From df8c984bb884e370dd6d08dcfeee24b94ef23c5f Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Sat, 4 Apr 2026 17:47:08 +0200
Subject: [PATCH] fix(boot): TUI mode now properly overrides kiosk

- cmdline-handler: Use systemctl mask to prevent kiosk startup
- cmdline-handler: Kill X11/Chromium if already running
- cmdline-handler: Create generator drop-in for correct target
- kiosk.service: Wait for cmdline handler before starting
- tui.service: Wait for cmdline handler before starting

Fixes: TUI boot menu option was loading Kiosk GUI instead

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 image/sbin/secubox-cmdline-handler        | 22 ++++++++++++++++++----
 image/systemd/secubox-console-tui.service |  5 +++++
 image/systemd/secubox-kiosk.service       |  4 ++++
 3 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/image/sbin/secubox-cmdline-handler b/image/sbin/secubox-cmdline-handler
index 8ee6e04b..e245f2bb 100755
--- a/image/sbin/secubox-cmdline-handler
+++ b/image/sbin/secubox-cmdline-handler
@@ -68,15 +68,29 @@ apply_settings() {
             rm -f "${MARKER_DIR}/.kiosk-enabled"
             touch "${MARKER_DIR}/.tui-enabled"
 
-            # Disable kiosk, enable TUI
-            systemctl disable secubox-kiosk.service 2>/dev/null || true
+            # Mask kiosk service to prevent any startup
+            systemctl mask secubox-kiosk.service 2>/dev/null || true
             systemctl stop secubox-kiosk.service 2>/dev/null || true
+
+            # Kill any X11/Chromium if already started
+            pkill -9 Xorg 2>/dev/null || true
+            pkill -9 chromium 2>/dev/null || true
+
+            # Enable TUI service
+            systemctl unmask secubox-console-tui.service 2>/dev/null || true
             systemctl enable secubox-console-tui.service 2>/dev/null || true
 
-            # Set multi-user target (no graphical)
+            # Set multi-user target for current AND future boots
             systemctl set-default multi-user.target 2>/dev/null || true
 
-            # Start TUI service (will run on tty1)
+            # Write to generator drop-in to ensure correct target on this boot
+            mkdir -p /run/systemd/generator
+            echo "[Unit]" > /run/systemd/generator/default.target
+            echo "Requires=multi-user.target" >> /run/systemd/generator/default.target
+
+            systemctl daemon-reload 2>/dev/null || true
+
+            # Start TUI service
             log "Starting console TUI service..."
             systemctl start secubox-console-tui.service 2>/dev/null &
             ;;
diff --git a/image/systemd/secubox-console-tui.service b/image/systemd/secubox-console-tui.service
index a4cedbdb..52dcbcbb 100644
--- a/image/systemd/secubox-console-tui.service
+++ b/image/systemd/secubox-console-tui.service
@@ -1,6 +1,11 @@
 [Unit]
 Description=SecuBox Console TUI Dashboard
 Documentation=https://secubox.in/docs/tui
+
+# Wait for cmdline handler to decide display mode FIRST
+After=secubox-cmdline.service
+Requires=secubox-cmdline.service
+
 After=multi-user.target
 After=network-online.target
 After=secubox-firstboot.service
diff --git a/image/systemd/secubox-kiosk.service b/image/systemd/secubox-kiosk.service
index 02d781e4..6d823f90 100644
--- a/image/systemd/secubox-kiosk.service
+++ b/image/systemd/secubox-kiosk.service
@@ -2,6 +2,10 @@
 Description=SecuBox Kiosk Mode (X11/Chromium)
 Documentation=https://secubox.in/docs/kiosk
 
+# Wait for cmdline handler to decide display mode FIRST
+After=secubox-cmdline.service
+Requires=secubox-cmdline.service
+
 # Proper dependency chain - wait for everything to be ready
 After=systemd-user-sessions.service
 After=plymouth-quit-wait.service