fix: nginx startup, kiosk fullscreen, reboot errors, kiosk toggle

- Remove hardcoded Tailscale IP from nginx listen (broke fresh install)
- Generate SSL cert in installer if rootfs missed it (safety net)
- Kiosk: add --start-fullscreen --start-maximized --window-size flags
- Kiosk: remove --disable-gpu (can prevent fullscreen rendering)
- Kiosk: add toggle command and Ctrl+Alt+F1/F7 docs in MOTD
- Reboot: suppress stderr during cleanup to hide flashing errors

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -1480,14 +1480,13 @@ if [ -t 0 ] && [ -z "$ARCHIPELAGO_WELCOMED" ]; then
     if [ -b /dev/mapper/archipelago-data ]; then
         echo "  🔒 Storage: LUKS2 encrypted"
     fi
-    echo "  📺 Display Mode:"
+    echo "  📺 Display:"
     if systemctl is-active archipelago-kiosk.service >/dev/null 2>&1; then
-        echo "     Kiosk ACTIVE — fullscreen web UI on display"
+        echo "     Kiosk ACTIVE — Ctrl+Alt+F1 for terminal"
     else
-        echo "     Console login (MOTD)"
+        echo "     Console — Ctrl+Alt+F7 for kiosk"
     fi
-    echo "     Toggle:  sudo archipelago-kiosk enable   — kiosk on display"
-    echo "              sudo archipelago-kiosk disable  — back to console"
+    echo "     Commands:  sudo archipelago-kiosk enable|disable|toggle"
     echo ""
 fi
 PROFILE
@@ -1611,8 +1610,15 @@ xset s noblank 2>/dev/null
 unclutter -idle 3 -root &
 
 while true; do
+    # Get screen resolution for window sizing
+    SCREEN_RES=$(xdpyinfo 2>/dev/null | awk '/dimensions:/{print $2}')
+    SCREEN_RES=${SCREEN_RES:-1920x1080}
     sudo -u archipelago env DISPLAY=:0 HOME=/home/archipelago chromium \
         --kiosk \
+        --start-fullscreen \
+        --start-maximized \
+        --window-position=0,0 \
+        --window-size=${SCREEN_RES/x/,} \
         --app=http://localhost/kiosk \
         --noerrdialogs \
         --disable-infobars \
@@ -1624,7 +1630,6 @@ while true; do
         --disable-save-password-bubble \
         --disable-suggestions-service \
         --disable-component-update \
-        --disable-gpu \
         --user-data-dir=/home/archipelago/.config/chromium-kiosk
     sleep 3
 done
@@ -1682,11 +1687,25 @@ case "${1:-status}" in
             echo "Kiosk mode: DISABLED (console login on tty1)"
         fi
         ;;
+    toggle)
+        if systemctl is-active archipelago-kiosk.service >/dev/null 2>&1; then
+            systemctl stop archipelago-kiosk.service 2>/dev/null || true
+            systemctl restart getty@tty1.service 2>/dev/null || true
+            chvt 1 2>/dev/null || true
+        else
+            systemctl start archipelago-kiosk.service 2>/dev/null || true
+        fi
+        ;;
     *)
-        echo "Usage: archipelago-kiosk [enable|disable|status]"
+        echo "Usage: archipelago-kiosk [enable|disable|status|toggle]"
         echo "  enable  — Start kiosk (fullscreen web UI on display)"
         echo "  disable — Stop kiosk, restore console login"
+        echo "  toggle  — Switch between kiosk and terminal"
         echo "  status  — Show current mode"
+        echo ""
+        echo "Keyboard shortcuts (from terminal):"
+        echo "  Ctrl+Alt+F7  — Switch to kiosk display"
+        echo "  Ctrl+Alt+F1  — Switch to terminal"
         exit 1
         ;;
 esac
@@ -1809,6 +1828,17 @@ if [ -f /cdrom/99-mesh-radio.rules ]; then
   echo "   Installed mesh radio udev rule"
 fi
 
+# Ensure SSL cert exists for nginx HTTPS (safety net if rootfs build missed it)
+if [ ! -f /mnt/target/etc/archipelago/ssl/archipelago.crt ]; then
+    mkdir -p /mnt/target/etc/archipelago/ssl
+    chroot /mnt/target openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+        -keyout /etc/archipelago/ssl/archipelago.key \
+        -out /etc/archipelago/ssl/archipelago.crt \
+        -subj "/C=XX/ST=Bitcoin/L=Node/O=Archipelago/CN=archipelago" 2>/dev/null
+    chmod 600 /mnt/target/etc/archipelago/ssl/archipelago.key
+    echo "   Generated self-signed SSL certificate"
+fi
+
 # Enable services
 chroot /mnt/target systemctl enable archipelago.service 2>/dev/null || true
 chroot /mnt/target systemctl enable nginx.service 2>/dev/null || true
@@ -1884,13 +1914,14 @@ echo -e "${YELLOW}  >>> REMOVE THE USB DRIVE NOW <<<${NC}"
 echo ""
 read -p "Press Enter to reboot (make sure USB is removed)..."
 
+# Suppress all error output during cleanup and reboot
+exec 2>/dev/null
+
 # Try to eject the USB boot media to prevent booting back into installer
 BOOT_DEV=$(findmnt -n -o SOURCE /run/live/medium 2>/dev/null || findmnt -n -o SOURCE /lib/live/mount/medium 2>/dev/null || echo "")
 if [ -n "$BOOT_DEV" ]; then
-    # Get the parent disk device (e.g., /dev/sdb1 -> /dev/sdb)
     BOOT_DISK=$(lsblk -no PKNAME "$BOOT_DEV" 2>/dev/null | head -1)
     if [ -n "$BOOT_DISK" ]; then
-        echo "   Ejecting USB (/dev/$BOOT_DISK)..."
         umount -l /run/live/medium 2>/dev/null || true
         umount -l /lib/live/mount/medium 2>/dev/null || true
         eject "/dev/$BOOT_DISK" 2>/dev/null || true

image-recipe/configs/nginx-archipelago.conf

@@ -5,7 +5,6 @@ limit_req_zone $binary_remote_addr zone=peer:10m rate=10r/s;
 
 server {
     listen 80;
-    listen 100.91.10.103:80;
     server_name _;
 
     root /opt/archipelago/web-ui;