feat: add kvm-npu and fill kvm-privacy deb packages for Rust services
kvm-npu (new): - debian/kvm-npu/ with control, postinst, prerm - config.yaml with standard model paths (/usr/share/kvm-npu/models/) - systemd service with security hardening (ProtectSystem, PrivateTmp) - Build script copies OCR + face models into package kvm-privacy (filled): - Was an empty shell (systemd-only, no binary) - Add binary install path, pii_rules.yaml config - New systemd service pointing to /usr/local/bin/info-privacy-rs - Remove hardcoded /home/pi/Desktop paths from info-privacy.service Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 4.6
Vendored
+8
@@ -0,0 +1,8 @@
|
||||
Package: kvm-npu
|
||||
Version: 1.0.0-1
|
||||
Architecture: arm64
|
||||
Maintainer: KVM-Privacy <noreply@kvm-privacy.local>
|
||||
Depends: librknnrt (>= 2.0)
|
||||
Description: NPU Daemon - Centralized RKNN inference (OCR, face, redaction)
|
||||
Manages RKNN NPU cores on RK3588 for OCR detection,
|
||||
recognition, face detection, and privacy redaction.
|
||||
+8
@@ -0,0 +1,8 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
if [ "$1" = "configure" ]; then
|
||||
systemctl daemon-reload
|
||||
systemctl enable npu-daemon.service
|
||||
systemctl start npu-daemon.service || true
|
||||
fi
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
if [ "$1" = "remove" ] || [ "$1" = "purge" ]; then
|
||||
systemctl stop npu-daemon.service || true
|
||||
systemctl disable npu-daemon.service || true
|
||||
fi
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
server:
|
||||
host: 0.0.0.0
|
||||
port: 8004
|
||||
|
||||
models:
|
||||
ocr_det: /usr/share/kvm-npu/models/ocr/ppocrv4_det.rknn
|
||||
ocr_rec_ch: /usr/share/kvm-npu/models/ocr/ch/ppocrv4_rec.rknn
|
||||
ocr_rec_en: /usr/share/kvm-npu/models/ocr/en/ppocrv4_rec.rknn
|
||||
ocr_dict_ch: /usr/share/kvm-npu/models/ocr/ch/ppocr_keys.txt
|
||||
ocr_dict_en: /usr/share/kvm-npu/models/ocr/en/ppocr_keys.txt
|
||||
face_det: /usr/share/kvm-npu/models/face/face_detection_short_range_rk3588.rknn
|
||||
|
||||
cores:
|
||||
ocr_det: core0
|
||||
ocr_rec: core1
|
||||
face_det: core0
|
||||
|
||||
scheduler:
|
||||
max_concurrent: 2
|
||||
queue_size: 32
|
||||
@@ -0,0 +1,38 @@
|
||||
[Unit]
|
||||
Description=NPU Daemon - Centralized RKNN inference service
|
||||
After=network.target
|
||||
Wants=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=pi
|
||||
Group=pi
|
||||
ExecStart=/usr/local/bin/npu-daemon --config /etc/npu-daemon/config.yaml
|
||||
|
||||
# Environment
|
||||
Environment=RUST_LOG=npu_daemon=info
|
||||
Environment=RKNN_LIB_DIR=/usr/lib
|
||||
|
||||
# CPU affinity: A55 cores (4-7) for NPU management overhead
|
||||
CPUAffinity=4 5 6 7
|
||||
|
||||
# Resource limits
|
||||
LimitNOFILE=65535
|
||||
MemoryMax=512M
|
||||
|
||||
# Restart policy
|
||||
Restart=on-failure
|
||||
RestartSec=3
|
||||
StartLimitBurst=5
|
||||
StartLimitIntervalSec=60
|
||||
|
||||
# Security hardening
|
||||
NoNewPrivileges=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=read-only
|
||||
ReadOnlyPaths=/usr/share/kvm-npu
|
||||
ReadWritePaths=/tmp
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Vendored
+2
-2
@@ -2,8 +2,8 @@ Package: kvm-privacy
|
||||
Version: 1.0.0-1
|
||||
Architecture: arm64
|
||||
Maintainer: KVM-Privacy <noreply@kvm-privacy.local>
|
||||
Depends: kvm-server (>= 1.0.0)
|
||||
Depends: kvm-npu (>= 1.0.0)
|
||||
Description: KVM Privacy PII detection service (Rust/RKNN)
|
||||
Document privacy scanning and redaction service built with Rust.
|
||||
Uses RKNN NPU for OCR and face detection on RK3588.
|
||||
Uses NPU Daemon for OCR and face detection on RK3588.
|
||||
Provides REST API for analyze/redact operations.
