From 3ef34745c97c3d3574520b303fdb6a0fb55e2bee Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Wed, 17 Jun 2026 14:28:27 +0000 Subject: [PATCH] Adding Plymouth --- .gitea/workflows/gitea-main-ci.yaml | 13 ++++- CLAUDE.md | 15 ++++- diskless.pkr.hcl | 22 +++++++- docs/TODO.md | 27 ++++++--- files/etc/dracut.conf.d/90-diskless.conf | 8 +++ http/ks.cfg | 1 - scripts/extract-artifacts.sh | 15 +++++ serving/README.md | 3 + serving/docker-compose.yml | 4 ++ serving/http/default.conf | 26 +++++++++ serving/http/kiosk/index.html | 72 ++++++++++++++++++++++++ 11 files changed, 188 insertions(+), 18 deletions(-) create mode 100644 serving/http/default.conf create mode 100644 serving/http/kiosk/index.html diff --git a/.gitea/workflows/gitea-main-ci.yaml b/.gitea/workflows/gitea-main-ci.yaml index 45cd395..b01361b 100644 --- a/.gitea/workflows/gitea-main-ci.yaml +++ b/.gitea/workflows/gitea-main-ci.yaml @@ -49,8 +49,16 @@ env: # per-environment DNS name (e.g. nvme.fleet.lab) resolved at boot so one UKI # works across environments — the serving stack's dnsmasq resolves it. NVMET_TRADDR: "192.168.50.10" - # URL the fullscreen Chromium kiosk loads at boot. Empty disables the kiosk. - KIOSK_URL: "https://www.reddit.com" + # URL the fullscreen Chromium kiosk loads at boot. Defaults to the test page + # served by the boot HTTP server (serving/http/kiosk) at /kiosk/; boot.fleet.lab + # resolves to the serving host via the stack's dnsmasq. Empty disables the kiosk. + KIOSK_URL: "http://boot.fleet.lab/kiosk/" + # Plymouth boot splash. "false" => verbose console boot (rhgb quiet NOT baked; + # plymouth.enable=0 instead) — kept OFF in CI while the network-manager port is + # being bench-verified, so the boot chain stays debuggable. Flip to "true" to + # ship the graphical splash once boot is trusted. (Plymouth is in the image + # either way; this only flips the cmdline.) + BOOT_SPLASH: "false" # =========================================================================== # TEMPORARY: 802.1X + MACsec are DISABLED for this build (rd.dot1x=0) so the # UKI / rootfs / NVMe-oF boot path can be validated on an OPEN switch port. @@ -178,4 +186,5 @@ jobs: -var nvmet_traddr="${{ env.NVMET_TRADDR }}" \ -var ssh_authorized_key="${{ secrets.SSH_AUTHORIZED_KEY }}" \ -var kiosk_url="${{ env.KIOSK_URL }}" \ + -var boot_splash=${{ env.BOOT_SPLASH }} \ . diff --git a/CLAUDE.md b/CLAUDE.md index 218c108..ec3d422 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -161,9 +161,10 @@ instead of working around it. `network-manager` module hands its initramfs connections to the real-root NM (state under `/run/NetworkManager`), which renews the lease. No more `dhcp-client`/`dhclient` (deprecated). The hook drives macsec0 DHCP via `nmcli` - (not `ifup`). See invariant on the managed/unmanaged split. BENCH-VERIFY: lease - actually renews past expiry (test path); macsec0 managed + `en*` unmanaged with - MKA surviving switch-root (secure path). + (not `ifup`). See invariant on the managed/unmanaged split. Test path + VERIFIED on the bench 2026-06-17 (lease renews past expiry; host stays up). + STILL BENCH-VERIFY when `disable_dot1x=false`: macsec0 managed + `en*` + unmanaged with MKA surviving switch-root (secure path). - Writable root overlay is `systemd.volatile=overlay`, **not** `rootovl`: RHEL/Rocky dracut ships no `overlayfs`/`rootovl` module. Needs `systemd-volatile-root.service` in the initramfs (bundled by recent dracut; @@ -194,6 +195,14 @@ These bit us