Skip to main content

max / alloy

Drop first-boot Flatpak provisioning; Rnote was the last tenant and is shelved The 2026-07-17 sway pivot shelved Rnote (TUI-first clashes with a stylus GUI, per MANIFESTO.md#status and STACK.md line 185), and the previous commit dropped Floorp for a baked-in Firefox RPM. That leaves the alloy-flatpak-firstboot.service with nothing to install, so remove it outright: - Delete usr/lib/systemd/system/alloy-flatpak-firstboot.service. - Drop the enable line from 50-alloy.preset; update the comment to explain that Firefox ships as an RPM and ungoogled-chromium and any other Flathub apps are user-installed on demand. - Update Containerfile comments to match. The `flatpak` client stays installed so users can pull ungoogled-chromium and friends on demand. - Update IMAGE.md's Flatpak paragraph to match.
Co-Authored-By
Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-07-18 14:44 UTC
Signed with PGP, not checked
Commit: 3a9b6706dc0737cb0e805629aca87398c7ba2263
Parent: 5f98e0e
4 files changed, +10 insertions, -38 deletions
M Containerfile +5 -12
@@ -75,8 +75,10 @@
75 75 # Package additions — full Alloy stack per docs/STACK.md
76 76 #
77 77 # Sources noted per group. Anything absent from both Fedora main and
78 - # Terra is either handled via Flatpak (Rnote) or downloaded
79 - # directly (Nerd Fonts).
78 + # Terra is downloaded directly (Nerd Fonts). The `flatpak` client is
79 + # installed so users can pull ungoogled-chromium and other on-demand
80 + # apps from Flathub post-install; no Flatpaks are provisioned at
81 + # build or first-boot time.
80 82 # =====================================================================
81 83 RUN dnf install -y \
82 84 # Compositor and Wayland session (Fedora main)
@@ -121,7 +123,7 @@
121 123 grim slurp \
122 124 # Browser (Gecko default; ungoogled-chromium is opt-in Flatpak per docs/STACK.md)
123 125 firefox \
124 - # Flatpak client (Flathub + Rnote install at first boot)
126 + # Flatpak client (user-installed apps on demand; see docs/STACK.md)
125 127 flatpak \
126 128 # Font tools
127 129 unzip fontconfig \
@@ -168,15 +170,6 @@
168 170 gnome-session \
169 171 || true
170 172
171 - # =====================================================================
172 - # Flathub + Rnote — deferred to first boot
173 - # =====================================================================
174 - # bootc prefers /var empty at build time; `flatpak remote-add` and
175 - # `flatpak install --system` both write to /var/lib/flatpak, which
176 - # tripped `bootc container lint` on the first build. The provisioning
177 - # now runs via alloy-flatpak-firstboot.service (see
178 - # usr/lib/systemd/system/), enabled by the system preset.
179 -
180 173 # =====================================================================
181 174 # System user for greetd. greetd drops privileges to this account
182 175 # before spawning tuigreet; without it greetd exits with
M docs/IMAGE.md +1 -1
@@ -73,7 +73,7 @@
73 73 7. **Branding:** os-release, plymouth splash.
74 74 8. **Validation:** `bootc container lint` runs at build.
75 75
76 - The base browser (Firefox) ships as an RPM baked into the image — one code path, no first-boot delay, and enterprise policies (`/etc/firefox/policies/policies.json`) take effect immediately. Rnote and any other Flathub-only apps are installed system-wide on first boot via `alloy-flatpak-firstboot.service`, which adds the Flathub remote and pulls the apps — an image-size / first-boot-latency trade Alloy accepts for tools without clean RPM sources.
76 + The base browser (Firefox) ships as an RPM baked into the image — one code path, no first-boot delay, and enterprise policies (`/etc/firefox/policies/policies.json`) take effect immediately. The `flatpak` client is included so users can pull ungoogled-chromium and other Flathub-only apps on demand post-install; no Flatpaks are provisioned at build or first-boot time.
77 77
78 78 ## Update cadence
79 79
M etc/systemd/system-preset/50-alloy.preset +4 -8
@@ -7,18 +7,14 @@
7 7 # - tailscaled: opt-in only. Enrollment happens via `alloy tail`
8 8 # (see docs/CONTINUITY.md — Alloy does not phone home
9 9 # before the user says yes).
10 - # - alloy-flatpak-firstboot: adds flathub and installs Rnote the first
11 - # time the machine reaches multi-user with network. Kept
12 - # out of the build so /var stays empty at image-build
13 - # time (bootc lint requirement). Firefox is the default
14 - # browser and ships in the base image via dnf, so no
15 - # Flatpak involvement there; ungoogled-chromium is
16 - # user-installed on demand (see docs/STACK.md).
10 + #
11 + # The base image ships Firefox as an RPM; ungoogled-chromium and any
12 + # other Flathub apps are user-installed on demand (see docs/STACK.md),
13 + # so no first-boot Flatpak provisioning is needed.
17 14 #
18 15 # Format: `enable|disable <unit>`. First match wins; entries without
19 16 # a match fall through to /usr/lib/systemd/system-preset/ defaults.
20 17
21 18 enable greetd.service
22 - enable alloy-flatpak-firstboot.service
23 19
24 20 disable tailscaled.service
D usr/lib/systemd/system/alloy-flatpak-firstboot.service -17
@@ -1,17 +1,0 @@
1 - [Unit]
2 - Description=Alloy first-boot Flatpak provisioning (Rnote)
3 - Documentation=file:///usr/share/alloy/README
4 - After=network-online.target
5 - Wants=network-online.target
6 - ConditionPathExists=!/var/lib/alloy/flatpak-firstboot.done
7 -
8 - [Service]
9 - Type=oneshot
10 - RemainAfterExit=yes
11 - ExecStart=/usr/bin/flatpak remote-add --system --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
12 - ExecStart=/usr/bin/flatpak install --system --noninteractive --or-update flathub com.github.flxzt.rnote
13 - ExecStart=/usr/bin/mkdir -p /var/lib/alloy
14 - ExecStart=/usr/bin/touch /var/lib/alloy/flatpak-firstboot.done
15 -
16 - [Install]
17 - WantedBy=multi-user.target