Claude
0454a259fa
Third and biggest Addon migrated: menus/addon_remote_access.sh - VNC (x11vnc), WireGuard, Tailscale, and Netbird, each with its own install/ connect/status/uninstall flow. Same risk class as CUPS (real apt packages, real system state) but broader in scope: Tailscale and Netbird install via the vendors' own documented `curl -fsSL <url> | sh` method, preserved exactly as-is rather than redesigned. - lib/config.sh: new $WIREGUARD_DIR, same pattern as $SYSTEMD_DIR/ $BIN_DIR/etc - nothing in this file hardcodes /etc/wireguard. - lib/menu.sh: promoted power_schedule.sh's enable_and_start_timers() to a shared enable_and_start_units() (works for services now too, not just timers) - Remote Access needed the identical enable+start-with- graceful-failure-reporting pattern for x11vnc and wg-quick@, so this is fixed once and reused rather than duplicated a second time. power_schedule.sh's four call sites renamed to match. Found and fixed a real framework-level bug while building this file: run_menu()'s *handler* call has been `|| true`-guarded since v2.1.0, but the *status function* call (`"$status_func"` on its own line) was still completely bare. A status function's entire job is read-only display, but if it contains so much as a pipeline whose grep matches nothing - which pipefail turns into a pipeline failure even though the actual last command in it (e.g. sed) succeeds - that bare call would crash the *entire session*, not just fail to show status text. Found while writing wireguard_status()'s `sudo wg show | grep ... | sed ...` and deliberately verifying its exact failure mode rather than assuming run_menu already covered it. Fixed once in run_menu() itself (lib/menu.sh), protecting every status function across every menu - present and future - the same "fix once at the framework level" pattern as the v2.1.0 handler fix. Given the framework fix meant this class of bug had been silently possible since v2.1.0, audited every existing status function across every already-migrated menu for the same specific shape (a bare `var=$(...)` assignment from a grep-based pipeline, not embedded in an echo and not already guarded - embedded substitutions and if-condition contexts are both already safe on their own). Found and fixed one real instance in power_schedule_status(). menus/addon_remote_access.sh's own two equivalent pipelines (wireguard_status, netbird_status) were written with `|| true` from the start once the pattern was identified. Verified: - New scratch/stub test for addon_remote_access.sh, with curl stubbed separately from sudo (Tailscale/Netbird's install scripts must never reach the real network regardless of what sudo intercepts) and a belt-and-suspenders `sh` stub in case anything got past curl: full status/menu-builder coverage for all four sub-areas in their real, unstubbed "not installed" state (none of the four tools exist in this sandbox); VNC install/change-password/uninstall with systemd unit content verified (correct $KIOSK_USER/$KIOSK_HOME substitution); WireGuard install, paste-config (content written correctly to scratch $WIREGUARD_DIR), and uninstall - including documenting a genuine cat-until-EOF test-harness limitation (a redirected pipe's EOF is permanent for the whole stream, unlike a real terminal's per-read Ctrl+D, so only the config's *default* name is testable through simple stdin redirection - inherent to the design, matches the legacy script's identical `cat`-based approach, not a bug); Tailscale and Netbird install/connect-interactive/connect-with-key/uninstall; and all four cancel paths confirmed to make zero sudo calls. - Full regression: re-ran all 11 prior scratch/stub suites after the lib/menu.sh and power_schedule.sh changes - all still clean. - End-to-end: ran the real install.sh as a genuine non-root, non- "kiosk" user through Addons -> Remote Access -> all four sub-menus in turn, each showing accurate real (unstubbed) "not installed" status, selecting Install, declining the confirmation, and returning cleanly - zero invalid-choice errors, clean exit code 0.
