From fd84ba418071ba9faebfe2af989a47354e068c91 Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Wed, 17 Jun 2026 12:44:07 +0000
Subject: [PATCH] Turn off kiosk by default

---
 diskless.pkr.hcl                            | 12 +++++++++++-
 docs/TODO.md                                |  6 ++++++
 files/dracut/95dot1x-macsec/nvmf-connect.sh | 17 ++++++++++++++++-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index 2fc7f86..9d06e68 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -112,6 +112,12 @@ variable "admin_user" {
   default     = "fleetadmin"
 }
 
+variable "enable_kiosk" {
+  type        = bool
+  description = "Build-time feature flag for the graphical kiosk (weston + Chromium + mesa). false (default, current) skips the kiosk provisioner entirely — much faster builds and a far smaller image — while iterating on the boot/network stack. Set true to bake the kiosk back in. (kiosk_url=\"\" also skips it; this flag lets you disable without losing the configured URL.)"
+  default     = false
+}
+
 variable "kiosk_url" {
   type        = string
   description = "URL the fullscreen Chromium kiosk loads at boot (cage Wayland session on tty1, baked into the immutable root). Empty disables the kiosk install entirely. A runtime config-agent could override it later via /etc/kiosk/kiosk.env."
@@ -269,9 +275,13 @@ build {
   # to verify; likely tweak points: chromium ozone/wayland, --disable-gpu vs a
   # real GPU, /dev/dri present in the VM, and SELinux AVCs for the GUI stack.
   provisioner "shell" {
-    environment_vars = ["KIOSK_URL=${var.kiosk_url}"]
+    environment_vars = [
+      "ENABLE_KIOSK=${var.enable_kiosk}",
+      "KIOSK_URL=${var.kiosk_url}",
+    ]
     inline = [
       "set -e",
+      "if [ \"$ENABLE_KIOSK\" != \"true\" ]; then echo 'enable_kiosk=false -> skipping kiosk install (smaller/faster build).'; exit 0; fi",
       "if [ -z \"$KIOSK_URL\" ]; then echo 'kiosk_url empty -> skipping kiosk install.'; exit 0; fi",
       "echo '==> Enabling EPEL + installing kiosk stack (weston, chromium, mesa)'",
       "dnf install -y epel-release",
diff --git a/docs/TODO.md b/docs/TODO.md
index fc13910..28b7504 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -88,6 +88,12 @@ kiosk + Chromium from EPEL, baked into the root. **cage is NOT packaged for EL9*
 (`dnf install cage` → "Unable to find a match"), so switched to **weston
 kiosk-shell** (weston 8.0.0-10.el9 is in EPEL; kiosk-shell.so landed in weston
 8.0; far lighter than the GDM+gnome-kiosk alternative).
+- **`enable_kiosk` Packer var — currently `false` by DEFAULT (set 2026-06-17).**
+  The whole kiosk provisioner is feature-flagged off while iterating on the
+  boot/network stack (DHCP-lease/keep-alive work), for faster builds and a
+  smaller image. **Re-enable with `-var enable_kiosk=true` when returning to
+  kiosk work** — CI does not pass the var, so CI currently builds lean (no
+  kiosk) too; add `-var enable_kiosk=true` to the Gitea workflow to ship it.
 - `kiosk_url` Packer var (default `https://www.reddit.com`; empty disables the
   whole install). Wired in CI as `KIOSK_URL` env.
 - Provisioner enables EPEL, installs `weston chromium mesa-dri-drivers
diff --git a/files/dracut/95dot1x-macsec/nvmf-connect.sh b/files/dracut/95dot1x-macsec/nvmf-connect.sh
index 4e26d61..b16b8ad 100644
--- a/files/dracut/95dot1x-macsec/nvmf-connect.sh
+++ b/files/dracut/95dot1x-macsec/nvmf-connect.sh
@@ -29,11 +29,26 @@ _trsvcid=${_rest##*,}
 # nvme_tcp is usually auto-loaded; ensure it so /dev/nvme-fabrics exists.
 modprobe nvme_tcp 2>/dev/null
 
+# Keep-alive / reconnect tuning for the ROOT device. These persist across
+# switch-root (the in-kernel nvme-tcp controller and its opts survive).
+#   -k 30  keep-alive timeout (s). The 5s default means a KA every 2.5s; under
+#          kiosk CPU/memory pressure the nvme-tcp keep-alive work can be delayed
+#          past 5s, the target sees no KA and disconnects ("keep alive timeout").
+#          30s gives a 15s emit interval and far more slack.
+#   -l -1  ctrl-loss-tmo = retry reconnection forever. This is the rootfs: the
+#          600s default makes the host GIVE UP after a blip, after which root I/O
+#          fails permanently and the box wedges — strictly worse than retrying.
+#   -c 10  wait 10s between reconnect attempts.
+_kato=30
+_ctrl_loss_tmo=-1
+_reconnect_delay=10
+
 # Networking (ip=dhcp) is brought up in parallel, so poll-and-connect until a
 # fabrics namespace appears or we time out. connect-all is idempotent.
 _i=0
 while [ "$_i" -lt 60 ]; do
-    nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid" 2>/dev/null
+    nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid" \
+        -k "$_kato" -l "$_ctrl_loss_tmo" -c "$_reconnect_delay" 2>/dev/null
     for _ns in /dev/nvme[0-9]*n[0-9]*; do
         if [ -b "$_ns" ]; then
             mkdir -p /run/dot1x