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
# PII 正则规则
|
||||
regex:
|
||||
id_card:
|
||||
pattern: '(?<!\d)([1-9]\d{5})(19|20)\d{2}(0[1-9]|1[0-2])(0[1-9]|[12]\d|3[01])\d{3}[\dX](?!\d)'
|
||||
security_level: high
|
||||
phone:
|
||||
pattern: '(?<!\d)((\+?86[-\s]?)?1[3-9]\d{9})(?!\d)'
|
||||
security_level: high
|
||||
bank_card:
|
||||
pattern: '(?<!\d)([1-9]\d{15,18})(?!\d)'
|
||||
security_level: high
|
||||
email:
|
||||
pattern: '\b[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}\b'
|
||||
security_level: medium
|
||||
license_plate:
|
||||
pattern: '[京津沪渝冀豫云辽黑湘皖鲁新苏浙赣鄂桂甘晋蒙陕吉闽贵粤川青藏琼宁夏][A-Z][A-Z0-9]{5,6}'
|
||||
security_level: medium
|
||||
|
||||
# 保密关键词
|
||||
confidential_keywords:
|
||||
- 机密
|
||||
- 绝密
|
||||
- 保密
|
||||
- 内部文件
|
||||
- 内部资料
|
||||
- CONFIDENTIAL
|
||||
- SECRET
|
||||
- TOP SECRET
|
||||
- RESTRICTED
|
||||
- FOR INTERNAL USE ONLY
|
||||
|
||||
# OCR + 人脸检测配置（RK3588 RKNN 子进程）
|
||||
#
|
||||
# 子模块代码路径（git submodule update --init 后自动可用）：
|
||||
# deps/ocr-rknn/ → PP-OCR RKNN Python 推理代码
|
||||
# deps/mediapipe-rknn → MediaPipe 人脸检测 RKNN 代码
|
||||
#
|
||||
# RKNN 模型文件需单独下载：
|
||||
# OCR: cd deps/ocr-rknn && python download_models.py --lang ch
|
||||
# 然后用 convert_to_rknn.py 转换，或直接复制预置 .rknn 文件
|
||||
# Face: cd deps/mediapipe-rknn && bash models/download_models.sh face
|
||||
# 然后用 convert.py 转换
|
||||
#
|
||||
# det_model / rec_model / face.model 为空时，对应功能自动禁用。
|
||||
rknn:
|
||||
ocr:
|
||||
det_model: /data/project/KVM-privacy/deps/info-privacy-rs/deps/ocr-rknn/models/PP-OCRv4/det/ppocrv4_det_ch_int8.rknn
|
||||
rec_model: /data/project/KVM-privacy/deps/info-privacy-rs/deps/ocr-rknn/models/PP-OCRv4/rec/ppocrv4_rec_ch_fp16.rknn
|
||||
dict_path: deps/ocr-rknn/dicts/ppocr_keys_v1.txt
|
||||
target: rk3588
|
||||
ppocr_dir: ""
|
||||
ocr_rknn_dir: deps/ocr-rknn
|
||||
python_bin: python3
|
||||
face:
|
||||
model: /data/project/KVM-privacy/deps/info-privacy-rs/deps/mediapipe-rknn/models/face_detection_short_range_rk3588.rknn
|
||||
mediapipe_src: deps/mediapipe-rknn
|
||||
python_bin: python3
|
||||
|
||||
# 中文姓名词典规则
|
||||
ner:
|
||||
name:
|
||||
security_level: medium
|
||||
surnames_file: configs/surnames.txt
|
||||
address:
|
||||
security_level: medium
|
||||
triggers:
|
||||
- 省
|
||||
- 市
|
||||
- 区
|
||||
- 县
|
||||
- 街道
|
||||
- 路
|
||||
- 号
|
||||
- 小区
|
||||
- 村
|
||||
@@ -0,0 +1,26 @@
|
||||
[Unit]
|
||||
Description=Info-Privacy-RS PII Detection Service (Rust/RKNN)
|
||||
After=network.target npu-daemon.service
|
||||
Wants=network.target npu-daemon.service
|
||||
StartLimitInterval=300
|
||||
StartLimitBurst=5
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=pi
|
||||
Group=pi
|
||||
WorkingDirectory=/usr/lib/kvm-privacy
|
||||
ExecStart=/usr/local/bin/info-privacy-rs
|
||||
Environment=PORT=8001
|
||||
Environment=NPU_DAEMON_URL=http://localhost:8004
|
||||
Environment=PII_RULES=/etc/kvm-privacy/pii_rules.yaml
|
||||
Restart=on-failure
|
||||
RestartSec=10
|
||||
MemoryMax=512M
|
||||
CPUAffinity=0 1
|
||||
LimitNOFILE=4096
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,7 +1,7 @@
|
||||
[Unit]
|
||||
Description=Info-Privacy-RS PII Detection Service (Rust/RKNN)
|
||||
After=network.target
|
||||
Wants=network.target
|
||||
After=network.target npu-daemon.service
|
||||
Wants=network.target npu-daemon.service
|
||||
StartLimitInterval=300
|
||||
StartLimitBurst=5
|
||||
|
||||
@@ -9,14 +9,14 @@ StartLimitBurst=5
|
||||
Type=simple
|
||||
User=pi
|
||||
Group=pi
|
||||
WorkingDirectory=/home/pi/Desktop/info-privacy-rs
|
||||
WorkingDirectory=/usr/lib/kvm-privacy
|
||||
ExecStart=/usr/local/bin/info-privacy-rs
|
||||
Environment=PORT=8001
|
||||
Environment=NPU_DAEMON_URL=http://localhost:8004
|
||||
ExecStart=/home/pi/Desktop/info-privacy-rs/target/release/info-privacy-rs
|
||||
Environment=PII_RULES=/etc/kvm-privacy/pii_rules.yaml
|
||||
Restart=on-failure
|
||||
RestartSec=10
|
||||
MemoryMax=512M
|
||||
# RK3588: pin to A55 small cores 0-1 (OCR post-processing + PII detection)
|
||||
CPUAffinity=0 1
|
||||
LimitNOFILE=4096
|
||||
StandardOutput=journal
|
||||
|
||||
Reference in New Issue
Block a user