Merge branch 'chore/refine-setup' into 'master'

### Base Image

1. Use the official “Raspberry Pi Imager” to flash an SD card

    - Use “Raspberry Pi OS” (the one recommended)

    - Use “Raspberry Pi OS Lite”

    - Use custom OS settings:

        - Hostname `poolpaypi`(`.local`)

        - Username `jakob`

4. Use an ethernet cable to connect the Pi to your main computer

    - Your computer should immediately start acting as a “wired hotspot” now and provide IP address and internet access to the Pi.

5. You can now `ssh jakob@poolpaypi.local` on your main computer and it shoud Just Work™.

6. Check `/etc/ssh/sshd_config` to ensure it contains `PasswordAuthentication no`.

    - This should already be the case.

### NFC Reader

1. Open `sudo raspi-config`

2. Go to “Interface Options”

3. Go to “SPI”

4. Enable it (no reboot necessary)

4. Enable it

    - This will enable the first SPI bus (SPI0)

5. Add the line `dtoverlay=spi1-1cs,cs0_pin=16` somewhere in `/boot/firmware/config.txt` (reboot might be necessary here)

    - This will enable the second SPI bus (SPI1). Furthermore, it will set the Chip Select pin for device 0 (`cs0`) to GPIO 16.

### Display

1. Connect the display by placing it on the GPIO header

2. Append the following line to `/boot/firmware/config.txt`

2. Add the following line to `/boot/firmware/config.txt`

    ```ini

    dtoverlay=fbtft,spi0-0,ili9486,width=320,height=480,regwidth=16,reset_pin=25,dc_pin=24,rotate=270

### Software

Install dependencies:

Install dependencies (`tmux` and `vim` are not necessary, but might be helpful):

```bash

sudo apt install cryptsetup

sudo apt install -y cryptsetup git libsdl2-2.0-0 libsdl2-ttf-2.0-0 tmux vim

```

Create a user account called `poolpay`. Equip it with the necessary permissions:

Create a user account called `poolpay` (with a secure, auto-generated password) and make sure it has the necessary permissions:

- Allow `poolpay` to access GPIO

- Allow `poolpay` to use `sudo` **to use `luks`** (don't give it general sudo access)!

```bash

sudo adduser poolpay

sudo usermod -a -G gpio,spi,video poolpay

```

Give it the permission to use `sudo` without an additional password prompt (`sudo nano /etc/sudoers.d/010_poolpay-nopasswd`):

Create a folder `/coli`, cd into it and make sure the permissions are correct.

```

poolpay ALL=(ALL) NOPASSWD: ALL

```

Clone the repository (you can use a Project Access Token for that, Settings → Access Tokens) and cd into it.

Create a folder `/coli`, and adjust the permission to `jakob`:

```bash

sudo mkdir /coli

sudo chown jakob:jakob /coli

cd /coli

```

Clone the repository and set everything up:

```bash

git clone https://gitlab.cl.uni-heidelberg.de/moser/poolpay.git

cd /coli/poolpay

python3 -m venv venv

source venv/bin/activate

pip install -r requirements.txt

pip uninstall rpi-gpio  # We want to use rpi-lgpio instead

sudo chown poolpay:poolpay /coli/poolpay

```

You can then, for example, run the card interfacing tool using:

As last step, deploy the systemd unit:

```bash

python3 -m poolpay.card id

sudo cp /coli/poolpay/poolpay.service /etc/systemd/system

sudo systemctl enable poolpay

```

As last step, deploy the systemd unit:

Reboot. The application should start automatically.

You now need to provide it with a password to create (or, at later starts, unlock) the vault:

```bash

sudo cp /coli/poolpay/poolpay.service /etc/systemd/system

sudo systemctl enable --now poolpay

sudo su poolpay

cd /coli/poolpay

source venv/bin/activate

python3 -m poolpay.admin unlock

```

You could also, for example, run the card interfacing tool:

```bash

python3 -m poolpay.card id

```

## License

We need to use `rpi-lgpio` instead of `rpi-gpio` so that edge detection works.

See Raspberry Pi book, page 632 and 624.

Or maybe we don't. I haven't quite figured out how this all works. This might be a helpful line, but it doesn't work out of the box:

```

pip uninstall RPi.GPIO

```

    return parser.parse_args()

def run_app() -> None:

    try:

        db.open(paths.db_file)

        app.run()

    finally:

        db.close()

args = parse_args()

vault = Vault(paths.vault_file, paths.instance_dir)

if not vault.is_open:

    # Vault was not open, so we get the password, and in case the action was "unlock", we unlock it

    password = get_password()

    if args.action == "unlock":

        with Client(socket_path) as c:

            c.send({"action": "unlock", "password": password})

else:

    print("🔓 The PoolPay database is already [green]unlocked[/green].")

    password = None

match args.action:

    case "ui":

if args.action == "ui":

    if password:

        with vault.open(password):

            try:

                db.open(paths.db_file)

                app.run()

            finally:

                db.close()

    case "unlock":

        if password is not None:

            with Client(socket_path) as c:

                c.send({"action": "unlock", "password": password})

            run_app()

    else:

        run_app()