Update Aimee OS

To minimize unexpected changes between builds, I'm going to schedule a
separate task to sync the Portage repositories.  This way, we know that
two runs in a row from the same source will have the same packages,
unless we have specifically updated Portage.

config

@@ -2,5 +2,5 @@ target=aarch64-unknown-linux-gnu
 profile=default/linux/arm64/23.0/systemd
 kernel_pkg=sys-kernel/raspberrypi-sources
 kernel_defconfig=bcm2835
-device_tree=broadcom/*.dtb
+device_tree=broadcom/bcm2711-rpi-4-b.dtb
 rootflags='ro rootwait=4'

config.txt

@@ -1,5 +1,3 @@
-# dch: Tested working 2025-01-01 08:28 CST
-
 arm_64bit=1
 arm_boost=1
 

customize.sh

@@ -7,13 +7,12 @@ O=$1
 
 export PORTAGE_CONFIGROOT="$O"/portage
 
+if [ ! -f /mnt/gentoo/usr/lib64/firefox/firefox ]; then
     ${target}-emerge -vbknuUDj --onlydeps --with-bdeps=n www-client/firefox:esr
     PORTAGE_BINHOST=https://distfiles.gentoo.org/releases/arm64/binpackages/23.0/arm64 \
     ${target}-emerge -vgKnj --root=/mnt/gentoo www-client/firefox:esr
+fi
 
 passwd -R /mnt/gentoo -d root
 
-groupadd -R /mnt/gentoo -r kiosk
+systemctl --root=/mnt/gentoo set-default graphical.target
-useradd -R /mnt/gentoo -r -m -d /home/kiosk -g kiosk kiosk
-
-systemctl --root=/mnt/gentoo enable wpa_supplicant@wlan0

linux.config

@@ -46,6 +46,7 @@ CONFIG_IPV6_SIT=m
 CONFIG_IPV6_SIT_6RD=m
 
 CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_GOODIX=m
 CONFIG_TOUCHSCREEN_EDT_FT5X06=m
 CONFIG_TOUCHSCREEN_RASPBERRYPI_FW=m
 
@@ -117,7 +118,9 @@ CONFIG_MEMCG=y
 CONFIG_CGROUP_PIDS=y
 CONFIG_CGROUP_BPF=y
 CONFIG_BLK_CGROUP=y
+CONFIG_USER_NS=y
 
+CONFIG_I2C_HID_OF_GOODIX=m
 CONFIG_USB_DWC2=m
 CONFIG_USB_DWC2_PCI=m
 CONFIG_USB_ACM=m

overlay/etc/firefox/policies/policies.json

@@ -0,0 +1,54 @@
+{
+  "policies": {
+    "BlockAboutAddons": true,
+    "BlockAboutConfig": true,
+    "BlockAboutProfiles": true,
+    "CaptivePortal": false,
+    "DisableDeveloperTools": true,
+    "DisableFeedbackCommands": true,
+    "DisableFirefoxScreenshots": true,
+    "DisableFirefoxSutudies": true,
+    "DisableFormHistory": true,
+    "DisableMasterPasswordCreation": true,
+    "DisablePasswordReveal": true,
+    "DisablePocket": true,
+    "DisablePrivateBrowsing": true,
+    "DisableProfileImport": true,
+    "DisableProfileRefresh": true,
+    "DisableSecurityBypass": true,
+    "DisableSetDesktopBackground": true,
+    "DNSOverHTTPS": {
+      "Enabled": false,
+      "Locked": true
+    },
+    "DontCheckDefaultBrowser": true,
+    "Homepage": {
+      "URL": "https://homeassistant.pyrocufflink.blue/dashboard-rosalina",
+      "Locked": true,
+      "StartPage": "homepage-locked"
+    },
+    "NewTabPage": false,
+    "NoDefaultBookmarks": true,
+    "OfferToSaveLogins": false,
+    "OverrideFirstRunPage": "",
+    "OverridePostUpdatePage": "",
+    "PasswordManagerEnabled": false,
+    "Preferences": {
+      "browser.sessionstore.resume_from_crash": {
+        "Value": false
+      },
+      "datareporting.policy.dataSubmissionPolicyBypassNotification": {
+        "Value": true
+      },
+      "extensions.activeThemeID": {
+        "Value": "firefox-compact-dark@mozilla.org"
+      }
+    },
+    "WebsiteFilter": {
+      "Block": ["<all_urls>"],
+      "Exceptions": [
+        "https://*.pyrocufflink.blue/*"
+      ]
+    }
+  }
+}

