ekklesiaandClaude Opus 5
34fd02e08f
Little Waders took the Plasma build and reported what a container cannot. A disc player on a machine with no optical drive, a clock nobody at the back of the room could read, a browser at half the size of the panel around it, and Parent Call with no broker to call. The broker is the same for every classroom, so it is a default now and not something to fill in room by room. classroom-migrate brings an existing room to the same place without touching its name, its username or its password, and Parent Call distinguishes a broker it cannot reach from one that was never set up: those send somebody to look at completely different things. The disc player's detection was right and ran too late — alongside the session rather than before it, and the panel is built from the layout the moment a session starts. It runs before the display manager now, and again from udev when a drive is plugged in. UI_SCALE had a ceiling of 1.5, which cannot express a 4K television; a clock pinned at 15 points, which is the same size at every scale; and a browser that was never told the number at all. All three are fixed and the room doubles together at 200%. This also brings 0.1.47's work into the repository, where it had only ever existed in a build directory under /tmp: the hidden display dialog, its authenticated writer, the polkit action, and the church's own wallpaper. One piece of it is deliberately left out. The custom volume display needed a shell package of our own, and with one selected plasmashell builds no panel at all — measured twice, with that build's own files, on a classroom that deletes its panel configuration at every login by design. The lab connected to the real church broker the moment the package defaulted to it. Nothing was left behind, which was checked, but the guard that should have stopped it had never worked: it used iptables, which the lab image does not have, and probed with /dev/tcp under dash, where that always fails. Both reported success. Co-Authored-By: Claude Opus 5 <[email protected]>
139 lines
6.2 KiB
Bash
Executable File
139 lines
6.2 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
|
|
if ! id classroom >/dev/null 2>&1; then
|
|
adduser \
|
|
--disabled-password \
|
|
--gecos "" \
|
|
classroom
|
|
fi
|
|
|
|
|
|
# Commands the room's own parts install. Listing them by name went wrong
|
|
# once already, when a command that had been removed was still chmod'ed
|
|
# here and the whole postinst failed; the package is the list.
|
|
for command in /usr/local/bin/classroom-*; do
|
|
[ -e "$command" ] || continue
|
|
chmod 0755 "$command"
|
|
done
|
|
|
|
# Reading the optical drive needs group cdrom. Takes effect at the next
|
|
# login, which the OTA reboot provides.
|
|
if getent group cdrom >/dev/null 2>&1; then
|
|
adduser classroom cdrom >/dev/null 2>&1 || true
|
|
fi
|
|
|
|
# Create device.conf on a new endpoint, or append only settings an older
|
|
# endpoint does not yet know. The helper preserves every existing byte apart
|
|
# from the append, so per-room choices always survive an upgrade.
|
|
PYTHONPATH=/usr/local/lib/ekklesia-classroom python3 - <<'PY'
|
|
from classroom_config import ensure_device_config
|
|
|
|
ensure_device_config()
