Migrate Display & Interaction menu; drop version number from installer filename; bump to v2.0.0

- menus/display.sh: second menu migrated onto lib/menu.sh + lib/config.sh,
  covering touch gesture mode, link navigation security, and the
  pause/keyboard/navigation button toggles (previously three separate
  Core Settings entries). Deliberately a different shape from Sites
  (toggle list vs. list CRUD) to exercise the framework more broadly.
  Wired into install.sh's top-level menu alongside Sites.

- Renamed ubuntu-based-kiosk-v1.0.3.sh -> ubuntu-based-kiosk.sh so the
  installer can be updated in place instead of growing a new
  version-numbered filename every release; released versions are now
  tracked via git history and the in-script changelog. Updated all
  Readme download/re-run commands accordingly. Older versioned files
  (ubuntu-based-kiosk-v*.sh, install_kiosk_*.sh) are left in place as
  archived releases.

- Bumped SCRIPT_VERSION to 2.0.0 (new script-level changelog entry) and
  the Readme version/changelog to match, given the new modular
  management path, the rename, and the two real bugs fixed along the
  way (settings clobbered on save, off-by-one in reorder).

Verified before moving on to the web admin work:
- Regression: re-ran the full Sites scratch-config test suite (add,
  edit, delete, reorder, home) - still clean, no invalid-input paths hit.
- New: scratch-config test for every display.sh action (touch mode,
  navigation security, all three toggles), confirming values persist
  through save/reload and that a previously-added site survives
  untouched across Display-menu saves.
- End-to-end: ran the real install.sh (not just sourced functions) as a
  genuine non-root, non-"kiosk" user with real sudo, driving actual menu
  input through Sites -> add a page -> Display -> toggle a setting ->
  exit. Confirmed final config.json on disk matches every action taken,
  and both guard clauses (run as root; no installed kiosk found) fire
  correctly.

LICENSE

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

Readme.md

@@ -1,9 +1,9 @@
-# Ubuntu Based Kiosk (UBK)
+# Ubuntu Based Kiosk
 
-**Current Version:** 0.9.7-2 (check script header for latest version)  
-**Built with Claude Sonnet 4/.5 AI assistance**  
-**License:** GPL v3 - Keep derivatives open source  
-**Repository:** https://github.com/outis1one/ubk/
+**Current Version:** 2.0.0 (check script header for latest version)
+**Built with Claude Sonnet 4.6 AI assistance**
+**License:** GPL v3 - Keep derivatives open source
+**Repository:** https://github.com/outis1one/ubuntu-based-kiosk/
 
 ---
 
@@ -43,35 +43,66 @@ Home/office kiosk for reusing old hardware, displaying:
 
 ```bash
 # Install Ubuntu 24.04 Server
+# ***Do not use "kiosk" as a user name when installing, the script creates a restricted user named kiosk and the script will not install if the sudo user/user name when setting up the system is "kiosk".***
 # Configure WiFi if no ethernet available
 # Enable SSH during installation
 
-# Download and run installer
-wget https://github.com/outis1one/ubk/raw/main/install_kiosk_0.9.7.sh
-chmod +x install_kiosk_0.9.7.sh
-./install_kiosk_0.9.7.sh
+# Download and run the installer
+wget https://github.com/outis1one/ubuntu-based-kiosk/raw/main/ubuntu-based-kiosk.sh
+chmod +x ubuntu-based-kiosk.sh && ./ubuntu-based-kiosk.sh
 ```
 
 The installer will guide you through configuration during setup.
 
 ---
 
+## Offline / Air-Gapped Download
+
+If the kiosk machine can't reach GitHub directly (no browser, restrictive proxy, or you just prefer to grab the script on another computer and carry it over via USB), download it ahead of time instead of using the `curl`/`wget` one-liner above.
+
+> **Note:** This only avoids needing internet access *to fetch the script*. The installer itself still requires the kiosk machine to have internet access while it runs — it uses `apt` to install packages, pulls Node.js from NodeSource, and runs `npm install` to fetch Electron (~120MB). There is currently no fully air-gapped/offline package bundle.
+
+**On a machine with internet access:**
+
+```bash
+# Option A: download just the installer script
+wget https://github.com/outis1one/ubuntu-based-kiosk/raw/main/ubuntu-based-kiosk.sh
+
+# Option B: download the whole repo as a ZIP (includes install.sh, addon scripts, and older archived installer versions)
+wget https://github.com/outis1one/ubuntu-based-kiosk/archive/refs/heads/main.zip
+unzip main.zip
+```
+
+Copy the downloaded `.sh` file (or the extracted ZIP contents) to a USB drive, then on the kiosk machine:
+
+```bash
+# Mount the USB drive and copy the script over, then:
+chmod +x ubuntu-based-kiosk.sh
+./ubuntu-based-kiosk.sh
+```
+
+The kiosk machine still needs a working internet connection (ethernet, or WiFi configured during Ubuntu install) for the script to complete.
+
+---
+
 ## Core Features
 
 ### Multi-Site Management
 - **Single or multiple sites** with independent configurations
+- **Named sites** - Optional friendly names for easy identification in navigation menu
 - **Auto-rotation** - Sites rotate automatically based on duration
 - **Manual sites** - Duration = 0, accessible via swipe only, trigger inactivity timeout
 - **Hidden sites** - Duration = -1, PIN-protected access, trigger inactivity timeout
 - **Home URL** - Auto-return after inactivity on manual or hidden sites
 - **Pause functionality** - Temporarily pause rotation (configurable per-site)
+- **Navigation menu** - Quick access to all sites via key icon (top-left hot corner)
 
 ### Touch Controls
 - **2-finger horizontal swipe** - Switch between sites
-- **3-finger up swipe** - Access hidden tabs (PIN required)
-- **3-finger down swipe** - Return to normal tabs (from hidden tabs)
+- **3-finger down swipe** - Toggle hidden tabs (PIN required to show, swipe again to hide)
 - **1-finger swipe** (dual mode) - Navigate within page (arrow keys)
 - **On-screen keyboard** - Auto-shows on text fields or click keyboard icon
+- **Navigation menu** - Click key icon (top-left) to access site list and gesture cheat sheet
 
 ### On-Screen Keyboard
 - **HTML-based keyboard** with full QWERTY layout
@@ -81,12 +112,11 @@ The installer will guide you through configuration during setup.
 - **Special characters** via shift keys
 - Works alongside physical keyboard
 
-### Password Protection & Lockout
+### Password Protection & Lockout (all are optional)
 - **Session lockout** after configured inactivity
-- **Scheduled lockout** at specific time daily
+- **Scheduled lockout** at specific time daily 
 - **Display wake lockout** - Require password after display schedule
 - **Boot password** option - Require password on system startup
-- **SHA-256 hashed passwords**
 - **Full screen blocking** during lockout (no content visible)
 
 ### Navigation Security
@@ -94,7 +124,7 @@ The installer will guide you through configuration during setup.
 - **Same-origin** - Links within same domain only (recommended)
 - **Open** - Unrestricted browsing (trusted environments only)
 
-### Scheduling System
+### Scheduling System (all are optional)
 - **Power schedule** - Auto-shutdown and RTC wake (hardware dependent)
 - **Display schedule** - Turn display off/on at specific times
 - **Quiet hours** - Mute audio or stop Squeezelite during hours
@@ -110,6 +140,124 @@ The installer will guide you through configuration during setup.
 
 ## Optional Add-ons
 
+### Authentication
+
+#### Authelia Auto-Login (SSO)
+
+Automatically authenticates the kiosk against a self-hosted [Authelia](https://www.authelia.com) instance on every startup. The Authelia password is **not stored in plain text** — it is encrypted with AES-256-CBC using a key derived from the machine's unique `/etc/machine-id`, so the encrypted blob is useless on any other machine.
+
+**Access via menu:** `Addons → 5. Authelia Auto-Login`
+
+After running the addon it prints the full server-side setup, but the summary is below.
+
+##### Kiosk side (SSH in and run the installer)
+
+```bash
+ssh user@kiosk-machine
+./ubuntu-based-kiosk.sh
+# Addons → 5. Authelia Auto-Login
+# Enter your Authelia URL, username, and password when prompted
+```
+
+##### Authelia server side (Dockerized)
+
+**Step 1 — Generate the argon2 password hash** (run on your Docker host):
+
+```bash
+docker run --rm authelia/authelia:latest \
+  authelia crypto hash generate argon2 \
+  --password 'yourpassword'
+```
+
+Copy the `$argon2id$...` output — that is your hash.
+
+**Step 2 — Add a kiosk user** to `~/docker/authelia/config/users.yml`:
+
+```yaml
+kiosk:
+  displayname: "Kiosk Display"
+  password: '$argon2id$v=19$m=65536,t=3,p=4$<paste hash here>'
+  email: kiosk@local.com
+  groups:
+    - kiosk
+```
+
+**Step 3 — MERGE into `~/docker/authelia/config/configuration.yml`** (do not replace your existing config):
+
+**access_control** — Find your **existing** `access_control:` block and add the kiosk rule as the **first** rule inside it.
+
+> **Do NOT create a second `access_control:` block.** YAML silently ignores duplicate keys — Authelia will never see the kiosk rule and the kiosk will get a white screen.
+
+Authelia reads rules top-down — first match wins. The kiosk rule **must** sit above any `two_factor` wildcard rule, otherwise the wildcard matches first.
+
+**Why `one_factor`?** The kiosk authenticates via the API (`/api/firstfactor` — password only). TOTP and WebAuthn require an interactive second step that is impossible from a script, so the kiosk group must use `one_factor`.
+
+*Before (your existing config):*
+```yaml
+access_control:
+  default_policy: deny
+  rules:
+    - domain: '*.yourdomain.com'
+      policy: two_factor
+```
+
+*After (add kiosk rule above the two_factor rule — same block, not a new one):*
+```yaml
+access_control:
+  default_policy: deny
+  rules:
+    - domain: '*.yourdomain.com'   # kiosk first — one_factor only
+      subject: 'group:kiosk'
+      policy: one_factor
+    - domain: '*.yourdomain.com'   # existing rule stays below
+      policy: two_factor
+```
+
+**session** — Keep your existing session block as-is; no changes needed. The kiosk re-authenticates via API on every startup so session expiry barely matters for it.
+
+If you do **not** yet have a session block, add:
+
+```yaml
+session:
+  expiration: 8h
+  inactivity: 1h
+  remember_me: 7d
+  cookies:
+    - domain: yourdomain.com
+      authelia_url: https://auth.yourdomain.com
+```
+
+**Step 4 — Restart Authelia:**
+
+```bash
+docker compose restart authelia
+```
+
+##### How it works
+
+On every kiosk startup, Electron calls Authelia's `/api/firstfactor` endpoint with `keepMeLoggedIn: true` **before** any sites load. Authelia responds with a `Set-Cookie` header that Electron absorbs into its default session. All BrowserViews then load with that session cookie already present.
+
+Because Electron's session persists to disk across reboots (`/home/kiosk/.config/kiosk-app/`), the cookie also survives restarts — the API call on startup just refreshes or extends it.
+
+##### Authelia vs HTTP Basic Auth
+
+Both can be used at the same time — they serve different purposes:
+
+| Method | Where configured | When to use |
+|--------|-----------------|-------------|
+| **Authelia SSO** | `Addons → Authelia Auto-Login` (global) | Sites protected by an Authelia reverse proxy |
+| **HTTP Basic Auth** | Per-site username/password in tab config | Sites that show a browser popup asking for credentials |
+
+---
+
+### Communication
+- **Easy Asterisk Intercom** - Voice communication and intercom system
+  - Downloads latest version from Easy Asterisk repository
+  - Automatic update detection and installation
+  - Configuration preservation during updates
+  - Full Asterisk PBX integration
+  - SIP/PJSIP support for IP phones and softphones
+
 ### Audio
 - **Lyrion Music Server (LMS)** - Formerly Logitech Media Server
 - **Squeezelite Player** - Network audio player for LMS
@@ -129,7 +277,9 @@ The installer will guide you through configuration during setup.
 - **Netbird VPN** - Setup key support
 
 ### Advanced
-- **Emergency WiFi Hotspot** - Auto-starts if no internet after boot
+- **Emergency WiFi Hotspot** - Auto-starts if no internet after boot (configurable during install)
+- **Virtual Console Access** - Ctrl+Alt+F1-F8 terminal login (can enable/disable during install)
+- **Complete Uninstall** - Full system cleanup and kiosk removal
 - **SSH remote access** - For configuration and troubleshooting
 
 ---
@@ -137,7 +287,7 @@ The installer will guide you through configuration during setup.
 ## What This Script Installs
 
 ### Core Components
-- **Electron** v33.4.11 (Chromium-based app framework)
+- **Electron** v42.x (Chromium-based app framework)
 - **Node.js** v20.x with npm
 - **Openbox** - Lightweight window manager
 - **LightDM** - Display manager with autologin
@@ -161,6 +311,9 @@ The installer will guide you through configuration during setup.
 - **build-essential** - GCC, make, etc.
 - **Python 3** with evdev for PTT
 - **jq** - JSON processing
+- **curl / git** - Downloading and version control
+- **net-tools** - Legacy networking utilities (ifconfig, netstat, etc.)
+- **ncdu** - Disk usage analyzer for troubleshooting
 
 ---
 
@@ -168,7 +321,7 @@ The installer will guide you through configuration during setup.
 
 ### Security & Lockdown
 - **Autologin** as kiosk user
-- **VT switching disabled** (Ctrl+Alt+F1-F12 blocked)
+- **Virtual consoles** (Ctrl+Alt+F1-F8) - Optional, configurable during install
 - **X server key combinations disabled** (Ctrl+Alt+Backspace)
 - **Right-click disabled** in kiosk app
 - **Screen blanking disabled** with schedule awareness
@@ -219,6 +372,57 @@ id kiosk
 sudo -u kiosk DISPLAY=:0 xdpyinfo
 ```
 
+**External monitor/TV (HDMI) shows nothing, or shows a cropped/scaled picture:**
+
+Any connected display beyond the primary is mirrored automatically at the **primary's exact resolution** (not the external display's own native resolution) — both at kiosk login/boot (via Openbox autostart) and live when plugged/unplugged afterward (via a udev rule that triggers `kiosk-hotplug.service`). Both paths call the same `/usr/local/bin/kiosk-mirror-display.sh`. If the external display doesn't natively list the primary's resolution (e.g. a 1366x768 laptop panel mirrored to a 1920x1080-native TV), a matching mode is generated on the fly with `cvt` and forced onto the output — most monitors/TVs accept a close, non-native CVT timing without issue, but a few strict ones may reject it (see below).
+
+```bash
+# List outputs and check if the external display is detected
+sudo -u kiosk DISPLAY=:0 XAUTHORITY=/home/kiosk/.Xauthority xrandr
+
+# Look for your output (e.g. HDMI1/HDMI2/HDMI-1) as "connected" with a mode list.
+
+# Check what the mirroring logic actually did (native mode vs. forced CVT mode, or failures)
+journalctl | grep "KIOSK:" | tail -20
+
+# Check whether the hotplug handler fired
+sudo journalctl -u kiosk-hotplug.service -n 20
+
+# Manually re-trigger it
+sudo systemctl start kiosk-hotplug.service
+
+# Run the mirroring logic by hand for more verbose output
+sudo -u kiosk DISPLAY=:0 XAUTHORITY=/home/kiosk/.Xauthority bash -x /usr/local/bin/kiosk-mirror-display.sh
+```
+If the output shows `disconnected`, it's a cabling/port/EDID issue, not software — try a different cable/port or a monitor known to work.
+
+If a forced CVT mode is rejected by the display (blank screen only after mirroring runs, works fine before), that display's EDID doesn't accept out-of-spec timings — you'll need to manually pick one of its natively listed modes instead:
+```bash
+sudo -u kiosk DISPLAY=:0 XAUTHORITY=/home/kiosk/.Xauthority xrandr --output HDMI2 --mode 1360x768 --same-as eDP1
+```
+
+**No sound over HDMI (audio only from laptop/built-in speakers):**
+
+Whenever an external display is connected/mirrored, `kiosk-audio-route.sh` switches PipeWire's default sink to whichever sink's name contains `hdmi`, and moves any already-playing audio stream onto it. It's called at kiosk login (after PipeWire is confirmed ready) and by `kiosk-hotplug.service` on every plug/unplug — see `/usr/local/bin/kiosk-mirror-display.sh` above for the display side of the same hotplug event.
+
+```bash
+# List sinks and confirm an HDMI one exists (name will contain "hdmi")
+sudo -u kiosk pactl list sinks short
+
+# Check what the routing logic actually did
+journalctl | grep "KIOSK: audio routed\|KIOSK: failed to route" | tail -10
+
+# Check current default sink
+sudo -u kiosk pactl get-default-sink
+
+# Manually re-trigger routing
+sudo systemctl start kiosk-hotplug.service
+
+# Force it by hand if needed (replace with your sink name from the list above)
+sudo -u kiosk pactl set-default-sink alsa_output.pci-0000_00_1f.3.hdmi-stereo
+```
+If no sink name contains `hdmi`, the audio codec on that HDMI port either isn't exposed by ALSA/PipeWire on this hardware, or the monitor/TV doesn't report HDMI audio support in its EDID (common on monitors that only do video) — in that case there's no PipeWire-side fix, audio has to come from the laptop speakers or a separate cable.
+
 **Audio not working:**
 ```bash
 # Check PipeWire (use menu: Advanced → Audio Diagnostics)
@@ -364,8 +568,7 @@ smb://WORKGROUP/COMPUTER/PrinterName
 |---------|---------|-----------|--------|
 | Swipe | 2 | Left/Right | Switch between sites |
 | Swipe | 1 | Left/Right | Navigate within page (arrow keys) |
-| Swipe | 3 | Up | Show hidden tabs (PIN required) |
-| Swipe | 3 | Down | Return to normal tabs |
+| Swipe | 3 | Down | Toggle hidden tabs (PIN required) |
 
 **Keyboard Shortcuts:**
 - `Ctrl+Tab` or `Ctrl+]` - Next tab
@@ -382,25 +585,104 @@ smb://WORKGROUP/COMPUTER/PrinterName
 
 ```bash
 # Run installer script again to access menu
-./install_kiosk_0.9.7.sh
+./ubuntu-based-kiosk.sh
 
 # Menu structure:
-# 1. Core Settings - Sites, WiFi, schedules, passwords
-# 2. Addons - LMS, CUPS, VNC, VPNs
-# 3. Advanced - Diagnostics, logs, Electron updates
+# 1. Core Settings - Sites, WiFi, schedules, passwords, full reinstall, complete uninstall
+# 2. Addons - Authelia Auto-Login, Easy Asterisk Intercom, LMS, CUPS, VNC, VPNs
+# 3. Advanced - Diagnostics, logs, Electron updates, virtual consoles, emergency hotspot
 # 4. Restart Kiosk Display
 ```
 
