Adding Plymouth

docs/TODO.md

@@ -5,13 +5,18 @@ Persistent backlog, kept in sync with the working session task tracker. Status:
 
 ---
 
-## [~] 1. Port the dracut module off `network-legacy` → `network-manager`
+## [x] 1. Port the dracut module off `network-legacy` → `network-manager`
 
-**IMPLEMENTED 2026-06-17 — awaiting boot-bench verification.** Fixes the
-confirmed lease-expiry outage: network-legacy's one-shot DHCP lease was never
-renewed post-switch-root, so the address dropped at lease expiry → NVMe/TCP root
-died ("keep alive timeout" / "no route to host"). NM hands its initramfs
-connections to the real-root NM (`/run/NetworkManager` state), which renews.
+**DONE — test path VERIFIED ON THE BENCH 2026-06-17** (host stays up past the
+DHCP lease time; no more lease-expiry outage). Fixed the confirmed outage:
+network-legacy's one-shot DHCP lease was never renewed post-switch-root, so the
+address dropped at lease expiry → NVMe/TCP root died ("keep alive timeout" /
+"no route to host"). NM hands its initramfs connections to the real-root NM
+(`/run/NetworkManager` state), which renews.
+
+REMAINING: the **secure path** (macsec0 DHCP via `nmcli`, physical NIC unmanaged
+via `nm-unmanaged.sh`) is only exercised once `disable_dot1x=false` — verify on
+the swtpm + hostapd + FreeRADIUS bench when re-enabling security (see #2/cleanup).
 
 Done:
 - `90-diskless.conf` `add_dracutmodules`: `network-legacy` → `network-manager`.
@@ -125,8 +130,11 @@ Path to getting here (don't re-discover):
   smaller image. **Re-enable with `-var enable_kiosk=true` when returning to
   kiosk work** — CI does not pass the var, so CI currently builds lean (no
   kiosk) too; add `-var enable_kiosk=true` to the Gitea workflow to ship it.
-- `kiosk_url` Packer var (default `https://www.reddit.com`; empty disables the
-  whole install). Wired in CI as `KIOSK_URL` env.
+- `kiosk_url` Packer var (default `http://boot.fleet.lab/kiosk/` — the
+  self-contained test page served by the boot HTTP server at
+  `serving/http/kiosk/`, via the `/kiosk/` nginx location; validates a boot
+  without external connectivity. Empty disables the whole install). Wired in CI
+  as `KIOSK_URL` env.
 - Provisioner enables EPEL, installs `weston chromium mesa-dri-drivers
   mesa-libEGL mesa-libgbm dejavu-sans-fonts`, creates a passwordless
   unprivileged `kiosk` user (video/input groups).
@@ -156,7 +164,8 @@ Path to getting here (don't re-discover):
 
 
 Make the diskless workstation boot straight into a locked-down kiosk: a
-fullscreen Chromium showing a configured site (initial target: Reddit). All
+fullscreen Chromium showing a configured site (default: the boot HTTP server's
+`/kiosk/` test page). All
 baked at **build time** into the root tree (immutable erofs/verity root; runtime
 is the tmpfs overlay), fleet-generic (no per-host state).