From 682d53fb35ce5fb6d9e692281848efc9b4756cfe Mon Sep 17 00:00:00 2001
From: Chris Wanstrath <chris@ozmm.org>
Date: Mon, 6 Oct 2025 20:33:54 -0700
Subject: [PATCH] finally... reboot

---
 bin/reboot.ts                |  4 ++--
 scripts/49-nose-reboot.rules |  7 +++++++
 scripts/install.sh           | 31 ++++++++++++++++++++++---------
 scripts/nose-reboot.service  |  7 +++++++
 4 files changed, 38 insertions(+), 11 deletions(-)
 create mode 100644 scripts/49-nose-reboot.rules
 create mode 100644 scripts/nose-reboot.service

diff --git a/bin/reboot.ts b/bin/reboot.ts
index a2b078c..22587b1 100644
--- a/bin/reboot.ts
+++ b/bin/reboot.ts
@@ -3,8 +3,8 @@ export default async function reboot() {
     setTimeout(async () => await Bun.$`/bin/systemctl start nose-reboot.service`, 1000)
 
     return {
-        text: "Rebooting... This will take about 10 seconds.",
-        script: `setTimeout(() => window.location.reload(), 10000)`
+        text: "Rebooting... This will take about 20 seconds.",
+        script: `setTimeout(() => window.location.reload(), 20000)`
     }
 }
 
diff --git a/scripts/49-nose-reboot.rules b/scripts/49-nose-reboot.rules
new file mode 100644
index 0000000..2754872
--- /dev/null
+++ b/scripts/49-nose-reboot.rules
@@ -0,0 +1,7 @@
+polkit.addRule(function(action, subject) {
+  if (action.id == "org.freedesktop.systemd1.manage-units" &&
+      action.lookup("unit") == "nose-reboot.service" &&
+      subject.user == "nose") {
+    return polkit.Result.YES;
+  }
+});
\ No newline at end of file
diff --git a/scripts/install.sh b/scripts/install.sh
index a68c156..83e1223 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -7,9 +7,19 @@ set -euo pipefail
 
 quiet() { "$@" > /dev/null 2>&1; }
 
+SYSTEMD_DIR="/etc/systemd/system"
 SERVICE_NAME="nose-pluto"
 SERVICE_FILE="$(dirname "$0")/${SERVICE_NAME}.service"
-SYSTEMD_PATH="/etc/systemd/system/${SERVICE_NAME}.service"
+SYSTEMD_PATH="${SYSTEMD_DIR}/${SERVICE_NAME}.service"
+
+REBOOT_NAME="nose-reboot"
+REBOOT_FILE="$(dirname "$0")/${REBOOT_NAME}.service"
+REBOOT_PATH="${SYSTEMD_DIR}/${REBOOT_NAME}.service"
+
+POLKIT_NAME="49-nose-reboot"
+POLKIT_FILE="$(dirname "$0")/${POLKIT_NAME}.rules"
+POLKIT_PATH="/etc/polkit-1/rules.d/${POLKIT_NAME}.rules"
+
 BUN_SYMLINK="/usr/local/bin/bun"
 BUN_REAL="$HOME/.bun/bin/bun"
 
@@ -38,24 +48,27 @@ echo ">> Setting CAP_NET_BIND_SERVICE on $BUN_REAL"
 quiet sudo setcap 'cap_net_bind_service=+ep' "$BUN_REAL"
 quiet /usr/sbin/getcap "$BUN_REAL" || true
 
-echo ">> Installing systemd unit to $SYSTEMD_PATH"
-quiet sudo cp "$SERVICE_FILE" "$SYSTEMD_PATH"
-quiet sudo chown root:root "$SYSTEMD_PATH"
-quiet sudo chmod 644 "$SYSTEMD_PATH"
+echo ">> Installing main NOSE Pluto service"
+quiet sudo install -m 644 -o root -g root "$SERVICE_FILE" "$SYSTEMD_PATH"
+
+echo ">> Installing NOSE reboot helper service"
+quiet sudo install -m 644 -o root -g root "$REBOOT_FILE" "$REBOOT_PATH"
+
+echo ">> Installing PolicyKit rule"
+quiet sudo install -m 644 -o root -g root "$POLKIT_FILE" "$POLKIT_PATH"
 
 echo ">> Reloading systemd daemon"
 quiet sudo systemctl daemon-reload
 
+echo ">> Reloading polkit daemon"
+quiet sudo systemctl restart polkit || true
+
 echo ">> Enabling $SERVICE_NAME to start at boot"
 quiet sudo systemctl enable "$SERVICE_NAME"
 
 echo ">> Starting (or restarting) $SERVICE_NAME"
 quiet sudo systemctl restart "$SERVICE_NAME"
 
-echo ">> Giving NOSE reboot access"
-echo "nose ALL=(ALL) NOPASSWD: /sbin/reboot, /usr/sbin/reboot" | sudo tee /etc/sudoers.d/nose-reboot > /dev/null
-quiet sudo chmod 440 /etc/sudoers.d/nose-reboot
-
 echo ">> Enabling kiosk mode"
 quiet mkdir -p ~/.config/labwc
 cat > ~/.config/labwc/autostart <<'EOF'
diff --git a/scripts/nose-reboot.service b/scripts/nose-reboot.service
new file mode 100644
index 0000000..d27358b
--- /dev/null
+++ b/scripts/nose-reboot.service
@@ -0,0 +1,7 @@
+[Unit]
+Description=Reboot triggered by NOSE
+After=multi-user.target
+
+[Service]
+Type=oneshot
+ExecStart=/sbin/reboot
\ No newline at end of file