Update kiosk to use weston
This commit is contained in:
Audiobuzz
+15
-12
@@ -258,33 +258,36 @@ build {
|
||||
]
|
||||
}
|
||||
|
||||
# --- 2b. Kiosk mode: Wayland (cage) + fullscreen Chromium ---------------
|
||||
# --- 2b. Kiosk mode: Wayland (weston kiosk-shell) + fullscreen Chromium --
|
||||
# Post-pivot graphical kiosk (no initramfs impact). Baked into the immutable
|
||||
# root, fleet-generic. Empty kiosk_url skips it. EPEL is enabled for cage +
|
||||
# root, fleet-generic. Empty kiosk_url skips it. EPEL is enabled for weston +
|
||||
# chromium — a supply-chain surface (accepted for the lab; see TODO #4).
|
||||
# NOTE: pulls in Chromium + Mesa (~hundreds of MB) — grows the uncompressed
|
||||
# erofs namespace noticeably. Graphical bring-up needs a display to verify;
|
||||
# likely tweak points: cage availability in EPEL, chromium ozone/wayland,
|
||||
# WLR_RENDERER, --disable-gpu, and SELinux AVCs for the GUI stack.
|
||||
# weston kiosk-shell is used because cage isn't packaged for EL9; weston 8.0
|
||||
# (EPEL 9) ships kiosk-shell.so and is far lighter than GDM+gnome-kiosk.
|
||||
# NOTE: pulls in Chromium + Mesa + weston (~hundreds of MB) — grows the
|
||||
# uncompressed erofs namespace noticeably. Graphical bring-up needs a display
|
||||
# to verify; likely tweak points: chromium ozone/wayland, --disable-gpu vs a
|
||||
# real GPU, /dev/dri present in the VM, and SELinux AVCs for the GUI stack.
|
||||
provisioner "shell" {
|
||||
environment_vars = ["KIOSK_URL=${var.kiosk_url}"]
|
||||
inline = [
|
||||
"set -e",
|
||||
"if [ -z \"$KIOSK_URL\" ]; then echo 'kiosk_url empty -> skipping kiosk install.'; exit 0; fi",
|
||||
"echo '==> Enabling EPEL + installing kiosk stack (cage, chromium, mesa)'",
|
||||
"echo '==> Enabling EPEL + installing kiosk stack (weston, chromium, mesa)'",
|
||||
"dnf install -y epel-release",
|
||||
"dnf install -y cage chromium mesa-dri-drivers mesa-libEGL mesa-libgbm dejavu-sans-fonts",
|
||||
"dnf install -y weston chromium mesa-dri-drivers mesa-libEGL mesa-libgbm dejavu-sans-fonts",
|
||||
# Unprivileged, passwordless kiosk user; video/input as a seat fallback.
|
||||
"id kiosk >/dev/null 2>&1 || useradd -m -G video,input kiosk",
|
||||
# Install the staged unit + wrapper.
|
||||
# Install the staged unit, weston config, and session wrapper.
|
||||
"install -D -m0755 /tmp/kiosk/kiosk-session /usr/local/bin/kiosk-session",
|
||||
"install -D -m0644 /tmp/kiosk/kiosk.service /etc/systemd/system/kiosk.service",
|
||||
# URL (from the var) + software wlroots renderer for VMs without a GPU.
|
||||
"install -D -m0644 /tmp/kiosk/weston.ini /etc/xdg/weston/weston.ini",
|
||||
# URL from the var (weston renderer is set via --use-pixman in the unit).
|
||||
"install -d -m0755 /etc/kiosk",
|
||||
"printf 'KIOSK_URL=%s\\nWLR_RENDERER=pixman\\n' \"$KIOSK_URL\" > /etc/kiosk/kiosk.env",
