build: make the classroom desktop something a .deb installs

Building the package found two things reading the tree did not.

dpkg refused it outright: plasma-workspace already owns
/etc/xdg/plasmanotifyrc and friends, and two packages cannot own one
path. The room's settings move to a directory of their own with
/etc/environment.d putting it in front of /etc/xdg, which is KConfig's
own cascade rather than a file fight.

The postinst then failed on a chmod for a command that no longer
exists. It now walks what the package installed instead of naming
files, removes the login shell that used to start sway on tty1, and
enables SDDM and the audio service.

Verified by installing the built package on a fresh machine and
starting the session from it: restrictions in force, palette applied,
audio service enabled and running, panel supervision unconditional.

Co-Authored-By: Claude Opus 5 <[email protected]>

config/environment/90-ekklesia-classroom.conf

@@ -0,0 +1,11 @@
+# Where the classroom's session settings live.
+#
+# The classroom cannot install its kdeglobals, kwinrc and the rest into
+# /etc/xdg: plasma-workspace already owns files by those names there, and
+# two packages cannot own one path. Measured — dpkg refused the package.
+#
+# KConfig reads XDG_CONFIG_DIRS in order, so putting a classroom directory
+# in front of /etc/xdg gives the room's settings priority over Debian's
+# defaults without touching a file another package owns. systemd's user
+# manager reads this file, and the Plasma session inherits it.
+XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg

packaging/debian/postinst

@@ -8,30 +8,21 @@ if ! id classroom >/dev/null 2>&1; then
         classroom
 fi
 
-cat > /home/classroom/.bash_profile <<'PROFILE'
+# The session is started by SDDM now. An upgrade from a sway-era room has
-if [ -z "$WAYLAND_DISPLAY" ] && [ "${XDG_VTNR:-}" = "1" ]; then
+# to remove the login shell that used to start it, or the machine has two
-    exec sway -c /etc/ekklesia-classroom/sway/config
+# things trying to own tty1.
-fi
+rm -f /home/classroom/.bash_profile
-PROFILE
+rm -f /etc/systemd/system/[email protected]/autologin.conf
+rmdir --ignore-fail-on-non-empty \
+    /etc/systemd/system/[email protected] 2>/dev/null || true
 
-chown classroom:classroom /home/classroom/.bash_profile
+# Commands the room's own parts install. Listing them by name went wrong
-chmod 0644 /home/classroom/.bash_profile
+# once already, when a command that had been removed was still chmod'ed
-
+# here and the whole postinst failed; the package is the list.
-chmod 0755 /usr/local/bin/classroom-browser
+for command in /usr/local/bin/classroom-*; do
-chmod 0755 /usr/local/bin/classroom-chrome-windows
+    [ -e "$command" ] || continue
-chmod 0755 /usr/local/bin/classroom-window
+    chmod 0755 "$command"
-chmod 0755 /usr/local/bin/classroom-dvd
+done
-chmod 0755 /usr/local/bin/classroom-dvd-session
-chmod 0755 /usr/local/bin/classroom-dvd-css-setup
-chmod 0755 /usr/local/bin/classroom-notify
-chmod 0755 /usr/local/bin/classroom-notify-test
-chmod 0755 /usr/local/bin/classroom-mqtt
-chmod 0755 /usr/local/bin/classroom-notifications
-chmod 0755 /usr/local/bin/classroom-scale
-chmod 0755 /usr/local/bin/classroom-shutdown
-chmod 0755 /usr/local/bin/classroom-chrome-setup
-chmod 0755 /usr/local/bin/classroom-provision
-chmod 0755 /usr/local/bin/classroom-printer-setup
 
 # Reading the optical drive needs group cdrom. Takes effect at the next
 # login, which the OTA reboot provides.
@@ -55,6 +46,13 @@ chmod 0640 /etc/ekklesia-classroom/device.conf
 
 systemctl daemon-reload || true
 
+# Autologin into the classroom, and back into it if the session ever ends.
+systemctl enable sddm.service >/dev/null 2>&1 || true
+
+# The room's own user services: the audio policy, and the drop-in that stops
+# Plasma giving up on a repeatedly crashing panel.
+systemctl --global enable ekklesia-classroom-audio.service >/dev/null 2>&1 || true
+
 # NetworkManager ships nmtui and deliberately leaves interfaces declared in
 # /etc/network/interfaces under ifupdown's control (managed=false). This gives
 # administrators saved, auto-reconnecting Wi-Fi without taking over an

tests/test-deployment-support.sh

@@ -92,6 +92,20 @@ check("restart is unconditional", "Restart=always" in supervision)
 check("the burst limit is lifted", "StartLimitIntervalSec=0" in supervision)
 check("the drop-in is packaged", "plasma-plasmashell.service.d" in build)
 
