Update RadiantWave - Fixed scaling issues

The RadiantWave app can now apply pending updates by restarting its own
TTY session (plain systemctl, no sudo): getty re-autologins kiosk and
the login shell relaunches cage + app from the new generation.

Also drop the cleanRadiantFiles activation script.

.gitea/workflows/build-dev.yml

@@ -1,68 +1,51 @@
-name: build-dev
+name: Build Dev ISO
+
 on:
-  # Every push to dev: build, run the offline test suite, publish to the
-  # dev Attic cache.
+  workflow_dispatch:
   push:
-    branches: [dev]
+    branches:
+      - dev
+
+env:
+  NIX_CONFIG: |
+    extra-substituters = https://attic.radiantwavetech.com/radiantwave-dev
+    extra-trusted-public-keys = radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0=
+
 jobs:
-  nix-build:
+  build-dev-iso:
     runs-on: build-server
+
     steps:
-      # actions/checkout@v4 is unreliable on host-mode runners (its files are
-      # copied into the workspace instead of the repo), so clone explicitly.
-      - name: Checkout
+      - name: Clone Repository
+        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
+
+      - name: Checkout dev branch
+        run: git checkout dev
+
+      - name: Prepare output directory
+        run: mkdir -p /home/user/radiantwave
+
+      # --- Kiosk ISO ---
+      - name: Build kiosk ISO
         run: |
-          rm -rf ./* ./.[!.]* 2>/dev/null || true
-          git config --global http.extraheader "Authorization: token ${{ github.token }}"
-          git clone --branch "${{ gitea.ref_name }}" \
-            "${{ gitea.server_url }}/${{ gitea.repository }}.git" .
-          test -f flake.nix
-          git log --oneline -1
-      - name: Inspect workspace
+          export NIXPKGS_ALLOW_UNFREE=1
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          nix build -L --impure .#nixosConfigurations.dev-iso.config.system.build.isoImage
+
+      - name: Rename kiosk ISO
         run: |
-          pwd
-          ls -la
-          git rev-parse --show-toplevel 2>&1 || true
-          git remote -v 2>&1 || true
-          git describe --tags --always 2>&1 || true
-          test -f flake.nix && echo "flake.nix present" || echo "NO flake.nix"
-      # Dev builds fingerprint as the short commit hash.
-      # Persisted via GITHUB_ENV so the impure nix eval below reads it via
-      # builtins.getEnv.
-      - name: Compute version
+          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
+          FILENAME="radiantwave-kiosk-dev-iso-${ISO_DATE}.iso"
+          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
+          echo "KIOSK_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
+
+      - name: Move old dev images to archive
+        run: tools/archive-images.sh nclack@157.245.124.103 /mnt/infrastructure_data/files/images /mnt/infrastructure_data/files/images/archives 'radiantwave-kiosk-dev*'
+
+      - name: Copy kiosk ISO to fileserver
         run: |
-          echo "APP_VERSION=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
-      # checks is keyed per-system (checks.<system>.default); nix build's
-      # #attr shorthand can't resolve it, so resolve the current system inline.
-      # --impure lets the flake read APP_VERSION via builtins.getEnv
-      # (pure evals always get the package defaults).
-      - name: Build package
-        run: |
-          nix build -L ".#packages.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
-            --impure --out-link result-pkg
-      # The offline test suite runs in the check derivation's checkPhase.
-      # This is a separate build/output from the package itself.
-      - name: Build + offline test suite
-        run: |
-          nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
-            --impure --out-link result-checks
-      - name: Live portal tests
-        env:
-          RWT_LIVE_ACCOUNT_EMAIL: ${{ secrets.RWT_LIVE_ACCOUNT_EMAIL }}
-          RWT_LIVE_LICENSE_EMAIL: ${{ secrets.RWT_LIVE_LICENSE_EMAIL }}
-          RWT_LIVE_LICENSE_KEY: ${{ secrets.RWT_LIVE_LICENSE_KEY }}
-        run: |
-          nix develop --command bash -c '
-            cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug
-            cmake --build build --target test_api_client test_license_service
-            ./build/test_api_client
-            ./build/test_license_service
-          '
-      # Dev closure (the actual package, not the check output) lands in the
-      # dev cache.
-      - name: Push to Attic dev cache
-        env:
-          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_DEV }}
-        run: |
-          attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
-          attic push radiantwave:radiantwave-dev ./result-pkg
+          scp "/home/user/radiantwave/${KIOSK_ISO_FILENAME}" \
+            radiantwave-infra:/mnt/infrastructure_data/files/images/
+
+      - name: Cleanup kiosk ISO
+        run: rm -f "/home/user/radiantwave/${KIOSK_ISO_FILENAME}"

.gitea/workflows/build-prod-android.yml

@@ -1,6 +1,11 @@
 on:
   workflow_dispatch:
 
+env:
+  NIX_CONFIG: |
+    extra-substituters = https://attic.radiantwavetech.com/radiantwave
+    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
+
 jobs:
   build-android:
     runs-on: build-server

.gitea/workflows/build-prod-commercial.yml

@@ -1,6 +1,11 @@
 on:
   workflow_dispatch:
 
+env:
+  NIX_CONFIG: |
+    extra-substituters = https://attic.radiantwavetech.com/radiantwave
+    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
+
 jobs:
   build-commercial:
     runs-on: build-server

.gitea/workflows/build-prod-kiosk.yml

@@ -1,6 +1,11 @@
 on:
   workflow_dispatch:
 
+env:
+  NIX_CONFIG: |
+    extra-substituters = https://attic.radiantwavetech.com/radiantwave
+    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
+
 jobs:
   build-kiosk:
     runs-on: build-server

