Adding Plymouth

diskless.pkr.hcl

@@ -120,8 +120,14 @@ variable "enable_kiosk" {
 
 variable "kiosk_url" {
   type        = string
-  description = "URL the fullscreen Chromium kiosk loads at boot (cage Wayland session on tty1, baked into the immutable root). Empty disables the kiosk install entirely. A runtime config-agent could override it later via /etc/kiosk/kiosk.env."
-  default     = "https://www.reddit.com"
+  description = "URL the fullscreen Chromium kiosk loads at boot (weston session on tty1, baked into the immutable root). Defaults to the self-contained test page served by the lab boot HTTP server at /kiosk/ (boot.fleet.lab resolves to the serving host via the stack's dnsmasq) — validates the boot end-to-end without external connectivity. Empty disables the kiosk install entirely. A runtime config-agent could override it later via /etc/kiosk/kiosk.env."
+  default     = "http://boot.fleet.lab/kiosk/"
+}
+
+variable "boot_splash" {
+  type        = bool
+  description = "true (default): bake 'rhgb quiet' into the UKI cmdline so Plymouth shows a graphical boot splash (covers the network-auth + NVMe/TCP + verity phase). false: bake 'plymouth.enable=0' for a fully verbose console boot — use while debugging the boot chain. Plymouth itself is always in the image; this only flips the cmdline. (The cmdline is immutable once signed, so this is a build-time choice.)"
+  default     = true
 }
 
 variable "sb_key" {
@@ -222,6 +228,14 @@ build {
       # dracut warns and silently falls back to gzip (a larger initramfs).
       "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network NetworkManager zstd openssl",
 
+      # Plymouth boot splash. plymouth-scripts provides plymouth-set-default-theme;
+      # spinner is the clean modern theme. Set the default theme BEFORE the dracut
+      # build below so the (-no-hostonly) initramfs bundles it; no -R here because
+      # we rebuild the initramfs explicitly. Whether the splash shows at boot is
+      # decided by the cmdline (boot_splash var), not by installing this.
+      "dnf -y install plymouth plymouth-scripts plymouth-theme-spinner",
+      "plymouth-set-default-theme spinner",
+
       # Stage etc files into place
       "install -D -m0644 /tmp/etc-stage/dot1x/radius-ca.pem            /etc/dot1x/radius-ca.pem",
       "install -D -m0644 /tmp/etc-stage/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf",
@@ -266,6 +280,8 @@ build {
       # a dracut hook).
       "grep -q 'nm-unmanaged.sh' /tmp/lsinitrd.txt || { echo 'ERROR: nm-unmanaged.sh hook missing from initramfs' >&2; exit 1; }",
       "grep -q 'nvmf-connect.service' /tmp/lsinitrd.txt || { echo 'ERROR: nvmf-connect.service missing from initramfs' >&2; exit 1; }",
+      # Plymouth must be in the initramfs to splash during the early boot phase.
+      "grep -q 'plymouthd' /tmp/lsinitrd.txt || { echo 'ERROR: plymouth missing from initramfs (plymouth dracut module not installed)' >&2; exit 1; }",
 
       # ---- Build hygiene ---------------------------------------------------
       "dnf clean all",
@@ -402,7 +418,7 @@ build {
       # home dirs) — we dropped mkfs.erofs --all-root, which used to mask this by
       # flattening everything to root:root. sudo is a no-op if already root, and
       # the runner has passwordless sudo (cf. the `sudo apt-get` install step).
-      "sudo bash -c \"NVMET_TRADDR='${var.nvmet_traddr}' bash scripts/extract-artifacts.sh output-qemu/diskless-build.qcow2 ${var.artifact_dir}/${var.image_version} ${var.disable_dot1x}\"",
+      "sudo bash -c \"NVMET_TRADDR='${var.nvmet_traddr}' BOOT_SPLASH='${var.boot_splash}' bash scripts/extract-artifacts.sh output-qemu/diskless-build.qcow2 ${var.artifact_dir}/${var.image_version} ${var.disable_dot1x}\"",
       # Hand the OUTPUT FILES back to the build user (their in-erofs ownership is
       # already baked correctly) so build-oci.sh can write the UKI and push with
       # the build user's `buildah login`.