From 045892bc94a3f9063d9ed08eeb128f50a1632e32 Mon Sep 17 00:00:00 2001 From: Julian Cuni Date: Sat, 27 Jun 2026 14:23:02 +0200 Subject: [PATCH] fix(deploy): group_add lp (gid 7) so the server can write the USB printer node MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit USB passthrough (1ea1aa4) made /dev/usb/lp1 visible in the container, but the node is `crw-rw---- root:lp` (660) and the server runs as the non-root `app` user, not in `lp` — so open(O_WRONLY) → EACCES → printer still "offline". Add the host's `lp` GID (7 on this Ubuntu booth, verified `getent group lp` → lp:x:7:) via group_add, so the app process gains the supplementary group that owns the node. Least-privilege: no world-writable device, no root, no image rebuild. (If a future booth's lp GID differs, update the number.) Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V --- docker-compose.prod.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index 7127349..2c8919f 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -60,6 +60,15 @@ services: # open(). `180:*` covers lp0/lp1/lp2… so a USB replug/boot-order renumber still works # (the printer's path can move; set Connection=USB + the matching /dev/usb/lpN in setup). # (Bind-mounting the dir, not a single `devices:` node, is what survives renumbering.) + # + # ...AND access: the lpN node is `crw-rw---- root:lp` (mode 660). The server runs as the + # non-root `app` user, which is NOT in `lp`, so open(O_WRONLY) → EACCES → still "offline". + # group_add the HOST's `lp` GID (numeric — `getent group lp`, typically 7 on Debian/Ubuntu) + # so the app process gains that supplementary group and can write the 660 node. Least- + # privilege (no world-writable device, no root, no rebuild). VERIFY the GID on the booth; + # if the host's lp GID differs, change the number here. + group_add: + - "7" volumes: - /dev/usb:/dev/usb device_cgroup_rules: