# Alpine Linux Kiosk Setup Script

This script automates the setup of a minimal, Wayland-based kiosk on Alpine Linux. It configures the system to automatically log in a dedicated user and launch a full-screen Chromium browser displaying a specified URL. It uses Sway as the Wayland compositor, greetd for autologin, and WayVNC for remote access.

## Features

*   **Minimal Base:** Leverages Alpine Linux for a small footprint.
*   **Wayland Native:** Uses Sway for a modern display server environment.
*   **Chromium Kiosk:** Launches Chromium in full-screen kiosk mode.
*   **Autologin:** Uses `greetd` with `agreety` to automatically log in the signage user and start Sway.
*   **Configurable Remote Access (WayVNC):**
    *   **TLS Authenticated:** Option to enable username/password authentication for WayVNC, secured with self-signed TLS certificates generated by the script.
    *   **Passwordless:** Option for passwordless VNC access (use with caution on trusted networks or with SSH tunneling).
*   **VM Friendly:** Includes `open-vm-tools` for better integration when run in VMware.
*   **Customizable:** Key settings like KIOSK URL, signage user, and WayVNC options can be configured.
*   **Dynamic Step Logging:** Script output clearly indicates progress with dynamic step numbering.
*   **Colorized Output:** Script output uses colors for better readability.

## Prerequisites

*   A fresh installation of Alpine Linux (standard or extended).
*   Internet connectivity during the script execution to download packages.
*   The script must be run as the `root` user.

## Configuration

Before running the script, you can adjust the following variables at the top of the `setup-kiosk.sh` file:

*   `KIOSK_URL`: The URL that Chromium will display. (Default: `"https://example.com"`)
*   `SIGNAGE_USER`: The dedicated user account for the kiosk. (Default: `"signage"`)

### WayVNC Configuration:

*   `WAYVNC_ENABLE_TLS_AUTH`:
    *   Set to `true` (default) to enable username/password authentication for WayVNC. This will also generate self-signed TLS certificates for encryption. `openssl` package will be installed.
    *   Set to `false` for passwordless VNC access. WayVNC will start without requiring authentication.
*   `WAYVNC_PASSWORD_TO_SET`:
    *   Used only if `WAYVNC_ENABLE_TLS_AUTH` is `true`.
    *   Set a strong password here. (Default: `"burek123"` - **CHANGE THIS!**)
    *   If left blank and TLS auth is enabled, the script will use an **INSECURE default password "changeme"** and issue a critical warning.
*   `WAYVNC_USERNAME`: The username for VNC authentication if `WAYVNC_ENABLE_TLS_AUTH` is `true`. (Default: `"signage_vnc"`)
*   `WAYVNC_LISTEN_ADDRESS`: The IP address WayVNC listens on. (Default: `"0.0.0.0"` for all interfaces)
*   `WAYVNC_PORT`: The port WayVNC listens on. (Default: `"5900"`)

## Usage

1.  **Download the script:**
    ```bash
    wget -O setup-kiosk.sh <URL_TO_YOUR_SCRIPT_RAW_FILE>
    # or copy the script content into a file named setup-kiosk.sh
    ```

2.  **Review and Edit Configuration:** Open `setup-kiosk.sh` and adjust the configuration variables, especially WayVNC settings, to your needs. **Ensure you set a strong `WAYVNC_PASSWORD_TO_SET` if `WAYVNC_ENABLE_TLS_AUTH` is `true`.**

3.  **Make it executable:**
    ```bash
    chmod +x setup-kiosk.sh
    ```

4.  **Run as root:**
    ```bash
    sudo ./setup-kiosk.sh
    # or if already root:
    # ./setup-kiosk.sh
    ```

5.  **Follow Prompts/Review Output:** The script will output its progress. Pay attention to any warnings, especially regarding `nomodeset` or WayVNC password settings.

6.  **Reboot:**
    ```bash
    reboot
    ```
    The system should automatically log in and launch the kiosk.

