Add Host API and fix kiosk performance

2026-06-28 03:14:25 +00:00
parent b5163f958e
commit ad6b7e3366
12 changed files with 747 additions and 37 deletions
@@ -31,5 +31,11 @@
  "AutofillCreditCardEnabled": false,
  "PasswordManagerEnabled": false,
  "ShoppingListEnabled": false,
-  "EnableMediaRouter": false
+  "EnableMediaRouter": false,
+
+  "_comment_pna": "Private Network Access: the kiosk page (insecure http boot-server origin) fetches the workstation host-info agent at http://localhost:9099 — a cross-origin PRIVATE-network request Chromium blocks by default. The agent sends Access-Control-Allow-Private-Network: true; this is the matching browser-side allowance, scoped to the kiosk ORIGIN ONLY (not '*'). MUST list the origin of kiosk_url (default http://boot.fleet.lab). The machine talking to itself; no internet egress (see HOST-API.md).",
+  "InsecurePrivateNetworkRequestsAllowedForUrls": [
+    "http://boot.fleet.lab",
+    "http://localhost"
+  ]
 }
@@ -26,6 +26,50 @@ SOCK=wayland-kiosk
 BROWSER=$(command -v chromium-browser || command -v chromium || true)
 : "${BROWSER:?chromium not found (expected chromium-browser or chromium in PATH)}"

+# GPU vs software path. This image is FLEET-GENERIC: it boots both real hardware
+# (e.g. the 820 / Intel HD620 -> i915) AND the virtio build/test VMs (no real
+# GPU). Probe for a real KMS render node and branch — real GPU gets hardware
+# raster/compositing (CPU drops off software raster); VMs keep the software path
+# so weston + Chromium still render there. Pure runtime probe; no per-host state
+# is baked (invariant #1).
+GPU=0
+case "$(basename "$(readlink -f /sys/class/drm/card0/device/driver 2>/dev/null)" 2>/dev/null)" in
+    i915|amdgpu|radeon|nouveau|xe) [ -e /dev/dri/renderD128 ] && GPU=1 ;;
+esac
+
+# Lockdown flags (what the managed policy can't cover). The distro chromium
+# wrapper PREPENDS its own defaults ahead of these — including its own
+# --disable-features. Chromium does NOT union duplicate --disable-features (the
+# LAST occurrence wins), and ours is last, so we MERGE the wrapper's disables
+# (LensOverlay/Gemini/Compose/TabOrganization) into ours — otherwise they are
+# silently dropped. We deliberately pass NO --enable-features, so the wrapper's
+# VA-API enables (AcceleratedVideoDecodeLinuxGL, ...) stay in effect.
+# Phone-home suppression (background networking, component/auto update, domain
+# reliability, crash upload, pings, search-engine probe) + the comprehensive
+# lockdown live in the managed policy (/etc/chromium/policies/managed/).
+COMMON_FLAGS=(
+    --kiosk --noerrdialogs --disable-infobars --incognito --no-first-run
+    --disable-session-crashed-bubble --start-maximized
+    --ozone-platform=wayland
+    --disable-background-networking --disable-component-update
+    --disable-sync --disable-domain-reliability --disable-breakpad
+    --no-pings --no-default-browser-check --metrics-recording-only
+    --disable-search-engine-collection
+    "--disable-features=LensOverlay,OptimizationGuideOnDeviceModel,PromptAPIForGeminiNano,Compose,TabOrganization,Translate,OptimizationHints,OptimizationTargetPrediction,MediaRouter,AutofillServerCommunication,InterestFeedContentSuggestions"
+    --user-data-dir=/tmp/kiosk-profile --disk-cache-dir=/tmp/kiosk-cache
+)
+
+if [ "$GPU" = 1 ]; then
+    # Real GPU: hardware raster/compositing. HD620 (gen7 Intel) is sometimes
+    # raster-blocklisted by Chromium, so override the blocklist. The GPU process
+    # opens /dev/dri/renderD128 -> the kiosk user must be in group 'render' (set
+    # at build, diskless.pkr.hcl). With --disable-gpu gone, the wrapper's VA-API
+    # --enable-features finally engage (they need a live GPU process).
+    GPU_FLAGS=(--ignore-gpu-blocklist --enable-gpu-rasterization --enable-zero-copy)
+else
+    GPU_FLAGS=(--disable-gpu)
+fi
+
 # Background: wait (up to ~60s) for weston's socket, then keep Chromium running.
 (
    for _ in $(seq 1 120); do
@@ -34,30 +78,17 @@ BROWSER=$(command -v chromium-browser || command -v chromium || true)
    done
    export WAYLAND_DISPLAY="$SOCK"
    while :; do
-        # --disable-* / --no-pings etc.: stop Chromium phoning home to Google
-        # (background networking = variations/field-trials + GCM, component &
-        # auto updates, domain reliability, crash upload, hyperlink pings). The
-        # --disable-features list kills the Optimization Guide hints fetch
-        # (optimizationguide-pa.googleapis.com), Translate, Media Router discovery
-        # and Autofill server calls. The comprehensive lockdown (sign-in, metrics,
-        # safe browsing, search suggest, ...) is the managed policy at
-        # /etc/chromium/policies/managed/10-kiosk-lockdown.json; these flags cover
-        # what policy can't. A fixed-URL kiosk needs none of it.
-        "$BROWSER" \
-            --kiosk --noerrdialogs --disable-infobars --incognito --no-first-run \
-            --disable-session-crashed-bubble --start-maximized \
-            --ozone-platform=wayland --disable-gpu \
-            --disable-background-networking --disable-component-update \
-            --disable-sync --disable-domain-reliability --disable-breakpad \
-            --no-pings --no-default-browser-check --metrics-recording-only \
-            --disable-search-engine-collection \
-            --disable-features=Translate,OptimizationHints,OptimizationTargetPrediction,MediaRouter,AutofillServerCommunication,InterestFeedContentSuggestions \
-            --user-data-dir=/tmp/kiosk-profile --disk-cache-dir=/tmp/kiosk-cache \
-            "$KIOSK_URL" || true
+        "$BROWSER" "${COMMON_FLAGS[@]}" "${GPU_FLAGS[@]}" "$KIOSK_URL" || true
        sleep 2
    done
 ) &

 # weston as the foreground process (owns the seat; service restarts if it dies).
-# desktop-shell + explicit socket; --use-pixman = software rendering for VMs.
-exec weston --use-pixman --socket="$SOCK" --config=/etc/xdg/weston/weston.ini
+# desktop-shell + explicit socket. On real GPU use weston's GL renderer (enables
+# the zero-copy dmabuf handoff from Chromium so its frames aren't CPU-copied); on
+# VMs force --use-pixman (software) — there's no usable DRM/GL device there.
+if [ "$GPU" = 1 ]; then
+    exec weston --socket="$SOCK" --config=/etc/xdg/weston/weston.ini
+else
+    exec weston --use-pixman --socket="$SOCK" --config=/etc/xdg/weston/weston.ini
+fi