+### Installing Easy Asterisk Intercom
+
+The Easy Asterisk Intercom addon provides voice communication capabilities to your kiosk system.
+
+**Access the addon menu:**
+```bash
+./ubuntu-based-kiosk.sh
+# Select: 2) Addons
+# Then: 4) Easy Asterisk Intercom
+```
+
+**Features:**
+- **Automatic installation** - Downloads and installs the latest version from the Easy Asterisk repository
+- **Update detection** - Checks for newer versions and prompts to update
+- **Safe re-runs** - Can be run multiple times without breaking existing configurations
+- **Config preservation** - Automatically backs up and restores configurations during updates
+- **Full Asterisk PBX** - Complete telephony features including SIP, extensions, voicemail
+
+**Installation behavior:**
+- **First install:** Downloads latest version from https://github.com/outis1one/easy-asterisk
+- **Already installed (latest):** Prompts to re-run installation (preserves configs)
+- **Update available:** Prompts to update and shows version difference
+- **All scenarios:** Configuration files in `/etc/asterisk/` and installation settings are preserved
+
+**Managing Easy Asterisk:**
+```bash
+# Check installation status
+systemctl status asterisk
+
+# View Asterisk console
+asterisk -rvvv
+
+# Restart Asterisk
+systemctl restart asterisk
+
+# Configure intercom (rerun installation to update)
+./ubuntu-based-kiosk.sh
+# Select: 2) Addons → 4) Easy Asterisk Intercom
+```
+
+**Installation location:**
+- Installation files: `/opt/easy-asterisk/`
+- Configuration: `/etc/asterisk/`
+- Version tracking: `/opt/easy-asterisk/.version`
+- Config backups: `/opt/easy-asterisk/config_backup/`
+
 ### Updating Electron
 
 ```bash
-# Via menu: Advanced → Manual Electron Update
+# Via menu: Advanced → Manual Electron Update (RECOMMENDED)
+# The menu option automatically:
+# - Creates backup before updating
+# - Shows rollback instructions
+# - Handles permissions correctly
+
 # Or manually:
 cd /home/kiosk/kiosk-app
 sudo -u kiosk npm install electron@latest
 sudo systemctl restart lightdm
 ```
 
+**Rollback if update fails:**
+
+The menu update creates automatic backups in `/home/kiosk/electron-backup-<timestamp>/`
+
+```bash
+# 1. Stop display
+sudo systemctl stop lightdm
+
+# 2. Find your backup (most recent)
+ls -lt /home/kiosk/electron-backup-* | head -1
+
+# 3. Restore backup files (replace timestamp with your backup)
+BACKUP=/home/kiosk/electron-backup-<timestamp>
+sudo cp $BACKUP/package.json /home/kiosk/kiosk-app/
+sudo cp $BACKUP/package-lock.json /home/kiosk/kiosk-app/ 2>/dev/null || true
+
+# 4. Remove failed install and reinstall previous version
+sudo rm -rf /home/kiosk/kiosk-app/node_modules/electron
+cd /home/kiosk/kiosk-app && sudo -u kiosk npm install --unsafe-perm
+
+# 5. Fix permissions
+sudo chown root:root /home/kiosk/kiosk-app/node_modules/electron/dist/chrome-sandbox
+sudo chmod 4755 /home/kiosk/kiosk-app/node_modules/electron/dist/chrome-sandbox
+
+# 6. Restart display
+sudo systemctl start lightdm
+```
+
 ---
 
 ## Configuration Files
@@ -477,14 +759,98 @@ echo "NOPIN" | sudo -u kiosk tee /home/kiosk/kiosk-app/.jitsi-pin
 - Triggers inactivity timeout (returns to home after idle time)
 
 **Hidden (duration = -1):**
-- Accessible via 3-finger up swipe + PIN
-- Return to normal tabs via 3-finger down swipe or Escape key
+- Toggle visibility via 3-finger down swipe + PIN, or F10 key
+- Also use Escape key to return to normal tabs
 - PIN stored in `/home/kiosk/kiosk-app/.jitsi-pin`
 - Default PIN: 1234 (configurable via Sites menu)
 - PIN can be 4-8 digits or disabled completely
 - Hidden from normal rotation
 - **Triggers inactivity timeout** (returns to home after idle time, just like manual sites)
 
+#### Why Use Hidden Tabs?
+
+Hidden tabs are perfect for scenarios where you need access to sensitive or private content on a shared/public kiosk:
+
+**Private Communication:**
+- Video conferencing (Jitsi Meet, Zoom, Google Meet)
+- Private messaging or chat applications
+- Internal communication tools for staff only
+- Conference room scheduling interfaces
+
+**Administrative Access:**
+- Server administration panels (Proxmox, TrueNAS, router interfaces)
+- Security camera feeds
+- Home automation controls (Home Assistant, OpenHAB)
+- Network monitoring dashboards
+
+**Content Management:**
+- Digital signage content editors
+- Photo album management (Immich, PhotoPrism)
+- Media server administration (Plex, Jellyfin)
+- Calendar and scheduling updates
+
+**Secure Entertainment:**
+- Personal streaming accounts (prevent others from accessing your watch history)
+- Gaming platforms or cloud gaming services
+- Adult content controls (parental access only)
+- Personal social media (Facebook, Instagram, etc.)
+
+**Business Use Cases:**
+- Employee time tracking systems
+- Inventory management interfaces
+- Point-of-sale backend access
+- Staff scheduling and shift management
+
+**Example Scenarios:**
+
+1. **Reception Kiosk:** Public-facing sites rotate (directory, weather, news), but staff can swipe up with PIN to access appointment scheduling, visitor management, or internal messaging.
+
+2. **Family Room Display:** Displays photo slideshows, calendar, and weather, but parents can PIN-access streaming services, smart home controls, or security cameras.
+
+3. **Digital Signage:** Publicly shows announcements and menus, but managers can PIN-access the content management system to make updates.
+
+4. **Conference Room Display:** Shows meeting schedules and company news, but attendees can PIN-access video conferencing or presentation tools.
+
+The hidden tab system provides a balance between public accessibility and private functionality without needing to physically access a terminal or reconfigure the system.
+
+#### Why Use Named Sites?
+
+Named sites provide user-friendly labels that make navigation and management easier, especially when dealing with multiple similar URLs or complex web addresses.
+
+**Benefits:**
+
+- **Easier Navigation:** Click "Photo Gallery" instead of remembering "https://immich.mydomain.com:2283"
+- **Better Organization:** Quickly identify sites in the navigation menu without parsing URLs
+- **User-Friendly:** Non-technical users can find sites by name instead of domain
+- **Cleaner Display:** "Home Assistant" is more readable than "http://192.168.1.50:8123"
+- **Professional Appearance:** Business kiosks benefit from descriptive names over technical URLs
+
+**Use Cases:**
+
+**Home/Family Kiosks:**
+- "Photo Albums" instead of "https://photoprism.local:2342"
+- "Weather" instead of "https://weather.com"
+- "Security Cameras" instead of "http://192.168.1.100:8000"
+- "Smart Home" instead of "http://homeassistant.local:8123"
+
+**Business Kiosks:**
+- "Employee Portal" instead of "https://portal.company.com/employees"
+- "Time Clock" instead of "https://timekeeping.company.com/punch"
+- "Inventory System" instead of "http://10.0.0.50:8080/inventory"
+- "Customer Service" instead of "https://crm.company.com/support"
+
+**Digital Signage:**
+- "Dashboard 1" through "Dashboard 5" for rotating content
+- "Announcements" instead of "https://cms.local/public/announcements"
+- "Menu Board" instead of "http://192.168.1.75/menus/today"
+
+**Multi-Location Setups:**
+- "Building A Reception" and "Building B Reception" for identical URL structures
+- "Floor 1 Display" through "Floor 10 Display" for elevator kiosks
+- "East Wing" and "West Wing" for hospital navigation
+
+Names are completely optional - if left blank, the URL will be displayed as usual. Configure names during initial setup or update them later via: Core Settings → Sites → Update site names.
+
 ### Inactivity Extensions
 
 When "Are you still here?" prompt appears (on manual or hidden sites):
@@ -548,6 +914,143 @@ Example: Display off 22:00-06:00, optional password on wake
 
 ---
 
+## Installation & Management Features
+
+### Virtual Console Configuration
+
+Virtual consoles provide terminal access via Ctrl+Alt+F1 through F8 keyboard combinations.
+
+**During Installation:**
+- Prompted at the end of initial setup
+- Default: ENABLED (Ubuntu standard behavior)
+- Option to disable for enhanced security
+
+**Security Considerations:**
+
+*Enabled (Default):*
+- Allows manual terminal login for troubleshooting
+- Useful for SSH failures or network issues
+- Standard Ubuntu/Linux behavior
+- Can login with kiosk user credentials or main user account
+
+*Disabled (More Secure):*
+- Blocks direct terminal access
+- Forces all access through SSH or menu system
+- Better for public kiosks or untrusted environments
+- Can still be re-enabled via Advanced menu (requires existing SSH access)
+
+**Post-Install Management:**
+```bash
+# Access via menu: Advanced → Virtual Consoles (option 7)
+# Note: Changes require restarting the display manager to take effect
+
+# Manual enable
+for i in {1..8}; do sudo systemctl unmask getty@tty$i.service; done
+sudo systemctl daemon-reload
+sudo systemctl restart lightdm
+
+# Manual disable
+for i in {1..8}; do sudo systemctl mask getty@tty$i.service; done
+sudo systemctl daemon-reload
+sudo systemctl restart lightdm
+```
+
+**Important Notes:**
+- **Version 0.9.7-4** fixed Ctrl+Alt+F1-F8 key combinations (now properly enables/disables X11 VT switching)
+- If you enabled virtual consoles in an earlier version, you must re-enable them from the menu for keys to work
+- Changes require restarting lightdm: `sudo systemctl restart lightdm`
+
+**Typical TTY Layout:**
+- TTY1-6: Login consoles (if enabled)
+- TTY7: Graphical kiosk display (X11/LightDM)
+- TTY8: Available for additional services
+
+### Emergency WiFi Hotspot
+
+Automatically creates a WiFi access point when internet connectivity is lost.
+
+**During Installation:**
+- Prompted at the end of initial setup
+- Optional configuration with custom SSID and password
+- Can be deferred and configured later
+
+**How It Works:**
+1. Service monitors internet connectivity every 30 seconds
+2. When internet is lost, automatically:
+   - Creates WiFi hotspot with configured credentials
+   - Assigns IP address (default: 10.42.0.1)
+   - Displays on-screen notification with connection details
+   - Serves simple web page at http://10.42.0.1
+3. When internet returns, hotspot automatically shuts down
+
+**Use Cases:**
+- Initial WiFi configuration without keyboard
+- Network troubleshooting when SSH is unavailable
+- Remote location setup without IT staff present
+- Automatic failover for temporary connectivity issues
+
+**Configuration:**
+```bash
+# Access via menu: Advanced → Emergency Hotspot (option 9)
+
+# Default credentials:
+SSID: Kiosk-Emergency
+Password: kioskhotspot123
+
+# Once connected to hotspot:
+# - SSH: ssh user@10.42.0.1
+# - Web: http://10.42.0.1 (shows connection info)
+# - Run installer script to reconfigure WiFi
+```
+
+**Files Created:**
+- `/usr/local/bin/kiosk-emergency-hotspot` - Main service script
+- `/etc/systemd/system/kiosk-emergency-hotspot.service` - Systemd service
+
+### Complete Uninstall
+
+Full system cleanup that removes all kiosk components and restores the system to pre-installation state.
+
+**Access:**
+```bash
+# Core Settings menu → option 11
+./ubuntu-based-kiosk.sh
+# Choose: Core Settings → Complete Uninstall
+```
+
+**What Gets Removed:**
+- Kiosk user and all user data
+- All Electron and Node.js installations
+- LightDM and Openbox window manager
+- All systemd services and timers
+- All kiosk scripts and configurations
+- CUPS printing system
+- VNC server
+- Emergency hotspot configuration
+- All scheduled tasks (power, display, quiet hours)
+
+**What Gets Preserved:**
+- VPN configurations (if not manually removed)
+- System packages (Ubuntu base system)
+- Network configuration (WiFi, ethernet)
+- SSH server and settings
+- User accounts (except kiosk user)
+
+**Safety Features:**
+- Requires typing "UNINSTALL" to confirm
+- Re-enables virtual consoles automatically
+- Stops all services before removal
+- Offers optional reboot after completion
+- No way to undo - creates clean slate
+
+**Use When:**
+- Repurposing hardware for different use
+- Testing/development cleanup
+- Complete fresh start needed
+- Removing kiosk from production system
+
+---
+
 ## Third-Party Software Licenses
 
 This project bundles or installs several open-source components under their respective licenses:
@@ -635,32 +1138,13 @@ This project bundles or installs several open-source components under their resp
 - **Repository:** https://github.com/netbirdio/netbird
 - **Full License:** https://github.com/netbirdio/netbird/blob/main/LICENSE
 
-### Mumble Client (Voice Communication)
-- **License:** BSD-3-Clause
-- **Source:** https://www.mumble.info
-- **Repository:** https://github.com/mumble-voip/mumble
-- **Full License:** https://github.com/mumble-voip/mumble/blob/master/LICENSE
-- **Note:** Used in separate voice communication components
 
-### Murmur Server (Mumble Server)
-- **License:** BSD-3-Clause
-- **Source:** https://www.mumble.info
-- **Repository:** https://github.com/mumble-voip/mumble
-- **Full License:** https://github.com/mumble-voip/mumble/blob/master/LICENSE
-- **Note:** Used in separate voice communication components
-
-### TalkKonnect (Mumble PTT Client)
-- **License:** Mozilla Public License 2.0 (MPL-2.0)
-- **Source:** https://github.com/talkkonnect/talkkonnect
-- **Repository:** https://github.com/talkkonnect/talkkonnect
-- **Full License:** https://github.com/talkkonnect/talkkonnect/blob/master/LICENSE
-- **Note:** Used in separate voice communication components
 
 ---
 
-## UBK Project License
+## Ubuntu Based Kiosk Project License
 
-The UBK installer script and original code components are licensed under **GPL-3.0-or-later**.
+The Ubuntu Based Kiosk installer script and original code components are licensed under **GPL-3.0-or-later**.
 
 See the LICENSE file in the repository for full terms.
 
@@ -678,20 +1162,100 @@ See the LICENSE file in the repository for full terms.
 
 ---
 
+## Modular Management (new, in progress)
+
+The 12,000+ line single-file installer works, but every menu lives in the
+same file as everything else, which makes small changes risky. We're
+pulling the *menu system* out into small, independently editable files as
+groundwork for the planned web-based GUI (same modules will back both the
+terminal menu and the web UI, so they can't drift apart).
+
+**What's here so far:**
+- `lib/menu.sh` — a generic numbered-menu framework (auto-numbers entries,
+  always offers `0` to exit/return, validated input helpers). Menu files
+  just declare their labels and handler functions; they don't hand-roll
+  `echo`/`case` loops.
+- `lib/config.sh` — the single place that reads/writes `config.json`.
+- `menus/sites.sh` — **Sites & Page Timing**, fully migrated: add, edit,
+  delete, and reorder pages, and set the duration/timing mode
+  (auto-rotate / manual / hidden) and home page — as a working proof of
+  concept for this approach.
+- `menus/display.sh` — **Display & Interaction**: touch gesture mode,
+  link navigation security, and the on-screen pause/keyboard/navigation
+  button toggles. A second proof of concept covering a different menu
+  shape (settings toggles vs. the list CRUD in Sites).
+- `install.sh` — entry point for the modular tool. Run it against an
+  *already-installed* kiosk:
+  ```bash
+  git clone https://github.com/outis1one/ubuntu-based-kiosk/
+  cd ubuntu-based-kiosk
+  ./install.sh
+  ```
+
+This does **not** yet replace first-time installation — that's still the
+single-file script above (`Quick Install`). The rest of Core
+Settings/Addons/Advanced will move into `menus/*.sh` the same way, one
+menu at a time, and `install.sh` will eventually take over the whole
+`show_main_menu` from the legacy script.
+
+---
+
 ## Project Status & Future Plans
 
-**Current Version:** 0.9.7 - Site-Specific Extension Fix
+**Current Version:** 2.0.0
+
+**Recent Updates (v2.0.0):**
+- **Modular management path:** new `lib/menu.sh` (reusable numbered-menu framework: auto-numbered entries, `0` always exits/returns) and `lib/config.sh` (single load/save for `config.json`), with menus migrating into `menus/*.sh` one at a time — **Sites & Page Timing** and **Display & Interaction** are migrated so far. Run via `./install.sh` after cloning the repo, against an already-installed kiosk (see "Modular Management" below). Groundwork for the planned web-based GUI, which will share this same `lib/config.sh` layer.
+- **Bug fix:** the old Sites menu could save `config.json` without first loading swipe/navigation/lockout settings, silently resetting them to script defaults.
+- **Bug fix:** reordering sites had an off-by-one that left the moved site one slot short of the requested position.
+- **Renamed installer:** the main script is now `ubuntu-based-kiosk.sh` (no version number in the filename), updated in place going forward. Released versions are tracked via git history and this changelog instead of the filename; older `ubuntu-based-kiosk-v*.sh` / `install_kiosk_*.sh` files remain in the repo as archived releases.
+
+**Previous (v1.0.3):**
+- **HDMI/external display mirroring:** any connected display beyond the primary (e.g. HDMI-out to a monitor/TV) is now mirrored automatically at the primary's exact resolution — generating a custom `cvt` mode if the external display doesn't natively list it — both at kiosk login/boot and live on plug/unplug via a new udev-triggered `kiosk-hotplug.service`. Previously the external output was left inactive even when detected by X, and would otherwise mirror at its own native resolution instead of matching the kiosk panel
+- **HDMI audio routing:** audio now follows the same hotplug event — the default PipeWire sink automatically switches to the HDMI audio output when an external display is connected/mirrored, and back to the built-in sink when it's disconnected (`kiosk-audio-route.sh`)
+- **Package install:** installer now also installs `net-tools` and `ncdu` (alongside the already-installed `curl` and `git`)
+- **Touch input fix (keyring):** added `--password-store=basic` to the Electron launch. Under LightDM autologin the GNOME keyring stays locked; when Chromium accessed it, the keyring unlock dialog grabbed all keyboard/touch input — the kiosk rendered fine but ignored every tap and keypress. This flag stops Electron from using the keyring, so the dialog never appears.
+- **Touch gesture fix (libinput):** any touch screen is now forced to the `libinput` driver via `/etc/X11/xorg.conf.d/99-finger-libinput.conf` (matched by hardware capability, so it works on any brand and never affects keyboards, mice, or the pen/stylus). Some drivers — notably `wacom` — only do single-touch pointer emulation and never pass real multitouch to Chromium, so 1-finger and 2-finger swipe gestures could not fire. libinput delivers proper multitouch.
+- **Upgrade reliability:** `start.sh` is now refreshed on every upgrade alongside `main.js` and `preload.js`
+- **Upgrade fix:** node_modules no longer wiped during upgrade — preserves the ~120MB Electron binary so upgrades don't fail on slow/unreliable connections
+- **Authelia fix:** 10-second timeout on Authelia login fetch prevents white screen when Authelia is slow to respond
+- **Authelia config:** clearer YAML merge instructions with before/after examples to prevent duplicate `access_control:` block mistake
+- **Upgrade fix:** config backup cleanup now uses `sudo rm` to avoid "Operation not permitted" error
+
+**Previous (v1.0.2):**
+- **Authelia Auto-Login addon** (`Addons → 5`) — authenticates with Authelia SSO on every startup; password stored encrypted (AES-256 keyed from machine ID, not plain text); prints full Dockerized Authelia server-side setup after configuration
+- **Bug fix:** PipeWire config dirs were created as root at step [5.5/27], causing "Permission denied" on fresh installs
+- **README:** install commands no longer hardcode version numbers — always fetch latest from GitHub
+
+**Previous (v1.0.1):**
+- **Node.js upgrade:** 20 LTS → 22 LTS
+- **Electron upgrade:** v39/41 → v42.x
+
+**Previous (v1.0.0):**
+- **Upgrade fix:** file extraction now correctly verifies written files on Ubuntu 22.04+ systems where the kiosk home directory has restrictive permissions (750)
+- **Install fix:** sudo credentials primed upfront before the long apt install step, preventing cache expiry at the timezone prompt
+- **Timezone fix:** fallback to direct `/etc/localtime` symlink when `timedatectl` fails via D-Bus
+
+**Previous (v0.9.9.1):**
+- Silent upgrade: no user input required, extracts files directly from script
+- Power button fixes
+- Import allows selecting backup by number instead of typing path
+
+**Previous (v0.9.8):**
+- Easy Asterisk Intercom addon with automatic updates
+- Smart version detection and configuration preservation
+- Named websites feature for user-friendly site identification
+- Navigation menu with key icon
 
 **Planned Features:**
 - Web-based GUI configuration interface
 - All-in-one ISO installer
-- Voice communication integration (Mumble/TalkKonnect)
 - Enhanced Raspberry Pi support and testing
 
 **Known Limitations:**
 - Raspberry Pi support untested in production
 - No web-based configuration (CLI menu only)
-- Single display only (extended desktop not supported)
+- Extended desktop not supported — additional connected displays (e.g. HDMI-out to a monitor/TV) are automatically **mirrored**, not extended
 
 ---
 
@@ -708,19 +1272,19 @@ Contributions welcome! Please:
 
 ## Support & Community
 
-- **Repository:** https://github.com/outis1one/ubk/
-- **Issues:** https://github.com/outis1one/ubk/issues
-- **Discussions:** https://github.com/outis1one/ubk/discussions
+- **Repository:** https://github.com/outis1one/ubuntu-based-kiosk/
+- **Issues:** https://github.com/outis1one/ubuntu-based-kiosk/issues
+- **Discussions:** https://github.com/outis1one/ubuntu-based-kiosk/discussions
 
 ---
 
 ## Credits
 
-Built with assistance from **Claude Sonnet 4/.5** (Anthropic AI)
+Built with assistance from **Claude Sonnet 4.6** (Anthropic AI)
 
-Special thanks to the maintainers of all upstream projects that make UBK possible.
+Special thanks to the maintainers of all upstream projects that make Ubuntu Based Kiosk possible.
 
