Bake Sunshine remote admin + add one-command configured ISO builder

- Sunshine flatpak in first-boot list; autostarts with the console account's session (bc250-sunshine-autostart, honors CONSOLE_KID_USER) - bc250-personalize: one-shot display names from /etc/bc250-console.conf - build-console.sh + console.env(.example): fill in usernames/passwords/ display names, get a fully personalized ISO — no post-install steps beyond per-account logins. Generated files git-ignored (credentials) - Docs: Moonlight is the remote-admin path; RDP marked blocked by the mutter cursor-metadata screencast crash on GFX1013 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-17 10:51:57 -04:00
parent c2d0f7967a
commit 6194756d2a
12 changed files with 222 additions and 7 deletions
@@ -0,0 +1,7 @@
+[Desktop Entry]
+Type=Application
+Name=Sunshine streaming host (console autostart)
+Comment=Serves the console session to Moonlight for remote admin
+Exec=/usr/bin/bc250-sunshine-autostart
+X-GNOME-Autostart-enabled=true
+NoDisplay=true
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# One-time personalization from /etc/bc250-console.conf (written at image
+# build time by build-console.sh): applies friendly display names to the
+# accounts created by the installer. Stamps so it never re-runs — later
+# on-box renames/chfn are never overwritten.
+[ -r /etc/bc250-console.conf ] && . /etc/bc250-console.conf
+
+apply() { # $1 = user, $2 = display name
+    [ -n "$2" ] || return 0
+    id "$1" >/dev/null 2>&1 || return 0
+    chfn -f "$2" "$1" || true
+}
+
+apply "${CONSOLE_KID_USER:-kid}"       "${CONSOLE_KID_DISPLAY:-}"
+apply "${CONSOLE_PARENT_USER:-parent}" "${CONSOLE_PARENT_DISPLAY:-}"
+
+mkdir -p /var/lib/bc250
+touch /var/lib/bc250/.personalized
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Start the Sunshine streaming host in the console (kid) account's session,
+# so the parent can connect with Moonlight whenever the console is in use.
+# Sunshine replaces RDP as the remote-admin path: GNOME RDP crashes mutter
+# on the BC-250 (cursor-metadata screencast segfault, mutter 50.3).
+[ -r /etc/bc250-console.conf ] && . /etc/bc250-console.conf
+[ "$(id -un)" = "${CONSOLE_KID_USER:-kid}" ] || exit 0
+flatpak info dev.lizardbyte.app.Sunshine >/dev/null 2>&1 || exit 0
+exec systemctl --user enable --now app-dev.lizardbyte.app.Sunshine.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=One-time console account personalization (display names)
+ConditionPathExists=!/var/lib/bc250/.personalized
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/bc250-personalize
+
+[Install]
+WantedBy=multi-user.target
@@ -13,7 +13,16 @@ kid's password any time: `sudo passwd kid`.
 | | Command / client | Works when |
 |---|---|---|
 | SSH (terminal) | `ssh parent@<console-address>` | Always (console is never asleep) |
-| RDP (see the screen) | Any RDP client → `<console-address>:3389` | Only while the kid's session is logged in |
+| Moonlight (see + control the screen) | [Moonlight](https://moonlight-stream.org) → console → **Desktop** | Only while the kid's session is logged in |
+
+One-time Moonlight pairing: browse to `https://<console-address>:47990`,
+create the Sunshine admin login, then enter the PIN Moonlight shows you in
+Sunshine's PIN tab. Sunshine starts automatically with the kid's session.
+
+> Why not RDP? GNOME Remote Desktop crashes the session on this GPU
+> (mutter 50.x cursor-metadata screencast segfault on cyan-skillfish).
+> `bc250-remote-setup` still configures it if you want to retry after a
+> future mutter update — but Moonlight is smoother anyway.

 `<console-address>`: the LAN IP, or (recommended) the Tailscale name/IP so it
 works from anywhere. Never port-forward 22/3389 on the router.