Add kiosk

diskless.pkr.hcl

@@ -112,6 +112,12 @@ variable "admin_user" {
   default     = "fleetadmin"
 }
 
+variable "kiosk_url" {
+  type        = string
+  description = "URL the fullscreen Chromium kiosk loads at boot (cage Wayland session on tty1, baked into the immutable root). Empty disables the kiosk install entirely. A runtime config-agent could override it later via /etc/kiosk/kiosk.env."
+  default     = "https://www.reddit.com"
+}
+
 variable "sb_key" {
   type        = string
   description = "Secure Boot signing key (PEM) for the UKI. Empty = unsigned lab build. Production: CI/HSM-held; never enters the build VM."
@@ -186,6 +192,14 @@ build {
     destination = "/tmp/etc-stage"
   }
 
+  # Kiosk unit + session wrapper (installed by the kiosk provisioner below).
+  # Dir-without-trailing-slash upload -> /tmp/kiosk/ (mirrors the dracut module
+  # upload form, which stages reliably).
+  provisioner "file" {
+    source      = "files/kiosk"
+    destination = "/tmp/"
+  }
+
   # --- 2. Packages, configs, diskless adaptations --------------------------
   provisioner "shell" {
     inline = [
@@ -244,6 +258,41 @@ build {
     ]
   }
 
+  # --- 2b. Kiosk mode: Wayland (cage) + fullscreen Chromium ---------------
+  # Post-pivot graphical kiosk (no initramfs impact). Baked into the immutable
+  # root, fleet-generic. Empty kiosk_url skips it. EPEL is enabled for cage +
+  # chromium — a supply-chain surface (accepted for the lab; see TODO #4).
+  # NOTE: pulls in Chromium + Mesa (~hundreds of MB) — grows the uncompressed
+  # erofs namespace noticeably. Graphical bring-up needs a display to verify;
+  # likely tweak points: cage availability in EPEL, chromium ozone/wayland,
+  # WLR_RENDERER, --disable-gpu, and SELinux AVCs for the GUI stack.
+  provisioner "shell" {
+    environment_vars = ["KIOSK_URL=${var.kiosk_url}"]
+    inline = [
+      "set -e",
+      "if [ -z \"$KIOSK_URL\" ]; then echo 'kiosk_url empty -> skipping kiosk install.'; exit 0; fi",
+      "echo '==> Enabling EPEL + installing kiosk stack (cage, chromium, mesa)'",
+      "dnf install -y epel-release",
+      "dnf install -y cage chromium mesa-dri-drivers mesa-libEGL mesa-libgbm dejavu-sans-fonts",
+      # Unprivileged, passwordless kiosk user; video/input as a seat fallback.
+      "id kiosk >/dev/null 2>&1 || useradd -m -G video,input kiosk",
+      # Install the staged unit + wrapper.
+      "install -D -m0755 /tmp/kiosk/kiosk-session /usr/local/bin/kiosk-session",
+      "install -D -m0644 /tmp/kiosk/kiosk.service /etc/systemd/system/kiosk.service",
+      # URL (from the var) + software wlroots renderer for VMs without a GPU.
+      "install -d -m0755 /etc/kiosk",
+      "printf 'KIOSK_URL=%s\\nWLR_RENDERER=pixman\\n' \"$KIOSK_URL\" > /etc/kiosk/kiosk.env",
+      "chmod 0644 /etc/kiosk/kiosk.env",
+      # Label the new files so they survive into the enforcing erofs.
+      "restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/kiosk",
+      # Boot graphical and start the kiosk (replaces the tty1 getty).
+      "systemctl enable kiosk.service",
+      "systemctl set-default graphical.target",
+      "rm -rf /tmp/kiosk",
+      "echo \"==> kiosk enabled: $KIOSK_URL\"",
+    ]
+  }
+
   # --- 2c. Admin access: sudo-enabled key user + locked root --------------
   # Fleet-generic (same user + key on every host => NOT per-host state). The
   # key comes from var.ssh_authorized_key (CI secret). If no key is supplied we