From 1a0cf689a8112d11c0704177aff4416af0c7f23e Mon Sep 17 00:00:00 2001
From: veilor-org <admin@veilor.org>
Date: Sun, 3 May 2026 10:10:46 +0100
Subject: [PATCH] v0.5.13: omit plymouth from dracut + regen initramfs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

v0.5.12 added /dev/null symlinks for plymouth services on real root.
Boot test confirmed plymouth STILL starts: it lives in initramfs
(dracut module 90plymouth) which has its own bundled service files,
unaffected by /etc/systemd/system/ masks on the installed btrfs.

Two-layer fix:
1. /etc/dracut.conf.d/99-veilor-no-plymouth.conf:
   omit_dracutmodules+=" plymouth "
   Then `dracut -f --kver $kver` to regenerate initramfs sans plymouth.
2. Keep /dev/null symlinks for post-pivot real-root masking.

Result: LUKS prompt rendered as text by systemd-tty-ask-password-agent
on tty1 — sendkey-friendly, hardware-realistic.
---
 overlay/usr/local/bin/veilor-installer | 36 ++++++++++++++++++++------
 1 file changed, 28 insertions(+), 8 deletions(-)

diff --git a/overlay/usr/local/bin/veilor-installer b/overlay/usr/local/bin/veilor-installer
index e1b6acc..a9f6ac5 100644
--- a/overlay/usr/local/bin/veilor-installer
+++ b/overlay/usr/local/bin/veilor-installer
@@ -501,14 +501,34 @@ bash $REPO/scripts/selinux/build-policy.sh || echo "[WARN] SELinux build failed;
 # Apply KDE theme + DuckSans + os-release branding
 bash $REPO/scripts/kde-theme-apply.sh
 
-# Mask plymouth services. Plymouth boot splash is unreliable in QEMU
-# (race between plymouth-start and systemd-ask-password-plymouth.path
-# leaves LUKS prompt invisible → boot hangs in dracut-initqueue).
-# `systemctl mask` requires systemd running, which isn't true in
-# anaconda chroot %post — write the /dev/null symlinks directly instead.
-# Targets the path-activated ask-password unit too (the .path is what
-# plymouth-start gets pulled in by). systemd-tty-ask-password-agent
-# handles LUKS prompt as fallback on tty1.
+# Disable plymouth at TWO layers:
+#
+# 1. Initramfs (the boot stage where LUKS unlock happens). Plymouth is
+#    a dracut module; masking units in /etc/systemd/ has zero effect
+#    here because dracut bundles its own copies into initramfs/.
+#    Solution: omit_dracutmodules in dracut.conf.d, then regenerate
+#    initramfs so the new config takes effect.
+#
+# 2. Real root (post-pivot, before SDDM). /dev/null symlinks mask all
+#    plymouth services + the path-activated ask-password unit so they
+#    never start when systemd is up.
+#
+# After both, LUKS prompt falls back to systemd-tty-ask-password-agent
+# on tty1 — text "Please enter passphrase for disk... :" — works in
+# QEMU sendkey AND on real hardware.
+
+# Layer 1: initramfs
+mkdir -p /etc/dracut.conf.d
+cat > /etc/dracut.conf.d/99-veilor-no-plymouth.conf << 'EOF'
+omit_dracutmodules+=" plymouth "
+EOF
+# Regenerate initramfs for the installed kernel(s).
+for kver in /lib/modules/*/; do
+    kver=$(basename "$kver")
+    dracut --force --kver "$kver" 2>/dev/null || true
+done
+
+# Layer 2: real-root masks
 mkdir -p /etc/systemd/system
 for unit in \
     plymouth-start.service \