151 lines
5.0 KiB
Bash
Executable File
151 lines
5.0 KiB
Bash
Executable File
#!/bin/bash
|
|
################################################################################
|
|
# install.sh - Modular management entry point for Ubuntu Based Kiosk.
|
|
#
|
|
# This is NOT yet the full system installer - that is still the big
|
|
# single-file script (ubuntu-based-kiosk.sh) documented in Readme.md, and
|
|
# first-time provisioning of a new kiosk still goes through it. That file
|
|
# still also contains its own (unmigrated, unmodified) copies of every
|
|
# menu below - both copies coexist deliberately until enough of Core
|
|
# Settings/Addons/Advanced has moved over to retire the old ones in one
|
|
# pass. This entry point is the modular replacement, one menus/*.sh file
|
|
# at a time, so a change to (say) the Sites menu can't accidentally break
|
|
# WiFi setup or the uninstaller three thousand lines away.
|
|
#
|
|
# Migrated so far, grouped the same way the legacy menu groups them:
|
|
# Core Settings: Sites & Page Timing, Display & Interaction, Timezone,
|
|
# Hidden Site PIN, Password Protection & Lockout, WiFi,
|
|
# Power/Display/Quiet Hours.
|
|
# Addons: CUPS Printing (menus/addon_cups.sh), Authelia Auto-Login
|
|
# (menus/addon_authelia.sh), Remote Access - VNC/WireGuard/
|
|
# Tailscale/Netbird (menus/addon_remote_access.sh).
|
|
# Advanced: Diagnostics (menus/diagnostics.sh - system status/logs/
|
|
# audio/network).
|
|
#
|
|
# Usage (once the kiosk has already been installed):
|
|
# git clone <repo>
|
|
# cd ubuntu-based-kiosk
|
|
# ./install.sh
|
|
################################################################################
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
# shellcheck source=lib/menu.sh
|
|
source "$SCRIPT_DIR/lib/menu.sh"
|
|
# shellcheck source=lib/config.sh
|
|
source "$SCRIPT_DIR/lib/config.sh"
|
|
# shellcheck source=menus/sites.sh
|
|
source "$SCRIPT_DIR/menus/sites.sh"
|
|
# shellcheck source=menus/display.sh
|
|
source "$SCRIPT_DIR/menus/display.sh"
|
|
# shellcheck source=menus/timezone.sh
|
|
source "$SCRIPT_DIR/menus/timezone.sh"
|
|
# shellcheck source=menus/hidden_pin.sh
|
|
source "$SCRIPT_DIR/menus/hidden_pin.sh"
|
|
# shellcheck source=menus/lockout.sh
|
|
source "$SCRIPT_DIR/menus/lockout.sh"
|
|
# shellcheck source=menus/wifi.sh
|
|
source "$SCRIPT_DIR/menus/wifi.sh"
|
|
# shellcheck source=menus/power_schedule.sh
|
|
source "$SCRIPT_DIR/menus/power_schedule.sh"
|
|
# shellcheck source=menus/diagnostics.sh
|
|
source "$SCRIPT_DIR/menus/diagnostics.sh"
|
|
# shellcheck source=menus/addon_cups.sh
|
|
source "$SCRIPT_DIR/menus/addon_cups.sh"
|
|
# shellcheck source=menus/addon_authelia.sh
|
|
source "$SCRIPT_DIR/menus/addon_authelia.sh"
|
|
# shellcheck source=menus/addon_remote_access.sh
|
|
source "$SCRIPT_DIR/menus/addon_remote_access.sh"
|
|
|
|
################################################################################
|
|
# Preflight
|
|
################################################################################
|
|
|
|
if [[ "$(whoami)" == "kiosk" ]]; then
|
|
log_error "Cannot run as user 'kiosk'"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ $EUID -eq 0 ]]; then
|
|
log_error "Run as a regular user with sudo privileges, not as root"
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v jq &>/dev/null; then
|
|
log_error "jq is required but not installed. Run: sudo apt-get install -y jq"
|
|
exit 1
|
|
fi
|
|
|
|
if ! is_kiosk_installed; then
|
|
echo
|
|
log_error "No installed kiosk found at ${KIOSK_DIR}."
|
|
echo
|
|
echo "This tool manages an already-installed kiosk. To provision a new"
|
|
echo "one for the first time, use the full installer instead - see"
|
|
echo "Readme.md ('Quick Install') for the current download command."
|
|
echo
|
|
exit 1
|
|
fi
|
|
|
|
################################################################################
|
|
# Top-level menu - grouped the same way the legacy menu groups them
|
|
# (Core Settings / Addons / Advanced), so the structure stays familiar
|
|
# and the flat list doesn't grow unwieldy as more menus migrate in.
|
|
################################################################################
|
|
|
|
core_settings_menu_builder() {
|
|
MENU_LABELS=(
|
|
"Sites & Page Timing"
|
|
"Display & Interaction"
|
|
"Timezone"
|
|
"Hidden Site PIN"
|
|
"Password Protection & Lockout"
|
|
"WiFi"
|
|
"Power/Display/Quiet Hours"
|
|
)
|
|
MENU_HANDLERS=(
|
|
sites_menu
|
|
display_menu
|
|
timezone_menu
|
|
hidden_pin_menu
|
|
lockout_menu
|
|
wifi_menu
|
|
power_schedule_menu
|
|
)
|
|
}
|
|
|
|
core_settings_menu() {
|
|
run_menu "CORE SETTINGS" core_settings_menu_builder
|
|
}
|
|
|
|
addons_menu_builder() {
|
|
MENU_LABELS=("CUPS Printing" "Authelia Auto-Login" "Remote Access")
|
|
MENU_HANDLERS=(addon_cups_menu addon_authelia_menu remote_access_menu)
|
|
}
|
|
|
|
addons_menu() {
|
|
run_menu "ADDONS" addons_menu_builder
|
|
}
|
|
|
|
advanced_menu_builder() {
|
|
MENU_LABELS=("Diagnostics")
|
|
MENU_HANDLERS=(diagnostics_menu)
|
|
}
|
|
|
|
advanced_menu() {
|
|
run_menu "ADVANCED" advanced_menu_builder
|
|
}
|
|
|
|
main_menu_builder() {
|
|
MENU_LABELS=("Core Settings" "Addons" "Advanced")
|
|
MENU_HANDLERS=(core_settings_menu addons_menu advanced_menu)
|
|
}
|
|
|
|
main_menu_status() {
|
|
echo "Managing kiosk at: ${KIOSK_DIR}"
|
|
}
|
|
|
|
run_menu "UBUNTU BASED KIOSK - MANAGEMENT" main_menu_builder main_menu_status "Exit"
|