Give the kiosk a window manager, and a debug mode to go with it

The role ran no window manager on the theory that Firefox is the only X client and
--kiosk makes it full-screen by itself. It doesn't: --kiosk *asks* to be full-screen
over EWMH, and with no WM running nobody answers. Firefox kept its default window
size in the top-left corner - on musicdolphin's 1920x1080 monitor, a 1280x972 window
with black bands down the right edge and along the bottom, which looks exactly like
an overscan problem and isn't one. Openbox answers the request and does nothing else.

pi_kiosk_mode=debug then turns the attached screen into something workable: Firefox
as an ordinary window that is not relaunched when you close it, a visible pointer,
Openbox as the session leader with a root menu offering a terminal, and xterm,
x11-utils and mesa-utils installed. musicdolphin is set to debug for now.

The templates notify the getty handler, so a mode switch restarts the session on its
own - Xorg lives in that unit's cgroup.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

roles/pi_kiosk/tasks/main.yml

@@ -5,10 +5,25 @@
       - xserver-xorg
       - xinit
       - x11-xserver-utils
+      # Without a window manager, Firefox's request to go full-screen (which is all
+      # --kiosk does) has nobody to answer it, and it settles for its default window
+      # size in the corner of the screen. Openbox answers it, and nothing else.
+      - openbox
       - firefox-esr
       - unclutter
     cache_valid_time: 7200
 
+- name: Debugging tools for the attached screen
+  # Only pulled in for pi_kiosk_mode=debug; apt does not take them away again when the
+  # host goes back to kiosk mode, which is fine - they are inert and small.
+  ansible.builtin.apt:
+    name:
+      - xterm       # a terminal that is ours, whatever x-terminal-emulator points at
+      - x11-utils   # xwininfo, xprop: is the window actually the size of the screen?
+      - mesa-utils  # glxinfo, glxgears: is anything accelerated, or is this llvmpipe?
+    cache_valid_time: 7200
+  when: pi_kiosk_mode == 'debug'
+
 - name: Create kiosk user
   ansible.builtin.user:
     name: "{{ pi_kiosk_user }}"
@@ -64,14 +79,16 @@
     owner: "{{ pi_kiosk_user }}"
     group: "{{ pi_kiosk_user }}"
     mode: "0644"
+  notify: Reload systemd and restart getty
 
-- name: Install .xinitrc (launches Firefox kiosk, no window manager)
+- name: Install .xinitrc (starts Openbox, then Firefox)
   ansible.builtin.template:
     src: xinitrc.j2
     dest: "/home/{{ pi_kiosk_user }}/.xinitrc"
     owner: "{{ pi_kiosk_user }}"
     group: "{{ pi_kiosk_user }}"
     mode: "0755"
+  notify: Reload systemd and restart getty
 
 - name: Ensure firefox-esr policy directory exists
   ansible.builtin.file:
@@ -85,3 +102,26 @@
     src: policies.json
     dest: /etc/firefox-esr/policies.json
     mode: "0644"
+
+- name: Ensure the Openbox config directories exist
+  # Both levels explicitly, and owned by the user: a file: task creates missing parents
+  # as root, and a root-owned ~/.config is the same trap that broke the Firefox profile
+  # above.
+  ansible.builtin.file:
+    path: "/home/{{ pi_kiosk_user }}/{{ item }}"
+    state: directory
+    owner: "{{ pi_kiosk_user }}"
+    group: "{{ pi_kiosk_user }}"
+    mode: "0755"
+  loop:
+    - .config
+    - .config/openbox
+
+- name: Install the Openbox root menu
+  ansible.builtin.template:
+    src: openbox-menu.xml.j2
+    dest: "/home/{{ pi_kiosk_user }}/.config/openbox/menu.xml"
+    owner: "{{ pi_kiosk_user }}"
+    group: "{{ pi_kiosk_user }}"
+    mode: "0644"
+  notify: Reload systemd and restart getty