Add kiosk

files/kiosk/kiosk.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=Wayland kiosk (cage + Chromium)
+Documentation=https://github.com/cage-kiosk/cage
+# Take over tty1 from the login getty and start after the network is up (the
+# kiosk loads a URL). plymouth-quit lets the splash hand off cleanly.
+After=systemd-user-sessions.service plymouth-quit-wait.service getty@tty1.service network-online.target
+Wants=network-online.target
+Conflicts=getty@tty1.service
+
+[Service]
+Type=simple
+User=kiosk
+# A real PAM login session on tty1 so logind assigns seat0 — cage/wlroots needs
+# a seat for DRM master + libinput. (PAMName runs account/session, not auth, so
+# the passwordless kiosk user is fine.)
+PAMName=login
+TTYPath=/dev/tty1
+TTYReset=yes
+TTYVHangup=yes
+TTYVTDisallocate=yes
+StandardInput=tty-fail
+StandardOutput=journal
+StandardError=journal
+UtmpIdentifier=tty1
+UtmpMode=user
+EnvironmentFile=/etc/kiosk/kiosk.env
+# cage -s: single-client kiosk compositor; runs the wrapper, exits when it does.
+ExecStart=/usr/bin/cage -s -- /usr/local/bin/kiosk-session
+Restart=always
+RestartSec=2
+
+[Install]
+WantedBy=graphical.target