## Post-Installation

### Remote Access (VNC)

*   **If `WAYVNC_ENABLE_TLS_AUTH` was `true`:**
    *   Connect to the kiosk using a VNC client to the IP address of your Alpine Linux machine on the port specified by `WAYVNC_PORT` (default 5900).
    *   You will be prompted for the `WAYVNC_USERNAME` and `WAYVNC_PASSWORD_TO_SET` configured in the script.
    *   Your VNC client will likely warn about an untrusted certificate because it's self-signed by the script. You will need to review and accept this certificate to proceed.
*   **If `WAYVNC_ENABLE_TLS_AUTH` was `false`:**
    *   Connect to the kiosk using a VNC client to the IP address and port. No password will be required.
    *   **SECURITY WARNING:** This mode is insecure. It's highly recommended to restrict network access to the VNC port (e.g., using a firewall) or access it exclusively via an SSH tunnel.

### Troubleshooting

The script provides a list of troubleshooting steps at the end of its execution. Key logs and checks include:

*   **Greetd logs:** `grep greetd /var/log/messages | tail -n 20`
*   **Sway log:** `cat /home/<SIGNAGE_USER>/.local/share/sway/sway-greetd.log`
*   **Sway config syntax check:**
    ```bash
    # Replace 'signage' if needed
    su - signage -c "export XDG_RUNTIME_DIR=/run/user/$(id -u signage) && sway -C -c /home/signage/.config/sway/config"
    ```
*   **WayVNC Configuration (if TLS auth enabled):** `cat /home/<SIGNAGE_USER>/.config/wayvnc/config`
*   **Required user groups:** `groups <SIGNAGE_USER>` (should include `video` and `input`)
*   **Manually test Sway (on TTY2, after stopping greetd):**
    ```bash
    rc-service greetd stop # Stop greetd on TTY1
    # Switch to TTY2 (Alt+F2), log in as <SIGNAGE_USER>
    dbus-run-session sway -d
    ```

### Modifying Chromium Flags

Chromium is launched with `--disable-gpu` by default for compatibility. To try enabling GPU acceleration:

1.  Edit the Sway configuration file: `vi /home/<SIGNAGE_USER>/.config/sway/config`
2.  Find the `exec /usr/bin/chromium ...` line and remove or comment out `--disable-gpu`.
3.  Save, then reload Sway (`Mod+Shift+c` or `swaymsg reload`) or reboot.

### Kernel Parameter `nomodeset`

If the script warns about `nomodeset`, Wayland (and Sway) will **not** function correctly. Remove this parameter from your bootloader configuration (e.g., `/etc/default/grub` or `/boot/extlinux.conf`), update your bootloader, and reboot.

## Script Breakdown

The script performs the following major steps:

1.  **Root Check & Initial Info.**
2.  **`nomodeset` Check.**
3.  **Package Repositories Update.**
4.  **Wayland Base Setup** (elogind, eudev).
5.  **Package Installation:** Installs Sway, Chromium, greetd, WayVNC, etc. `openssl` is installed conditionally if TLS auth for WayVNC is enabled.
6.  **D-Bus Service Setup.**
7.  **open-vm-tools Service Setup.**
8.  **Signage User Creation** (with `video` and `input` group membership).
9.  **User Profile Configuration.**
10. **WayVNC Configuration:**
    *   If `WAYVNC_ENABLE_TLS_AUTH` is true: Generates self-signed TLS keys/certificates and creates `/home/<SIGNAGE_USER>/.config/wayvnc/config` with authentication enabled.
    *   If false: Skips WayVNC config file creation, ensuring WayVNC starts without its internal authentication.
11. **Sway Configuration:** Creates `~/.config/sway/config` to autostart Chromium and WayVNC (launch arguments for WayVNC depend on the auth setting).
12. **Greetd Configuration** for autologin.
13. **Inittab Configuration** to launch greetd on tty1.
14. **PAM Configuration** for elogind session management.
15. **Final Information & Troubleshooting.**