 ---
 
-*Last Updated: November 23 2025*  
-*Version: Check script header for current version*
+*Last Updated: June 15, 2026*
+*Version: 1.0.3*

addon_asterisk_easy.sh

@@ -0,0 +1,314 @@
+#!/bin/bash
+
+################################################################################
+# Asterisk-Easy Addon Installation Functions
+# Description: Addon module for installing and configuring Asterisk-Easy
+# Version: 1.0
+################################################################################
+
+# Color definitions for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+################################################################################
+# Function: install_asterisk_easy
+# Description: Main function to install Asterisk-Easy
+# Parameters: None
+# Returns: 0 on success, 1 on failure
+################################################################################
+install_asterisk_easy() {
+    echo -e "${BLUE}================================${NC}"
+    echo -e "${BLUE}Asterisk-Easy Installation${NC}"
+    echo -e "${BLUE}================================${NC}"
+    
+    # Update system packages
+    echo -e "${YELLOW}Updating system packages...${NC}"
+    apt-get update -qq
+    if [ $? -ne 0 ]; then
+        echo -e "${RED}Failed to update system packages${NC}"
+        return 1
+    fi
+    
+    # Install Asterisk dependencies
+    echo -e "${YELLOW}Installing Asterisk dependencies...${NC}"
+    apt-get install -y \
+        asterisk \
+        asterisk-config \
+        asterisk-dev \
+        asterisk-doc \
+        asterisk-modules \
+        asterisk-voicemail \
+        dahdi \
+        libpri \
+        asterisk-dahdi &>/dev/null
+    
+    if [ $? -ne 0 ]; then
+        echo -e "${RED}Failed to install Asterisk packages${NC}"
+        return 1
+    fi
+    
+    # Install additional dependencies
+    echo -e "${YELLOW}Installing additional dependencies...${NC}"
+    apt-get install -y \
+        build-essential \
+        libssl-dev \
+        libxml2-dev \
+        libsqlite3-dev \
+        uuid-dev &>/dev/null
+    
+    if [ $? -ne 0 ]; then
+        echo -e "${RED}Failed to install additional dependencies${NC}"
+        return 1
+    fi
+    
+    # Configure Asterisk
+    echo -e "${YELLOW}Configuring Asterisk...${NC}"
+    configure_asterisk_easy
+    
+    if [ $? -ne 0 ]; then
+        echo -e "${RED}Failed to configure Asterisk-Easy${NC}"
+        return 1
+    fi
+    
+    # Start Asterisk service
+    echo -e "${YELLOW}Starting Asterisk service...${NC}"
+    systemctl enable asterisk
+    systemctl start asterisk
+    
+    if [ $? -ne 0 ]; then
+        echo -e "${RED}Failed to start Asterisk service${NC}"
+        return 1
+    fi
+    
+    echo -e "${GREEN}✓ Asterisk-Easy installation completed successfully${NC}"
+    return 0
+}
+
+################################################################################
+# Function: configure_asterisk_easy
+# Description: Configure Asterisk-Easy with basic settings
+# Parameters: None
+# Returns: 0 on success, 1 on failure
+################################################################################
+configure_asterisk_easy() {
+    local asterisk_dir="/etc/asterisk"
+    
+    # Check if Asterisk directory exists
+    if [ ! -d "$asterisk_dir" ]; then
+        echo -e "${RED}Asterisk configuration directory not found: $asterisk_dir${NC}"
+        return 1
+    fi
+    
+    # Backup original configuration files
+    echo -e "${YELLOW}Backing up original Asterisk configuration...${NC}"
+    if [ -f "$asterisk_dir/extensions.conf" ]; then
+        cp "$asterisk_dir/extensions.conf" "$asterisk_dir/extensions.conf.bak.$(date +%s)"
+    fi
+    
+    if [ -f "$asterisk_dir/sip.conf" ]; then
+        cp "$asterisk_dir/sip.conf" "$asterisk_dir/sip.conf.bak.$(date +%s)"
+    fi
+    
+    # Create basic extensions configuration
+    echo -e "${YELLOW}Creating basic extensions configuration...${NC}"
+    create_extensions_conf "$asterisk_dir"
+    
+    # Create basic SIP configuration
+    echo -e "${YELLOW}Creating basic SIP configuration...${NC}"
+    create_sip_conf "$asterisk_dir"
+    
+    return 0
+}
+
+################################################################################
+# Function: create_extensions_conf
+# Description: Create basic extensions configuration file
+# Parameters: $1 - Asterisk configuration directory
+# Returns: 0 on success, 1 on failure
+################################################################################
+create_extensions_conf() {
+    local asterisk_dir="$1"
+    local extensions_file="$asterisk_dir/extensions.conf"
+    
+    cat > "$extensions_file" << 'EOF'
+[general]
+static=yes
+writeprotect=no
+
+[default]
+exten => 100,1,Dial(SIP/100)
+exten => 100,n,Voicemail(100@default)
+exten => 100,n,Hangup()
+
+exten => 101,1,Dial(SIP/101)
+exten => 101,n,Voicemail(101@default)
+exten => 101,n,Hangup()
+
+exten => 102,1,Dial(SIP/102)
+exten => 102,n,Voicemail(102@default)
+exten => 102,n,Hangup()
+
+exten => 200,1,VoicemailMain(${CALLERID(num)}@default)
+exten => 200,n,Hangup()
+EOF
+    
+    if [ $? -ne 0 ]; then
+        echo -e "${RED}Failed to create extensions configuration${NC}"
+        return 1
+    fi
+    
+    return 0
+}
+
+################################################################################
+# Function: create_sip_conf
+# Description: Create basic SIP configuration file
+# Parameters: $1 - Asterisk configuration directory
+# Returns: 0 on success, 1 on failure
+################################################################################
+create_sip_conf() {
+    local asterisk_dir="$1"
+    local sip_file="$asterisk_dir/sip.conf"
+    
+    cat > "$sip_file" << 'EOF'
+[general]
+context=default
+allowoverlap=no
+bindport=5060
+bindaddr=0.0.0.0
+srvlookup=yes
+pedantic=no
+maxexpiry=3600
+minexpiry=60
+defaultexpiry=120
+defaultexpirey=120
+rtptimeout=30
+rtpholdtimeout=300
+videosupport=yes
+allowtransfer=yes
+nat=force_rport,comedia
+
+[100]
+type=friend
+secret=123456
+host=dynamic
+context=default
+
+[101]
+type=friend
+secret=123456
+host=dynamic
+context=default
+
+[102]
+type=friend
+secret=123456
+host=dynamic
+context=default
+EOF
+    
+    if [ $? -ne 0 ]; then
+        echo -e "${RED}Failed to create SIP configuration${NC}"
+        return 1
+    fi
+    
+    return 0
+}
+
+################################################################################
+# Function: verify_asterisk_easy
+# Description: Verify Asterisk-Easy installation
+# Parameters: None
+# Returns: 0 if installed and running, 1 otherwise
+################################################################################
+verify_asterisk_easy() {
+    # Check if Asterisk is installed
+    if ! command -v asterisk &> /dev/null; then
+        echo -e "${RED}Asterisk is not installed${NC}"
+        return 1
+    fi
+    
+    # Check if Asterisk service is running
+    if ! systemctl is-active --quiet asterisk; then
+        echo -e "${YELLOW}Asterisk service is not running${NC}"
+        return 1
+    fi
+    
+    echo -e "${GREEN}✓ Asterisk-Easy is properly installed and running${NC}"
+    return 0
+}
+
+################################################################################
+# Function: show_asterisk_easy_status
+# Description: Display Asterisk-Easy status information
+# Parameters: None
+# Returns: 0 on success
+################################################################################
+show_asterisk_easy_status() {
+    echo -e "${BLUE}================================${NC}"
+    echo -e "${BLUE}Asterisk-Easy Status${NC}"
+    echo -e "${BLUE}================================${NC}"
+    
+    # Check service status
+    if systemctl is-active --quiet asterisk; then
+        echo -e "${GREEN}Service Status: Running${NC}"
+    else
+        echo -e "${RED}Service Status: Not Running${NC}"
+    fi
+    
+    # Check Asterisk version
+    if command -v asterisk &> /dev/null; then
+        local version=$(asterisk -v | grep -oP 'Asterisk \K[0-9.]+')
+        echo -e "${BLUE}Asterisk Version: $version${NC}"
+    fi
+    
+    # Check configuration files
+    if [ -f "/etc/asterisk/extensions.conf" ]; then
+        echo -e "${GREEN}✓ Extensions Configuration: Present${NC}"
+    else
+        echo -e "${RED}✗ Extensions Configuration: Missing${NC}"
+    fi
+    
+    if [ -f "/etc/asterisk/sip.conf" ]; then
+        echo -e "${GREEN}✓ SIP Configuration: Present${NC}"
+    else
+        echo -e "${RED}✗ SIP Configuration: Missing${NC}"
+    fi
+    
+    return 0
+}
+
+################################################################################
+# Function: remove_asterisk_easy
+# Description: Remove Asterisk-Easy installation
+# Parameters: None
+# Returns: 0 on success, 1 on failure
+################################################################################
+remove_asterisk_easy() {
+    echo -e "${YELLOW}Removing Asterisk-Easy...${NC}"
+    
+    # Stop Asterisk service
+    systemctl stop asterisk
+    systemctl disable asterisk
+    
+    # Remove Asterisk packages
+    apt-get remove -y asterisk asterisk-* &>/dev/null
+    
+    if [ $? -ne 0 ]; then
+        echo -e "${RED}Failed to remove Asterisk packages${NC}"
+        return 1
+    fi
+    
+    echo -e "${GREEN}✓ Asterisk-Easy has been removed${NC}"
+    return 0
+}
+
+# Export functions for use in main script
+export -f install_asterisk_easy
+export -f configure_asterisk_easy
+export -f verify_asterisk_easy
+export -f show_asterisk_easy_status
+export -f remove_asterisk_easy

install.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+################################################################################
+# install.sh - Modular management entry point for Ubuntu Based Kiosk.
+#
+# This is NOT yet the full system installer - that is still the big
+# single-file script (ubuntu-based-kiosk-v1.0.3.sh etc) documented in
+# Readme.md, and first-time provisioning of a new kiosk still goes through
+# it. This entry point is the start of pulling the *menu system* out of
+# that 12k-line file into small, independently editable modules under
+# lib/ and menus/, so a change to (say) the Sites menu can't accidentally
+# break WiFi setup or the uninstaller three thousand lines away.
+#
+# Today this wires up Sites & Page Timing (menus/sites.sh) and Display &
+# Interaction (menus/display.sh). The rest of Core Settings/Addons/Advanced
+# will move over the same way, one menus/*.sh file at a time.
+#
+# Usage (once the kiosk has already been installed):
+#   git clone <repo>
+#   cd ubuntu-based-kiosk
+#   ./install.sh
+################################################################################
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# shellcheck source=lib/menu.sh
+source "$SCRIPT_DIR/lib/menu.sh"
+# shellcheck source=lib/config.sh
+source "$SCRIPT_DIR/lib/config.sh"
+# shellcheck source=menus/sites.sh
+source "$SCRIPT_DIR/menus/sites.sh"
+# shellcheck source=menus/display.sh
+source "$SCRIPT_DIR/menus/display.sh"
+
+################################################################################
+# Preflight
+################################################################################
+
+if [[ "$(whoami)" == "kiosk" ]]; then
+    log_error "Cannot run as user 'kiosk'"
+    exit 1
+fi
+
+if [[ $EUID -eq 0 ]]; then
+    log_error "Run as a regular user with sudo privileges, not as root"
+    exit 1
+fi
+
+if ! command -v jq &>/dev/null; then
+    log_error "jq is required but not installed. Run: sudo apt-get install -y jq"
+    exit 1
+fi
+
+if ! is_kiosk_installed; then
+    echo
+    log_error "No installed kiosk found at ${KIOSK_DIR}."
+    echo
+    echo "This tool manages an already-installed kiosk. To provision a new"
+    echo "one for the first time, use the full installer instead - see"
+    echo "Readme.md ('Quick Install') for the current download command."
+    echo
+    exit 1
+fi
+
+################################################################################
+# Top-level menu
+################################################################################
+
+main_menu_builder() {
+    MENU_LABELS=("Sites & Page Timing" "Display & Interaction")
+    MENU_HANDLERS=(sites_menu display_menu)
+}
+
+main_menu_status() {
+    echo "Managing kiosk at: ${KIOSK_DIR}"
+}
+
+run_menu "UBUNTU BASED KIOSK - MANAGEMENT" main_menu_builder main_menu_status "Exit"

install_kiosk_0.9.7-3.sh

@@ -1,13 +1,17 @@
 #!/bin/bash
 ################################################################################
-###   Ubuntu Based Kiosk (UBK) v0.9.7         ###
+###   Ubuntu Based Kiosk v0.9.7-3             ###
 ################################################################################
 #
-# RELEASE v0.9.7 - phase one complete
+# RELEASE v0.9.7-3 - Install improvements & management features
+# - Fixed missing complete_uninstall function
+# - Added virtual console configuration (Ctrl+Alt+F1-F8)
+# - Added emergency hotspot to initial installation
+# - Enhanced security options and documentation
 #
 # Built with Claude Sonnet 4/.5 AI assistance
-# License: GPL v3 - Keep derivatives open sour
-# Repository: https://github.com/outis1one/ubk/
+# License: GPL v3 - Keep derivatives open source
+# Repository: https://github.com/outis1one/ubuntu-based-kiosk/
 #
 # TARGET SYSTEMS:
 # - Ubuntu 24.04+ Server (minimal install recommended)
@@ -35,7 +39,7 @@ set -euo pipefail
 ### SECTION 1: CONSTANTS & GLOBALS
 ################################################################################
 
-SCRIPT_VERSION="0.9.7"
+SCRIPT_VERSION="0.9.7-3"
 KIOSK_USER="kiosk"
 BUILD_USER="${SUDO_USER:-$(whoami)}"
 KIOSK_HOME="/home/${KIOSK_USER}"
@@ -2146,7 +2150,75 @@ disable_emergency_hotspot() {
     pause
 }
 
+################################################################################
+### VIRTUAL CONSOLE CONFIGURATION
+################################################################################
 
+configure_virtual_consoles() {
+    clear
+    echo "══════════════════════════════════════════════════════════════"
+    echo "   VIRTUAL CONSOLE CONFIGURATION                              "
+    echo "══════════════════════════════════════════════════════════════"
+    echo
+    echo "Virtual consoles (Ctrl+Alt+F1 through F8) allow manual login"
+    echo "to a terminal for troubleshooting and system maintenance."
+    echo
+    echo "Current status:"
+
+    # Check if virtual consoles are enabled
+    local consoles_disabled=false
+    if systemctl is-masked getty@tty1.service >/dev/null 2>&1; then
+        consoles_disabled=true
+        echo "  Virtual consoles: ✗ DISABLED"
+    else
+        consoles_disabled=false
+        echo "  Virtual consoles: ✓ ENABLED"
+    fi
+
+    echo
+    echo "Options:"
+    echo "  1. Enable virtual consoles (Ctrl+Alt+F1-F8 for manual login)"
+    echo "  2. Disable virtual consoles (more secure, kiosk only)"
+    echo "  0. Cancel"
+    echo
+    read -r -p "Choose [0-2]: " choice
+
+    case "$choice" in
+        1)
+            echo
+            echo "Enabling virtual consoles..."
+            for i in {1..8}; do
+                sudo systemctl unmask getty@tty$i.service 2>/dev/null || true
+            done
+            sudo systemctl daemon-reload
+            log_success "Virtual consoles enabled"
+            echo
+            echo "You can now access virtual consoles with:"
+            echo "  Ctrl+Alt+F1 through Ctrl+Alt+F8"
+            echo "  (Ctrl+Alt+F7 typically returns to the kiosk)"
+            pause
+            ;;
+        2)
+            echo
+            read -r -p "Disable all virtual consoles? (y/n): " confirm
+            if [[ "$confirm" =~ ^[Yy]$ ]]; then
+                echo "Disabling virtual consoles..."
+                for i in {1..8}; do
+                    sudo systemctl mask getty@tty$i.service 2>/dev/null || true
+                done
+                sudo systemctl daemon-reload
+                log_success "Virtual consoles disabled"
+                echo
+                echo "Virtual console access has been disabled for security."
+                echo "You can re-enable them from the Tools menu if needed."
+                pause
+            fi
+            ;;
+        0)
+            return
+            ;;
+    esac
+}
 
