# Provisioning

Some things a classroom needs cannot be installed by the classroom
package itself: they need the network, and they need the apt lock that
dpkg is holding for the whole of the package's `postinst`.

`ekklesia-classroom-provision.service` runs after every boot and does
them. It is a `oneshot` unit that nothing else waits on, so it never
holds the classroom up, and **it is not allowed to fail the boot**: a
machine with no DVD codecs is still a working classroom.

The package `postinst` enables the service but deliberately does not
start it. Every OTA update reboots the moment the install finishes, and
an apt run killed by that reboot would leave dpkg half-configured. The
next boot is a few seconds away and is a clean place to work.

To provision without waiting for a reboot:

```
sudo classroom-provision
```

Each step checks whether it is already done and returns immediately if
so. A provisioned machine costs nothing; a machine that was offline the
first time gets another go at the next boot.

```
journalctl -u ekklesia-classroom-provision
```

## Google Chrome

Chrome is not in Debian and a classroom is not usable without it, so a
fresh machine installs it itself rather than waiting for someone to do it
by hand on every box.

`classroom-chrome-setup` adds Google's signing key to
`/etc/apt/keyrings/google-chrome.gpg` and their repository to
`/etc/apt/sources.list.d/google-chrome.list` — the same path Google's own
package manages, so the two cannot become two copies of the same
repository — then installs `google-chrome-stable`. Using the repository
rather than a one-off `.deb` means Chrome keeps getting security updates.

Run it by hand with `sudo classroom-chrome-setup`. It returns
immediately if Chrome is already installed.

The Chrome policies in `/etc/opt/chrome/policies/` are shipped by the
classroom package and apply as soon as Chrome exists.

## DVD codecs

Only for rooms with `DVD_ENABLED=true`. See [dvd.md](dvd.md).

## What provisioning does not do

It never upgrades or reconfigures anything already installed, and it
never touches a repository it did not add. Classroom software updates
are the OTA channel's job, not this.