sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Update kiosk to use weston

Browse Source
This commit is contained in:
Audiobuzz
2026-06-17 09:32:59 +00:00
parent 61088d4e6d
commit 0bcf6fb2aa
4 changed files with 65 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+23 -18
View File
@@ -83,28 +83,33 @@ step 8 and §5). Retire/reset the errata afterward. Needs the design-doc source
## [~] 4. Kiosk mode — autologin + fullscreen Chromium loading a URL
**First cut implemented (2026-06-16) — needs a display to verify.** `cage`
(Wayland single-app compositor) + Chromium from EPEL, baked into the root:
**First cut implemented (2026-06-16) — needs a display to verify.** Wayland
kiosk + Chromium from EPEL, baked into the root. **cage is NOT packaged for EL9**
(`dnf install cage` → "Unable to find a match"), so switched to **weston
kiosk-shell** (weston 8.0.0-10.el9 is in EPEL; kiosk-shell.so landed in weston
8.0; far lighter than the GDM+gnome-kiosk alternative).
- `kiosk_url` Packer var (default `https://www.reddit.com`; empty disables the
whole install). Wired in CI as `KIOSK_URL` env.
- Provisioner enables EPEL, installs `cage chromium mesa-dri-drivers mesa-libEGL
mesa-libgbm dejavu-sans-fonts`, creates a passwordless unprivileged `kiosk`
user (video/input groups).
- `files/kiosk/kiosk.service` — runs `cage -s -- /usr/local/bin/kiosk-session`
as `kiosk` on tty1 via `PAMName=login`+`TTYPath` (gets seat0 for DRM/input),
`Conflicts=getty@tty1`, `WantedBy=graphical.target`; default target set to
graphical.
- Provisioner enables EPEL, installs `weston chromium mesa-dri-drivers
mesa-libEGL mesa-libgbm dejavu-sans-fonts`, creates a passwordless
unprivileged `kiosk` user (video/input groups).
- `files/kiosk/kiosk.service` — runs `weston --use-pixman
--config=/etc/xdg/weston/weston.ini` as `kiosk` on tty1 via
`PAMName=login`+`TTYPath` (gets seat0 for DRM/input), `Conflicts=getty@tty1`,
`WantedBy=graphical.target`; default target set to graphical.
- `files/kiosk/weston.ini` — `shell=kiosk-shell.so`, `idle-time=0`,
`require-input=false`, `xwayland=false`, `[autolaunch] path=/usr/local/bin/
kiosk-session watch=true`.
- `files/kiosk/kiosk-session` — Chromium with `--kiosk --ozone-platform=wayland
--disable-gpu` + tmpfs profile/cache; URL from `/etc/kiosk/kiosk.env`.
- `WLR_RENDERER=pixman` in kiosk.env for VMs without a GPU.
- **Verify on a VM with a console (Proxmox VNC/SPICE):** cage comes up on tty1,
Chromium loads the URL over the booted network. Likely tweak points:
`cage` availability in EPEL 9 (else fall back to `weston --shell=kiosk-shell`),
Chromium ozone/wayland support, dropping `--disable-gpu` on real GPUs, and
**SELinux AVCs** for the GUI stack (check `ausearch -m avc`; now that the image
is enforcing with labels, the kiosk may need a small policy module or booleans
— do NOT just set permissive). Admin SSH (the key user) still works for debug
even if the kiosk fails (it lands at graphical.target either way).
- **Verify on a VM with a console (Proxmox VNC/SPICE):** weston comes up on
tty1, Chromium loads the URL over the booted network. Likely tweak points:
Chromium ozone/wayland support, dropping `--disable-gpu` on real GPUs,
`/dev/dri` present in the VM (weston needs a DRM device — set Display to
VirtIO-GPU/std), and **SELinux AVCs** for the GUI stack (check `ausearch -m
avc`; the kiosk user is unconfined so likely none — but do NOT set permissive
if they appear; add a policy module). Admin SSH (the key user) still works for
debug even if the kiosk fails (it lands at graphical.target either way).
- **Image size:** Chromium+Mesa add hundreds of MB to the *uncompressed* erofs —
feeds the "shrink the rootfs" concern (and #7); reconsider whether a lighter
browser/render path is viable.