This article continues from Setting up Raspberry Pi for MIX or TransSECS Deployments (Bookworm)

Complete this setup before installing MIX or the TransSECS built deployment.

For a new installation, use a Raspberry Pi 4 or Raspberry Pi 5.

A TransSECS Devices system can normally run on a 1 GB Pi or better (2GB or 4GB, for example). If the Raspberry Pi will also display a MIX or MIStudio user interface in a browser, use 4 GB or more.

A Raspberry Pi 3 can run the 32-bit operating system, but a Raspberry Pi 3 is not recommended for a new installation because the newer (4,5) versions are faster and more capable.

If your Raspberry Pi came with an OS installed on its microSD Card, you may start with this installation or you may start with a new SD Card and keep this bundled SD Card for reference.

Use a good-quality microSD card. Industrial or high-endurance cards are preferred because the Raspberry Pi may run continuously for years.

Good choices include industrial cards from Transcend or Kingston, and SanDisk High Endurance or SanDisk Ultra.

16 GB is sufficient, and 32 GB is also a good choice. An 8 GB card leaves little spare room and should only be used when all of the log limits in this guide are configured.

A Raspberry Pi 5 has a real-time clock. Install the official Raspberry Pi RTC Battery if the system needs to retain accurate time while power is off.

This guide is written for Raspberry Pi OS Bookworm.

Use:

• Raspberry Pi 4 or 5: Raspberry Pi OS 64-bit
• Raspberry Pi 3: Raspberry Pi OS 32-bit

Use Lite when the Pi will run TransSECS or MIX without its own graphical display (running headless).

Use Desktop when the Raspberry Pi itself will drive a screen, although the kiosk article also describes installing only the graphical packages which are needed.

Download Bookworm from here (scroll down to the Legacy section): https://www.raspberrypi.com/software/operating-systems/

For a standard MIX system:

A TransSECS-only system may instead use mix or pi or anything which makes sense as the hostname and username.

The examples in these articles use mix. If your login user is pi, substitute pi in paths such as /home/mix.

Raspberry Pi Imager from https://www.raspberrypi.com/software/ is the easiest method for someone who is new to Raspberry Pi and can be run from Windows, Linux, or a Mac.

In Imager:

1. Choose your Raspberry Pi model.
2. Choose the appropriate Raspberry Pi OS (Bookworm)
3. Choose the microSD card carefully. The selected device will be erased. Check that the size matches what you expect and be very cautious.
4. Open the OS customization settings.
5. Set the hostname, username, password, time zone, and keyboard layout.
6. Enable SSH using password authentication. You will need SSH for the next steps.
7. Write and verify the card.

Do not configure WiFi unless the installation requires it.

Experienced Linux users may write a downloaded .img.xz image directly using dd.

When using dd, create the SSH and user configuration on the boot partition after imaging:

sudo touch /media/$USER/bootfs/ssh
echo "mix:$(echo 'ErgoErgo' | openssl passwd -6 -stdin)" | sudo tee /media/$USER/bootfs/userconf.txt
sudo umount /media/$USER/bootfs

After the first login, set the hostname and correct time zone:

sudo raspi-config nonint do_hostname mix
timedatectl list-timezones
ssudo timedatectl set-timezone America/Los_Angeles
sudo reboot

Replace America/Los_Angeles with the correct time zone for the installation such as Europe/Rome.

Connect Ethernet and power, then allow about a minute for the first boot.

From Windows Command Prompt, PowerShell, Linux, or macOS:

ssh [email protected]

The first time you connect, SSH asks whether you trust the computer’s fingerprint. Type yes, then enter the password.

If mix.local does not work, connect using the Pi’s IP address, for example:

ssh [email protected]

Replace the example address with the actual address.

On the Pi, this command shows its hostname:

hostname

Industrial equipment and host software normally need the Pi to remain at the same IP address.

For a TransSECS-only system, use:

sudo nmtui

Choose Edit a connection, select the wired Ethernet connection, set IPv4 configuration to Manual, then enter the address, gateway, and DNS information supplied for the installation.

After saving, restart the connection:

sudo nmcli connection down "Wired connection 1" && sudo nmcli connection up "Wired connection 1"

Your SSH connection will close if the IP address changed. Reconnect using the new address.

MIX systems can also configure networking later through:

http://<Pi-address>:7226/setup.html

Choose Network Configuration.

A message such as:

sudo: unable to resolve host mix: Temporary failure in name resolution

usually means the Pi’s current hostname and /etc/hosts do not agree.