bringing the build up on Rocky 9.8; they are easy to regress. stack stays in the image, dormant. The matching lab DHCP/HTTP/NVMe-oF serving stack lives in `serving/` (docker compose). Re-enable security by dropping the var / setting `DISABLE_DOT1X: "false"` in the CI workflow. +- **Boot splash toggle**: `boot_splash=true` (default) bakes `rhgb quiet` for a + Plymouth graphical splash (theme `spinner`, set in the provisioner); `false` + bakes `plymouth.enable=0` for a verbose console boot — keep it OFF while + debugging the boot chain. Plymouth is always in the image + initramfs (the + `plymouth` dracut module, which pulls `drm`); only the cmdline changes. CI + currently sets `BOOT_SPLASH: "false"` during the network-manager bench-verify. + Press ESC at boot to see details behind a splash. ks.cfg no longer excludes + `plymouth`. ## Testing changes diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl index a87b0d3..1e335aa 100644 --- a/diskless.pkr.hcl +++ b/diskless.pkr.hcl @@ -120,8 +120,14 @@ variable "enable_kiosk" { variable "kiosk_url" { type = string - description = "URL the fullscreen Chromium kiosk loads at boot (cage Wayland session on tty1, baked into the immutable root). Empty disables the kiosk install entirely. A runtime config-agent could override it later via /etc/kiosk/kiosk.env." - default = "https://www.reddit.com" + description = "URL the fullscreen Chromium kiosk loads at boot (weston session on tty1, baked into the immutable root). Defaults to the self-contained test page served by the lab boot HTTP server at /kiosk/ (boot.fleet.lab resolves to the serving host via the stack's dnsmasq) — validates the boot end-to-end without external connectivity. Empty disables the kiosk install entirely. A runtime config-agent could override it later via /etc/kiosk/kiosk.env." + default = "http://boot.fleet.lab/kiosk/" +} + +variable "boot_splash" { + type = bool + description = "true (default): bake 'rhgb quiet' into the UKI cmdline so Plymouth shows a graphical boot splash (covers the network-auth + NVMe/TCP + verity phase). false: bake 'plymouth.enable=0' for a fully verbose console boot — use while debugging the boot chain. Plymouth itself is always in the image; this only flips the cmdline. (The cmdline is immutable once signed, so this is a build-time choice.)" + default = true } variable "sb_key" { @@ -222,6 +228,14 @@ build { # dracut warns and silently falls back to gzip (a larger initramfs). "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network NetworkManager zstd openssl", + # Plymouth boot splash. plymouth-scripts provides plymouth-set-default-theme; + # spinner is the clean modern theme. Set the default theme BEFORE the dracut + # build below so the (-no-hostonly) initramfs bundles it; no -R here because + # we rebuild the initramfs explicitly. Whether the splash shows at boot is + # decided by the cmdline (boot_splash var), not by installing this. + "dnf -y install plymouth plymouth-scripts plymouth-theme-spinner", + "plymouth-set-default-theme spinner", + # Stage etc files into place "install -D -m0644 /tmp/etc-stage/dot1x/radius-ca.pem /etc/dot1x/radius-ca.pem", "install -D -m0644 /tmp/etc-stage/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf", @@ -266,6 +280,8 @@ build { # a dracut hook). "grep -q 'nm-unmanaged.sh' /tmp/lsinitrd.txt || { echo 'ERROR: nm-unmanaged.sh hook missing from initramfs' >&2; exit 1; }", "grep -q 'nvmf-connect.service' /tmp/lsinitrd.txt || { echo 'ERROR: