Add kiosk

files/kiosk/kiosk-session

@@ -0,0 +1,22 @@
+#!/bin/bash
+# kiosk-session — launched by cage (Wayland) from kiosk.service.
+# Starts Chromium fullscreen on the configured URL.
+#
+# KIOSK_URL comes from /etc/kiosk/kiosk.env (baked from the kiosk_url Packer
+# var; a runtime config-agent could override it later). The Chromium profile is
+# pinned to a tmpfs path so writes land in RAM (the root is read-only erofs +
+# volatile overlay) — watch RAM if the page is heavy.
+#
+# VM/GPU notes: --disable-gpu + the pixman wlroots renderer (WLR_RENDERER in
+# kiosk.env) keep this working on VMs with no real GPU. On hardware with a GPU,
+# drop --disable-gpu (and set WLR_RENDERER=gles2) for compositing.
+set -euo pipefail
+
+BROWSER=$(command -v chromium-browser || command -v chromium)
+
+exec "$BROWSER" \
+    --kiosk --noerrdialogs --disable-infobars --incognito --no-first-run \
+    --disable-session-crashed-bubble --start-maximized \
+    --ozone-platform=wayland --disable-gpu \
+    --user-data-dir=/tmp/kiosk-profile --disk-cache-dir=/tmp/kiosk-cache \
+    "${KIOSK_URL:?KIOSK_URL not set in /etc/kiosk/kiosk.env}"