Check both:

hostname
cat /etc/hosts

The hostname should have an appropriate local entry in /etc/hosts. If correction is required:

sudo cp /etc/hosts /etc/hosts.bak.$(date +%Y%m%d_%H%M%S)
sudo nano /etc/hosts

Save with Ctrl+O, Enter, Ctrl+X.

If several Pis created from the same image will operate on the same network, give them unique hostnames. For example:

sudo raspi-config nonint do_hostname mix-line3
sudo reboot

The Linux login username does not need to change when the hostname changes.

Configure Ethernet and WiFi according to the needs of the installation.

If WiFi is not needed, it may be left unconfigured or disabled using the approved network setup for the system. For MIX systems, network configuration can be managed through the MIX setup page.

Run this once after the initial setup:

sudo apt update
sudo apt full-upgrade -y
sudo apt install -y librxtx-java libsqlite3-0 rsyslog logrotate fake-hwclock avahi-daemon unzip rsync htop ncdu
sudo reboot

These packages provide serial-port support, SQLite support, system logging, log rotation, Raspberry Pi clock recovery, .local hostname discovery, and several useful support tools.

For an ErgoTech system which will run continuously in production, software updates should be performed as a planned maintenance task rather than installed automatically.

Automatic operating-system updates can change system libraries, networking components, Chromium, Java-related packages, or other software which the ErgoTech application depends on. Disabling automatic updates helps keep a tested production system in a known configuration.

Stop and disable the unattended-upgrades service:

sudo systemctl disable unattended-upgrades
sudo systemctl stop unattended-upgrades

Stop and disable the two automatic APT update timers:

sudo systemctl disable apt-daily.timer
sudo systemctl stop apt-daily.timer

sudo systemctl disable apt-daily-upgrade.timer
sudo systemctl stop apt-daily-upgrade.timer

Prevent the system from prompting for an operating-system release upgrade.

First make a dated backup:

sudo cp /etc/update-manager/release-upgrades /etc/update-manager/release-upgrades.bak.$(date +%Y%m%d_%H%M%S)

Open the configuration file:

sudo nano /etc/update-manager/release-upgrades

Find the line beginning with:

Prompt=

Change it to:

Prompt=never

Save and exit nano:

• Press Ctrl+O to save.
• Press Enter to confirm the filename.
• Press Ctrl+X to exit.

Check the automatic-update service and timers:

systemctl status unattended-upgrades
systemctl status apt-daily.timer
systemctl status apt-daily-upgrade.timer

The unattended-upgrades service and both APT timers should show which they are disabled or inactive. Press q if a status display remains open.

Also verify the release-upgrade setting:

grep '^Prompt=' /etc/update-manager/release-upgrades

It should show:

Prompt=never

These changes do not prevent an administrator from installing updates manually later. Updates can still be performed deliberately during a maintenance period after they have been reviewed and tested.

ErgoTech applications covered by this guide use Java 8 unless ErgoTech support specifies otherwise.

For a 64-bit Raspberry Pi OS installation:

cd /tmp
wget -O java8.tar.gz "https://api.adoptium.net/v3/binary/latest/8/ga/linux/aarch64/jre/hotspot/normal/eclipse"
sudo mkdir -p /opt/java
sudo tar -xzf java8.tar.gz -C /opt/java
ls /opt/java

The ls command shows the folder which was extracted. Use the actual folder name in the next command:

sudo update-alternatives --install /usr/bin/java java /opt/java/jdk8u462-b08-jre/bin/java 100
java -version

The version should begin with:

openjdk version "1.8.0_

If Java 17 or 21 is still selected:

sudo update-alternatives --config java

Choose the Java 8 entry under /opt/java.

Only install or select Java 11 when ErgoTech support asks for it.

cd /tmp
wget -O java11.tar.gz "https://api.adoptium.net/v3/binary/latest/11/ga/linux/aarch64/jre/hotspot/normal/eclipse"
sudo tar -xzf java11.tar.gz -C /opt/java
ls /opt/java

Register the extracted Java 11 installation using its actual folder name and a lower priority than Java 8.

Linux system logs can grow surprisingly large when a device repeatedly reports an error. A nearly full SD card can make SSH and other commands extremely slow and can eventually make the system unusable.

The goal is to keep syslog and daemon.log bounded while still retaining useful diagnostic information.

First make a dated backup:

sudo cp /etc/logrotate.d/rsyslog /etc/logrotate.d/rsyslog.bak.$(date +%Y%m%d_%H%M%S)

Then edit the system log configuration:

sudo nano /etc/logrotate.d/rsyslog

Find the block which controls /var/log/syslog. If it contains size 200M, size 100M, or maxsize 100M, change the size setting to 20M while keeping the same keyword already used in the file.