 ################################################################################
 ### SECTION 5: POWER/DISPLAY/QUIET SCHEDULES
@@ -3475,6 +3547,124 @@ full_reinstall() {
     echo ""
     pause
 }
+
+complete_uninstall() {
+    echo ""
+    echo "══════════════════════════════════════════════════════════════"
+    echo "  COMPLETE UNINSTALL"
+    echo "══════════════════════════════════════════════════════════════"
+    echo ""
+    echo "⚠️  This will COMPLETELY REMOVE:"
+    echo "  • Kiosk user and all data"
+    echo "  • All kiosk configuration and sites"
+    echo "  • All Electron/Node.js installations"
+    echo "  • All browser caches and data"
+    echo "  • CUPS printer system"
+    echo "  • LightDM and Openbox"
+    echo "  • All kiosk schedules and services"
+    echo "  • Emergency hotspot configuration"
+    echo ""
+    echo "⚠️  This CANNOT be undone!"
+    echo ""
+    read -p "Are you ABSOLUTELY SURE? (type UNINSTALL): " CONFIRM
+
+    if [ "$CONFIRM" != "UNINSTALL" ]; then
+        echo "Cancelled."
+        return
+    fi
+
+    echo ""
+    echo "Beginning complete uninstall..."
+
+    # Stop all services
+    echo "[1/12] Stopping all kiosk services..."
+    sudo systemctl stop lightdm 2>/dev/null || true
+    sudo systemctl stop kiosk-emergency-hotspot.service 2>/dev/null || true
+    sudo systemctl stop kiosk-shutdown.timer 2>/dev/null || true
+    sudo systemctl stop kiosk-display-on.timer 2>/dev/null || true
+    sudo systemctl stop kiosk-display-off.timer 2>/dev/null || true
+    sudo systemctl stop kiosk-quiet-start.timer 2>/dev/null || true
+    sudo systemctl stop kiosk-quiet-end.timer 2>/dev/null || true
+    sudo systemctl stop kiosk-electron-reload.timer 2>/dev/null || true
+    sudo systemctl stop x11vnc 2>/dev/null || true
+
+    # Remove kiosk user
+    echo "[2/12] Removing kiosk user..."
+    if id "$KIOSK_USER" &>/dev/null; then
+        sudo pkill -u "$KIOSK_USER" 2>/dev/null || true
+        sudo userdel -r "$KIOSK_USER" 2>/dev/null || true
+        log_success "Kiosk user removed"
+    fi
+
+    # Remove kiosk files
+    echo "[3/12] Removing kiosk files..."
+    sudo rm -rf "$KIOSK_DIR"
+    sudo rm -rf /home/$KIOSK_USER
+
+    # Remove systemd services and timers
+    echo "[4/12] Removing systemd services..."
+    sudo rm -f /etc/systemd/system/kiosk-*.service
+    sudo rm -f /etc/systemd/system/kiosk-*.timer
+    sudo rm -f /etc/systemd/system/x11vnc.service
+    sudo systemctl daemon-reload
+
+    # Remove scripts
+    echo "[5/12] Removing scripts..."
+    sudo rm -f /usr/local/bin/kiosk-*
+    sudo rm -f /usr/local/bin/rtc-wake.sh
+
+    # Remove CUPS
+    echo "[6/12] Removing CUPS..."
+    sudo systemctl stop cups 2>/dev/null || true
+    sudo systemctl disable cups 2>/dev/null || true
+    sudo apt-get purge -y cups cups-client cups-common 2>/dev/null || true
+
+    # Remove Node.js and Electron
+    echo "[7/12] Removing Node.js..."
+    sudo apt-get purge -y nodejs npm 2>/dev/null || true
+    sudo rm -rf /usr/local/lib/node_modules
+    sudo rm -rf /usr/local/bin/node
+    sudo rm -rf /usr/local/bin/npm
+
+    # Remove LightDM and Openbox
+    echo "[8/12] Removing LightDM and Openbox..."
+    sudo systemctl disable lightdm 2>/dev/null || true
+    sudo apt-get purge -y lightdm openbox 2>/dev/null || true
+
+    # Remove VNC
+    echo "[9/12] Removing VNC..."
+    sudo systemctl stop x11vnc 2>/dev/null || true
+    sudo systemctl disable x11vnc 2>/dev/null || true
+    sudo apt-get purge -y x11vnc 2>/dev/null || true
+
+    # Remove polkit rules
+    echo "[10/12] Removing polkit rules..."
+    sudo rm -f /etc/polkit-1/localauthority/50-local.d/kiosk-power.pkla
+
+    # System cleanup
+    echo "[11/12] Cleaning up packages..."
+    sudo apt-get autoremove -y 2>/dev/null || true
+    sudo apt-get autoclean 2>/dev/null || true
+
+    # Re-enable virtual consoles if they were disabled
+    echo "[12/12] Re-enabling virtual consoles..."
+    for i in {1..6}; do
+        sudo systemctl unmask getty@tty$i.service 2>/dev/null || true
+    done
+
+    echo ""
+    echo "✓✓✓ KIOSK COMPLETELY UNINSTALLED ✓✓✓"
+    echo ""
+    echo "The system has been returned to its pre-kiosk state."
+    echo "You may want to reboot to ensure all changes take effect."
+    echo ""
+    read -r -p "Reboot now? (y/n): " do_reboot
+    if [[ "$do_reboot" =~ ^[Yy]$ ]]; then
+        echo "Rebooting..."
+        sleep 3
+        sudo reboot
+    fi
+}
 ################################################################################
 ### SECTION 8: FIRST TIME INSTALLATION
 ################################################################################
@@ -6575,6 +6765,52 @@ fi
     echo "[26/27] Finalizing installation..."
     log_success "Core installation complete!"
     echo
+
+    # Optional: Configure emergency hotspot
+    echo
+    echo "══════════════════════════════════════════════════════════════"
+    echo "   OPTIONAL: Emergency Hotspot                                "
+    echo "══════════════════════════════════════════════════════════════"
+    echo
+    echo "The emergency hotspot automatically activates when there's no"
+    echo "internet connection, allowing you to connect and troubleshoot."
+    echo
+    read -r -p "Configure emergency hotspot now? (y/n): " setup_hotspot
+    if [[ "$setup_hotspot" =~ ^[Yy]$ ]]; then
+        install_emergency_hotspot
+    else
+        log_info "Emergency hotspot can be configured later from Advanced menu"
+    fi
+
+    # Optional: Configure virtual consoles
+    echo
+    echo "══════════════════════════════════════════════════════════════"
+    echo "   OPTIONAL: Virtual Console Access                           "
+    echo "══════════════════════════════════════════════════════════════"
+    echo
+    echo "Virtual consoles (Ctrl+Alt+F1-F8) allow manual terminal login"
+    echo "for troubleshooting. This is useful but less secure."
+    echo
+    echo "Current status: ENABLED (default)"
+    echo
+    read -r -p "Keep virtual consoles enabled? (y/n): " keep_consoles
+    if [[ ! "$keep_consoles" =~ ^[Yy]$ ]]; then
+        echo
+        echo "Disabling virtual consoles for security..."
+        for i in {1..8}; do
+            sudo systemctl mask getty@tty$i.service 2>/dev/null || true
+        done
+        sudo systemctl daemon-reload
+        log_success "Virtual consoles disabled"
+        echo
+        echo "You can re-enable them later from Advanced menu (option 7)"
+    else
+        log_info "Virtual consoles remain enabled (Ctrl+Alt+F1-F8)"
+    fi
+
+    echo
+    echo "[27/27] Installation complete!"
+    echo
     echo "Next steps:"
     echo "  • Rerun this script to configure addons"
     echo "  • Reboot to start the kiosk"
@@ -8957,12 +9193,13 @@ advanced_menu() {
         echo "  4. Audio Diagnostics"
         echo "  5. Fix Squeezelite Audio"
         echo "  6. Factory Reset Config"
+        echo "  7. Virtual Consoles (Ctrl+Alt+F1-F8)"
         echo "  9. Emergency Hotspot"
         echo " 10. Network Test"
         echo "  0. Return"
         echo
         read -r -p "Choose [0-10]: " choice
-        
+
         case "$choice" in
             1) manual_electron_update ;;
             2) system_diagnostics ;;
@@ -8970,6 +9207,7 @@ advanced_menu() {
             4) audio_diagnostics ;;
             5) fix_squeezelite_audio ;;
             6) factory_reset ;;
+            7) configure_virtual_consoles ;;
             9) configure_emergency_hotspot ;;
             10) network_test ;;
             0) return ;;

lib/config.sh

@@ -0,0 +1,202 @@
+#!/bin/bash
+################################################################################
+# lib/config.sh - config.json read/write for the kiosk Electron app.
+#
+# Every menu that touches sites/timing/settings works against the same
+# in-memory bash arrays (URLS, DURS, USERS, PASSES, NAMES, ...) and the same
+# two functions below. Load once when a menu opens, save after each change.
+#
+# IMPORTANT: save_config() rewrites config.json from these globals in full.
+# Any menu that calls save_config() MUST call load_existing_config() first
+# (even if it only touches sites), otherwise settings it doesn't know about
+# (swipe mode, navigation security, lockout, etc) get silently reset to
+# script defaults. This bit the old single-file Sites menu, which read
+# tabs directly via jq but never loaded the rest of the settings - fixed
+# here by making load_existing_config() the one canonical loader.
+################################################################################
+
+: "${KIOSK_USER:=kiosk}"
+: "${KIOSK_HOME:=/home/${KIOSK_USER}}"
+: "${KIOSK_DIR:=${KIOSK_HOME}/kiosk-app}"
+: "${CONFIG_PATH:=${KIOSK_DIR}/config.json}"
+
+# Site/tab arrays
+declare -a URLS=()
+declare -a DURS=()
+declare -a USERS=()
+declare -a PASSES=()
+declare -a NAMES=()
+
+# Other top-level config.json settings we must round-trip even though the
+# Sites menu doesn't edit most of them.
+AUTOSWITCH="true"
+SWIPE_MODE="dual"
+ALLOW_NAVIGATION="same-origin"
+HOME_TAB_INDEX=-1
+INACTIVITY_TIMEOUT=120
+ENABLE_PAUSE_BUTTON="true"
+ENABLE_KEYBOARD_BUTTON="true"
+ENABLE_NAV_BUTTON="true"
+ENABLE_PASSWORD_PROTECTION="false"
+LOCKOUT_PASSWORD=""
+LOCKOUT_TIMEOUT=0
+LOCKOUT_AT_TIME=""
+LOCKOUT_ACTIVE_START=""
+LOCKOUT_ACTIVE_END=""
+REQUIRE_PASSWORD_ON_BOOT="false"
+
+kiosk_user_exists() {
+    id "$KIOSK_USER" &>/dev/null
+}
+
+is_kiosk_installed() {
+    kiosk_user_exists && sudo -u "$KIOSK_USER" test -f "$KIOSK_DIR/main.js" 2>/dev/null
+}
+
+is_service_active() {
+    local service="$1"
+    systemctl is-active --quiet "$service" 2>/dev/null
+}
+
+# Load every setting config.json has into the bash globals above.
+# Safe to call with no existing config file - leaves script defaults in place.
+load_existing_config() {
+    if ! sudo -u "$KIOSK_USER" test -f "$CONFIG_PATH" 2>/dev/null; then
+        return 0
+    fi
+
+    URLS=()
+    DURS=()
+    USERS=()
+    PASSES=()
+    NAMES=()
+
+    local tab_count
+    tab_count=$(sudo -u "$KIOSK_USER" jq -r '.tabs | length' "$CONFIG_PATH" 2>/dev/null || echo "0")
+    if [[ "$tab_count" -gt 0 ]]; then
+        for ((i = 0; i < tab_count; i++)); do
+            URLS+=("$(sudo -u "$KIOSK_USER" jq -r ".tabs[$i].url" "$CONFIG_PATH")")
+            DURS+=("$(sudo -u "$KIOSK_USER" jq -r ".tabs[$i].duration" "$CONFIG_PATH")")
+            USERS+=("$(sudo -u "$KIOSK_USER" jq -r ".tabs[$i].username // empty" "$CONFIG_PATH")")
+            PASSES+=("$(sudo -u "$KIOSK_USER" jq -r ".tabs[$i].password // empty" "$CONFIG_PATH")")
+            NAMES+=("$(sudo -u "$KIOSK_USER" jq -r ".tabs[$i].name // empty" "$CONFIG_PATH")")
+        done
+    fi
+
+    HOME_TAB_INDEX=$(sudo -u "$KIOSK_USER" jq -r '.homeTabIndex // -1' "$CONFIG_PATH" 2>/dev/null || echo "-1")
+    INACTIVITY_TIMEOUT=$(sudo -u "$KIOSK_USER" jq -r '.inactivityTimeout // 120' "$CONFIG_PATH" 2>/dev/null || echo "120")
+    ALLOW_NAVIGATION=$(sudo -u "$KIOSK_USER" jq -r '.allowNavigation // "same-origin"' "$CONFIG_PATH" 2>/dev/null || echo "same-origin")
+    SWIPE_MODE=$(sudo -u "$KIOSK_USER" jq -r '.swipeMode // "dual"' "$CONFIG_PATH" 2>/dev/null || echo "dual")
+
+    local pause_btn keyboard_btn nav_btn password_enabled boot_password
+    pause_btn=$(sudo -u "$KIOSK_USER" jq -r '.enablePauseButton // true' "$CONFIG_PATH" 2>/dev/null)
+    [[ "$pause_btn" == "true" ]] && ENABLE_PAUSE_BUTTON="true" || ENABLE_PAUSE_BUTTON="false"
+
+    keyboard_btn=$(sudo -u "$KIOSK_USER" jq -r '.enableKeyboardButton // true' "$CONFIG_PATH" 2>/dev/null)
+    [[ "$keyboard_btn" == "true" ]] && ENABLE_KEYBOARD_BUTTON="true" || ENABLE_KEYBOARD_BUTTON="false"
+
+    nav_btn=$(sudo -u "$KIOSK_USER" jq -r '.enableNavButton // true' "$CONFIG_PATH" 2>/dev/null)
+    [[ "$nav_btn" == "true" ]] && ENABLE_NAV_BUTTON="true" || ENABLE_NAV_BUTTON="false"
+
+    password_enabled=$(sudo -u "$KIOSK_USER" jq -r '.enablePasswordProtection // false' "$CONFIG_PATH" 2>/dev/null)
+    [[ "$password_enabled" == "true" ]] && ENABLE_PASSWORD_PROTECTION="true" || ENABLE_PASSWORD_PROTECTION="false"
+
+    LOCKOUT_PASSWORD=$(sudo -u "$KIOSK_USER" jq -r '.lockoutPassword // ""' "$CONFIG_PATH" 2>/dev/null || echo "")
+    LOCKOUT_TIMEOUT=$(sudo -u "$KIOSK_USER" jq -r '.lockoutTimeout // 0' "$CONFIG_PATH" 2>/dev/null || echo "0")
+    LOCKOUT_AT_TIME=$(sudo -u "$KIOSK_USER" jq -r '.lockoutAtTime // ""' "$CONFIG_PATH" 2>/dev/null || echo "")
+    LOCKOUT_ACTIVE_START=$(sudo -u "$KIOSK_USER" jq -r '.lockoutActiveStart // ""' "$CONFIG_PATH" 2>/dev/null || echo "")
+    LOCKOUT_ACTIVE_END=$(sudo -u "$KIOSK_USER" jq -r '.lockoutActiveEnd // ""' "$CONFIG_PATH" 2>/dev/null || echo "")
+
+    boot_password=$(sudo -u "$KIOSK_USER" jq -r '.requirePasswordOnBoot // false' "$CONFIG_PATH" 2>/dev/null)
+    [[ "$boot_password" == "true" ]] && REQUIRE_PASSWORD_ON_BOOT="true" || REQUIRE_PASSWORD_ON_BOOT="false"
+}
+
+# Write every bash global back out to config.json, then offer to reload the
+# kiosk display so the change takes effect immediately.
+save_config() {
+    if ! kiosk_user_exists; then
+        log_error "Kiosk user doesn't exist - run the full installer first"
+        return 1
+    fi
+
+    sudo mkdir -p "$KIOSK_DIR"
+    sudo chown -R "$KIOSK_USER:$KIOSK_USER" "$KIOSK_DIR"
+
+    local tmp
+    tmp=$(mktemp)
+
+    local dual_json="false"
+    [[ "$SWIPE_MODE" == "dual" ]] && dual_json="true"
+
+    local pause_btn_json="true"
+    [[ "$ENABLE_PAUSE_BUTTON" == "false" ]] && pause_btn_json="false"
+
+    local keyboard_btn_json="true"
+    [[ "$ENABLE_KEYBOARD_BUTTON" == "false" ]] && keyboard_btn_json="false"
+
+    local nav_btn_json="true"
+    [[ "$ENABLE_NAV_BUTTON" == "false" ]] && nav_btn_json="false"
+
+    local password_json="false"
+    [[ "$ENABLE_PASSWORD_PROTECTION" == "true" ]] && password_json="true"
+
+    local boot_password_json="false"
+    [[ "$REQUIRE_PASSWORD_ON_BOOT" == "true" ]] && boot_password_json="true"
+
+    jq -n \
+        --argjson autoswitch true \
+        --argjson enableTouch true \
+        --argjson dualSwipe "$dual_json" \
+        --arg swipeMode "$SWIPE_MODE" \
+        --arg allowNavigation "$ALLOW_NAVIGATION" \
+        --argjson homeTabIndex "${HOME_TAB_INDEX:--1}" \
+        --argjson inactivityTimeout "${INACTIVITY_TIMEOUT:-120}" \
+        --argjson enablePauseButton "$pause_btn_json" \
+        --argjson enableKeyboardButton "$keyboard_btn_json" \
+        --argjson enableNavButton "$nav_btn_json" \
+        --argjson enablePasswordProtection "$password_json" \
+        --arg lockoutPassword "${LOCKOUT_PASSWORD:-}" \
+        --argjson lockoutTimeout "${LOCKOUT_TIMEOUT:-0}" \
+        --arg lockoutAtTime "${LOCKOUT_AT_TIME:-}" \
+        --arg lockoutActiveStart "${LOCKOUT_ACTIVE_START:-}" \
+        --arg lockoutActiveEnd "${LOCKOUT_ACTIVE_END:-}" \
+        --argjson requirePasswordOnBoot "$boot_password_json" \
+        '{autoswitch:$autoswitch,enableTouch:$enableTouch,dualSwipe:$dualSwipe,swipeMode:$swipeMode,allowNavigation:$allowNavigation,homeTabIndex:$homeTabIndex,inactivityTimeout:$inactivityTimeout,enablePauseButton:$enablePauseButton,enableKeyboardButton:$enableKeyboardButton,enableNavButton:$enableNavButton,enablePasswordProtection:$enablePasswordProtection,lockoutPassword:$lockoutPassword,lockoutTimeout:$lockoutTimeout,lockoutAtTime:$lockoutAtTime,lockoutActiveStart:$lockoutActiveStart,lockoutActiveEnd:$lockoutActiveEnd,requirePasswordOnBoot:$requirePasswordOnBoot,tabs:[]}' > "$tmp"
+
+    if [[ ${#URLS[@]} -gt 0 ]]; then
+        for idx in "${!URLS[@]}"; do
+            local url="${URLS[$idx]:-}"
+            local dur="${DURS[$idx]:-0}"
+            local user="${USERS[$idx]:-}"
+            local pass="${PASSES[$idx]:-}"
+            local name="${NAMES[$idx]:-}"
+
+            jq --arg u "$url" \
+               --argjson d "$dur" \
+               --arg user "$user" \
+               --arg pass "$pass" \
+               --arg name "$name" \
+               '.tabs += [{"url":$u,"duration":$d,"username":$user,"password":$pass,"name":$name}]' \
+               "$tmp" > "${tmp}.new"
+            mv -f "${tmp}.new" "$tmp"
+        done
+    fi
+
+    sudo -u "$KIOSK_USER" bash -c "cat > '$CONFIG_PATH'" < "$tmp"
+    sudo -u "$KIOSK_USER" chmod 644 "$CONFIG_PATH"
+    rm -f "$tmp"
+
+    log_success "Configuration saved"
+
+    if is_service_active lightdm; then
+        echo
+        if ask_yes_no "Reload kiosk now to apply changes?" "y"; then
+            echo "Reloading kiosk..."
+            sudo systemctl restart lightdm
+            sleep 2
+            log_success "Kiosk reloaded"
+        else
+            log_warning "Remember to reload: sudo systemctl restart lightdm"
+        fi
+    fi
+}