nvmf-connect.service missing from initramfs' >&2; exit 1; }", + # Plymouth must be in the initramfs to splash during the early boot phase. + "grep -q 'plymouthd' /tmp/lsinitrd.txt || { echo 'ERROR: plymouth missing from initramfs (plymouth dracut module not installed)' >&2; exit 1; }", # ---- Build hygiene --------------------------------------------------- "dnf clean all", @@ -402,7 +418,7 @@ build { # home dirs) — we dropped mkfs.erofs --all-root, which used to mask this by # flattening everything to root:root. sudo is a no-op if already root, and # the runner has passwordless sudo (cf. the `sudo apt-get` install step). - "sudo bash -c \"NVMET_TRADDR='${var.nvmet_traddr}' bash scripts/extract-artifacts.sh output-qemu/diskless-build.qcow2 ${var.artifact_dir}/${var.image_version} ${var.disable_dot1x}\"", + "sudo bash -c \"NVMET_TRADDR='${var.nvmet_traddr}' BOOT_SPLASH='${var.boot_splash}' bash scripts/extract-artifacts.sh output-qemu/diskless-build.qcow2 ${var.artifact_dir}/${var.image_version} ${var.disable_dot1x}\"", # Hand the OUTPUT FILES back to the build user (their in-erofs ownership is # already baked correctly) so build-oci.sh can write the UKI and push with # the build user's `buildah login`. diff --git a/docs/TODO.md b/docs/TODO.md index 6ce83b6..698cfd0 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -5,13 +5,18 @@ Persistent backlog, kept in sync with the working session task tracker. Status: --- -## [~] 1. Port the dracut module off `network-legacy` → `network-manager` +## [x] 1. Port the dracut module off `network-legacy` → `network-manager` -**IMPLEMENTED 2026-06-17 — awaiting boot-bench verification.** Fixes the -confirmed lease-expiry outage: network-legacy's one-shot DHCP lease was never -renewed post-switch-root, so the address dropped at lease expiry → NVMe/TCP root -died ("keep alive timeout" / "no route to host"). NM hands its initramfs -connections to the real-root NM (`/run/NetworkManager` state), which renews. +**DONE — test path VERIFIED ON THE BENCH 2026-06-17** (host stays up past the +DHCP lease time; no more lease-expiry outage). Fixed the confirmed outage: +network-legacy's one-shot DHCP lease was never renewed post-switch-root, so the +address dropped at lease expiry → NVMe/TCP root died ("keep alive timeout" / +"no route to host"). NM hands its initramfs connections to the real-root NM +(`/run/NetworkManager` state), which renews. + +REMAINING: the **secure path** (macsec0 DHCP via `nmcli`, physical NIC unmanaged +via `nm-unmanaged.sh`) is only exercised once `disable_dot1x=false` — verify on +the swtpm + hostapd + FreeRADIUS bench when re-enabling security (see #2/cleanup). Done: - `90-diskless.conf` `add_dracutmodules`: `network-legacy` → `network-manager`. @@ -125,8 +130,11 @@ Path to getting here (don't re-discover): smaller image. **Re-enable with `-var enable_kiosk=true` when returning to kiosk work** — CI does not pass the var, so CI currently builds lean (no kiosk) too; add `-var enable_kiosk=true` to the Gitea workflow to ship it. -- `kiosk_url` Packer var (default `https://www.reddit.com`; empty disables the - whole install). Wired in CI as `KIOSK_URL` env. +- `kiosk_url` Packer var (default `http://boot.fleet.lab/kiosk/` — the + self-contained test page served by the boot HTTP server at + `serving/http/kiosk/`, via the `/kiosk/` nginx location; validates a boot + without external connectivity. Empty disables the whole install). Wired in CI + as `KIOSK_URL` env. - Provisioner