Then find the block which controls /var/log/daemon.log and change its size setting to 20M in the same way.

Do not change the other logrotate settings.

Save with Ctrl+O, Enter, Ctrl+X.

Check the file before relying on it:

sudo logrotate -d /etc/logrotate.d/rsyslog

The -d option is a safe debug check. It does not actually rotate the logs. Look for a 20 MB threshold and make sure there are no error messages.

Also cap the systemd journal at 50 MB:

sudo mkdir -p /etc/systemd/journald.conf.d
printf '[Journal]\nSystemMaxUse=50M\n' | sudo tee /etc/systemd/journald.conf.d/size.conf
sudo systemctl restart systemd-journald

/etc/rc.local is a traditional Linux startup script which runs near the end of the boot process. On a Raspberry Pi it is useful for small recovery and housekeeping tasks after a power interruption.

Make a dated backup and then edit this:

sudo cp /etc/rc.local /etc/rc.local.bak.$(date +%Y%m%d_%H%M%S) 2>/dev/null
sudo nano /etc/rc.local

Replace the file with:

#!/bin/sh
 
# Print current IP address during boot
_IP=$(hostname -I) || true
if [ "$_IP" ]; then
  printf "My IP address is %s\n" "$_IP"
fi
 
# ErgoTech boot maintenance
echo "Boot maintenance started: $(date)" >> /var/log/ergotech-boot-maintenance.log
 
# Clean stale X11 lock files
rm -f /tmp/.tX0-lock /tmp/.X0-lock
rm -f /tmp/.X11-unix/X0
 
# Ensure /tmp permissions are correct
chmod 1777 /tmp
 
# Remove compressed logs older than 7 days
find /var/log -name "*.gz" -mtime +7 -delete
 
# Trim oversized Linux system logs
find /var/log -maxdepth 1 -type f \
  \( -name "syslog*" \
  -o -name "daemon.log*" \
  -o -name "auth.log*" \
  -o -name "kern.log*" \
  -o -name "messages*" \) \
  -size +20M \
  -exec truncate -s 5M {} \;
 
# Record disk usage
df -h / >> /var/log/ergotech-boot-maintenance.log
 
echo "Boot maintenance finished: $(date)" >> /var/log/ergotech-boot-maintenance.log
 
exit 0

Save with Ctrl+O, Enter, Ctrl+X.

Make the script executable and test it before rebooting:

sudo chmod +x /etc/rc.local
sudo systemctl enable rc-local 2>/dev/null
sudo sh -x /etc/rc.local
cat /var/log/ergotech-boot-maintenance.log

The test should complete without shell errors. The maintenance log should contain a start time, disk-usage information, and a finish time.

The MIX kiosk article adds two browser-specific cleanup commands to this file.

The Pi 5 has a built-in real-time clock. With the official RTC battery installed, it can retain the time while power is off.

Check:

timedatectl

The RTC time: line should contain a real date and time rather than n/a.

These models do not have a battery-backed real-time clock. fake-hwclock saves an approximate time which Linux can restore after a power interruption.

Save the clock every five minutes:

printf '*/5 * * * * root /sbin/fake-hwclock save\n' | sudo tee /etc/cron.d/fake-hwclock-5min

This causes normal log entries similar to:

CRON: (root) CMD (/usr/sbin/fake-hwclock)

Those entries mean the clock-save task is running.

Check the current time status with:

timedatectl

If the factory network has no Internet or local time server, the clock may drift. MIX provides another convenient way to set the system time by loading Get Pre-License Key on the setup page. In addition, for SECS/GEM tool applications, the host can also set the Pi's clock by sending the standard S2F31 Date and Time Set Request message. This updates the system clock in the same way which opening the MIX Get Pre-License Key page updates it from the browser.

Reboot:

sudo reboot

After about a minute, reconnect and run:

java -version
cat /var/log/ergotech-boot-maintenance.log
df -h /

Verify:

• Java reports version 1.8.0_....
• The boot-maintenance log contains a new start and finish entry from the reboot.
• The root filesystem has plenty of free space.

At this point the SD card can be used as a base master image before TransSECS or MIX is installed.

Before removing the SD card, shut the Pi down cleanly (and wait a minute before powering off):

sudo shutdown -h now

A Pi created from the image still needs the correct network settings and a unique hostname when several Pis share a network. Each individual system also requires its own ErgoTech license.