.gitea/workflows/build-prod-rpi.yml

@@ -1,6 +1,11 @@
 on:
   workflow_dispatch:
 
+env:
+  NIX_CONFIG: |
+    extra-substituters = https://attic.radiantwavetech.com/radiantwave https://nixos-raspberrypi.cachix.org
+    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=
+
 jobs:
   build-rpi:
     runs-on: build-server
@@ -26,8 +31,7 @@ jobs:
           echo "RPI_IMAGE_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
 
       - name: Move old Raspberry Pi images to archive
-        run: |
-          ssh nclack@157.245.124.103 'find /mnt/infrastructure_data/files/images -maxdepth 1 -name "radiantwave-rpi*" -exec mv {} /mnt/infrastructure_data/files/images/archives/ ;'
+        run: tools/archive-images.sh nclack@157.245.124.103 /mnt/infrastructure_data/files/images /mnt/infrastructure_data/files/images/archives 'radiantwave-rpi*'
 
       - name: Copy Raspberry Pi image to fileserver
         run: |

configuration.nix

@@ -55,6 +55,22 @@ in
     }
   ];
 
+  # Let the kiosk app apply pending updates by restarting its own TTY
+  # session (re-autologin -> fresh cage + RadiantWave). Scoped to exactly
+  # one unit and verb; everything else keeps stock (denied) policy.
+  security.polkit.enable = true;
+  environment.etc."polkit-1/rules.d/10-kiosk-getty.rules".text = ''
+    polkit.addRule(function(action, subject) {
+      if (subject.user !== "kiosk") return null;
+      if (action.id !== "org.freedesktop.systemd1.manage-units") return null;
+      var unit = action.lookup("unit");
+      var verb = action.lookup("verb");
+      if ((unit === "getty@tty1.service" || unit === "getty@tty1") && verb === "restart") {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+
   hardware.graphics.enable = true;
 
   time.timeZone = "America/Chicago";
@@ -69,10 +85,6 @@ in
     operation = "switch";
   };
 
-  system.activationScripts.cleanRadiantFiles = ''
-    rm -rf /home/kiosk/.local/radiantwave/audio
-  '';
-
   # Virtual machine declaration
   virtualisation.vmVariant = {
     boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;

flake.lock

@@ -220,11 +220,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1787341934,
-        "narHash": "sha256-pWGpgM5acdCO02H8P3KKtdv09n9ucnI3cg8d3/tvwtk=",
+        "lastModified": 1787522765,
+        "narHash": "sha256-D3KOrGcAH07lvKYgyiwejOQpDW91js7zI6l87WdabLk=",
         "ref": "main",
-        "rev": "b96631c374682088088b3d679359d192a0ae74d6",
-        "revCount": 35,
+        "rev": "63265cc22f3055a782a0114e92c57a36bef723b2",
+        "revCount": 40,
         "type": "git",
         "url": "https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git"
       },
@@ -240,11 +240,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1787507168,
-        "narHash": "sha256-LeMd6lnfhnixC+e77yM5DG5gVYaEa+URfKD+yEmenJc=",
+        "lastModified": 1787522765,
+        "narHash": "sha256-D3KOrGcAH07lvKYgyiwejOQpDW91js7zI6l87WdabLk=",
         "ref": "dev",
-        "rev": "f2a40cd0194fe920a0fc1062d57a93dfc6693b52",
-        "revCount": 38,
+        "rev": "63265cc22f3055a782a0114e92c57a36bef723b2",
+        "revCount": 40,
         "type": "git",
         "url": "https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git"
       },

tools/archive-images.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Archive old build images on the fileserver before publishing new ones.
+#
+# Usage: tools/archive-images.sh <ssh-target> <images-dir> <archive-dir> <pattern>...
+#
+# Zero matching files is fine (nothing to archive yet); a missing directory
+# or a failed move aborts non-zero so CI stops before publishing.
+# The remote half is piped to `bash -s` over stdin so there is no nested
+# shell quoting to get wrong.
+
+set -euo pipefail
+
+die() { echo "error: $*" >&2; exit 1; }
+
+(( $# >= 4 )) || die "usage: $0 <ssh-target> <images-dir> <archive-dir> <pattern>..."
+
+target=$1 images_dir=$2 archive_dir=$3
+shift 3
+patterns=("$@")
+
+for v in "$images_dir" "$archive_dir" "${patterns[@]}"; do
+	case $v in
+		*[[:space:]\'\"]*) die "unsafe argument (whitespace/quotes): $v" ;;
+	esac
+done
+
+echo "Archiving previous images on $target:"
+printf '  pattern: %s\n' "${patterns[@]}"
+
+# Assignments prefixed to `bash -s` are parsed by the remote shell as
+# environment variables for the script below; the quoted heredoc marker
+# keeps every byte of the payload literal until bash executes it.
+ssh "$target" "IMAGES_DIR=$images_dir ARCHIVE_DIR=$archive_dir bash -s" <<'REMOTE'
+set -euo pipefail
+shopt -s nullglob
+
+if [ ! -d "$IMAGES_DIR" ]; then
+	echo "error: images dir not found: $IMAGES_DIR" >&2
+	exit 1
+fi
+if [ ! -d "$ARCHIVE_DIR" ]; then
+	echo "error: archive dir not found: $ARCHIVE_DIR" >&2
+	exit 1
+fi
+
+moved=0
+for pat in "${PATTERNS[@]}"; do
+	for f in "$IMAGES_DIR"/$pat; do
+		echo "  archiving $(basename "$f")"
+		mv "$f" "$ARCHIVE_DIR/"
+		moved=$((moved + 1))
+	done
+done
+
+echo "Archived $moved file(s)."
+REMOTE