# Provisioning

Some things a classroom needs cannot be installed by the classroom
package itself: they need the network, and they need the apt lock that
dpkg is holding for the whole of the package's `postinst`.

`ekklesia-classroom-provision.service` runs after every boot and does
them. It is a `oneshot` unit that nothing else waits on, so it never
holds the classroom up, and **it is not allowed to fail the boot**: a
machine with no DVD codecs is still a working classroom.

The package `postinst` enables the service and schedules a delayed start after
the outer apt transaction has had time to release its lock. It never runs
provisioning synchronously inside dpkg. If an OTA reboot happens before the
delayed job, the enabled service runs normally on the next boot.

To provision without waiting for a reboot:

```
sudo classroom-provision
```

Each step checks whether it is already done and returns immediately if
so. A provisioned machine costs nothing; a machine that was offline the
first time gets another go at the next boot.

```
journalctl -u ekklesia-classroom-provision
```

## Google Chrome

Chrome is not in Debian and a classroom is not usable without it, so a
fresh machine installs it itself rather than waiting for someone to do it
by hand on every box.

`classroom-chrome-setup` adds Google's signing key to
`/etc/apt/keyrings/google-chrome.gpg` and their repository to
`/etc/apt/sources.list.d/google-chrome.list` — the same path Google's own
package manages, so the two cannot become two copies of the same
repository — then installs `google-chrome-stable`. Using the repository
rather than a one-off `.deb` means Chrome keeps getting security updates.

Run it by hand with `sudo classroom-chrome-setup`. It returns
immediately if Chrome is already installed.

The Chrome policies in `/etc/opt/chrome/policies/` are shipped by the
classroom package and apply as soon as Chrome exists.

## DVD codecs

Only for rooms with `DVD_ENABLED=true`. See [dvd.md](dvd.md).

## Networking and printing

NetworkManager and CUPS are Debian package dependencies, not deferred network
provisioning steps. Their services are enabled by the package and neither
requires Internet access or hardware to be present.

- Wi-Fi administration: [networking.md](networking.md)
- Church color printer setup: [printing.md](printing.md)

The printer helper is part of every provisioning pass. It is capped at 30
seconds and only configures the local scheduler, so an offline Ricoh cannot
hold boot or provisioning open. Failures are logged and retried on the next
boot. A correctly configured queue is a quick no-op.

## What provisioning does not do

The boot provisioning command never upgrades or reconfigures anything already installed, and it
never touches a repository it did not add. Classroom software updates
are the OTA channel's job, not this.