# Shepherd Launcher - Kiosk Mode Sway Configuration
# This config makes Sway act as a kiosk environment with a custom launcher

# Set up GNOME Keyring for secrets management if available
exec_always sh -lc 'command -v gnome-keyring-daemon >/dev/null && gnome-keyring-daemon --start --components=secrets >/dev/null 2>&1 || true'

# Update environment variables for D-Bus and GNOME Keyring
exec_always dbus-update-activation-environment --systemd \
    SSH_AUTH_SOCK GNOME_KEYRING_CONTROL WAYLAND_DISPLAY XDG_CURRENT_DESKTOP XDG_SESSION_TYPE XDG_SESSION_DESKTOP XDG_RUNTIME_DIR

### Variables
set $launcher ./target/debug/shepherd-launcher
set $hud ./target/debug/shepherd-hud
set $stop_current $launcher --stop-current

### Output configuration
# Set up displays (adjust as needed for your hardware)
output * bg #000000 solid_color

# Hide ALL window borders and focus indicators by making them transparent/black
# Note: The 5th value is the "child_border" which is the actual visible border
# Text color (3rd value) is also black to make title/tab text invisible (black on black)
client.focused          #000000 #000000 #000000 #000000 #000000
client.focused_inactive #000000 #000000 #000000 #000000 #000000
client.unfocused        #000000 #000000 #000000 #000000 #000000
client.urgent           #000000 #000000 #000000 #000000 #000000
client.placeholder      #000000 #000000 #000000 #000000 #000000
client.background       #000000

# Completely hide focus indicator by hiding the mark
hide_edge_borders --i3 both

### Idle configuration
# Prevent screen from turning off (adjust timeout as needed)
exec swayidle -w \
    timeout 600 'swaymsg "output * dpms off"' \
    resume 'swaymsg "output * dpms on"'

### Input configuration
# Disable touchpad/mouse acceleration if needed
input type:pointer {
    accel_profile flat
}

### Key bindings - HEAVILY RESTRICTED for kiosk mode

# Disable ALL default Sway keybindings by not setting a modifier
# This prevents users from opening terminals, switching workspaces, etc.

# Disable TTY switching (Ctrl+Alt+F1-F12)
# This is handled by disabling VT switching at the kernel/systemd level
# Add this to kernel parameters: vt.handoff=0
# Or in /etc/systemd/logind.conf: NAutoVTs=0 and ReserveVT=0

# Exit keybinding - works for both nested sway (dev) and production logout
# Kill shepherdd first to ensure clean shutdown, then exit sway
# In dev: exits the nested sway instance
# In production: logs out of the session (REMOVE or change to something harder to press)
bindsym Mod4+Shift+Escape exec pkill -TERM shepherdd && swaymsg exit

### Window rules for kiosk behavior

# Shepherd HUD should always be visible on top (likely uses layer-shell protocol)
# Layer shell surfaces are automatically handled by sway and don't need window rules

# Make launcher windows fullscreen (launcher doesn't need to respect HUD)
for_window [app_id="shepherd-launcher"] fullscreen enable

# Prevent apps from requesting fullscreen (except launcher)
# This catches apps that try to go fullscreen and forces them to respect the HUD
for_window [app_id="^(?!shepherd-launcher$).*"] fullscreen disable
for_window [class=".*"] fullscreen disable

# Make other windows maximize to fill available space (respecting HUD exclusive zone)
# We use inhibit_idle and border none to make them behave like fullscreen visually
# but they will respect layer-shell exclusive zones
for_window [class=".*"] border none, title_format ""
for_window [app_id=".*"] border none, title_format ""

# Minecraft Launcher (Electron app) and Minecraft Java Edition (game)
# Launcher: class="Minecraft Launcher" instance="minecraft-launcher"
# Game: class="Minecraft 1.21.11" instance="Minecraft 1.21.11" (version varies)
# We add "focus" to ensure the window gets focus when it appears
for_window [class="^Minecraft [0-9]"] border none, focus
for_window [instance="^Minecraft [0-9]"] border none, focus
for_window [class="^Minecraft Launcher$"] border none
for_window [instance="^minecraft-launcher$"] border none