|
||||
"printf 'KIOSK_URL=%s\\n' \"$KIOSK_URL\" > /etc/kiosk/kiosk.env",
|
||||
"chmod 0644 /etc/kiosk/kiosk.env",
|
||||
# Label the new files so they survive into the enforcing erofs.
|
||||
"restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/kiosk",
|
||||
"restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/xdg/weston /etc/kiosk",
|
||||
# Boot graphical and start the kiosk (replaces the tty1 getty).
|
||||
"systemctl enable kiosk.service",
|
||||
"systemctl set-default graphical.target",
|
||||
|
||||
+23
-18
@@ -83,28 +83,33 @@ step 8 and §5). Retire/reset the errata afterward. Needs the design-doc source
|
||||
|
||||
## [~] 4. Kiosk mode — autologin + fullscreen Chromium loading a URL
|
||||
|
||||
**First cut implemented (2026-06-16) — needs a display to verify.** `cage`
|
||||
(Wayland single-app compositor) + Chromium from EPEL, baked into the root:
|
||||
**First cut implemented (2026-06-16) — needs a display to verify.** Wayland
|
||||
kiosk + Chromium from EPEL, baked into the root. **cage is NOT packaged for EL9**
|
||||
(`dnf install cage` → "Unable to find a match"), so switched to **weston
|
||||
kiosk-shell** (weston 8.0.0-10.el9 is in EPEL; kiosk-shell.so landed in weston
|
||||
8.0; far lighter than the GDM+gnome-kiosk alternative).
|
||||
- `kiosk_url` Packer var (default `https://www.reddit.com`; empty disables the
|
||||
whole install). Wired in CI as `KIOSK_URL` env.
|
||||
- Provisioner enables EPEL, installs `cage chromium mesa-dri-drivers mesa-libEGL
|
||||
mesa-libgbm dejavu-sans-fonts`, creates a passwordless unprivileged `kiosk`
|
||||
user (video/input groups).
|
||||
- `files/kiosk/kiosk.service` — runs `cage -s -- /usr/local/bin/kiosk-session`
|
||||
as `kiosk` on tty1 via `PAMName=login`+`TTYPath` (gets seat0 for DRM/input),
|
||||
`Conflicts=getty@tty1`, `WantedBy=graphical.target`; default target set to
|
||||
graphical.
|
||||
- Provisioner enables EPEL, installs `weston chromium mesa-dri-drivers
|
||||
mesa-libEGL mesa-libgbm dejavu-sans-fonts`, creates a passwordless
|
||||
unprivileged `kiosk` user (video/input groups).
|
||||
- `files/kiosk/kiosk.service` — runs `weston --use-pixman
|
||||
--config=/etc/xdg/weston/weston.ini` as `kiosk` on tty1 via
|
||||
`PAMName=login`+`TTYPath` (gets seat0 for DRM/input), `Conflicts=getty@tty1`,
|
||||
`WantedBy=graphical.target`; default target set to graphical.
|
||||
- `files/kiosk/weston.ini` — `shell=kiosk-shell.so`, `idle-time=0`,
|
||||
`require-input=false`, `xwayland=false`, `[autolaunch] path=/usr/local/bin/
|
||||
kiosk-session watch=true`.
|
||||
- `files/kiosk/kiosk-session` — Chromium with `--kiosk --ozone-platform=wayland
|
||||
--disable-gpu` + tmpfs profile/cache; URL from `/etc/kiosk/kiosk.env`.
|
||||
- `WLR_RENDERER=pixman` in kiosk.env for VMs without a GPU.
|
||||
- **Verify on a VM with a console (Proxmox VNC/SPICE):** cage comes up on tty1,
|
||||
Chromium loads the URL over the booted network. Likely tweak points:
|
||||
`cage` availability in EPEL 9 (else fall back to `weston --shell=kiosk-shell`),
|
||||
Chromium ozone/wayland support, dropping `--disable-gpu` on real GPUs, and
|
||||
**SELinux AVCs** for the GUI stack (check `ausearch -m avc`; now that the image
|
||||
is enforcing with labels, the kiosk may need a small policy module or booleans
|
||||
— do NOT just set permissive). Admin SSH (the key user) still works for debug
|
||||
even if the kiosk fails (it lands at graphical.target either way).