enables EPEL, installs `weston chromium mesa-dri-drivers mesa-libEGL mesa-libgbm dejavu-sans-fonts`, creates a passwordless unprivileged `kiosk` user (video/input groups). @@ -156,7 +164,8 @@ Path to getting here (don't re-discover): Make the diskless workstation boot straight into a locked-down kiosk: a -fullscreen Chromium showing a configured site (initial target: Reddit). All +fullscreen Chromium showing a configured site (default: the boot HTTP server's +`/kiosk/` test page). All baked at **build time** into the root tree (immutable erofs/verity root; runtime is the tmpfs overlay), fleet-generic (no per-host state). diff --git a/files/etc/dracut.conf.d/90-diskless.conf b/files/etc/dracut.conf.d/90-diskless.conf index f959368..a58470e 100644 --- a/files/etc/dracut.conf.d/90-diskless.conf +++ b/files/etc/dracut.conf.d/90-diskless.conf @@ -15,6 +15,14 @@ hostonly="no" # lease was never renewed post-switch-root -> the address was dropped at lease # expiry -> NVMe/TCP root died ("keep alive timeout" / "no route to host"). add_dracutmodules+=" dot1x-macsec network-manager nvmf systemd-veritysetup " +# plymouth: graphical boot splash, shown from early initramfs through the long +# network-auth + NVMe/TCP + verity phase until the kiosk/login takes over. The +# plymouth dracut module depends on 'drm', which in --no-hostonly mode pulls a +# broad set of DRM/KMS drivers (incl. the VM's bochs/virtio-gpu); if a specific +# fleet GPU's splash doesn't render, add its drm kmod to add_drivers like the +# NICs. Whether the splash actually displays is gated by the cmdline (rhgb quiet +# vs plymouth.enable=0), set from the boot_splash var in extract-artifacts.sh. +add_dracutmodules+=" plymouth " filesystems+=" erofs overlay " add_drivers+=" macsec nvme-tcp nvme-fabrics dm-verity @NIC_DRIVERS@ " install_items+=" /etc/dot1x/radius-ca.pem /etc/dot1x/wpa_supplicant-dot1x.conf " diff --git a/http/ks.cfg b/http/ks.cfg index cab41f3..ef8c847 100644 --- a/http/ks.cfg +++ b/http/ks.cfg @@ -32,7 +32,6 @@ reboot kernel openssh-server chrony --plymouth -firewalld %end diff --git a/scripts/extract-artifacts.sh b/scripts/extract-artifacts.sh index 3e46851..d88f6ab 100755 --- a/scripts/extract-artifacts.sh +++ b/scripts/extract-artifacts.sh @@ -23,6 +23,10 @@ DISABLE_DOT1X=${3:-false} # environments. Defaults to the literal placeholder so build-oci.sh's warning # fires if it was never set. NVMET_TRADDR=${NVMET_TRADDR:-NVMET_TRADDR} +# Plymouth boot splash toggle (from the boot_splash Packer var). "true" bakes +# "rhgb quiet" so Plymouth shows the graphical splash; anything else bakes +# "plymouth.enable=0" for a fully verbose console boot (boot-chain debugging). +BOOT_SPLASH=${BOOT_SPLASH:-true} # Stable namespace UUIDs. Devices are referenced by-id # (/dev/disk/by-id/nvme-uuid.) rather than /dev/nvmeNnM because NVMe # controller/namespace indices are NOT stable (a transient discovery controller @@ -142,6 +146,16 @@ jq -n --arg hash "$ROOT_HASH" --arg erofs_uuid "$FIXED_UUID" \ # The device node assumes the root namespace is the host's first/only # NVMe/TCP namespace; adjust if not. NVMET_TRADDR: set per environment # *before* the UKI build, since the cmdline is immutable once signed. +# Plymouth: rhgb (Red Hat graphical boot) + quiet for a clean splash, or +# plymouth.enable=0 for a verbose debug boot. Press ESC at boot to see details +# behind the splash; or override at runtime via the SMBIOS Type 11 +# io.systemd.stub.kernel-cmdline-extra OEM