+print()
+print("4b2. the session settings do not fight another package")
+# plasma-workspace owns /etc/xdg/kdeglobals and friends. dpkg refused the
+# package when the classroom tried to own them too, so the room's copies
+# live in a directory of their own, in front of /etc/xdg.
+check("settings install to the classroom's own directory",
+      "$STAGE/etc/ekklesia-classroom/xdg/" in build)
+check("nothing is installed into /etc/xdg", "$STAGE/etc/xdg/" not in build)
+check("and that directory is searched first",
+      "XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg" in
+      (root / "config/environment/90-ekklesia-classroom.conf").read_text())
+check("the environment file is packaged",
+      "/etc/environment.d/90-ekklesia-classroom.conf" in build)
+
 print()
 print("4c. the teacher cannot reach a command line")
 for restriction in ("run_command=false", "shell_access=false",

tools/build-release.sh

@@ -207,13 +207,19 @@ install -Dm644 \
 # a dock, a window helper, a notification wrapper or a compositor config in
 # the list above.
 
+# Not /etc/xdg: plasma-workspace already owns files by these names there.
+# The classroom's directory goes in front of it in XDG_CONFIG_DIRS instead.
 for setting in kdeglobals kwinrc kwinrulesrc kscreenlockerrc ksmserverrc \
         krunnerrc plasmanotifyrc; do
     install -Dm644 \
         "$ROOT/config/plasma/xdg/${setting}" \
-        "$STAGE/etc/xdg/${setting}"
+        "$STAGE/etc/ekklesia-classroom/xdg/${setting}"
 done
 
+install -Dm644 \
+    "$ROOT/config/environment/90-ekklesia-classroom.conf" \
+    "$STAGE/etc/environment.d/90-ekklesia-classroom.conf"
+
 for scheme in EkklesiaDark EkklesiaLight; do
     install -Dm644 \
         "$ROOT/config/plasma/colors/${scheme}.colors" \

tools/lab/install-desktop

@@ -9,13 +9,18 @@ set -euo pipefail
 
 SRC="${1:-/srv/classroom}"
 
-install -Dm644 "$SRC/config/plasma/xdg/kdeglobals"       /etc/xdg/kdeglobals
+# A directory of the classroom's own, ahead of /etc/xdg in
-install -Dm644 "$SRC/config/plasma/xdg/kwinrc"           /etc/xdg/kwinrc
+# XDG_CONFIG_DIRS. plasma-workspace owns files by these names in /etc/xdg
-install -Dm644 "$SRC/config/plasma/xdg/kwinrulesrc"      /etc/xdg/kwinrulesrc
+# and two packages cannot own one path.
-install -Dm644 "$SRC/config/plasma/xdg/kscreenlockerrc"  /etc/xdg/kscreenlockerrc
+for setting in kdeglobals kwinrc kwinrulesrc kscreenlockerrc ksmserverrc \
-install -Dm644 "$SRC/config/plasma/xdg/ksmserverrc"      /etc/xdg/ksmserverrc
+        krunnerrc plasmanotifyrc; do
-install -Dm644 "$SRC/config/plasma/xdg/krunnerrc"        /etc/xdg/krunnerrc
+    install -Dm644 "$SRC/config/plasma/xdg/$setting" \
-install -Dm644 "$SRC/config/plasma/xdg/plasmanotifyrc"   /etc/xdg/plasmanotifyrc
+        "/etc/ekklesia-classroom/xdg/$setting"
+    rm -f "/etc/xdg/$setting.ekklesia-old"
+done
+
+install -Dm644 "$SRC/config/environment/90-ekklesia-classroom.conf" \
+    /etc/environment.d/90-ekklesia-classroom.conf
 
 install -Dm644 "$SRC/config/plasma/colors/EkklesiaDark.colors" \
     /usr/share/color-schemes/EkklesiaDark.colors

tools/lab/lab

@@ -103,6 +103,7 @@ plasma-up)
         -e WAYLAND_DISPLAY="$OUTER" -e XDG_SESSION_TYPE=wayland \
         -e XDG_CURRENT_DESKTOP=KDE -e LIBGL_ALWAYS_SOFTWARE=1 \
         -e QT_LOGGING_RULES="kwin_scripting.debug=true" \
+        -e XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg \
         -d "$NAME" sh -c 'exec startplasma-wayland > /tmp/plasma.log 2>&1'
     for _ in $(seq 1 60); do
         docker exec "$NAME" pgrep -x plasmashell >/dev/null 2>&1 && break