Replaces the vague "separate netinstall media" fallback with a
concrete design: move the workspace/backend decision to the
self-service portal, before boot, and bake the finished kickstart/
autoinstall/preseed config into a personalized, distro-specific,
much smaller installer ISO at build time. Sidesteps the live-session
vs. native-installer-automation tension entirely, and the open
early-boot networking question from the two-stage-reboot plan, since
no runtime config fetch is needed. Consistent with backend_postinstall()
already being scoped to the installed system's first boot, not the
install phase.
Names the real cost honestly: demotes the interactive kiosk mode to
an optional secondary path, and requires real per-distro ISO-build
infrastructure server-side.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Further research showed the live-session-invocation limitation isn't
Fedora-specific: Ubuntu/Subiquity autoinstall and Ubiquity/preseed are
also strictly kernel-boot-parameter-triggered, and Calamares has no
unattended mode at all regardless of timing. Rather than switching
distros, the live session can instead set the right boot parameter
for a second boot and reboot into the installer's normal automated
mode - potentially avoiding a Fedora/Anaconda departure entirely.
Records the agreed test order: confirm Mint's actual installer,
test Fedora+kickstart-via-reboot first (lowest cost), then Mint/Ubuntu
with the same pattern, with the original ADR-0009 ultima ratio last.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Real test on Fedora 44 / Anaconda 44.30-2.fc44 (bypassing the liveinst
wrapper, which explicitly rejects kickstart on live media) confirmed
the documented restriction firsthand rather than just by reading
about it: --liveinst --kickstart in text mode silently drops rootpw/
user directives (require full manual re-entry, no error), and cmdline
mode exits cleanly with CmdlineError naming Installation Destination,
Root password, and User creation as unfinished despite being fully
specified in the kickstart.
Reimplementing install logic to bypass Anaconda entirely was
considered and explicitly rejected. Next step is re-evaluating
Ubuntu/Debian-based installer media instead of Anaconda's live mode;
switching Fedora to the officially supported inst.ks=/liveimg pattern
(separate netinstall media) remains a last resort.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The previous Auto-Modus-Gate rule unconditionally forced new devices
into the interactive flow because no better mechanism was known yet.
Enrollment Sessions (11-device-enrollment.md) already solve planned
bulk rollouts, but not a single, spontaneously booted new device.
New devices in auto mode now go on hold after the identification
handshake and wait for a customer to confirm registration and assign
a workspace via the future management UI, reusing the same
fail-closed poll mechanism already planned for the interactive flow's
kiosk communication (ADR-0007). Devices covered by an active
Enrollment Session are unaffected and remain fully unattended.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Kiosk UI: Chromium was evaluated as an Epiphany alternative (ADR-0005)
after ADR-0004's application-mode approach turned out unusable
end-to-end, then abandoned after four distinct real-boot failures in a
row (ADR-0006) in favor of a hardened plain --profile Epiphany launch.
ADR-0004 amended with the actual fix history (profile directory
creation, application-mode's undocumented web-app requirement,
--private-instance/--profile conflict on the target's Epiphany 50.1
vs. the 43.1 used for local testing). ADR-0007 resolves ADR-0004's
open question: the kiosk web UI and installer.sh never talk directly,
only via the provisioning server.
WLAN autoprovisioning: customer profile gets an "Autoprovisionierung"
flag plus WLAN credentials, driving self-service generation of a
personalized ISO with the credentials baked in as a NetworkManager
profile — works from device one, no persistent on-stick state needed.
Personalizing the build this way also motivated giving the ISO its
own volume label (TUXFLOTTE) instead of the source Fedora label.
Also folds in the EROFS root-cause writeup and the Ubuntu-live-medium
alternative noted for a future ISO rework, and brings
roadmap/installer-roadmap.md's checkboxes in line with actual status.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Replaces the stale "not yet implemented" note for installer.sh
autostart with the actual mechanism (dracut's official
20-apply-live-updates.sh pre-pivot hook via a top-level /updates/
directory, not squashfs/EROFS remastering - that image is EROFS
despite the filename, and hit a reproducible erofs-utils extraction
bug even freshly built from source). Adds the milestone entry for the
first clean end-to-end run through every module, live in Proxmox.
Fedora Cinnamon Live 44 chosen as the concrete base (interchangeable
with Workstation Live for this purpose), tuxflotte.mode kernel cmdline
flag name, 10s countdown with auto as default entry, and the
xorriso-based build.sh/extract.sh that no longer needs root. Checks
off 'Boot from local disk' in the installer roadmap, now verified
end-to-end in QEMU/KVM.
Moves from a Fedora DVD/netinst base (GRUB boots straight into Anaconda
via a static inst.ks= URL, bypassing installer.sh entirely) to a real
live medium. installer.sh runs as an application inside the live
session; backend_launch() starts the native installer explicitly at
the end instead of a boot-time kickstart parameter.
The boot menu offers two entries: a default with a countdown that
leads to an unattended flow, and a manual entry for the branded
interactive flow. The unattended flow is gated on
device.registration_status == "existing" - unknown devices always
fail closed into the interactive enrollment path. Device registration
now documents that this is a condition of registering a device.
Also notes the tension with the installer roadmap's long-term
minimal-medium vision: distribution packages still aren't bundled and
are pulled per install, but the live environment itself makes the
medium larger, accepted for the UX it enables.
Details: architecture/13-live-provisioning-boot.md.
Introduces the Merkmal-Backend-Blueprint realization model: a Merkmal
describes one distribution-independent workspace feature, a Blueprint
realizes exactly one Merkmal for exactly one backend (usually an
Ansible role applied post-first-boot via ansible-pull), and a
Bereitstellungsvorlage bundles workspace + backend + org-specific
installation directives (partitioning, encryption, secure boot).
Replaces the old flat profile model (profiles/profile.json/
distribution+version) throughout the provisioning API, data model,
interactive provisioning flow, and device enrollment docs with
templates/Bereitstellungsvorlage terminology. Moves 02-workspace-model.md
and 04-backend-model.md into architecture/, archives the superseded
flat organization-model.md.