|
||||
- **Verify on a VM with a console (Proxmox VNC/SPICE):** weston comes up on
|
||||
tty1, Chromium loads the URL over the booted network. Likely tweak points:
|
||||
Chromium ozone/wayland support, dropping `--disable-gpu` on real GPUs,
|
||||
`/dev/dri` present in the VM (weston needs a DRM device — set Display to
|
||||
VirtIO-GPU/std), and **SELinux AVCs** for the GUI stack (check `ausearch -m
|
||||
avc`; the kiosk user is unconfined so likely none — but do NOT set permissive
|
||||
if they appear; add a policy module). Admin SSH (the key user) still works for
|
||||
debug even if the kiosk fails (it lands at graphical.target either way).
|
||||
- **Image size:** Chromium+Mesa add hundreds of MB to the *uncompressed* erofs —
|
||||
feeds the "shrink the rootfs" concern (and #7); reconsider whether a lighter
|
||||
browser/render path is viable.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
[Unit]
|
||||
Description=Wayland kiosk (cage + Chromium)
|
||||
Documentation=https://github.com/cage-kiosk/cage
|
||||
Description=Wayland kiosk (weston kiosk-shell + Chromium)
|
||||
Documentation=man:weston(1) man:weston.ini(5)
|
||||
# Take over tty1 from the login getty and start after the network is up (the
|
||||
# kiosk loads a URL). plymouth-quit lets the splash hand off cleanly.
|
||||
After=systemd-user-sessions.service plymouth-quit-wait.service getty@tty1.service network-online.target
|
||||
@@ -24,8 +24,12 @@ StandardError=journal
|
||||
UtmpIdentifier=tty1
|
||||
UtmpMode=user
|
||||
EnvironmentFile=/etc/kiosk/kiosk.env
|
||||
# cage -s: single-client kiosk compositor; runs the wrapper, exits when it does.
|
||||
ExecStart=/usr/bin/cage -s -- /usr/local/bin/kiosk-session
|
||||
# weston with kiosk-shell (every app fullscreen). --use-pixman = software
|
||||
# rendering for VMs/no-GPU. weston.ini's [autolaunch] runs /usr/local/bin/
|
||||
# kiosk-session (Chromium) and, with watch=true, weston exits if it dies — so
|
||||
# Restart=always relaunches the whole stack. cage (the original choice) isn't
|
||||
# packaged for EL9; weston kiosk-shell is the minimal EL9-available equivalent.
|
||||
ExecStart=/usr/bin/weston --use-pixman --config=/etc/xdg/weston/weston.ini
|
||||
Restart=always
|
||||
RestartSec=2
|
||||
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
# weston kiosk configuration (consumed by kiosk.service: weston --config=...).
|
||||
#
|
||||
# kiosk-shell makes every client fullscreen with no decorations/desktop — the
|
||||
# kiosk behaviour cage gave us. The [autolaunch] app is the Chromium wrapper;
|
||||
# watch=true makes weston exit when it exits, so kiosk.service (Restart=always)
|
||||
# relaunches the whole stack on a browser crash.
|
||||
|
||||
[core]
|
||||
shell=kiosk-shell.so
|
||||
# No screen blanking on a kiosk.
|
||||
idle-time=0
|
||||
# Don't refuse to start if no input device is present (headless/VM consoles).
|
||||
require-input=false
|
||||
# No X11 apps here — Chromium runs native Wayland (--ozone-platform=wayland).
|
||||
xwayland=false
|
||||
|
||||
[autolaunch]
|
||||
path=/usr/local/bin/kiosk-session
|
||||
watch=true
|
||||
Reference in New Issue
Block a user