lib/menu.sh

@@ -0,0 +1,240 @@
+#!/bin/bash
+################################################################################
+# lib/menu.sh - Reusable numbered-menu framework + validated input helpers.
+#
+# Goal: menu *behavior* (numbering, "0 to exit/return", input validation)
+# lives here once. Individual menus/*.sh files only supply their content
+# (labels + handler functions) and never re-implement the loop/echo/case
+# boilerplate that made the old single-file installer hard to change safely.
+#
+# Usage:
+#   my_menu_builder() {
+#       MENU_LABELS=("Do thing A" "Do thing B")
+#       MENU_HANDLERS=(action_a action_b)
+#   }
+#   run_menu "MY MENU TITLE" my_menu_builder [my_status_func]
+#
+# The builder runs fresh on every redraw, so labels/handlers can change
+# based on current state (e.g. "no sites yet" vs "5 sites configured").
+################################################################################
+
+################################################################################
+# Logging
+################################################################################
+
+log_info() {
+    echo "[INFO] $*"
+}
+
+log_error() {
+    echo "[ERROR] $*" >&2
+}
+
+log_success() {
+    echo "✓ $*"
+}
+
+log_warning() {
+    echo "⚠ $*"
+}
+
+pause() {
+    read -r -p "Press Enter to continue..."
+}
+
+################################################################################
+# Validated input helpers
+################################################################################
+
+validate_yes_no() {
+    local answer="$1"
+    case "${answer,,}" in
+        y|yes|yeah|yep|yup|sure|ok|okay) return 0 ;;
+        n|no|nope|nah) return 1 ;;
+        *) return 2 ;;  # invalid
+    esac
+}
+
+ask_yes_no() {
+    local prompt="$1"
+    local default="${2:-n}"
+    local answer
+
+    while true; do
+        read -r -p "$prompt (y/n) [$default]: " answer
+        answer="${answer:-$default}"
+
+        validate_yes_no "$answer"
+        local result=$?
+
+        if [[ $result -eq 0 ]]; then
+            return 0
+        elif [[ $result -eq 1 ]]; then
+            return 1
+        else
+            echo "❌ Invalid input. Please enter 'y' for yes or 'n' for no"
+            echo
+        fi
+    done
+}
+
+validate_integer() {
+    local value="$1"
+    local min="${2:--2147483648}"
+    local max="${3:-2147483647}"
+
+    if [[ $value =~ ^-?[0-9]+$ ]]; then
+        if [[ $value -ge $min && $value -le $max ]]; then
+            return 0
+        fi
+    fi
+    return 1
+}
+
+ask_integer() {
+    local prompt="$1"
+    local default="$2"
+    local min="${3:--2147483648}"
+    local max="${4:-2147483647}"
+    local value
+
+    while true; do
+        read -r -p "$prompt [$default]: " value
+        value="${value:-$default}"
+
+        if validate_integer "$value" "$min" "$max"; then
+            echo "$value"
+            return 0
+        else
+            echo "❌ Invalid number. Please enter an integer between $min and $max" >&2
+            echo >&2
+        fi
+    done
+}
+
+validate_url() {
+    local url="$1"
+    if [[ $url =~ ^(https?|file|data)://.*$ ]] || [[ $url =~ ^about: ]]; then
+        return 0
+    else
+        return 1
+    fi
+}
+
+ask_url() {
+    local prompt="$1"
+    local default="$2"
+    local url
+
+    while true; do
+        read -r -p "$prompt [$default]: " url
+        url="${url:-$default}"
+
+        if validate_url "$url"; then
+            echo "$url"
+            return 0
+        else
+            echo "❌ Invalid URL. Must start with http://, https://, file://, data:, or about:" >&2
+            echo >&2
+        fi
+    done
+}
+
+ask_text() {
+    local prompt="$1"
+    local default="${2:-}"
+    local value
+
+    read -r -p "$prompt [$default]: " value
+    echo "${value:-$default}"
+}
+
+validate_menu_choice() {
+    local choice="$1"
+    local max="$2"
+    validate_integer "$choice" 0 "$max"
+}
+
+ask_menu_choice() {
+    local max="$1"
+    local choice
+
+    while true; do
+        read -r -p "Choose [0-$max]: " choice
+
+        if validate_menu_choice "$choice" "$max"; then
+            echo "$choice"
+            return 0
+        else
+            echo "❌ Invalid choice. Please enter a number between 0 and $max" >&2
+            echo >&2
+        fi
+    done
+}
+
+################################################################################
+# Menu framework
+################################################################################
+
+print_menu_header() {
+    local title="$1"
+    echo "══════════════════════════════════════════════════════════"
+    printf "   %s\n" "$title"
+    echo "══════════════════════════════════════════════════════════"
+    echo
+}
+
+# run_menu TITLE BUILDER_FUNC [STATUS_FUNC] [EXIT_LABEL]
+#
+# BUILDER_FUNC must set the globals MENU_LABELS and MENU_HANDLERS (parallel
+# indexed arrays). It is called once per redraw, so it can reflect current
+# state. STATUS_FUNC, if given, is called right after the header to print
+# read-only context (current settings, current list, etc).
+#
+# Entries are auto-numbered 1..N. "0" always returns from run_menu - no
+# menu file needs to hand-roll its own exit case.
+run_menu() {
+    local title="$1"
+    local builder="$2"
+    local status_func="${3:-}"
+    local exit_label="${4:-Return}"
+
+    while true; do
+        clear
+        print_menu_header "$title"
+
+        if [[ -n "$status_func" ]]; then
+            "$status_func"
+            echo
+        fi
+
+        local -a MENU_LABELS=()
+        local -a MENU_HANDLERS=()
+        "$builder"
+
+        if [[ "${#MENU_LABELS[@]}" -eq 0 ]]; then
+            log_warning "Nothing to do here yet."
+            echo "   0. $exit_label"
+            echo
+            ask_menu_choice 0 >/dev/null
+            return 0
+        fi
+
+        local i=1
+        for label in "${MENU_LABELS[@]}"; do
+            printf "  %2d. %s\n" "$i" "$label"
+            i=$((i + 1))
+        done
+        echo "   0. $exit_label"
+        echo
+
+        local choice
+        choice=$(ask_menu_choice "${#MENU_LABELS[@]}")
+
+        if [[ "$choice" == "0" ]]; then
+            return 0
+        fi
+
+        "${MENU_HANDLERS[$((choice - 1))]}"
+    done
+}

menus/display.sh

@@ -0,0 +1,137 @@
+#!/bin/bash
+################################################################################
+# menus/display.sh - "Display & Interaction" menu.
+#
+# Second menu migrated off the old single-file installer, folding together
+# three small settings screens that used to be separate Core Settings
+# entries (Touch controls, Navigation security, Optional Features). All
+# three are simple scalar/boolean fields on config.json, so this is a
+# deliberately different shape from menus/sites.sh's list CRUD - a toggle
+# list where each entry shows its current value and flips/edits itself,
+# saving immediately (same immediate-save pattern as Sites, so behavior
+# stays consistent no matter which menu you're in).
+#
+# Depends on: lib/menu.sh, lib/config.sh being sourced first.
+################################################################################
+
+display_status() {
+    echo "Touch gesture mode: $SWIPE_MODE"
+    echo "Link navigation:    $ALLOW_NAVIGATION"
+    echo "Pause button:       $(display_onoff "$ENABLE_PAUSE_BUTTON")"
+    echo "Keyboard button:    $(display_onoff "$ENABLE_KEYBOARD_BUTTON")"
+    echo "Navigation button:  $(display_onoff "$ENABLE_NAV_BUTTON")"
+}
+
+display_onoff() {
+    [[ "$1" == "true" ]] && echo "ON" || echo "OFF"
+}
+
+display_menu_builder() {
+    MENU_LABELS=(
+        "Touch gesture mode (currently: $SWIPE_MODE)"
+        "Link navigation security (currently: $ALLOW_NAVIGATION)"
+        "Toggle pause button (currently: $(display_onoff "$ENABLE_PAUSE_BUTTON"))"
+        "Toggle on-screen keyboard button (currently: $(display_onoff "$ENABLE_KEYBOARD_BUTTON"))"
+        "Toggle navigation/help button (currently: $(display_onoff "$ENABLE_NAV_BUTTON"))"
+    )
+    MENU_HANDLERS=(
+        action_set_touch_mode
+        action_set_navigation_security
+        action_toggle_pause_button
+        action_toggle_keyboard_button
+        action_toggle_nav_button
+    )
+}
+
+display_menu() {
+    load_existing_config
+    run_menu "DISPLAY & INTERACTION" display_menu_builder display_status
+}
+
+################################################################################
+# Touch gesture mode
+################################################################################
+
+action_set_touch_mode() {
+    echo
+    echo "DUAL-DIRECTION (recommended for touchscreens):"
+    echo "  2-finger swipe = switch pages, 1-finger swipe = navigate within page"
+    echo "STANDARD (simpler):"
+    echo "  2-finger swipe = switch pages only, 1-finger swipes do nothing"
+    echo
+
+    local default
+    [[ "$SWIPE_MODE" == "dual" ]] && default="y" || default="n"
+
+    if ask_yes_no "Use dual-direction mode?" "$default"; then
+        SWIPE_MODE="dual"
+    else
+        SWIPE_MODE="standard"
+    fi
+
+    log_success "Touch mode: $SWIPE_MODE"
+    save_config
+}
+
+################################################################################
+# Navigation security
+################################################################################
+
+action_set_navigation_security() {
+    echo
+    echo "  r) restricted   - only the loaded URL, no link clicking"
+    echo "  s) same-origin  - can click links within the same domain (recommended)"
+    echo "  o) open         - can click any link, browse anywhere"
+    echo
+
+    local choice
+    read -r -p "(r)estricted / (s)ame-origin / (o)pen [${ALLOW_NAVIGATION}]: " choice
+
+    case "${choice,,}" in
+        r) ALLOW_NAVIGATION="restricted" ;;
+        o) ALLOW_NAVIGATION="open" ;;
+        s) ALLOW_NAVIGATION="same-origin" ;;
+        "") ;; # keep current value
+        *) log_warning "Unrecognized choice, keeping '$ALLOW_NAVIGATION'" ;;
+    esac
+
+    log_success "Link navigation: $ALLOW_NAVIGATION"
+    save_config
+}
+
+################################################################################
+# On-screen button toggles
+################################################################################
+
+action_toggle_pause_button() {
+    if [[ "$ENABLE_PAUSE_BUTTON" == "true" ]]; then
+        ENABLE_PAUSE_BUTTON="false"
+        log_warning "Pause button disabled"
+    else
+        ENABLE_PAUSE_BUTTON="true"
+        log_success "Pause button enabled"
+    fi
+    save_config
+}
+
+action_toggle_keyboard_button() {
+    if [[ "$ENABLE_KEYBOARD_BUTTON" == "true" ]]; then
+        ENABLE_KEYBOARD_BUTTON="false"
+        log_warning "On-screen keyboard button disabled"
+    else
+        ENABLE_KEYBOARD_BUTTON="true"
+        log_success "On-screen keyboard button enabled"
+    fi
+    save_config
+}
+
+action_toggle_nav_button() {
+    if [[ "$ENABLE_NAV_BUTTON" == "true" ]]; then
+        ENABLE_NAV_BUTTON="false"
+        log_warning "Navigation/help button disabled"
+    else
+        ENABLE_NAV_BUTTON="true"
+        log_success "Navigation/help button enabled"
+    fi
+    save_config
+}

menus/sites.sh

@@ -0,0 +1,363 @@
+#!/bin/bash
+################################################################################
+# menus/sites.sh - "Sites & Page Timing" menu.
+#
+# First real menu built on lib/menu.sh + lib/config.sh, as a proof of
+# concept for pulling menus out of the old 12k-line installer one at a
+# time. Covers exactly what was asked for first: adding, deleting, and
+# changing pages, and the timing (duration) of each.
+#
+# Depends on: lib/menu.sh, lib/config.sh being sourced first.
+################################################################################
+
+# Index of the page currently being edited by the nested "edit page" menu.
+SITE_EDIT_IDX=""
+
+################################################################################
+# Small helpers
+################################################################################
+
+# Normalize whatever the user typed into a URL, same rules the old
+# installer used: bare host -> https://, bare IP -> http://.
+sites_parse_url() {
+    local raw="$1"
+    if [[ "$raw" =~ ^https?:// ]]; then
+        echo "$raw"
+    elif [[ "$raw" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ ]]; then
+        echo "http://${raw}"
+    else
+        echo "https://${raw}"
+    fi
+}
+
+# Human label for a duration value: >0 seconds = auto-rotate, 0 = manual,
+# -1 = hidden (PIN-gated).
+sites_duration_label() {
+    local dur="$1"
+    if [[ "$dur" == "-1" ]]; then
+        echo "hidden"
+    elif [[ "$dur" == "0" ]]; then
+        echo "manual"
+    else
+        echo "auto-rotate ${dur}s"
+    fi
+}
+
+sites_display_label() {
+    local idx="$1"
+    local label="${URLS[$idx]}"
+    [[ -n "${NAMES[$idx]:-}" ]] && label="\"${NAMES[$idx]}\" - ${URLS[$idx]}"
+    echo "$label"
+}
+
+################################################################################
+# Status line shown above the main Sites menu
+################################################################################
+
+sites_status() {
+    if [[ "${#URLS[@]}" -eq 0 ]]; then
+        echo "No pages configured yet."
+        return
+    fi
+
+    echo "Current pages:"
+    local has_rotation=false
+    for idx in "${!URLS[@]}"; do
+        local dur="${DURS[$idx]}"
+        local flags=""
+        [[ "$dur" != "0" && "$dur" != "-1" ]] && has_rotation=true
+        [[ -n "${USERS[$idx]:-}" ]] && flags+=" [auth]"
+        [[ "$HOME_TAB_INDEX" == "$idx" ]] && flags+=" [HOME]"
+
+        printf "  %2d. %s (%s)%s\n" "$((idx + 1))" "$(sites_display_label "$idx")" "$(sites_duration_label "$dur")" "$flags"
+    done
+    echo
+    if $has_rotation; then
+        echo "Auto-rotation: active (pages with duration > 0)"
+    else
+        echo "Auto-rotation: off (all pages manual/hidden)"
+    fi
+    if [[ "$HOME_TAB_INDEX" != "-1" ]]; then
+        echo "Home page: #$((HOME_TAB_INDEX + 1)), ${INACTIVITY_TIMEOUT}s inactivity timeout"
+    else
+        echo "Home page: disabled"
+    fi
+}
+
+################################################################################
+# Top-level Sites menu
+################################################################################
+
+sites_menu_builder() {
+    MENU_LABELS=("Add a page")
+    MENU_HANDLERS=(action_add_page)
+
+    if [[ "${#URLS[@]}" -gt 0 ]]; then
+        MENU_LABELS+=("Edit a page" "Delete a page")
+        MENU_HANDLERS+=(action_pick_and_edit_page action_delete_page)
+    fi
+
+    if [[ "${#URLS[@]}" -gt 1 ]]; then
+        MENU_LABELS+=("Reorder pages")
+        MENU_HANDLERS+=(action_reorder_page)
+    fi
+
+    if [[ "${#URLS[@]}" -gt 0 ]]; then
+        MENU_LABELS+=("Set/clear home page")
+        MENU_HANDLERS+=(action_set_home_page)
+    fi
+}
+
+sites_menu() {
+    load_existing_config
+    run_menu "SITES & PAGE TIMING" sites_menu_builder sites_status
+}
+
+################################################################################
+# Add
+################################################################################
+
+action_add_page() {
+    echo
+    echo "Duration controls rotation:"
+    echo "  > 0  = auto-rotates every X seconds"
+    echo "    0  = manual only (swipe/nav menu to reach it)"
+    echo "   -1  = hidden (PIN-gated, F10 or 3-finger swipe)"
+    echo
+
+    local raw_url url dur name needs_auth user pass
+    read -r -p "URL: " raw_url
+    if [[ -z "$raw_url" ]]; then
+        echo "Cancelled"
+        return
+    fi
+    url=$(sites_parse_url "$raw_url")
+
+    dur=$(ask_integer "Duration in seconds (-1=hidden, 0=manual)" "180" -1 86400)
+    name=$(ask_text "Page name (optional, blank = show URL)" "")
+
+    user=""
+    pass=""
+    if ask_yes_no "Does this page need HTTP Basic Auth?" "n"; then
+        read -r -p "  Username: " user
+        read -r -s -p "  Password: " pass
+        echo
+    fi
+
+    URLS+=("$url")
+    DURS+=("$dur")
+    USERS+=("$user")
+    PASSES+=("$pass")
+    NAMES+=("$name")
+
+    log_success "Added: $url ($(sites_duration_label "$dur"))"
+    save_config
+}
+
+################################################################################
+# Edit (nested menu on the selected page)
+################################################################################
+
+action_pick_and_edit_page() {
+    echo
+    for idx in "${!URLS[@]}"; do
+        echo "  $((idx + 1)). $(sites_display_label "$idx")"
+    done
+    echo
+    local num
+    num=$(ask_integer "Edit which page? (0=cancel)" "0" 0 "${#URLS[@]}")
+    [[ "$num" == "0" ]] && return
+
+    SITE_EDIT_IDX=$((num - 1))
+    run_menu "EDIT PAGE #${num}" edit_page_menu_builder edit_page_status
+}
+
+edit_page_status() {
+    local idx="$SITE_EDIT_IDX"
+    echo "URL:      ${URLS[$idx]}"
+    echo "Name:     ${NAMES[$idx]:-(none)}"
+    echo "Timing:   $(sites_duration_label "${DURS[$idx]}")"
+    if [[ -n "${USERS[$idx]:-}" ]]; then
+        echo "Basic auth: enabled (user: ${USERS[$idx]})"
+    else
+        echo "Basic auth: disabled"
+    fi
+}
+
+edit_page_menu_builder() {
+    MENU_LABELS=("Change URL" "Change name" "Change timing (duration)" "Change Basic Auth")
+    MENU_HANDLERS=(action_edit_url action_edit_name action_edit_duration action_edit_auth)
+}
+
+action_edit_url() {
+    local idx="$SITE_EDIT_IDX"
+    local raw_url
+    raw_url=$(ask_text "New URL" "${URLS[$idx]}")
+    URLS[$idx]=$(sites_parse_url "$raw_url")
+    log_success "URL updated"
+    save_config
+}
+
+action_edit_name() {
+    local idx="$SITE_EDIT_IDX"
+    NAMES[$idx]=$(ask_text "New name (blank = show URL)" "${NAMES[$idx]:-}")
+    log_success "Name updated"
+    save_config
+}
+
+action_edit_duration() {
+    local idx="$SITE_EDIT_IDX"
+    echo
+    echo "  > 0  = auto-rotates every X seconds"
+    echo "    0  = manual only"
+    echo "   -1  = hidden (PIN-gated)"
+    DURS[$idx]=$(ask_integer "Duration in seconds" "${DURS[$idx]}" -1 86400)
+    log_success "Timing updated: $(sites_duration_label "${DURS[$idx]}")"
+    save_config
+}
+
+action_edit_auth() {
+    local idx="$SITE_EDIT_IDX"
+    if ask_yes_no "Enable HTTP Basic Auth for this page?" "$([[ -n "${USERS[$idx]:-}" ]] && echo y || echo n)"; then
+        read -r -p "  Username: " USERS_new
+        read -r -s -p "  Password: " PASSES_new
+        echo
+        USERS[$idx]="$USERS_new"
+        PASSES[$idx]="$PASSES_new"
+        log_success "Basic Auth updated"
+    else
+        USERS[$idx]=""
+        PASSES[$idx]=""
+        log_success "Basic Auth disabled"
+    fi
+    save_config
+}
+
+################################################################################
+# Delete
+################################################################################
+
+action_delete_page() {
+    echo
+    for idx in "${!URLS[@]}"; do
+        echo "  $((idx + 1)). $(sites_display_label "$idx")"
+    done
+    echo
+    local num
+    num=$(ask_integer "Delete which page? (0=cancel)" "0" 0 "${#URLS[@]}")
+    [[ "$num" == "0" ]] && { echo "Cancelled"; return; }
+
+    local del_idx=$((num - 1))
+    echo "Deleting: $(sites_display_label "$del_idx")"
+
+    unset 'URLS[del_idx]' 'DURS[del_idx]' 'USERS[del_idx]' 'PASSES[del_idx]' 'NAMES[del_idx]'
+    URLS=("${URLS[@]}")
+    DURS=("${DURS[@]}")
+    USERS=("${USERS[@]}")
+    PASSES=("${PASSES[@]}")
+    NAMES=("${NAMES[@]}")
+
+    if [[ "$HOME_TAB_INDEX" == "$del_idx" ]]; then
+        HOME_TAB_INDEX=-1
+        log_warning "Home page was deleted - home feature disabled"
+    elif [[ "$HOME_TAB_INDEX" -gt "$del_idx" ]]; then
+        HOME_TAB_INDEX=$((HOME_TAB_INDEX - 1))
+    fi
+
+    log_success "Page deleted"
+    save_config
+}
+
+################################################################################
+# Reorder
+################################################################################
+
+action_reorder_page() {
+    echo
+    echo "Current order:"
+    for idx in "${!URLS[@]}"; do
+        echo "  $((idx + 1)). $(sites_display_label "$idx")"
+    done
+    echo
+
+    local max="${#URLS[@]}"
+    local from_num to_num
+    from_num=$(ask_integer "Move which page? (0=cancel)" "0" 0 "$max")
+    [[ "$from_num" == "0" ]] && { echo "Cancelled"; return; }
+    to_num=$(ask_integer "Move to position?" "1" 1 "$max")
+
+    local from_idx=$((from_num - 1))
+    local to_idx=$((to_num - 1))
+    if [[ "$from_idx" == "$to_idx" ]]; then
+        echo "Same position - no change"
+        return
+    fi
+
+    # Work out where the home page (if any, and not the one being moved)
+    # will land, before we touch the arrays. Removing the moved item and
+    # then re-inserting it at $to_idx always places it at index $to_idx of
+    # the *final* array - no further adjustment needed there. Everything
+    # else only shifts by the remove and the insert individually.
+    local new_home_idx="$HOME_TAB_INDEX"
+    if [[ "$HOME_TAB_INDEX" == "$from_idx" ]]; then
+        new_home_idx="$to_idx"
+    elif [[ "$HOME_TAB_INDEX" != "-1" ]]; then
+        [[ "$from_idx" -lt "$HOME_TAB_INDEX" ]] && new_home_idx=$((new_home_idx - 1))
+        [[ "$to_idx" -le "$new_home_idx" ]] && new_home_idx=$((new_home_idx + 1))
+    fi
+    HOME_TAB_INDEX="$new_home_idx"
+
+    local move_url="${URLS[$from_idx]}" move_dur="${DURS[$from_idx]}" \
+          move_user="${USERS[$from_idx]}" move_pass="${PASSES[$from_idx]}" move_name="${NAMES[$from_idx]}"
+
+    unset 'URLS[from_idx]' 'DURS[from_idx]' 'USERS[from_idx]' 'PASSES[from_idx]' 'NAMES[from_idx]'
+    URLS=("${URLS[@]}")
+    DURS=("${DURS[@]}")
+    USERS=("${USERS[@]}")
+    PASSES=("${PASSES[@]}")
+    NAMES=("${NAMES[@]}")
+
+    URLS=("${URLS[@]:0:$to_idx}" "$move_url" "${URLS[@]:$to_idx}")
+    DURS=("${DURS[@]:0:$to_idx}" "$move_dur" "${DURS[@]:$to_idx}")
+    USERS=("${USERS[@]:0:$to_idx}" "$move_user" "${USERS[@]:$to_idx}")
+    PASSES=("${PASSES[@]:0:$to_idx}" "$move_pass" "${PASSES[@]:$to_idx}")
+    NAMES=("${NAMES[@]:0:$to_idx}" "$move_name" "${NAMES[@]:$to_idx}")
+
+    log_success "Pages reordered"
+    save_config
+}
+
+################################################################################
+# Home page
+################################################################################
+
+action_set_home_page() {
+    echo
+    if [[ "$HOME_TAB_INDEX" != "-1" ]]; then
+        echo "Current home page: #$((HOME_TAB_INDEX + 1)), ${INACTIVITY_TIMEOUT}s timeout"
+    else
+        echo "Home page currently disabled"
+    fi
+    echo
+    for idx in "${!URLS[@]}"; do
+        echo "  $((idx + 1)). $(sites_display_label "$idx")"
+    done
+    echo
+
+    local num
+    num=$(ask_integer "Set which page as home? (0=disable)" "0" 0 "${#URLS[@]}")
+    if [[ "$num" == "0" ]]; then
+        HOME_TAB_INDEX=-1
+        log_success "Home page disabled"
+        save_config
+        return
+    fi
+
+    HOME_TAB_INDEX=$((num - 1))
+    local timeout_min
+    timeout_min=$(ask_integer "Inactivity timeout in minutes" "2" 1 240)
+    INACTIVITY_TIMEOUT=$((timeout_min * 60))
+
+    log_success "Home page: #${num} (${timeout_min}m inactivity timeout)"
+    save_config
+}

