Organize flakes and cleanup things.

Update SSH keys
Remove ISO 'VM' configuration

configuration.nix

@@ -2,9 +2,13 @@
 
 let
   radiantApp = radiantwave.packages.${pkgs.system}.default;
-  myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4vXx7sOOVAyxdS/N1LEI+L8wYICf+gbzs6Kz7K8Je5 cnclack@pm.me:Thinkpad" ];
+  myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook" ];
 in
 {
+  ############################################################
+  # System configuration
+  ############################################################
+
   # Included packages
   environment.systemPackages = [
     pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite
@@ -19,12 +23,12 @@ in
   boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "i915" "drm" "drm_kms_helper" ];
   boot.kernelParams = [ "quiet" "splash" ];
 
-  # --- Essential Services ---
-  services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; };
-  services.seatd.enable = true;
-  services.openssh.enable = true;
-  services.openssh.settings.PermitRootLogin = "prohibit-password";
   hardware.graphics.enable = true;
+
+  time.timeZone = "America/Chicago";
+
+  networking.networkmanager.enable = true;
+
   system.autoUpgrade = {
     enable = true;
     flake = upgradeFlakeRef;
@@ -32,15 +36,40 @@ in
     flags = [ "--refresh" "-L" ];
     operation = "switch";
   };
-  time.timeZone = "America/Chicago";
 
-  # Networking Network-Manager
+  system.activationScripts.cleanRadiantFiles = ''
-  services.resolved.enable = false;
+    rm -rf /home/kiosk/.local/share/radiantwave/audio
-  networking.networkmanager.enable = true;
+  '';
-  systemd.services.NetworkManager-wait-online.enable = false;
+
-  systemd.network.wait-online.enable = false;
+  # Virtual machine declaration
+  virtualisation.vmVariant = {
+    boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;
+    boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false;
+    virtualisation.forwardPorts = [
+      { from = "host"; host.port = 2222; guest.port = 22; }
+    ];
+    virtualisation.qemu.options = [
+      "-device intel-hda"
+      "-device hda-duplex"
+      "-vga virtio"
+    ];
+    virtualisation = {
+      cores = 8;
+      memorySize = 8192;
+    };
+    services.logrotate.enable = false;
+  };
+  virtualisation.diskSize = 10485760;
+
+  # NixOS settings.
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.accept-flake-config = true;
+  system.stateVersion = "24.05";
+
+  ############################################################
+  # User configuration
+  ############################################################
 
-  # --- Users & SSH Keys ---
   users.users.root.openssh.authorizedKeys.keys = myKey;
   users.users.kiosk = {
     isNormalUser = true;
@@ -49,17 +78,57 @@ in
     openssh.authorizedKeys.keys = myKey;
     password = "Fuckp@ssw0rds";
   };
+
   services.getty.autologinUser = "kiosk";
 
+  # --- The Kiosk Startup Script ---
+  environment.loginShellInit = ''
+   if [ "$(tty)" = "/dev/tty1" ]; then
+      export GODEBUG=netdns=cgo
+      export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+
+      # Smart Network Wait
+      for i in {1..10}; do
+        if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then
+          break
+        fi
+        sleep 1
+      done
+
+      # Graphics fixes
+      export SDL_VIDEODRIVER=wayland
+      export QT_QPA_PLATFORM=wayland
+      export XDG_SESSION_TYPE=wayland
+      export WLR_RENDERER=pixman
+      export WLR_NO_HARDWARE_CURSORS=1
+
+      # Asset sync + start app
+      mkdir -p /home/kiosk/.local/share/radiantwave
+      ${pkgs.rsync}/bin/rsync -ru ${radiantApp}/share/radiantwave/ /home/kiosk/.local/share/radiantwave/
+
+      exec dbus-run-session cage -- ${radiantApp}/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1
+    fi
+  '';
+
+  ############################################################
+  # Service configuration
+  ############################################################
+
+  services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; };
+  services.seatd.enable = true;
+  services.openssh.enable = true;
+  services.openssh.settings.PermitRootLogin = "prohibit-password";
+
+  # Networking Network-Manager
+  services.resolved.enable = false;
+  systemd.services.NetworkManager-wait-online.enable = false;
+  systemd.network.wait-online.enable = false;
+
   # --- Set ownership of Radiantwave files ---
   systemd.tmpfiles.rules = [
     "d /home/kiosk/.local/share/radiantwave 0770 kiosk kiosk -"
   ];
 
