Initial commit - Phase 3/4

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

systemd/dangerous-pi-cpu-cores.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Set default CPU cores (maxcpus) for Dangerous Pi
+# This service sets initial defaults in cmdline.txt on first boot
+# For Pi Zero 2 W, this defaults to 2 cores for thermal management
+After=local-fs.target
+Before=dangerous-pi.service
+
+[Service]
+Type=oneshot
+ExecStart=/opt/dangerous-pi/scripts/apply-cpu-cores.sh
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

systemd/dangerous-pi-frontend.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=Dangerous Pi Frontend Service
+Documentation=https://github.com/grizmin/dangerous-pi
+After=network.target dangerous-pi.service
+Wants=dangerous-pi.service
+
+[Service]
+Type=simple
+User=dt
+Group=dt
+WorkingDirectory=/opt/dangerous-pi/app/frontend
+Environment="NODE_ENV=production"
+Environment="PORT=3000"
+ExecStart=/usr/bin/node node_modules/@remix-run/serve/dist/cli.js build/server/index.js
+
+# Restart policy
+Restart=always
+RestartSec=5
+StartLimitBurst=5
+StartLimitInterval=60
+
+# Resource limits (lighter than backend)
+MemoryMax=256M
+CPUQuota=50%
+
+# Graceful shutdown
+TimeoutStopSec=10
+KillMode=mixed
+KillSignal=SIGTERM
+
+[Install]
+WantedBy=multi-user.target

systemd/dangerous-pi-nginx-config.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=Configure nginx for Dangerous Pi (HTTP/HTTPS)
+Documentation=https://github.com/yourusername/dangerous-pi
+Before=nginx.service
+After=dangerous-pi-ssl-gen.service local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/opt/dangerous-pi/scripts/configure-nginx.sh
+RemainAfterExit=yes
+
+# Run as root to manage nginx config symlinks
+User=root
+Group=root
+
+# Timeout for configuration
+TimeoutStartSec=30
+
+[Install]
+WantedBy=multi-user.target

systemd/dangerous-pi-ssl-gen.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=Generate SSL certificate for Dangerous Pi
+Documentation=https://github.com/yourusername/dangerous-pi
+Before=dangerous-pi-nginx-config.service nginx.service
+After=local-fs.target
+
+# Only run if certificate doesn't exist
+ConditionPathExists=!/opt/dangerous-pi/ssl/dangerous-pi.crt
+
+[Service]
+Type=oneshot
+ExecStart=/opt/dangerous-pi/scripts/generate-ssl-cert.sh
+RemainAfterExit=yes
+
+# Run as root to set proper permissions
+User=root
+Group=root
+
+# Timeout for certificate generation
+TimeoutStartSec=30
+
+[Install]
+WantedBy=multi-user.target

systemd/dangerous-pi.env.example

@@ -22,13 +22,31 @@ WLAN_INTERFACE=wlan0
 USB_WLAN_INTERFACE=wlan1
 
 # UPS Configuration
-UPS_I2C_ADDRESS=0x36
+# UPS_TYPE options: "pisugar", "i2c", "none"
+UPS_TYPE=i2c
 UPS_CHECK_INTERVAL=60
 
+# I2C UPS settings (for generic fuel gauge HATs like MAX17040/MAX17048)
+UPS_I2C_ADDRESS=0x36
+
+# PiSugar UPS settings (for PiSugar 2/3 series)
+UPS_PISUGAR_HOST=127.0.0.1
+UPS_PISUGAR_PORT=8423
+
 # BLE Configuration
 BLE_ENABLED=true
 BLE_DEVICE_NAME=DangerousPi
 
 # Security
 AUTH_ENABLED=false
+
+# HTTPS Configuration
+# Set HTTPS_ENABLED=true to enable HTTPS with self-signed certificates
+# On first boot with HTTPS enabled, a certificate will be automatically generated
+# The certificate is valid for 10 years and covers:
+#   - 192.168.4.1 (AP gateway IP)
+#   - dangerous-pi.local (mDNS hostname)
+#   - localhost
+# Note: Browsers will show a security warning for self-signed certificates
+# After enabling, restart services: sudo systemctl restart dangerous-pi-nginx-config nginx
 HTTPS_ENABLED=false

systemd/dangerous-pi.service

@@ -6,11 +6,12 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-User=pi
-Group=pi
+User=__DANGEROUS_PI_USER__
+Group=__DANGEROUS_PI_USER__
 WorkingDirectory=/opt/dangerous-pi
-Environment="PATH=/usr/local/bin:/usr/bin:/bin"
+Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin"
 Environment="PYTHONUNBUFFERED=1"
+Environment="PYTHONPATH=/home/__DANGEROUS_PI_USER__/.pm3/proxmark3/client/pyscripts:/home/__DANGEROUS_PI_USER__/.pm3/proxmark3/client/experimental_lib/build"
 EnvironmentFile=-/opt/dangerous-pi/.env
 
 # Main service command
@@ -33,13 +34,17 @@ CPUQuota=80%
 # Security hardening
 NoNewPrivileges=true
 PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=true
-ReadWritePaths=/opt/dangerous-pi/data /opt/dangerous-pi/logs
-ReadOnlyPaths=/opt/dangerous-pi
+ProtectSystem=full
+ProtectHome=read-only
+ReadWritePaths=/opt/dangerous-pi/data /opt/dangerous-pi/logs /etc/NetworkManager/conf.d
+ReadOnlyPaths=/opt/dangerous-pi /home/__DANGEROUS_PI_USER__/.pm3 /usr/local/bin
 
 # Allow I2C and Bluetooth access
-SupplementaryGroups=i2c bluetooth gpio dialout
+SupplementaryGroups=i2c bluetooth gpio dialout netdev
+
+# Network management capabilities (for WiFi scanning/configuration without sudo)
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
 
 # Graceful shutdown
 TimeoutStopSec=30