Hardening a raspberry pi 3B

Question

I have a Raspberry Pi 3B+, running NOOBS. I'm using it for home automation, and it's important to me that it never fail (or if lightning fries it, that it be trivial to swap in a new one. Downtime is very unacceptable.)

Step 1 was having it boot off the SD card, but moving/to a much larger external SSD drive. I needed the space and wanted to minimize writes to the SD card. I got that to work despite some misinformation from Adafruit's website. But when I shut the pi down, I see activity on the external drive as I'd expect, but then I see the green led on the pi flashing, suggesting it's writing to that SD card. (Or is that read activity?)

What's it doing? I don't want the SD card touched - it's there for boot, period. It's been suggested I mount it read-only. Is that a viable option and how is it done?

My next step is to give it a backup power supply.

What else do I need to do? Since I also want the SSD to last a long time, I'm considering moving /tmp and /var/logs to tmpfs. Are there other steps that should be taken?

Finally, I'd like to initiate a controlled shutdown on power failure. Normally I'd poll the Ethernet carrier signal once every few seconds and code a shutdown if it drops; but I'd like to keep this pi wireless to minimize chances of it frying when nearby lightning strikes happen (which in my area isn't uncommon.) Is there something I can poll to indicate when there's no Wi-Fi signal from a particular access point? The alternative is to rig up something with wiringPi and an optoisolator, which I can do, but it's an annoying approach - more wires and more hardware to fail.

Answer 1

Change the line (substituting your PARTUUID)

PARTUUID=2b762eaa-01  /boot           vfat    defaults          0       2

To either of

PARTUUID=2b762eaa-01  /boot           vfat    ro          0       2
PARTUUID=2b762eaa-01  /boot           vfat    noauto          0       2

I would just use the latter as there is no need to mount it, because it is not used, except to upgrade if there is new firmware. This way you can manually mount to perform upgrades.

Frankly, I wouldn't bother, as there is almost no prospect of its being damaged, although I ofter use a line similar to the 1st to mount HFS drives I want to read but don't want Linux fiddling with.

Your situation is possibly different to this, as you use NOOBS. Virtually none of the experienced users do this, we just use Raspbian, or other OS.

NOOBS is (among other things) a boot manager; it is actually booting to a special OS, which is used to then check user input and then boot the selected OS. This special OS is actually on the SD Card - so you are using 3 SD Card partitions to start your system.

You have asked several questions - again you likely get more productive responses if you stick to one question.

There are hundreds (if not thousands) of questions about safe shutdown. Simply this can only be done with external hardware. The Pi (in common with most other computers without battery) risks damage from uncontrolled loss of power, although the likelihood is much overstated.

Answer 2

Some random Ideas.

Mount with option noatime (by default access time is written when file is read), relatime is a good compromise.

After moving the bits you write to, to another disk, and mounting. Then mount readonly.

Configure journaling to maximum. It may be a little slower, but it will make the file-system robust to sudden power off.

Add redundancy: Two pies with independent power supply.

Lightning protectors: If lightning is frying your stuff, then get a lightning protector fitted to your house.