-  system.activationScripts.cleanRadiantFiles = ''
-    rm -rf /home/kiosk/.local/share/radiantwave/audio
-  '';
-
   # --- Backup service: runs before nixos-upgrade ---
   systemd.services.radiantwave-backup = {
     description = "Backup RadiantWave user data before upgrade";
@@ -107,96 +176,4 @@ in
       echo "Rollback completed at $(date)"
     '';
   };
-
-  # --- 3. The Kiosk Startup Script ---
-  environment.loginShellInit = ''
-   if [ "$(tty)" = "/dev/tty1" ]; then
-      export GODEBUG=netdns=cgo
-      export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
-
-      # Smart Network Wait
-      for i in {1..10}; do
-        if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then
-          break
-        fi
-        sleep 1
-      done
-
-      # Graphics fixes
-      export SDL_VIDEODRIVER=wayland
-      export QT_QPA_PLATFORM=wayland
-      export XDG_SESSION_TYPE=wayland
-      export WLR_RENDERER=pixman
-      export WLR_NO_HARDWARE_CURSORS=1
-
-      # Asset sync + start app
-      mkdir -p /home/kiosk/.local/share/radiantwave
-      ${pkgs.rsync}/bin/rsync -ru ${radiantApp}/share/radiantwave/ /home/kiosk/.local/share/radiantwave/
-
-      exec dbus-run-session cage -- ${radiantApp}/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1
-    fi
-  '';
-
-  # # Tailscale Configuration 
-  # systemd.tmpfiles.rules = [
-  #   "d /etc/tailscale 0700 root root -"
-  #   "f /etc/tailscale/preauth-key 0600 root root - ${preAuthKey}"
-  # ];
-
-  # services.tailscale = {
-  #   enable = true;
-  #   authKeyFile = "/etc/tailscale/preauth-key";
-  #   openFirewall = true;
-  #   authKeyParameters.preauthorized = true;
-  #   extraUpFlags = [
-  #     "--login-server" headscaleUrl
-  #   ];
-  # };
-
-  # systemd.services.tailscale-set-hostname = {
-  #   description = "Set Tailscale hostname based on the RadiantWave license key";
-  #   after = [ "tailscale-autoconnect.service" ];
-  #   wants = [ "tailscaled.service" ];
-  #   wantedBy = [ "multi-user.target" ];
-  #   serviceConfig = {
-  #     Type = "oneshot";
-  #     RemainAfterExit = true;
-  #   };
-  #   script = ''
-  #      if [ -f "${licenseKeyFile}" ]; then
-  #       KEY=$(cat "${licenseKeyFile}" | tr -d '[:space:]')
-  #       if [ -n "$KEY" ]; then
-  #         echo "Setting Tailscale hostname to: $KEY"
-  #         ${pkgs.lib.getExe pkgs.tailscale} set --hostname="$KEY"
-  #         exit 0
-  #       fi
-  #     fi
-  #     echo "No license key found, skipping hostname override"
-  #   '';
-  # };
-
-  # Virtual machine declaration
-  virtualisation.vmVariant = {
-    boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;
-    boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false;
-    virtualisation.forwardPorts = [
-      { from = "host"; host.port = 2222; guest.port = 22; }
-    ];
-    virtualisation.qemu.options = [
-      "-device intel-hda" 
-      "-device hda-duplex"
-      "-vga virtio"
-    ];
-    virtualisation = {
-      cores = 8;
-      memorySize = 8192;
-    };
-    services.logrotate.enable = false;
-  };
-  virtualisation.diskSize = 10485760;
-
-  # NixOS settings.
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  nix.settings.accept-flake-config = true;
-  system.stateVersion = "24.05";
 }

flake.nix

@@ -62,13 +62,6 @@
             ./configuration.nix
             radiantwave.nixosModules.default
             {
-              # system.autoUpgrade = {
-              #   enable = enableAutoUpgrade;
-              #   flake = upgradeFlakeRef;
-              #   dates = "*:00/10";
-              #   allowReboot = true;
-              #   flags = [ "--refresh" ];
-              # };
               boot.loader.systemd-boot.enable = nixpkgs.lib.mkForce false;
               boot.loader.efi.canTouchEfiVariables = nixpkgs.lib.mkForce false;
               boot.loader.raspberry-pi.bootloader = "kernel";
@@ -88,6 +81,7 @@
       packages.x86_64-linux.radiantwavekiosk-dev = self.nixosConfigurations.radiantwavekiosk-dev.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-android = self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;
+      # Kiosk
       nixosConfigurations = {
         radiantwavekiosk = mkKioskSystem {
           system = "x86_64-linux";
@@ -96,6 +90,7 @@
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk";
           extraModules = [];
         };
+        # Kiosk-dev
         radiantwavekiosk-dev = mkKioskSystem {
           system = "x86_64-linux";
           radiantwave = radiantwave-dev;
@@ -103,6 +98,7 @@
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-dev";
           extraModules = [];
         };
+        # Commercial
         radiantwavekiosk-commercial = mkKioskSystem {
           system = "x86_64-linux";
           radiantwave = radiantwave;
@@ -110,6 +106,7 @@
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-commercial";
           extraModules = [];
         };
+        # Commercial-dev
         radiantwavekiosk-commercial-dev = mkKioskSystem {
           system = "x86_64-linux";
           radiantwave = radiantwave;
@@ -117,6 +114,7 @@
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial";
           extraModules = [];
         };
+        # Kiosk - rotated screen for android displays
         radiantwavekiosk-android = mkKioskSystem {
           system = "x86_64-linux";
           radiantwave = radiantwave;
@@ -124,15 +122,19 @@
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-android";
           extraModules = [./rotated_display.nix  ];
         };
+        # Raspberry pi 5
         radiantwavekiosk-rpi = mkRpiKioskSystem {
           radiantwave = radiantwave;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-rpi";
         };
+        # Raspberry pi 5 dev
         radiantwavekiosk-rpi-dev = mkRpiKioskSystem {
           radiantwave = radiantwave-dev;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-rpi-dev";
         };
-        usb-iso = nixpkgs.lib.nixosSystem {
+        # === USB Images ===
+        # Kiosk USB
+        kiosk-iso = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = {
             inherit inputs;
@@ -154,7 +156,8 @@
             })
           ];
         };
-        commercial-usb-iso = nixpkgs.lib.nixosSystem {
+        # Commercial iso
+        commercial-iso = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = {
             inherit inputs;
@@ -176,7 +179,7 @@
             })
           ];
         };
-
+        # kiosk rotated screen
         android-iso = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = {
@@ -199,6 +202,7 @@
             })
           ];
         };
+        # Kiosk iso development branch
         dev-iso = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = {

