Merge remote-tracking branch 'origin/main' into archy-hwconfig

image-recipe/_archived/build-auto-installer-iso.sh

@@ -387,6 +387,11 @@ RUN apt-get update && apt-get -y full-upgrade && apt-get install -y --no-install
     xorg \
     xdotool \
     chromium \
+    pipewire \
+    pipewire-pulse \
+    pipewire-alsa \
+    wireplumber \
+    alsa-utils \
     unclutter \
     fonts-liberation \
     fonts-noto-color-emoji \
@@ -425,7 +430,10 @@ RUN apt-get update && apt-get -y full-upgrade && apt-get install -y --no-install
 RUN echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen
 
 # Create archipelago user with password "archipelago"
-RUN useradd -m -s /bin/bash -G sudo,dialout archipelago && \
+# audio group: PipeWire runs under the lingering user manager (no logind seat
+# session), so udev's seat ACLs on /dev/snd never apply — group access is the
+# only way the kiosk's audio can open the hardware.
+RUN useradd -m -s /bin/bash -G sudo,dialout,audio archipelago && \
     echo "archipelago:archipelago" | chpasswd && \
     echo "root:archipelago" | chpasswd && \
     echo "archipelago ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/archipelago
@@ -1162,6 +1170,20 @@ if [ "$BACKEND_CAPTURED" = "0" ] && [ "$BUILD_FROM_SOURCE" != "1" ]; then
     fi
 fi
 
+# Bundle the Reticulum RNode daemon alongside the backend. install-to-disk
+# copies everything in archipelago/bin/ to /usr/local/bin, and the mesh
+# listener spawns /usr/local/bin/archy-reticulum-daemon for RNode radios —
+# a node imaged without it can never connect a Reticulum stick
+# (framework-pt, 2026-07-22: silent connect failures until hand-copied).
+RETICULUM_DAEMON="${ARCHY_RETICULUM_DAEMON:-/usr/local/bin/archy-reticulum-daemon}"
+if [ -f "$RETICULUM_DAEMON" ]; then
+    cp "$RETICULUM_DAEMON" "$ARCH_DIR/bin/archy-reticulum-daemon"
+    chmod +x "$ARCH_DIR/bin/archy-reticulum-daemon"
+    echo "   ✅ Reticulum daemon bundled ($(du -h "$ARCH_DIR/bin/archy-reticulum-daemon" | cut -f1))"
+else
+    echo "   ⚠️  archy-reticulum-daemon not found at $RETICULUM_DAEMON — ISO nodes won't support RNode radios until it's sideloaded"
+fi
+
 if [ "$BACKEND_CAPTURED" = "0" ]; then
     if [ "$BUILD_FROM_SOURCE" != "1" ]; then
         echo "   ⚠️  Could not capture from live server, building from source..."
@@ -2867,6 +2889,62 @@ fi
     echo "KIOSKSVC"
 } >> "$ARCH_DIR/auto-install.sh"
 
+# Audio router: same splice-from-configs/ pattern as the kiosk (single source
+# of truth, also embedded in the binary for bootstrap self-heal). Keeps HDMI
+# audio working: profile/default-sink routing + the ELD boot-race re-modeset.
+AUDIO_ROUTER_SRC="$SCRIPT_DIR/../configs/archipelago-audio-router.sh"
+AUDIO_SERVICE_SRC="$SCRIPT_DIR/../configs/archipelago-audio-router.service"
+for _audio_src in "$AUDIO_ROUTER_SRC" "$AUDIO_SERVICE_SRC"; do
+    if [ ! -f "$_audio_src" ]; then
+        echo "ERROR: audio config file missing: $_audio_src" >&2
+        exit 1
+    fi
+done
+if grep -qx 'AUDIOROUTER' "$AUDIO_ROUTER_SRC" || grep -qx 'AUDIOSVC' "$AUDIO_SERVICE_SRC"; then
+    echo "ERROR: audio config contains a reserved heredoc terminator line (AUDIOROUTER/AUDIOSVC)" >&2
+    exit 1
+fi
+{
+    echo ""
+    echo "# Audio router — HDMI profile/default-sink follow + ELD boot-race heal."
+    echo "# Payloads spliced at ISO-build time from image-recipe/configs/ (source of truth)."
+    echo "cat > /mnt/target/usr/local/bin/archipelago-audio-router <<'AUDIOROUTER'"
+    cat "$AUDIO_ROUTER_SRC"
+    echo "AUDIOROUTER"
+    echo "chmod +x /mnt/target/usr/local/bin/archipelago-audio-router"
+    echo ""
+    echo "cat > /mnt/target/etc/systemd/system/archipelago-audio-router.service <<'AUDIOSVC'"
+    cat "$AUDIO_SERVICE_SRC"
+    echo "AUDIOSVC"
+} >> "$ARCH_DIR/auto-install.sh"
+
+# Gamepad->keyboard bridge: same pattern (configs/ single source of truth,
+# also self-healed via the binary). TV input for every app iframe.
+GAMEPAD_SRC="$SCRIPT_DIR/../configs/archipelago-gamepad-keys.py"
+GAMEPAD_SERVICE_SRC="$SCRIPT_DIR/../configs/archipelago-gamepad-keys.service"
+for _pad_src in "$GAMEPAD_SRC" "$GAMEPAD_SERVICE_SRC"; do
+    if [ ! -f "$_pad_src" ]; then
+        echo "ERROR: gamepad config file missing: $_pad_src" >&2
+        exit 1
+    fi
+done
+if grep -qx 'GAMEPADPY' "$GAMEPAD_SRC" || grep -qx 'GAMEPADSVC' "$GAMEPAD_SERVICE_SRC"; then
+    echo "ERROR: gamepad config contains a reserved heredoc terminator line (GAMEPADPY/GAMEPADSVC)" >&2
+    exit 1
+fi
+{
+    echo ""
+    echo "# Gamepad->keyboard bridge — controller input inside every app iframe on the TV."
+    echo "cat > /mnt/target/usr/local/bin/archipelago-gamepad-keys <<'GAMEPADPY'"
+    cat "$GAMEPAD_SRC"
+    echo "GAMEPADPY"
+    echo "chmod +x /mnt/target/usr/local/bin/archipelago-gamepad-keys"
+    echo ""
+    echo "cat > /mnt/target/etc/systemd/system/archipelago-gamepad-keys.service <<'GAMEPADSVC'"
+    cat "$GAMEPAD_SERVICE_SRC"
+    echo "GAMEPADSVC"
+} >> "$ARCH_DIR/auto-install.sh"
+
 cat >> "$ARCH_DIR/auto-install.sh" <<'INSTALLER_SCRIPT'
 
 # Toggle script: sudo archipelago-kiosk enable|disable|status
@@ -3246,6 +3324,8 @@ chroot /mnt/target systemctl enable archipelago-first-boot-secrets.service 2>/de
 chroot /mnt/target systemctl enable archipelago-setup-tor.service 2>/dev/null || true
 chroot /mnt/target systemctl enable archipelago-first-boot-containers.service 2>/dev/null || true
 chroot /mnt/target systemctl enable archipelago-kiosk.service 2>/dev/null || true
+chroot /mnt/target systemctl enable archipelago-audio-router.service 2>/dev/null || true
+chroot /mnt/target systemctl enable archipelago-gamepad-keys.service 2>/dev/null || true
 chroot /mnt/target systemctl enable nostr-vpn.service 2>/dev/null || true
 # Enable claude-api-proxy (create symlink manually — chroot systemctl can fail)
 chroot /mnt/target systemctl enable claude-api-proxy.service 2>/dev/null || \