Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 34 additions & 18 deletions agent/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,27 +248,43 @@ sudo chmod 666 /dev/tty.usbserial*

## Production Deployment

### Запуск как служба (systemd на Linux)

```ini
[Unit]
Description=Idento Hardware Agent
After=network.target

[Service]
Type=simple
User=idento
WorkingDirectory=/opt/idento/agent
ExecStart=/opt/idento/agent/idento-agent --port 12345
Restart=always

[Install]
WantedBy=multi-user.target
### Standalone Linux (systemd) — рекомендуемый способ

Для headless Linux-хоста (например, Raspberry Pi рядом с принтером/сканером,
подключаемого к киоску в режиме "External agent") используйте готовый бандл
из `agent/dist/`, а не ручную настройку ниже: он содержит готовый бинарник,
копирует unit-файл, добавляет пользователя в группу `dialout`, включает и
запускает сервис одной командой и печатает готовые Base URL + токен для
вставки в Equipment-шаг киоска.

```bash
# На CI под каждую архитектуру уже собирается готовый архив
# idento-agent-standalone_linux_{amd64,arm64}.tar.gz (release.yml) --
# либо соберите сами (bin попадёт туда же, откуда install.sh его возьмёт):
cd agent && go build -o dist/idento-agent .
cd dist && ./install.sh
```

`install.sh` устанавливает `idento-agent.service` (реальный unit-файл в этой
директории, `--host 0.0.0.0 --port 12345`, `Restart=on-failure`) и печатает
Base URL + auth-токен станции. Подробности подключения киоска к такому
агенту — в разделе "Connecting to a standalone agent (external mode)" файла
`desktop/README.md`.

### Ручная настройка (без install.sh)

Если готовый бандл не подходит (нестандартный путь установки, другой
пользователь и т.д.), адаптируйте `idento-agent.service` из этой директории
под свои нужды и установите вручную:

```bash
sudo systemctl enable idento-agent
sudo systemctl start idento-agent
cd agent/dist
sudo install -m 0755 idento-agent /usr/local/bin/idento-agent
sudo cp idento-agent.service /etc/systemd/system/idento-agent.service
# отредактируйте User= в скопированном unit-файле под своего пользователя
sudo usermod -a -G dialout <ваш_пользователь> # доступ к serial-сканерам/принтерам
sudo systemctl daemon-reload
sudo systemctl enable --now idento-agent.service
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Comment thread
coderabbitai[bot] marked this conversation as resolved.
```

### Запуск как служба (macOS launchd)
Expand Down
26 changes: 26 additions & 0 deletions desktop/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,32 @@ standalone agent's base URL (e.g. `http://192.168.1.50:12345`) and its auth
token (printed by `agent/dist/install.sh` on install, or found in
`~/.idento/agent_config.json` on that machine).

## Self-service mode (unattended stations)

A station can run unattended instead of staffed: on the Mode pre-flight step,
switch "Station type" to **Self-service**. This restricts scan input to
wedge/scanner (no manual code entry -- there's no operator to type a code on
a guest's behalf), shows an idle attract screen between scans, and shows
privacy-safe verdicts (name only, no check-in time/operator detail) that
auto-return to the attract screen on their own, including for a duplicate
scan (staffed mode leaves that one for an operator to dismiss; self-service
has none).

While a self-service station is running, the app window is locked down:
fullscreen, no window decorations, always on top, hidden from the
taskbar/dock, and cannot be closed via the OS's own window controls or quit
shortcuts (including macOS Cmd+Q). To exit, tap the small icon in the
screen's corner and enter a staff QR token -- the same token used for QR
login on the Login pre-flight step. A successful check releases the lockdown
and returns to the Mode step.

**Known gap**: live lockdown behavior (fullscreen actually taking effect,
window-close genuinely blocked on each OS including Cmd+Q, always-on-top
under a real window manager) has been verified against the Tauri API
surface but never exercised on real hardware. Test this on your actual
target device(s) before relying on it for a genuinely unattended
deployment.

## Auto-updates (one-time setup, before the first release)

The desktop app checks for updates against signed release manifests. Before
Expand Down
Loading