iso-config.nix

@@ -12,6 +12,10 @@ let
     self.nixosConfigurations.radiantwavekiosk.config.system.build.diskoScript;
 in
 {
+  ############################################################
+  # System configuration
+  ############################################################
+
   nix.settings = {
     experimental-features = [
       "nix-command"
@@ -23,6 +27,8 @@ in
     ];
 
     flake-registry = "";
+
+    connect-timeout = 0;
   };
 
   nix.registry.nixpkgs = pkgs.lib.mkForce {
@@ -32,19 +38,11 @@ in
     };
   };
 
-  environment.variables.KIOSK_FLAKE = "${self}";
+  nix.extraOptions = ''
+    netrc-file = /etc/nix/netrc
+  '';
 
-  virtualisation.vmVariant = {
+  environment.variables.KIOSK_FLAKE = "${self}";
-    virtualisation.memorySize = 8096;
-    virtualisation.diskSize = 100000;
-    virtualisation.cores = 4;
-    virtualisation.qemu.options = [
-      # "-nic none"
-    ];
-    virtualisation.forwardPorts = [
-      { from = "host"; host.port = 2222; guest.port = 22; }
-    ];
-  };
 
   environment.etc."nix/netrc" = {
     text = ''
@@ -53,29 +51,33 @@ in
     mode = "0400";
   };
 
-  nix.extraOptions = ''
-    netrc-file = /etc/nix/netrc
-  '';
-
   networking.networkmanager.enable = true;
 
-  systemd.services.NetworkManager-wait-online.enable = false;
+  ############################################################
+  # User configuration
+  ############################################################
 
-  nix.settings.connect-timeout = 0;
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook"
+  ];
+
+  ############################################################
+  # Service configuration
+  ############################################################
 
   services.openssh.enable = true;
 
-  users.users.root.openssh.authorizedKeys.keys = [
+  systemd.services.NetworkManager-wait-online.enable = false;
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4vXx7sOOVAyxdS/N1LEI+L8wYICf+gbzs6Kz7K8Je5 cnclack@pm.me:Thinkpad"
-  ];
 
   systemd.services.zero-touch-install = {
     description = "Zero-Touch Kiosk Installation";
 
     wantedBy = [ "multi-user.target" ];
 
-    wants = [ ];
+    # Make sure we own tty1 exclusively - getty@tty1 will otherwise
-    after = [ "systemd-udev-settle.service" ];
+    # try to spawn a login prompt on the same console.
+    conflicts = [ "getty@tty1.service" ];
+    after = [ "systemd-udev-settle.service" "getty@tty1.service" ];
 
     path = with pkgs; [
       nix
@@ -95,6 +97,15 @@ in
       DISKO_SCRIPT = "${diskoScript}";
     };
 
+    serviceConfig = {
+      StandardInput = "tty";
+      StandardOutput = "tty";
+      StandardError = "tty";
+      TTYPath = "/dev/tty1";
+      TTYReset = true;
+      TTYVHangup = true;
+      TTYVTDisallocate = true;
+    };
 
     script = ''
       set -euo pipefail
@@ -114,10 +125,9 @@ script = ''
 
       echo "============================================"
       echo " Installation complete!"
-      echo " Rebooting in 5 seconds..."
+      echo " Please shut down and remove the flash drive before restarting"
       echo "============================================"
-      sleep 5
+      sleep 10000000
-      systemctl reboot --force
     '';
   };
 }