Add kiosk

docs/TODO.md

@@ -81,7 +81,37 @@ re-export a **v3** PDF (key change: `rootovl` → `systemd.volatile=overlay` in
 step 8 and §5). Retire/reset the errata afterward. Needs the design-doc source
 (not in this repo).
 
-## [ ] 4. Kiosk mode — autologin + fullscreen Chromium loading a URL
+## [~] 4. Kiosk mode — autologin + fullscreen Chromium loading a URL
+
+**First cut implemented (2026-06-16) — needs a display to verify.** `cage`
+(Wayland single-app compositor) + Chromium from EPEL, baked into the root:
+- `kiosk_url` Packer var (default `https://www.reddit.com`; empty disables the
+  whole install). Wired in CI as `KIOSK_URL` env.
+- Provisioner enables EPEL, installs `cage chromium mesa-dri-drivers mesa-libEGL
+  mesa-libgbm dejavu-sans-fonts`, creates a passwordless unprivileged `kiosk`
+  user (video/input groups).
+- `files/kiosk/kiosk.service` — runs `cage -s -- /usr/local/bin/kiosk-session`
+  as `kiosk` on tty1 via `PAMName=login`+`TTYPath` (gets seat0 for DRM/input),
+  `Conflicts=getty@tty1`, `WantedBy=graphical.target`; default target set to
+  graphical.
+- `files/kiosk/kiosk-session` — Chromium with `--kiosk --ozone-platform=wayland
+  --disable-gpu` + tmpfs profile/cache; URL from `/etc/kiosk/kiosk.env`.
+- `WLR_RENDERER=pixman` in kiosk.env for VMs without a GPU.
+- **Verify on a VM with a console (Proxmox VNC/SPICE):** cage comes up on tty1,
+  Chromium loads the URL over the booted network. Likely tweak points:
+  `cage` availability in EPEL 9 (else fall back to `weston --shell=kiosk-shell`),
+  Chromium ozone/wayland support, dropping `--disable-gpu` on real GPUs, and
+  **SELinux AVCs** for the GUI stack (check `ausearch -m avc`; now that the image
+  is enforcing with labels, the kiosk may need a small policy module or booleans
+  — do NOT just set permissive). Admin SSH (the key user) still works for debug
+  even if the kiosk fails (it lands at graphical.target either way).
+- **Image size:** Chromium+Mesa add hundreds of MB to the *uncompressed* erofs —
+  feeds the "shrink the rootfs" concern (and #7); reconsider whether a lighter
+  browser/render path is viable.
+
+### Original task
+
+
 
 Make the diskless workstation boot straight into a locked-down kiosk: a
 fullscreen Chromium showing a configured site (initial target: Reddit). All