overlay/etc/pam.d/kiosk

@@ -4,5 +4,4 @@ session optional pam_loginuid.so
 session required pam_env.so envfile=/etc/profile.env
 session required pam_limits.so
 session required pam_env.so
-session required pam_unix.so
 session required pam_systemd.so

overlay/etc/sway/kiosk.conf

@@ -0,0 +1,14 @@
+# vim: set ft=swayconfig :
+
+output DSI-1 resolution 720x1280 transform 90
+
+input * {
+    map_to_output DSI-1
+}
+
+exec gsettings set org.gnome.desktop.interface gtk-theme Adwaita-dark
+exec gsettings set org.gnome.desktop.interface color-scheme prefer-dark
+
+exec /usr/lib64/firefox/firefox
+
+for_window [title="Mozilla Firefox"] fullscreen

overlay/root/.ssh/authorized_keys

@@ -0,0 +1,4 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINZCN2cxMDwedJ1Ke23Z3CZRcOYjqW8fFqsooRus7RK0AAAABHNzaDo= dustin@rosalina.p
+yrocufflink.blue
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAB6xTCSNz+AcQCWcyVKs84tThXN4wpLgCo2Lc48L6EsAAAABHNzaDo= dustin@luma.pyroc
+ufflink.blue

overlay/usr/lib/systemd/system-preset/70-kiosk.preset

@@ -0,0 +1,3 @@
+enable wpa_supplicant@.service wlan0
+
+enable kiosk.service

overlay/usr/lib/systemd/system/kiosk.service

@@ -10,9 +10,11 @@ Wants=time-sync.target
 After=time-sync.target
 
 [Service]
-ExecStart=/usr/bin/sway -d
+StateDirectory=%N
+CacheDirectory=%N
+Environment=XDG_CACHE_HOME=%C/%N
+ExecStart=/usr/bin/sway -c /etc/sway/kiosk.conf
 User=kiosk
-Environment=WLR_LIBINPUT_NO_DEVICES=1
 StandardInput=tty
 StandardOutput=tty
 StandardError=journal
@@ -23,3 +25,7 @@ TTYVTDisallocate=yes
 PAMName=kiosk
 UtmpMode=user
 UtmpIdentifier=tty1
+
+[Install]
+WantedBy=graphical.target
+Alias=display-manager.service

overlay/usr/lib/sysusers.d/kiosk.conf

@@ -0,0 +1,2 @@
+g kiosk -
+u kiosk - "Kiosk User" /var/lib/kiosk /bin/sh

portage/make.conf/systemd.conf

@@ -1,9 +1 @@
-INSTALL_MASK="
+INSTALL_MASK="${INSTALL_MASK} /usr/lib/systemd/systemd-nsresourced* /usr/lib/systemd/system/systemd-nsresourced.*"
-${INSTALL_MASK}
-/etc/ssh/ssh*_config.d/*systemd*
-/usr/lib/systemd/ssh_config.d
-/usr/lib/systemd/sshd_config.d
-/usr/lib/systemd/system-generators/systemd-ssh-generator
-/usr/lib/systemd/system/systemd-nsresourced.*
-/usr/lib/systemd/systemd-nsresourced*
-"

prepare.sh

@@ -2,13 +2,6 @@
 
 . "${CONFIGDIR:=${PWD}}"/config
 
-if [ ! -f /var/db/repos/gentoo/metadata/timestamp ]; then
-    emerge-webrsync
-fi
-if [ "$(find /var/db/repos/gentoo/metadata -newermt '-24 hours' | wc -l)" -eq 0 ]; then
-    emaint sync
-fi
-
 mkdir -p /etc/portage/package.use
 mkdir -p /etc/portage/make.conf
 echo 'virtual/libudev systemd' >> /etc/portage/package.use/systemd

squashfs.exclude

@@ -0,0 +1,5 @@
+etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
+etc/ssh/sshd_config.d/20-systemd-userdb.conf
+usr/lib/systemd/ssh_config.d
+usr/lib/systemd/sshd_config.d
+usr/lib/systemd/system-generators/systemd-ssh-generator