# Steam: Hide Steam client windows that appear before the actual game launches
# Steam shows various windows (client, dialogs, updates) before launching games
# We make these completely transparent and floating off-screen so they don't interfere
# Steam client main window and various dialogs
for_window [class="^Steam$"] floating enable, opacity 0, move position -9999 -9999
for_window [instance="^Steam$"] floating enable, opacity 0, move position -9999 -9999
# Steam-related helper windows and dialogs (case-insensitive matching)
for_window [class="^steam$"] floating enable, opacity 0, move position -9999 -9999
for_window [instance="^steam$"] floating enable, opacity 0, move position -9999 -9999
# Steam Big Picture mode overlay and notifications
for_window [title="^Steam$"] floating enable, opacity 0, move position -9999 -9999
# Steam sign-in window
for_window [title="^Sign in to Steam$"] floating enable, opacity 0, move position -9999 -9999
# Steam game update/install progress windows
for_window [title="^Steam - News"] floating enable, opacity 0, move position -9999 -9999

# Disable window decorations (no title bars) - for all windows
default_border none
default_floating_border none

# Force pixel border of 0 explicitly
default_border pixel 0
default_floating_border pixel 0

# Force no border on XWayland windows
for_window [shell="xwayland"] border none, border pixel 0

# Tell clients not to draw their own decorations (for apps that respect this)
# Note: Many Electron apps ignore this
titlebar_border_thickness 0
titlebar_padding 0 0

# Disable gaps
gaps inner 0
gaps outer 0

# Use stacking layout - windows stack on top of each other (focused one visible)
# This avoids tiling side-by-side while also avoiding tabbed's window switcher
workspace_layout stacking
focus_follows_mouse no

# Hide any title/tab text by using minimal font size
font pango:monospace 1

# Session stop keybindings via shepherdd API (does not close windows directly)
# Handled in sway so they work regardless of which client currently has focus.
bindsym --locked Alt+F4 exec $stop_current
bindsym --locked Ctrl+w exec $stop_current
bindsym --locked Home exec $stop_current

# Hide mouse cursor after inactivity
seat * hide_cursor 5000

### Workspace configuration

# Use only one workspace for true kiosk mode
workspace 1 output *

### Application startup

# Start shepherdd FIRST - it needs to create the socket before HUD/launcher connect
# Running inside sway ensures all spawned processes use the nested compositor
# Shepherdd handles SIGHUP for graceful shutdown when sway exits
# If shepherdd fails to start (e.g., config error), exit sway to prevent a broken state
exec sh -c './target/debug/shepherdd -c ./config.example.toml || swaymsg exit'

# Give shepherdd a moment to initialize, then start UI components
# Start the shepherd-hud (time remaining overlay)
exec sleep 1 && $hud

# Start the shepherd-launcher on startup (the main "home" screen)
# Small delay to ensure shepherdd is ready
exec_always sleep 1 && $launcher

### Disable workspace switching
# No keybindings defined = no switching possible

### Status bar - DISABLED for kiosk mode
# bar {
#     position top
# }

### Additional security measures

# Disable Xwayland if not needed (prevents X11 escape hatches)
# xwayland disable

# Prevent floating windows from staying floating - make them tiled
# This ensures they respect the HUD's exclusive zone
for_window [floating] floating disable

# Lock down IPC for security (prevents external control)
# ipc {
#     socket disable
# }

### Focused window indicator
# Since there's no title bar, no visual indication needed
focus_on_window_activation focus

### Mouse bindings - DISABLED
# No mouse bindings defined to prevent window manipulation

### Notes for production deployment:
# 1. Remove the emergency exit keybinding (Super+Shift+Escape)
# 2. Add kernel parameter: vt.handoff=0
# 3. Configure auto-login to this Sway session
# 4. Set up systemd to restart Sway if it crashes
# 5. Consider using a systemd user service for the launcher
# 6. Lock down sudo/root access
# 7. Disable virtual console switching in /etc/systemd/logind.conf:
#    NAutoVTs=0
#    ReserveVT=0
# 8. Consider running as a dedicated user account with limited permissions