|
|
PY
|
|
|
|
# The broker password lives here, so the file stops being world readable.
|
|
# Everything that reads it runs as root or as the classroom user.
|
|
chown root:classroom /etc/ekklesia-classroom/device.conf 2>/dev/null || true
|
|
chmod 0640 /etc/ekklesia-classroom/device.conf
|
|
|
|
# Converge a machine that was something else: the old bar and notification
|
|
# daemon stopped and deactivated, the login shell that used to start sway
|
|
# removed, and device.conf moved off settings this package cannot carry
|
|
# out. Runs on every install, does nothing on a machine that is already
|
|
# this classroom.
|
|
/usr/local/bin/classroom-migrate || true
|
|
|
|
systemctl daemon-reload || true
|
|
|
|
# The power button stops working immediately rather than at the next
|
|
# boot. Verified in the lab: logind re-reads its drop-ins on reload and
|
|
# reports ignore afterwards, and the running graphical session is not
|
|
# disturbed by it.
|
|
systemctl reload systemd-logind >/dev/null 2>&1 || true
|
|
|
|
# Autologin into the classroom, and back into it if the session ever ends.
|
|
systemctl enable sddm.service >/dev/null 2>&1 || true
|
|
|
|
# The room's own user services: the audio policy, and the drop-in that
|
|
# stops Plasma giving up on a repeatedly crashing panel. The display scale
|
|
# is applied by an XDG autostart entry instead, which is already how it
|
|
# reaches a session on the classroom machines.
|
|
systemctl --global enable ekklesia-classroom-audio.service >/dev/null 2>&1 || true
|
|
systemctl --global enable ekklesia-classroom-desktop.service >/dev/null 2>&1 || true
|
|
|
|
# The panel's disc player is decided before the display manager starts, not
|
|
# at the same time as it. Enabled rather than started: this install has
|
|
# just run the same command directly, below.
|
|
systemctl enable ekklesia-classroom-layout.service >/dev/null 2>&1 || true
|
|
|
|
# So a drive plugged in later is noticed without a reboot.
|
|
udevadm control --reload-rules >/dev/null 2>&1 || true
|
|
|
|
# Match the bar to this machine now, so the first login already has the
|
|
# right one rather than waiting for the next provisioning run.
|
|
/usr/local/bin/classroom-desktop-layout >/dev/null 2>&1 || true
|
|
|
|
# NetworkManager ships nmtui and deliberately leaves interfaces declared in
|
|
# /etc/network/interfaces under ifupdown's control (managed=false). This gives
|
|
# administrators saved, auto-reconnecting Wi-Fi without taking over an
|
|
# existing static Ethernet setup. No classroom service needs to hold boot for
|
|
# NetworkManager's online wait, so keep that waiter disabled.
|
|
systemctl enable NetworkManager.service || true
|
|
systemctl disable NetworkManager-wait-online.service || true
|
|
systemctl start NetworkManager.service || true
|
|
|
|
# CUPS is ready at boot, but no queue is created until an administrator runs
|
|
# classroom-printer-setup. cups-browsed is unnecessary here and would expose
|
|
# every advertised printer on the church network if installed independently.
|
|
systemctl enable cups.socket cups.service || true
|
|
systemctl disable --now cups-browsed.service || true
|
|
# Direct DNS-SD destinations still appear through Avahi even when
|
|
# cups-browsed is inactive. Nothing else in this appliance uses Avahi, so stop
|
|
# both activation paths and keep unrelated church printers out of print lists.
|
|
systemctl disable --now avahi-daemon.socket avahi-daemon.service || true
|
|
systemctl mask avahi-daemon.socket avahi-daemon.service || true
|
|
systemctl start cups.socket || true
|
|
|
|
systemctl enable ekklesia-classroom-update.timer || true
|
|
systemctl start ekklesia-classroom-update.timer || true
|
|
|
|
# Google Chrome, and the DVD codecs when the room has a drive, are
|
|
# fetched by the provisioning service at the next boot.
|
|
#
|
|
# Deliberately enabled but not started here. It cannot run during this
|
|
# script anyway, because dpkg holds the apt lock throughout. Starting it
|
|
# straight afterwards would race the reboot that an OTA update performs
|
|
# the moment this install finishes, and an apt run killed by that reboot
|
|
# leaves dpkg half-configured. Every OTA reboots, so waiting for the next
|
|
# boot costs nothing and cannot corrupt anything.
|
|
#
|
|
# Provisioning is still enabled at boot so machines that were offline or
|
|
# interrupted get another chance automatically.
|
|
systemctl enable ekklesia-classroom-provision.service || true
|
|
|
|
# Also schedule provisioning after this package installation completes.
|
|
# Do not start it synchronously from postinst: dpkg/apt still owns its locks.
|
|
# A short delayed systemd job lets the outer apt transaction finish first.
|
|
#
|
|
# If an OTA reboot happens before this fires, the normal enabled boot service
|
|
# handles provisioning on the next boot instead.
|
|
systemd-run \
|
|
--unit=ekklesia-classroom-provision-after-install \
|
|
--on-active=15s \
|
|
--property=Type=oneshot \
|
|
/bin/systemctl start ekklesia-classroom-provision.service \
|
|
>/dev/null 2>&1 || true
|
|
|
|
# Gives Chrome a chance to close properly on reboot, so its profile is
|
|
# not marked as crashed. Best effort: it must never hold a shutdown up.
|
|
systemctl enable ekklesia-classroom-shutdown.service || true
|
|
|
|
# The room's link to the church broker. Enabled always; it does nothing
|
|
# at all until a broker is configured in device.conf.
|
|
systemctl enable ekklesia-classroom-mqtt.service || true
|
|
systemctl restart ekklesia-classroom-mqtt.service || true
|
|
systemctl start ekklesia-classroom-shutdown.service || true
|
|
|
|
exit 0
|