string (adds args without a rebuild). +if [ "$BOOT_SPLASH" = "true" ]; then + SPLASH_FRAGMENT="rhgb quiet " +else + SPLASH_FRAGMENT="plymouth.enable=0 " +fi + DOT1X_FRAGMENT="" if [ "$DISABLE_DOT1X" = "true" ]; then echo "==> WARNING: building TEST cmdline with rd.dot1x=0 (802.1X + MACsec DISABLED)" >&2 @@ -154,6 +168,7 @@ if [ "$DISABLE_DOT1X" = "true" ]; then DOT1X_FRAGMENT="rd.dot1x=0 ip=dhcp " fi printf '%s' \ + "$SPLASH_FRAGMENT" \ "$DOT1X_FRAGMENT" \ "rd.neednet=1 systemd.volatile=overlay " \ "rd.dot1x.nvindex=0x01800001 rd.dot1x.timeout=60 " \ diff --git a/serving/README.md b/serving/README.md index 2b29afa..1cca9eb 100644 --- a/serving/README.md +++ b/serving/README.md @@ -58,6 +58,9 @@ docker compose ps # HTTP: UKI is served curl -sI http://${SERVER_IP}/fleet-${IMAGE_VERSION}.efi | head -1 # 200 OK +# HTTP: kiosk test page is served (what the diskless kiosk loads by default) +curl -sI http://${SERVER_IP}/kiosk/ | head -1 # 200 OK + # NVMe/TCP: target is listening + discoverable ss -lntp | grep 4420 sudo nvme discover -t tcp -a ${SERVER_IP} -s 4420 # lists the subsystem diff --git a/serving/docker-compose.yml b/serving/docker-compose.yml index 4bfb85c..793648c 100644 --- a/serving/docker-compose.yml +++ b/serving/docker-compose.yml @@ -89,6 +89,10 @@ services: subpath: artifacts # mount only /artifacts from the image # Fallback (Docker < 28 / offline): bind the local Packer output dir: # - ${ARTIFACT_SRC}:/usr/share/nginx/html:ro + # Serve the kiosk test page at /kiosk/ alongside the artifacts. Config + # adds the location; the page is lab content (NOT in the artifact image). + - ./http/default.conf:/etc/nginx/conf.d/default.conf:ro + - ./http/kiosk:/usr/share/nginx/kiosk:ro # For HTTPS boot (production), terminate TLS here with the boot-infra CA's # cert and switch the dhcp-boot URL above to https://. Left HTTP for the lab. diff --git a/serving/http/default.conf b/serving/http/default.conf new file mode 100644 index 0000000..d72a9d9 --- /dev/null +++ b/serving/http/default.conf @@ -0,0 +1,26 @@ +# Lab boot HTTP server (nginx). Replaces the stock default.conf so one server on +# :80 serves BOTH: +# / -> the OCI release artifacts (UKI fleet-.efi, etc.), mounted +# read-only from the image volume at /usr/share/nginx/html +# /kiosk/ -> the diskless kiosk test page (lab content bind-mounted at +# /usr/share/nginx/kiosk, deliberately NOT part of the artifact +# image, which stays FROM-scratch). +# A separate kiosk container was considered, but every service here uses host +# networking, so a second nginx would fight for :80; a single location is cleaner. +server { + listen 80 default_server; + server_name _; + + # UKI + release artifacts (firmware fetches /fleet-.efi from here). + location / { + root /usr/share/nginx/html; + autoindex on; + } + + # Kiosk test page. The diskless kiosk (kiosk_url) points at + # http://boot.fleet.lab/kiosk/ — resolved to this host by the stack's dnsmasq. + location /kiosk/ { + alias /usr/share/nginx/kiosk/; + index index.html; + } +} diff --git a/serving/http/kiosk/index.html b/serving/http/kiosk/index.html new file mode 100644 index 0000000..984f25f --- /dev/null +++ b/serving/http/kiosk/index.html @@ -0,0 +1,72 @@ + + + + + + +Fleet Kiosk — Boot OK + + + +

▣ FLEET KIOSK ONLINE

+
diskless boot validated — weston + chromium rendering local HTTP
+
+
--:--:--
+
+ served from… + page url… + user agent… + screen… +
+
boot HTTP server · replace this page or point kiosk_url elsewhere
+ + +