setup_intercom_simple.sh

@@ -1,715 +0,0 @@
-#!/bin/bash
-################################################################################
-###   UBK Mumble/Talkiepi Intercom Setup                                    ###
-###   Simple CLI-based Installation                                         ###
-################################################################################
-#
-# This script provides a lightweight intercom solution using:
-#   - Murmur: The Mumble server
-#   - talkiepi: A simple, lightweight barnard-based Mumble client
-#
-# Advantages over talkkonnect:
-#   - Much simpler codebase and build process
-#   - Fewer dependencies
-#   - Direct CLI arguments for server, user, password, channel
-#   - More stable and less fragile
-#
-################################################################################
-
-VERSION="2.0.0"
-KIOSK_USER="${KIOSK_USER:-kiosk}"
-
-################################################################################
-### HELPER FUNCTIONS
-################################################################################
-
-log_error() {
-    echo "[ERROR] $*" >&2
-}
-
-log_success() {
-    echo "✓ $*"
-}
-
-log_warning() {
-    echo "⚠ $*"
-}
-
-pause() {
-    read -r -p "Press Enter to continue..."
-}
-
-get_ip_address() {
-    hostname -I | awk '{print $1}' || echo "No IP"
-}
-
-################################################################################
-### STATUS CHECK FUNCTIONS
-################################################################################
-
-check_murmur_status() {
-    local installed=false
-    local running=false
-
-    if systemctl list-unit-files | grep -q "mumble-server.service"; then
-        installed=true
-        if systemctl is-active --quiet mumble-server; then
-            running=true
-        fi
-    fi
-
-    echo "$installed:$running"
-}
-
-check_talkiepi_status() {
-    local installed=false
-    local running=false
-
-    if [[ -f /usr/local/bin/talkiepi ]] || [[ -f /etc/systemd/system/talkiepi.service ]]; then
-        installed=true
-        if systemctl is-active --quiet talkiepi; then
-            running=true
-        fi
-    fi
-
-    echo "$installed:$running"
-}
-
-################################################################################
-### MURMUR SERVER INSTALLATION
-################################################################################
-
-install_murmur_server() {
-    echo
-    echo "═══════════════════════════════════════════════════════════════"
-    echo "   INSTALLING MURMUR SERVER"
-    echo "═══════════════════════════════════════════════════════════════"
-    echo
-
-    echo "[1/5] Installing mumble-server package..."
-    sudo apt update
-    sudo apt install -y mumble-server
-
-    echo "[2/5] Getting configuration details..."
-    read -r -s -p "SuperUser password: " superuser_pass
-    echo
-    read -r -s -p "Server password (clients need this): " server_pass
-    echo
-    read -r -p "Welcome text [Welcome to Kiosk Intercom]: " welcome_text
-    welcome_text="${welcome_text:-Welcome to Kiosk Intercom}"
-
-    echo "[3/5] Creating configuration..."
-    local config_file="/etc/mumble-server.ini"
-
-    # Create config if it doesn't exist
-    if [[ ! -f "$config_file" ]]; then
-        sudo tee "$config_file" > /dev/null <<'MURMURCONF'
-# Murmur configuration file
-
-# Database location
-database=/var/lib/mumble-server/mumble-server.sqlite
-
-# Network settings
-port=64738
-host=0.0.0.0
-
-# Logging
-logfile=/var/log/mumble-server/mumble-server.log
-
-# Limits
-users=10
-bandwidth=72000
-
-# Welcome message
-welcometext=Welcome
-
-# Server password
-serverpassword=
-
-# Allow pings
-allowping=true
-
-# Enable HTML
-allowhtml=true
-MURMURCONF
-        log_success "Config file created"
-    fi
-
-    # Update configuration
-    sudo sed -i "s|^welcometext=.*|welcometext=$welcome_text|" "$config_file"
-    sudo sed -i "s|^port=.*|port=64738|" "$config_file"
-    sudo sed -i "s|^users=.*|users=10|" "$config_file"
-    sudo sed -i "s|^bandwidth=.*|bandwidth=72000|" "$config_file"
-
-    if [[ -n "$server_pass" ]]; then
-        sudo sed -i "s|^serverpassword=.*|serverpassword=$server_pass|" "$config_file"
-    fi
-
-    echo "[4/5] Setting SuperUser password..."
-    sudo systemctl stop mumble-server 2>/dev/null || true
-    sleep 2
-
-    echo "$superuser_pass" | sudo murmurd -ini "$config_file" -supw - 2>/dev/null || {
-        log_warning "Could not set SuperUser password via murmurd command"
-        echo "You can set it later with: sudo murmurd -ini $config_file -supw YOUR_PASSWORD"
-    }
-
-    echo "[5/5] Starting service..."
-    sudo systemctl enable mumble-server
-    sudo systemctl start mumble-server
-
-    # Configure firewall
-    sudo ufw allow 64738/tcp comment 'Mumble/Murmur' 2>/dev/null || true
-    sudo ufw allow 64738/udp comment 'Mumble/Murmur' 2>/dev/null || true
-
-    sleep 3
-
-    local server_ip=$(get_ip_address)
-    log_success "Murmur server installed"
-    echo
-    echo "═══════════════════════════════════════════════════════════════"
-    echo "  Server: $server_ip:64738"
-    echo "  SuperUser: SuperUser / $superuser_pass"
-    [[ -n "$server_pass" ]] && echo "  Password: $server_pass"
-    echo "═══════════════════════════════════════════════════════════════"
-
-    pause
-}
-
-################################################################################
-### TALKIEPI CLIENT INSTALLATION
-################################################################################
-
-install_talkiepi_with_config() {
-    local server_addr="$1"
-    local server_port="$2"
-    local tp_user="$3"
-    local tp_pass="$4"
-    local tp_channel="$5"
-
-    echo
-    echo "═══════════════════════════════════════════════════════════════"
-    echo "   INSTALLING TALKIEPI CLIENT"
-    echo "═══════════════════════════════════════════════════════════════"
-    echo
-    echo "talkiepi is a lightweight Mumble client based on barnard"
-    echo "Much simpler and more stable than talkkonnect"
-    echo
-
-    local TARGET_USER="$KIOSK_USER"
-    local TARGET_UID=$(id -u "$TARGET_USER")
-    local TARGET_HOME="/home/$TARGET_USER"
-
-    # Verify home directory exists
-    if [ ! -d "$TARGET_HOME" ]; then
-        log_error "Home directory does not exist: $TARGET_HOME"
-        pause
-        return 1
-    fi
-
-    # --- System Prep ------------------------------------------------------
-    echo "[1/5] Installing system dependencies..."
-    sudo apt update
-    sudo apt install -y git golang libopenal-dev libopus-dev
-
-    # --- Clone and Build Talkiepi -----------------------------------------
-    echo "[2/5] Cloning talkiepi repository..."
-    cd "$TARGET_HOME"
-    if [ -d "talkiepi" ]; then
-        sudo rm -rf talkiepi
-    fi
-
-    # Clone as the target user
-    sudo -u "$TARGET_USER" git clone https://github.com/dchote/talkiepi.git
-    cd talkiepi
-
-    echo "[3/5] Building talkiepi..."
-    export GOPATH="$TARGET_HOME/gocode"
-    export GOBIN="$TARGET_HOME/bin"
-
-    # Install gopus dependency
-    sudo -u "$TARGET_USER" go get github.com/dchote/gopus
-
-    # Build talkiepi
-    sudo -u "$TARGET_USER" go build -o "$TARGET_HOME/bin/talkiepi" cmd/talkiepi/main.go
-
-    if [ ! -f "$TARGET_HOME/bin/talkiepi" ]; then
-        log_error "Build failed!"
-        pause
-        return 1
-    fi
-
-    # Stop any running instances
-    if systemctl is-active --quiet talkiepi 2>/dev/null; then
-        sudo systemctl stop talkiepi
-    fi
-
-    # Install binary
-    sudo cp "$TARGET_HOME/bin/talkiepi" /usr/local/bin/talkiepi
-    sudo chmod +x /usr/local/bin/talkiepi
-    log_success "Binary installed to /usr/local/bin/talkiepi"
-
-    # --- User Permissions -------------------------------------------------
-    echo "[4/5] Setting up permissions..."
-    if ! groups "$TARGET_USER" | grep -q audio; then
-        sudo usermod -a -G audio "$TARGET_USER"
-        log_success "Added $TARGET_USER to 'audio' group"
-    fi
-
-    # --- Create Systemd Service -------------------------------------------
-    echo "[5/5] Creating systemd service..."
-
-    # Build the command line arguments
-    local TALKIEPI_ARGS="-server ${server_addr}:${server_port} -username ${tp_user}"
-
-    if [[ -n "$tp_pass" ]]; then
-        TALKIEPI_ARGS="$TALKIEPI_ARGS -password ${tp_pass}"
-    fi
-
-    if [[ -n "$tp_channel" ]]; then
-        TALKIEPI_ARGS="$TALKIEPI_ARGS -channel ${tp_channel}"
-    fi
-
-    # Add insecure flag for local/self-signed certs
-    TALKIEPI_ARGS="$TALKIEPI_ARGS -insecure"
-
-    sudo tee /etc/systemd/system/talkiepi.service > /dev/null <<EOFSVC
-[Unit]
-Description=Talkiepi Lightweight Mumble Client
-After=network-online.target sound.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=$TARGET_USER
-Group=$TARGET_USER
-WorkingDirectory=$TARGET_HOME
-ExecStart=/usr/local/bin/talkiepi $TALKIEPI_ARGS
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-Environment="XDG_RUNTIME_DIR=/run/user/$TARGET_UID"
-
-[Install]
-WantedBy=multi-user.target
-EOFSVC
-
-    sudo systemctl daemon-reload
-    sudo systemctl enable talkiepi
-    sudo systemctl start talkiepi
-
-    sleep 3
-
-    log_success "talkiepi installed successfully!"
-    echo "═══════════════════════════════════════════════════════════════"
-    echo "  Server: $server_addr:$server_port"
-    echo "  Username: $tp_user"
-    echo "  Channel: ${tp_channel:-Root}"
-    echo "  Binary: /usr/local/bin/talkiepi"
-    echo "═══════════════════════════════════════════════════════════════"
-    echo
-
-    # Show status
-    if systemctl is-active --quiet talkiepi; then
-        log_success "Service is running"
-        echo "View logs: sudo journalctl -u talkiepi -f"
-    else
-        log_warning "Service may have issues"
-        echo "Check logs: sudo journalctl -u talkiepi -n 50"
-    fi
-
-    pause
-}
-
-install_talkiepi_only() {
-    echo
-    echo "═══════════════════════════════════════════════════════════════"
-    echo "   TALKIEPI - CONNECT TO EXISTING SERVER"
-    echo "═══════════════════════════════════════════════════════════════"
-    echo
-
-    echo "Enter Murmur/Mumble server details:"
-    read -r -p "Server address (IP or domain): " server_addr
-    read -r -p "Port [64738]: " server_port
-    server_port="${server_port:-64738}"
-    read -r -p "Username: " tp_user
-    read -r -s -p "Password (leave empty if none): " tp_pass
-    echo
-    read -r -p "Channel [Root]: " tp_channel
-    tp_channel="${tp_channel:-Root}"
-
-    install_talkiepi_with_config "$server_addr" "$server_port" "$tp_user" "$tp_pass" "$tp_channel"
-}
-
-install_murmur_and_talkiepi() {
-    echo
-    echo "═══════════════════════════════════════════════════════════════"
-    echo "   ALL-IN-ONE: SERVER + CLIENT"
-    echo "═══════════════════════════════════════════════════════════════"
-    echo
-
-    echo "Installing Murmur server..."
-    install_murmur_server
-
-    echo
-    echo "Now installing talkiepi client..."
-    echo "Configuring to connect to local server..."
-
-    # Auto-configure for local server
-    AUTO_SERVER="127.0.0.1"
-    AUTO_PORT="64738"
-    read -r -p "Username for talkiepi [kiosk]: " tp_user
-    tp_user="${tp_user:-kiosk}"
-    read -r -s -p "Server password: " tp_pass
-    echo
-
-    install_talkiepi_with_config "$AUTO_SERVER" "$AUTO_PORT" "$tp_user" "$tp_pass" "Root"
-}
-
-################################################################################
-### SERVICE MANAGEMENT
-################################################################################
-
-toggle_murmur_service() {
-    echo
-    if systemctl is-active --quiet mumble-server; then
-        echo "Stopping Murmur server..."
-        sudo systemctl stop mumble-server
-        log_success "Murmur stopped"
-    else
-        echo "Starting Murmur server..."
-        sudo systemctl start mumble-server
-        sleep 2
-        if systemctl is-active --quiet mumble-server; then
-            log_success "Murmur started"
-        else
-            log_error "Failed to start - check logs: sudo journalctl -u mumble-server"
-        fi
-    fi
-    pause
-}
-
-toggle_talkiepi_service() {
-    echo
-    if systemctl is-active --quiet talkiepi; then
-        echo "Stopping talkiepi..."
-        sudo systemctl stop talkiepi
-        log_success "talkiepi stopped"
-    else
-        echo "Starting talkiepi..."
-        sudo systemctl start talkiepi
-        sleep 2
-        if systemctl is-active --quiet talkiepi; then
-            log_success "talkiepi started"
-        else
-            log_error "Failed to start - check logs: sudo journalctl -u talkiepi"
-        fi
-    fi
-    pause
-}
-
-################################################################################
-### LOGS AND DIAGNOSTICS
-################################################################################
-
-view_talkiepi_logs() {
-    echo
-    echo "Recent talkiepi logs:"
-    echo "═══════════════════════════════════════════════════════════════"
-    sudo journalctl -u talkiepi -n 50 --no-pager
-    echo
-    pause
-}
-
-view_murmur_logs() {
-    echo
-    echo "Recent Murmur server logs:"
-    echo "═══════════════════════════════════════════════════════════════"
-    sudo journalctl -u mumble-server -n 50 --no-pager
-    echo
-    pause
-}
-
-################################################################################
-### UNINSTALLATION
-################################################################################
-
-uninstall_murmur() {
-    echo
-    read -r -p "Uninstall Murmur server? (yes/no): " confirm
-    [[ "$confirm" != "yes" ]] && return
-
-    echo "Uninstalling..."
-    sudo systemctl stop mumble-server 2>/dev/null || true
-    sudo systemctl disable mumble-server 2>/dev/null || true
-    sudo apt remove -y mumble-server 2>/dev/null || true
-
-    read -r -p "Remove configuration and database? (y/n): " remove_data
-    if [[ "$remove_data" =~ ^[Yy]$ ]]; then
-        sudo rm -rf /var/lib/mumble-server
-        sudo rm -f /etc/mumble-server.ini
-        log_success "Murmur and data removed"
-    else
-        log_success "Murmur removed (data preserved)"
-    fi
-
-    pause
-}
-
-uninstall_talkiepi() {
-    echo
-    read -r -p "Uninstall talkiepi? (yes/no): " confirm
-    [[ "$confirm" != "yes" ]] && return
-
-    echo "Uninstalling talkiepi..."
-
-    # Stop and disable service
-    if systemctl is-active --quiet talkiepi 2>/dev/null; then
-        sudo systemctl stop talkiepi
-    fi
-
-    if systemctl is-enabled --quiet talkiepi 2>/dev/null; then
-        sudo systemctl disable talkiepi
-    fi
-
-    # Remove systemd service file
-    if [[ -f /etc/systemd/system/talkiepi.service ]]; then
-        sudo rm -f /etc/systemd/system/talkiepi.service
-        sudo systemctl daemon-reload
-    fi
-
-    # Remove binary
-    if [[ -f /usr/local/bin/talkiepi ]]; then
-        sudo rm -f /usr/local/bin/talkiepi
-    fi
-
-    # Remove source directory
-    read -r -p "Also remove source directory? (y/n): " remove_source
-    if [[ "$remove_source" =~ ^[Yy]$ ]] && [[ -d "/home/$KIOSK_USER/talkiepi" ]]; then
-        sudo rm -rf "/home/$KIOSK_USER/talkiepi"
-        sudo rm -rf "/home/$KIOSK_USER/gocode"
-        sudo rm -rf "/home/$KIOSK_USER/bin"
-    fi
-
-    log_success "talkiepi uninstalled"
-    pause
-}
-
-################################################################################
-### MAIN MENU
-################################################################################
-
-show_status() {
-    local murmur_status=$(check_murmur_status)
-    local murmur_installed=$(echo "$murmur_status" | cut -d: -f1)
-    local murmur_running=$(echo "$murmur_status" | cut -d: -f2)
-
-    local tp_status=$(check_talkiepi_status)
-    local tp_installed=$(echo "$tp_status" | cut -d: -f1)
-    local tp_running=$(echo "$tp_status" | cut -d: -f2)
-
-    echo
-    echo "═══════════════════════════════════════════════════════════════"
-    echo "   INTERCOM STATUS"
-    echo "═══════════════════════════════════════════════════════════════"
-    echo
-
-    # Murmur status
-    if [[ "$murmur_installed" == "true" ]]; then
-        echo "Murmur Server: ✓ Installed"
-        if [[ "$murmur_running" == "true" ]]; then
-            echo "  Status: Running"
-            local server_ip=$(get_ip_address)
-            echo "  Address: $server_ip:64738"
-        else
-            echo "  Status: Stopped"
-        fi
-        echo
-    else
-        echo "Murmur Server: Not installed"
-        echo
-    fi
-
-    # talkiepi status
-    if [[ "$tp_installed" == "true" ]]; then
-        echo "talkiepi Client: ✓ Installed"
-        if [[ "$tp_running" == "true" ]]; then
-            echo "  Status: Running"
-        else
-            echo "  Status: Stopped"
-        fi
-        echo
-    else
-        echo "talkiepi Client: Not installed"
-        echo
-    fi
-}
-
-main_menu() {
-    while true; do
-        clear
-        echo "═══════════════════════════════════════════════════════════════"
-        echo "   UBK INTERCOM SETUP v${VERSION}"
-        echo "   Mumble/Talkiepi (Lightweight & Stable)"
-        echo "═══════════════════════════════════════════════════════════════"
-
-        show_status
-
-        local murmur_status=$(check_murmur_status)
-        local murmur_installed=$(echo "$murmur_status" | cut -d: -f1)
-        local murmur_running=$(echo "$murmur_status" | cut -d: -f2)
-
-        local tp_status=$(check_talkiepi_status)
-        local tp_installed=$(echo "$tp_status" | cut -d: -f1)
-        local tp_running=$(echo "$tp_status" | cut -d: -f2)
-
-        echo "═══════════════════════════════════════════════════════════════"
-        echo "   INSTALLATION OPTIONS"
-        echo "═══════════════════════════════════════════════════════════════"
-
-        local menu_num=1
-
-        # Installation options (shown when nothing installed)
-        if [[ "$murmur_installed" == "false" && "$tp_installed" == "false" ]]; then
-            echo "  $menu_num. Install All-in-One (Server + Client)"
-            local opt_all_in_one=$menu_num
-            ((menu_num++))
-            echo "  $menu_num. Install Murmur Server Only"
-            local opt_server_only=$menu_num
-            ((menu_num++))
-            echo "  $menu_num. Install talkiepi Client Only"
-            local opt_client_only=$menu_num
-            ((menu_num++))
-        else
-            # Murmur management options
-            if [[ "$murmur_installed" == "true" ]]; then
-                echo
-                echo "Murmur Server:"
-                if [[ "$murmur_running" == "true" ]]; then
-                    echo "  $menu_num. Stop Murmur"
-                else
-                    echo "  $menu_num. Start Murmur"
-                fi
-                local opt_murmur_toggle=$menu_num
-                ((menu_num++))
-
-                echo "  $menu_num. View Murmur Logs"
-                local opt_murmur_logs=$menu_num
-                ((menu_num++))
-
-                echo "  $menu_num. Uninstall Murmur"
-                local opt_murmur_uninstall=$menu_num
-                ((menu_num++))
-            else
-                echo
-                echo "  $menu_num. Install Murmur Server"
-                local opt_install_murmur=$menu_num
-                ((menu_num++))
-            fi
-
-            # talkiepi management options
-            if [[ "$tp_installed" == "true" ]]; then
-                echo
-                echo "talkiepi Client:"
-                if [[ "$tp_running" == "true" ]]; then
-                    echo "  $menu_num. Stop talkiepi"
-                else
-                    echo "  $menu_num. Start talkiepi"
-                fi
-                local opt_tp_toggle=$menu_num
-                ((menu_num++))
-
-                echo "  $menu_num. View talkiepi Logs"
-                local opt_tp_logs=$menu_num
-                ((menu_num++))
-
-                echo "  $menu_num. Uninstall talkiepi"
-                local opt_tp_uninstall=$menu_num
-                ((menu_num++))
-            else
-                echo
-                echo "  $menu_num. Install talkiepi Client"
-                local opt_install_tp=$menu_num
-                ((menu_num++))
-            fi
-        fi
-
-        echo
-        echo "═══════════════════════════════════════════════════════════════"
-        echo "  0. Exit"
-        echo "═══════════════════════════════════════════════════════════════"
-        echo
-        read -r -p "Choose [0-$((menu_num-1))]: " choice
-
-        # Handle menu selection
-        case "$choice" in
-            0)
-                echo "Exiting..."
-                exit 0
-                ;;
-            ${opt_all_in_one:-})
-                install_murmur_and_talkiepi
-                ;;
-            ${opt_server_only:-})
-                install_murmur_server
-                ;;
-            ${opt_client_only:-})
-                install_talkiepi_only
-                ;;
-            ${opt_install_murmur:-})
-                install_murmur_server
-                ;;
-            ${opt_install_tp:-})
-                install_talkiepi_only
-                ;;
-            ${opt_murmur_toggle:-})
-                toggle_murmur_service
-                ;;
-            ${opt_murmur_logs:-})
-                view_murmur_logs
-                ;;
-            ${opt_murmur_uninstall:-})
-                uninstall_murmur
-                ;;
-            ${opt_tp_toggle:-})
-                toggle_talkiepi_service
-                ;;
-            ${opt_tp_logs:-})
-                view_talkiepi_logs
-                ;;
-            ${opt_tp_uninstall:-})
-                uninstall_talkiepi
-                ;;
-            *)
-                echo "Invalid choice"
-                sleep 1
-                ;;
-        esac
-    done
-}
-
-################################################################################
-### ENTRY POINT
-################################################################################
-
-# Check if running as root
-if [[ $EUID -eq 0 ]]; then
-    log_error "This script should not be run as root"
-    echo "Please run as: ./setup_intercom_simple.sh"
-    exit 1
-fi
-
-# Check if kiosk user exists
-if ! id "$KIOSK_USER" &>/dev/null; then
-    log_warning "User '$KIOSK_USER' does not exist"
-    read -r -p "Enter the username to use for installation: " KIOSK_USER
-
-    if ! id "$KIOSK_USER" &>/dev/null; then
-        log_error "User '$KIOSK_USER' not found"
-        exit 1
-    fi
-fi
-
-# Run main menu
-main_menu

talkkonnect_complete_install.sh

@@ -1,784 +0,0 @@
-#!/usr/bin/env bash
-# ======================================================================
-# File: install_talkkonnect_x86_complete.sh
-# Purpose: Complete Talkkonnect installation for Ubuntu 24.04 x86_64
-#          Fixes Opus architecture issues and creates working config
-# Author: Compiled from troubleshooting session
-# Date: November 2025
-# ======================================================================
-set -e
-
-echo "======================================================================="
-echo "TalkKonnect Complete Installation Script for x86_64"
-echo "This script will:"
-echo "  1. Install system dependencies"
-echo "  2. Install Go 1.24.1"
-echo "  3. Clone and patch TalkKonnect for x86_64"
-echo "  4. Build the binary"
-echo "  5. Create configuration files"
-echo "  6. Set up systemd service"
-echo "======================================================================="
-echo ""
-
-# Check if this is a Chromebook or multi-user audio setup
-echo "Audio Setup Detection:"
-echo "  - If you have audio working under a different user (e.g. 'kiosk'),"
-echo "    talkkonnect should run as that user to share the PipeWire session"
-echo "  - This also enables audio ducking between applications"
-echo ""
-read -p "Run talkkonnect as a different user? [kiosk]: " TARGET_USER
-TARGET_USER=${TARGET_USER:-kiosk}
-
-if [ "$TARGET_USER" != "$USER" ]; then
-    # Verify the target user exists
-    if ! id "$TARGET_USER" &>/dev/null; then
-        echo "[!] Error: User '$TARGET_USER' does not exist"
-        exit 1
-    fi
-    
-    # Get target user's UID for XDG_RUNTIME_DIR
-    TARGET_UID=$(id -u "$TARGET_USER")
-    TARGET_HOME=$(eval echo ~"$TARGET_USER")
-    echo "[+] Will install for user: $TARGET_USER (UID: $TARGET_UID)"
-    echo "[+] Home directory: $TARGET_HOME"
-else
-    TARGET_UID=$(id -u)
-    TARGET_HOME="$HOME"
-    echo "[+] Installing for current user: $USER"
-fi
-
-echo ""
-read -p "Press Enter to continue or Ctrl-C to abort..."
-
-# --- System Prep ------------------------------------------------------
-echo ""
-echo "[+] Updating system packages..."
-sudo apt update
-sudo apt upgrade -y
-
-echo "[+] Installing dependencies..."
-sudo apt install -y wget git build-essential pkg-config \
-    libasound2-dev libopus-dev libopus0 libopusfile-dev \
-    libpipewire-0.3-dev libevdev-dev libopenal-dev alsa-utils
-
-# --- Go Installation --------------------------------------------------
-echo ""
-echo "[+] Installing Go 1.24.1..."
-sudo rm -rf /usr/local/go /usr/lib/go* /usr/bin/go
-wget https://go.dev/dl/go1.24.1.linux-amd64.tar.gz
-sudo tar -C /usr/local -xzf go1.24.1.linux-amd64.tar.gz
-sudo ln -sf /usr/local/go/bin/go /usr/bin/go
-rm -f go1.24.1.linux-amd64.tar.gz
-export PATH="/usr/local/go/bin:$PATH"
-go version
-
-# --- Clone TalkKonnect ------------------------------------------------
-echo ""
-echo "[+] Cloning TalkKonnect repository..."
-cd ~
-if [ -d "talkkonnect" ]; then
-    echo "[!] Removing existing talkkonnect directory..."
-    rm -rf talkkonnect
-fi
-
-git clone https://github.com/talkkonnect/talkkonnect.git
-cd talkkonnect
-
-echo "[+] Current version:"
-git log --oneline -1
-
-# --- Critical Fix: Patch gopus for x86_64 -----------------------------
-echo ""
-echo "======================================================================="
-echo "[+] APPLYING X86_64 OPUS FIX"
-echo "======================================================================="
-echo "[+] The talkkonnect gopus package embeds Opus source for ARM"
-echo "[+] but it's incomplete for x86_64. We'll patch it to use system libopus"
-echo ""
-
-# Create vendor directory
-go mod vendor
-
-# Check that gopus exists in vendor
-if [ ! -d "vendor/github.com/talkkonnect/gopus" ]; then
-    echo "[!] ERROR: gopus not found in vendor!"
-    exit 1
-fi
-
-echo "[+] Backing up original opus_nonshared.go..."
-cp vendor/github.com/talkkonnect/gopus/opus_nonshared.go \
-   vendor/github.com/talkkonnect/gopus/opus_nonshared.go.original
-
-echo "[+] Creating x86_64-compatible opus_nonshared.go..."
-cat > vendor/github.com/talkkonnect/gopus/opus_nonshared.go << 'EOFOPUS'
-// +build amd64,cgo 386,cgo
-
-package gopus
-
-// #cgo pkg-config: opus
-// #cgo LDFLAGS: -lm
-//
-// #include <stdio.h>
-// #include <stdlib.h>
-// #include <opus.h>
-//
-// enum {
-//   gopus_ok = OPUS_OK,
-//   gopus_bad_arg = OPUS_BAD_ARG,
-//   gopus_small_buffer = OPUS_BUFFER_TOO_SMALL,
-//   gopus_internal = OPUS_INTERNAL_ERROR,
-//   gopus_invalid_packet = OPUS_INVALID_PACKET,
-//   gopus_unimplemented = OPUS_UNIMPLEMENTED,
-//   gopus_invalid_state = OPUS_INVALID_STATE,
-//   gopus_alloc_fail = OPUS_ALLOC_FAIL,
-// };
-//
-// enum {
-//   gopus_application_voip    = OPUS_APPLICATION_VOIP,
-//   gopus_application_audio   = OPUS_APPLICATION_AUDIO,
-//   gopus_restricted_lowdelay = OPUS_APPLICATION_RESTRICTED_LOWDELAY,
-//   gopus_bitrate_max         = OPUS_BITRATE_MAX,
-// };
-//
-// void gopus_setvbr(OpusEncoder *encoder, int vbr) {
-//   opus_encoder_ctl(encoder, OPUS_SET_VBR(vbr));
-// }
-//
-// void gopus_setbitrate(OpusEncoder *encoder, int bitrate) {
-//   opus_encoder_ctl(encoder, OPUS_SET_BITRATE(bitrate));
-// }
-//
-// opus_int32 gopus_bitrate(OpusEncoder *encoder) {
-//   opus_int32 bitrate;
-//   opus_encoder_ctl(encoder, OPUS_GET_BITRATE(&bitrate));
-//   return bitrate;
-// }
-//
-// void gopus_setapplication(OpusEncoder *encoder, int application) {
-//   opus_encoder_ctl(encoder, OPUS_SET_APPLICATION(application));
-// }
-//
-// opus_int32 gopus_application(OpusEncoder *encoder) {
-//   opus_int32 application;
-//   opus_encoder_ctl(encoder, OPUS_GET_APPLICATION(&application));
-//   return application;
-// }
-//
-// void gopus_encoder_resetstate(OpusEncoder *encoder) {
-//   opus_encoder_ctl(encoder, OPUS_RESET_STATE);
-// }
-//
-// void gopus_decoder_resetstate(OpusDecoder *decoder) {
-//   opus_decoder_ctl(decoder, OPUS_RESET_STATE);
-// }
-import "C"
-
-import (
-	"errors"
-	"unsafe"
-)
-
-type Application int
-
-const (
-	Voip               Application = C.gopus_application_voip
-	Audio              Application = C.gopus_application_audio
-	RestrictedLowDelay Application = C.gopus_restricted_lowdelay
-)
-
-const (
-	BitrateMaximum = C.gopus_bitrate_max
-)
-
-type Encoder struct {
-	data     []byte
-	cEncoder *C.struct_OpusEncoder
-}
-
-func NewEncoder(sampleRate, channels int, application Application) (*Encoder, error) {
-	encoder := &Encoder{}
-	encoder.data = make([]byte, int(C.opus_encoder_get_size(C.int(channels))))
-	encoder.cEncoder = (*C.struct_OpusEncoder)(unsafe.Pointer(&encoder.data[0]))
-
-	ret := C.opus_encoder_init(encoder.cEncoder, C.opus_int32(sampleRate), C.int(channels), C.int(application))
-	if err := getErr(ret); err != nil {
-		return nil, err
-	}
-	return encoder, nil
-}
-
-func (e *Encoder) Encode(pcm []int16, frameSize, maxDataBytes int) ([]byte, error) {
-	pcmPtr := (*C.opus_int16)(unsafe.Pointer(&pcm[0]))
-
-	data := make([]byte, maxDataBytes)
-	dataPtr := (*C.uchar)(unsafe.Pointer(&data[0]))
-
-	encodedC := C.opus_encode(e.cEncoder, pcmPtr, C.int(frameSize), dataPtr, C.opus_int32(len(data)))
-	encoded := int(encodedC)
-
-	if encoded < 0 {
-		return nil, getErr(C.int(encodedC))
-	}
-	return data[0:encoded], nil
-}
-
-func (e *Encoder) SetVbr(vbr bool) {
-	var cVbr C.int
-	if vbr {
-		cVbr = 1
-	} else {
-		cVbr = 0
-	}
-	C.gopus_setvbr(e.cEncoder, cVbr)
-}
-
-func (e *Encoder) SetBitrate(bitrate int) {
-	C.gopus_setbitrate(e.cEncoder, C.int(bitrate))
-}
-
-func (e *Encoder) Bitrate() int {
-	return int(C.gopus_bitrate(e.cEncoder))
-}
-
-func (e *Encoder) SetApplication(application Application) {
-	C.gopus_setapplication(e.cEncoder, C.int(application))
-}
-
-func (e *Encoder) Application() Application {
-	return Application(C.gopus_application(e.cEncoder))
-}
-
-func (e *Encoder) ResetState() {
-	C.gopus_encoder_resetstate(e.cEncoder)
-}
-
-type Decoder struct {
-	data     []byte
-	cDecoder *C.struct_OpusDecoder
-	channels int
-}
-
-func NewDecoder(sampleRate, channels int) (*Decoder, error) {
-	decoder := &Decoder{}
-	decoder.data = make([]byte, int(C.opus_decoder_get_size(C.int(channels))))
-	decoder.cDecoder = (*C.struct_OpusDecoder)(unsafe.Pointer(&decoder.data[0]))
-
-	ret := C.opus_decoder_init(decoder.cDecoder, C.opus_int32(sampleRate), C.int(channels))
-	if err := getErr(ret); err != nil {
-		return nil, err
-	}
-	decoder.channels = channels
-
-	return decoder, nil
-}
-
-func (d *Decoder) Decode(data []byte, frameSize int, fec bool) ([]int16, error) {
-	var dataPtr *C.uchar
-	if len(data) > 0 {
-		dataPtr = (*C.uchar)(unsafe.Pointer(&data[0]))
-	}
-	dataLen := C.opus_int32(len(data))
-
-	output := make([]int16, d.channels*frameSize)
-	outputPtr := (*C.opus_int16)(unsafe.Pointer(&output[0]))
-
-	var cFec C.int
-	if fec {
-		cFec = 1
-	} else {
-		cFec = 0
-	}
-
-	cRet := C.opus_decode(d.cDecoder, dataPtr, dataLen, outputPtr, C.int(frameSize), cFec)
-	ret := int(cRet)
-
-	if ret < 0 {
-		return nil, getErr(cRet)
-	}
-	return output[:ret*d.channels], nil
-}
-
-func (d *Decoder) ResetState() {
-	C.gopus_decoder_resetstate(d.cDecoder)
-}
-
-func GetSamplesPerFrame(data []byte, samplingRate int) (int, error) {
-	dataPtr := (*C.uchar)(unsafe.Pointer(&data[0]))
-	cSamplingRate := C.opus_int32(samplingRate)
-	cRet := C.opus_packet_get_samples_per_frame(dataPtr, cSamplingRate)
-	return int(cRet), nil
-}
-
-func CountFrames(data []byte) (int, error) {
-	dataPtr := (*C.uchar)(unsafe.Pointer(&data[0]))
-	cLen := C.opus_int32(len(data))
-
-	cRet := C.opus_packet_get_nb_frames(dataPtr, cLen)
-	if err := getErr(cRet); err != nil {
-		return 0, err
-	}
-	return int(cRet), nil
-}
-
-var (
-	ErrBadArgument   = errors.New("bad argument")
-	ErrSmallBuffer   = errors.New("buffer is too small")
-	ErrInternal      = errors.New("internal error")
-	ErrInvalidPacket = errors.New("invalid packet")
-	ErrUnimplemented = errors.New("unimplemented")
-	ErrInvalidState  = errors.New("invalid state")
-	ErrAllocFail     = errors.New("allocation failed")
-	ErrUnknown       = errors.New("unknown error")
-)
-
-func getErr(code C.int) error {
-	switch code {
-	case C.gopus_ok:
-		return nil
-	case C.gopus_bad_arg:
-		return ErrBadArgument
-	case C.gopus_small_buffer:
-		return ErrSmallBuffer
-	case C.gopus_internal:
-		return ErrInternal
-	case C.gopus_invalid_packet:
-		return ErrInvalidPacket
-	case C.gopus_unimplemented:
-		return ErrUnimplemented
-	case C.gopus_invalid_state:
-		return ErrInvalidState
-	case C.gopus_alloc_fail:
-		return ErrAllocFail
-	default:
-		return ErrUnknown
-	}
-}
-EOFOPUS
-
-echo "[+] Patched opus_nonshared.go to use system libopus"
-
-# --- Build TalkKonnect ------------------------------------------------
-echo ""
-echo "======================================================================="
-echo "[+] BUILDING TALKKONNECT"
-echo "======================================================================="
-cd ~/talkkonnect/cmd/talkkonnect
-
-export CGO_ENABLED=1
-export CGO_CFLAGS="$(pkg-config --cflags opus)"
-export CGO_LDFLAGS="$(pkg-config --libs opus) -lm"
-
-echo "[+] Building (this may take a few minutes)..."
-go build -mod=vendor -v -o ~/talkkonnect-binary . 2>&1 | tee /tmp/talkkonnect_build.log
-
-if [ ! -f ~/talkkonnect-binary ]; then
-    echo ""
-    echo "[!] BUILD FAILED!"
-    echo "[!] Last 50 lines of build log:"
-    tail -50 /tmp/talkkonnect_build.log
-    exit 1
-fi
-
-echo ""
-echo "[+] Installing binary..."
-
-# Stop any running talkkonnect instances first
-if systemctl is-active --quiet talkkonnect 2>/dev/null; then
-    echo "[+] Stopping existing talkkonnect service..."
-    sudo systemctl stop talkkonnect
-fi
-
-# Kill any stray processes
-if pgrep -x talkkonnect > /dev/null; then
-    echo "[+] Killing running talkkonnect processes..."
-    sudo pkill -9 talkkonnect
-    sleep 1
-fi
-
-# Now install the binary
-sudo cp ~/talkkonnect-binary /usr/local/bin/talkkonnect
-sudo chmod +x /usr/local/bin/talkkonnect
-rm ~/talkkonnect-binary
-
-echo "[+] Binary installed successfully!"
-echo "[+] Checking dependencies:"
-ldd /usr/local/bin/talkkonnect | grep -E "(opus|alsa)" || echo "    (may be statically linked)"
-
-# --- User Permissions -------------------------------------------------
-echo ""
-echo "[+] Setting up user permissions..."
-
-# Add target user to input group for keyboard PTT
-if ! groups "$TARGET_USER" | grep -q input; then
-    sudo usermod -a -G input "$TARGET_USER"
-    echo "[+] Added $TARGET_USER to 'input' group"
-    if [ "$TARGET_USER" = "$USER" ]; then
-        echo "[!] IMPORTANT: Log out and back in for this to take effect!"
-        echo "[!] Or run: newgrp input"
-        NEEDS_RELOGIN=true
-    fi
-else
-    echo "[+] User $TARGET_USER already in 'input' group"
-    NEEDS_RELOGIN=false
-fi
-
-# Add target user to audio group
-if ! groups "$TARGET_USER" | grep -q audio; then
-    sudo usermod -a -G audio "$TARGET_USER"
-    echo "[+] Added $TARGET_USER to 'audio' group"
-fi
-
-# --- Configuration ----------------------------------------------------
-echo ""
-echo "======================================================================="
-echo "[+] CREATING CONFIGURATION"
-echo "======================================================================="
-
-# Verify target user's home directory exists
-if [ ! -d "$TARGET_HOME" ]; then
-    echo "[!] Error: Home directory for user '$TARGET_USER' does not exist: $TARGET_HOME"
-    echo "[!] Please ensure the user account is properly set up with a home directory"
-    echo "[!] You may need to run: sudo mkhomedir_helper $TARGET_USER"
-    exit 1
-fi
-
-CONFIG_DIR="$TARGET_HOME/.config/talkkonnect"
-
-# Create config directory with appropriate permissions
-if [ "$TARGET_USER" != "$USER" ]; then
-    # Need to use sudo to create directory in another user's home
-    sudo -u "$TARGET_USER" mkdir -p "$CONFIG_DIR"
-    echo "[+] Created config directory as user: $TARGET_USER"
-else
-    mkdir -p "$CONFIG_DIR"
-    echo "[+] Created config directory"
-fi
-
-# Create config file (use tee with sudo to handle permissions)
-sudo tee "$CONFIG_DIR/talkkonnect.xml" > /dev/null << 'EOFXML'
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="talkkonnect/xml">
-  <global>
-    <software>
-      <settings outputdevice="default"
-                logfilenameandpath="/home/user/.config/talkkonnect/talkkonnect.log"
-                logging="both"
-                daemonize="false"
-                cancelconnect="false"
-                simplexwithvox="false"
-                nextserverindex="0"/>
-      <autoprovisioning enabled="false"/>
-    </software>
-    <hardware>
-      <settings targetboard="pc"
-                voiceactivitytimersecs="200"/>
-      <io>
-        <pins enabled="false"/>
-      </io>
-    </hardware>
-  </global>
-
-  <accounts>
-    <account name="default" default="true">
-      <serverandport>your.mumble.server:64738</serverandport>
-      <username>your_username</username>
-      <password>your_password</password>
-      <insecure>false</insecure>
-      <register>false</register>
-      <certificate></certificate>
-      <channel>Root</channel>
-      <ident></ident>
-      <tokens enabled="false"></tokens>
-      <voicetargets enabled="false">
-        <id id="1" iscurrent="false" name="default">
-          <channels></channels>
-          <users></users>
-        </id>
-      </voicetargets>
-    </account>
-  </accounts>
-
-  <beacon enabled="false"/>
-
-  <audio>
-    <input>
-      <settings enabled="true"
-                device="default"
-                samplerate="48000"
-                channels="1"
-                codec="opus"
-                framespersecond="50"/>
-    </input>
-    <output>
-      <settings enabled="true"
-                device="default"
-                samplerate="48000"
-                channels="1"/>
-    </output>
-  </audio>
-
-  <ptt enabled="false">
-    <usbkeyboard enabled="false"/>
-  </ptt>
-
-  <voiceactivity enabled="true">
-    <settings threshold="0.3"
-              holdtimems="1000"
-              holdtimeoutms="2000"/>
-  </voiceactivity>
-
-  <sounds enabled="false"/>
-
-  <txtts enabled="false"/>
-
-  <smtp enabled="false"/>
-
-  <api enabled="false"/>
-
-  <printxml enabled="false"/>
-
-</document>
-EOFXML
-
-# Update the log path to use actual username (needs sudo since file was created with tee)
-sudo sed -i "s|/home/user/|$TARGET_HOME/|g" "$CONFIG_DIR/talkkonnect.xml"
-
-# Set proper ownership - always needed since we used sudo tee
-sudo chown -R "$TARGET_USER:$TARGET_USER" "$CONFIG_DIR"
-sudo chmod 755 "$CONFIG_DIR"
-sudo chmod 644 "$CONFIG_DIR/talkkonnect.xml"
-echo "[+] Set ownership of config directory to $TARGET_USER"
-
-echo "[+] Created configuration file: $CONFIG_DIR/talkkonnect.xml"
-
-# --- Audio Mixer Detection --------------------------------------------
-echo ""
-echo "[+] Detecting audio configuration for user: $TARGET_USER..."
-
-# Detect audio devices as the target user
-if [ "$TARGET_USER" != "$USER" ]; then
-    # Get target user's runtime directory
-    AUDIO_DEVICES=$(sudo -u "$TARGET_USER" XDG_RUNTIME_DIR=/run/user/$TARGET_UID aplay -l 2>/dev/null)
-    PIPEWIRE_SINKS=$(sudo -u "$TARGET_USER" XDG_RUNTIME_DIR=/run/user/$TARGET_UID pactl list sinks short 2>/dev/null)
-else
-    AUDIO_DEVICES=$(aplay -l 2>/dev/null)
-    PIPEWIRE_SINKS=$(pactl list sinks short 2>/dev/null)
-fi
-
-# Determine best audio device
-AUDIO_DEVICE="default"
-AUDIO_BACKEND="alsa"
-
-if echo "$AUDIO_DEVICES" | grep -q "card 0:"; then
-    # ALSA devices found
-    CARD_NAME=$(echo "$AUDIO_DEVICES" | grep "card 0:" | head -1 | sed 's/.*card 0: \([^[]*\).*/\1/' | xargs)
-    echo "[+] Found ALSA card: $CARD_NAME"
-    
-    # Use hw:0,0 for direct ALSA access (better for Chromebooks)
-    AUDIO_DEVICE="hw:0,0"
-    echo "[+] Using ALSA device: $AUDIO_DEVICE"
-    
-elif echo "$PIPEWIRE_SINKS" | grep -v "auto_null" | grep -q "alsa_output"; then
-    # PipeWire/PulseAudio sinks found
-    SINK_NAME=$(echo "$PIPEWIRE_SINKS" | grep -v "auto_null" | grep "alsa_output" | head -1 | awk '{print $2}')
-    echo "[+] Found PipeWire sink: $SINK_NAME"
-    AUDIO_DEVICE="pulse"
-    AUDIO_BACKEND="pulse"
-    echo "[+] Using PulseAudio/PipeWire backend"
-else
-    echo "[!] Warning: No specific audio device detected, using 'default'"
-fi
-
-# Try to unmute and set volume
-MIXER_CONTROL=$(sudo -u "$TARGET_USER" amixer scontrols 2>/dev/null | grep -oP "Simple mixer control '\K[^']+(?=',0)" | head -1)
-
-if [ -n "$MIXER_CONTROL" ]; then
-    echo "[+] Found mixer control: $MIXER_CONTROL"
-    
-    # Try to unmute and set volume
-    sudo -u "$TARGET_USER" amixer set "$MIXER_CONTROL" unmute 2>/dev/null && echo "[+] Unmuted $MIXER_CONTROL" || echo "[!] Could not unmute $MIXER_CONTROL"
-    sudo -u "$TARGET_USER" amixer set "$MIXER_CONTROL" 80% 2>/dev/null && echo "[+] Set $MIXER_CONTROL to 80%" || echo "[!] Could not set volume"
-else
-    echo "[!] Warning: No ALSA mixer controls found"
-    echo "[!] Audio may work through PipeWire, but you may need to configure it manually"
-fi
-
-echo "[+] Audio configuration summary:"
-echo "    Backend: $AUDIO_BACKEND"
-echo "    Device:  $AUDIO_DEVICE"
-if [ -n "$CARD_NAME" ]; then
-    echo "    Card:    $CARD_NAME"
-fi
-
-# --- Systemd Service --------------------------------------------------
-echo ""
-echo "[+] Creating systemd service for user: $TARGET_USER..."
-SERVICE_FILE="/etc/systemd/system/talkkonnect.service"
-
-sudo tee "$SERVICE_FILE" > /dev/null <<EOFSVC
-[Unit]
-Description=TalkKonnect Headless Mumble Transceiver
-After=network-online.target sound.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=$TARGET_USER
-Group=$TARGET_USER
-WorkingDirectory=$TARGET_HOME
-ExecStart=/usr/local/bin/talkkonnect -config $CONFIG_DIR/talkkonnect.xml
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-# Use target user's PipeWire/PulseAudio session
-Environment="XDG_RUNTIME_DIR=/run/user/$TARGET_UID"
-
-[Install]
-WantedBy=multi-user.target
-EOFSVC
-
-sudo systemctl daemon-reload
-sudo systemctl enable talkkonnect
-
-echo "[+] Systemd service created and enabled"
-
-# --- Audio Ducking Setup (Optional) -----------------------------------
-if [ "$TARGET_USER" != "$USER" ]; then
-    echo ""
-    echo "[+] Setting up audio ducking for user: $TARGET_USER..."
-    echo "[+] This will lower other audio when talkkonnect is transmitting"
-    
-    # Create a script to enable ducking
-    DUCKING_SCRIPT="$TARGET_HOME/.config/talkkonnect/enable-ducking.sh"
-    cat > /tmp/enable-ducking.sh << 'EOFDUCKING'
-#!/bin/bash
-# Enable audio ducking - lowers music/media when on PTT
-pactl load-module module-role-ducking \
-    trigger_roles=phone \
-    ducking_roles=music,video \
-    volume=30% 2>/dev/null || echo "Ducking already enabled"
-EOFDUCKING
-    
-    if [ "$TARGET_USER" != "$USER" ]; then
-        sudo cp /tmp/enable-ducking.sh "$DUCKING_SCRIPT"
-        sudo chown "$TARGET_USER:$TARGET_USER" "$DUCKING_SCRIPT"
-        sudo chmod +x "$DUCKING_SCRIPT"
-    else
-        cp /tmp/enable-ducking.sh "$DUCKING_SCRIPT"
-        chmod +x "$DUCKING_SCRIPT"
-    fi
-    rm /tmp/enable-ducking.sh
-    
-    echo "[+] Ducking script created: $DUCKING_SCRIPT"
-    echo "[+] Run as $TARGET_USER to enable: $DUCKING_SCRIPT"
-fi
-
-# --- Completion -------------------------------------------------------
-echo ""
-echo "======================================================================="
-echo "✓✓✓ INSTALLATION COMPLETE! ✓✓✓"
-echo "======================================================================="
-echo ""
-
-if [ "$TARGET_USER" != "$USER" ]; then
-    echo "⚠️  IMPORTANT: Talkkonnect is configured to run as user: $TARGET_USER"
-    echo "   This allows it to share the PipeWire audio session with your apps"
-    echo "   All configuration files are in: $TARGET_HOME/.config/talkkonnect/"
-    echo ""
-fi
-
-if [ "$NEEDS_RELOGIN" = true ]; then
-    echo "⚠️  IMPORTANT: You were added to the 'input' group"
-    echo "   You must LOG OUT and LOG BACK IN for keyboard PTT to work!"
-    echo "   (Or run: newgrp input)"
-    echo ""
-fi
-
-echo "BEFORE RUNNING: Edit the configuration file with your Mumble server details"
-echo ""
-if [ "$TARGET_USER" != "$USER" ]; then
-    echo "  1. Edit config file (as $TARGET_USER or with sudo):"
-    echo "     sudo nano $CONFIG_DIR/talkkonnect.xml"
-else
-    echo "  1. Edit config file:"
-    echo "     nano $CONFIG_DIR/talkkonnect.xml"
-fi
-echo ""
-echo "  2. Update these settings:"
-echo "     - <serverandport>: Your Mumble server address and port"
-echo "     - <username>: Your Mumble username"
-echo "     - <password>: Your Mumble password (if required)"
-echo "     - <channel>: Channel to join on connect"
-echo "     - <insecure>: Set to 'true' if server has self-signed cert"
-echo ""
-echo "  3. Optional - Enable keyboard/USB button PTT (voice activation is enabled by default):"
-echo "     - Set <ptt enabled=\"true\">"
-echo "     - For USB mini keyboard: Find device with 'sudo evtest'"
-echo "     - Set <usbkeyboard enabled=\"true\" device=\"/dev/input/eventX\" keycode=\"KEY_F13\"/>"
-echo "     - Tip: Program your USB keyboard to send F13-F24 to avoid conflicts"
-echo "     - Set <voiceactivity enabled=\"false\"/>"
-if [ "$TARGET_USER" = "$USER" ]; then
-    echo "     - Make sure you're in 'input' group: groups | grep input"
-fi
-echo ""
-echo "TESTING:"
-if [ "$TARGET_USER" != "$USER" ]; then
-    echo "  Test manually as $TARGET_USER:"
-    echo "    sudo -u $TARGET_USER /usr/local/bin/talkkonnect -config $CONFIG_DIR/talkkonnect.xml"
-else
-    echo "  Test manually first:"
-    echo "    /usr/local/bin/talkkonnect -config $CONFIG_DIR/talkkonnect.xml"
-fi
-echo ""
-echo "  Once working, start the service:"
-echo "    sudo systemctl start talkkonnect"
-echo ""
-echo "  Check status:"
-echo "    sudo systemctl status talkkonnect"
-echo ""
-echo "  View logs:"
-echo "    journalctl -u talkkonnect -f"
-echo "    cat $CONFIG_DIR/talkkonnect.log"
-echo ""
-if [ "$TARGET_USER" != "$USER" ]; then
-    echo "AUDIO DUCKING:"
-    echo "  To enable audio ducking (lower other apps when transmitting):"
-    echo "    sudo -u $TARGET_USER $CONFIG_DIR/enable-ducking.sh"
-    echo ""
-fi
-echo "FILES:"
-echo "  Binary:  /usr/local/bin/talkkonnect"
-echo "  Config:  $CONFIG_DIR/talkkonnect.xml"
-echo "  Service: /etc/systemd/system/talkkonnect.service"
-echo "  Source:  ~/talkkonnect"
-echo "  Logs:    $CONFIG_DIR/talkkonnect.log"
-if [ "$TARGET_USER" != "$USER" ]; then
-    echo "  Ducking: $CONFIG_DIR/enable-ducking.sh"
-fi
-echo ""
-echo "TROUBLESHOOTING:"
-echo "  - Build log: /tmp/talkkonnect_build.log"
-echo "  - Runtime logs: $CONFIG_DIR/talkkonnect.log"
-echo "  - System logs: journalctl -u talkkonnect -f"
-echo "  - If audio issues: check 'aplay -L' and 'arecord -L'"
-echo "  - If 'unable to unmute' error: run 'amixer scontrols' to see controls"
-echo "  - If cert errors: set <insecure>true</insecure> in config"
-echo "  - For keyboard PTT: ensure you're in 'input' group (groups)"
-echo "  - If crash after connect: ensure voicetargets section exists in XML"
-echo ""
-echo "KNOWN ISSUES:"
-echo "  - Voice activation is enabled by default (PTT disabled)"
-echo "  - Keyboard PTT requires logout/login after installation"
-echo "  - Self-signed certs need <insecure>true</insecure>"
-if [ "$TARGET_USER" != "$USER" ]; then
-    echo "  - Config files owned by $TARGET_USER - edit with sudo or su"
-    echo "  - Audio ducking must be enabled manually (see above)"
-fi
-echo ""
-echo "CHROMEBOOK-SPECIFIC:"
-echo "  - If no audio: ensure $TARGET_USER can access /dev/snd devices"
-echo "  - Check audio as target user: sudo -u $TARGET_USER aplay -l"
-echo "  - PipeWire session: /run/user/$TARGET_UID/pipewire-0"
-echo ""
-echo "======================================================================="