Installing from the console image

The image is a full Fedora bootc install: flash it, answer nothing — it installs onto the first disk it finds and erases it — and the console is running when it reboots. This is the recommended path — see Packages for the alternative of installing onto a Fedora you already have.

Status (2026-09-08). The console variant boots, answers /health and /api/plugins, issues and anchors its own certificate, updates and rolls back between two image tags, and converges under the Ansible playbook — all measured on a real qcow2/VM built against a LOCAL dnf tree (the published repo still answers 404; see docs/design/notes/2026-09-08-image-proofs-lane.md for full traces and five real defects found and fixed along the way). Not yet measured: the ISO's unattended install completing end to end (it was mid-install when the build host itself rebooted), and the desk variant's kiosk screen (built, not re-verified after the fixes below). The ISO built in this run is 2.3 GB; first-boot timing is not yet measured.

Two variants

Every release publishes two images from the one build:

Both are the same product at the same version; desk only adds a screen. A surface that should show a different console's desk (not this box's own server) is not part of either variant — point a browser or a kiosk unit at that console's address instead, and see Trusting the console's certificate first.

1. Download the ISO

Each release publishes openmixer-console-fc44-<version>-x86_64.iso and openmixer-desk-fc44-<version>-x86_64.iso as GitHub Release assets. The version in the filename is the tag — and the tag is one dnf repo snapshot, so /health.version on a running console will read that same string back once it is up (see Upgrading).

2. Write it to a USB stick

dd it, or use Fedora Media Writer / Balena Etcher if you would rather not type a device path by hand:

sudo dd if=openmixer-desk-fc44-<version>-x86_64.iso of=/dev/sdX bs=8M status=progress

Double-check /dev/sdX — dd overwrites the device you name with no confirmation and no undo. lsblk before you type the command, not after.

3. Boot it

Boot the stick from your firmware's boot menu (F12, F11 or Esc on most machines). Whether the stick boots with Secure Boot on has not been verified yet — the ISO built and its unattended GRUB selection was proven headless in a VM (no Secure Boot in that path), but the disk write itself was interrupted by a host reboot before an install completed. If the firmware refuses it, turn Secure Boot off for the install and tell us.

4. Nothing to answer

The install is unattended (packaging/image/kickstart/console.toml, embedded in the ISO). It answers the three questions Anaconda would otherwise ask:

• Disk — the whole first disk, always. There is no disk picker; a box with more than one drive should have any drive it does not want wiped disconnected before this step.
• User — openmixer, password openmixer, in the wheel group (so sudo works, and asks for that same password). This is a documented default and every console flashed from one image starts with it: see §5a for changing it, and for the switch that makes the box ask for its own instead.
• Timezone — whatever the image itself carries (UTC, Fedora's own default). Nothing in the installer sets this; it is a property of the image, not a question asked at install time.

None of the three configures the desk — the web UI, the audio graph and every per-console fact in §6 below arrive after the box reboots, never through the installer.

5. Reboot; what happens without you

On first boot, openmixer-firstboot.service runs once: it issues this machine's own TLS certificate authority and leaf (never the same key two consoles would ever share), anchors that root into the system trust store, enables the HTTPS block, resolves and labels the web port, and arms the engine's --user unit under loginctl enable-linger so it runs with nobody logged in. Only once that unit has succeeded does gdm.service start (desk variant only) — the ordering is deliberate: a kiosk that opened before the certificate existed would show a certificate warning on a screen with no keyboard to dismiss it.

• console — the box is now a headless server. Nothing shows on an attached monitor; reach it from another machine's browser (see step 7).
• desk — the box logs in as openmixer and opens https://localhost:8443/ full-screen. That is the console's own web UI, not a separate viewer — see the next section.

Nothing is asked, and nothing waits. A console is switched on before a show, often with no keyboard attached: the boot has no question in it, and the mixer is what appears. If the first-boot unit ever FAILS, the desk does not open — the machine stays on its text console with that unit's error printed on it, which is the screen you want when something is wrong, rather than a browser showing a connection error that looks like a network fault.

5a. The password

The image ships one, documented, the same on every box flashed from it:

Change it on any box that is reachable by people who should not have it. From another machine:

ssh openmixer@<the console's address>        # password: openmixer
passwd                                       # asks for the old one, then the new one twice

or at the console itself: Ctrl+Alt+F3 for a text login, passwd, then Ctrl+Alt+F1 back to the mixer. Nothing on the console reads this password again — it is an ordinary account password, and the desk keeps running while you change it.

Or have each box ask for its own, at its first boot. One switch, /etc/openmixer/firstboot.conf:

ask-console-password = yes

With that set BEFORE a box's first boot, the console stops on a full-screen prompt and asks for a password for openmixer, twice, before the mixer opens; an empty answer or two that do not match are refused and it asks again. It waits as long as it takes — nobody can answer it remotely, so this is for boxes someone will be standing at the first time they are switched on. It asks once per first boot: a machine that completes its first boot is never asked again, and one whose first boot FAILS partway (no network for the certificate step, say) asks again the next time it is switched on, together with everything else that first boot does.

To turn it on for a box that has already booted, clear the first-boot stamp as well:

sudo sed -i 's/^ask-console-password.*/ask-console-password = yes/' /etc/openmixer/firstboot.conf
sudo rm /var/lib/openmixer/.firstboot-done
sudo systemctl reboot

Two things to know before you enable it:

• Nothing checks how good the password is. There is no minimum length and no complexity rule — whatever is typed is accepted. Twelve characters or a short passphrase is a sensible house rule; the console will not enforce one for you.
• There is no way back in if it is forgotten. Root is locked and no other account exists, so a console whose password nobody remembers is re-flashed from the ISO (which erases the disk; the session and takes on it go with it). With the documented default left in place this cannot happen, which is part of why it is the default.

6. Plug the boxes in

REAC stageboxes and the RME clock master are hardware this image cannot know about at build time — see the hardware guide for cabling, then the Ansible section below for how their NIC names and clock role reach the console.

7. Per-console facts: Ansible

The image is identical on every console it is flashed onto. What makes this box this room's desk — its console size, which NICs carry which REAC segment, which device is the clock master, a private repo mirror if this room has one, and a TLS re-issue after a rename — is carried by ansible/playbooks/configure-console.yml against the consoles inventory group, not baked into the image. Trusting the console from an operator's laptop is the separate trust page walk, not an Ansible role — pushing a CA onto a fleet of laptops the console does not own would be a second door onto the same trust store.

8. Open the desk

• On a desk console's own screen: it is already open.
• From anywhere else, on either variant: https://<box-address>:8443/. Find the box's LAN address the way your network already tells you (DHCP lease list or mDNS); the desk does not display it yet.
• Every other device visits http://<box-address>:8880/trust/ first — the certificate this machine minted for itself in step 5 is trusted by nothing else yet. See Trusting the console's certificate; it is not optional.

Until the project opens

The image and the packages live on private registries for now, and pulling them needs a credential from the project. Those steps are internal and change when the project opens; ask for them rather than reading them here.

9. Updating and going back

bootc-fetch-apply-updates.timer (enabled in the image, no updater of our own) pulls the tag the machine was flashed from. It is bootc's own unit and runs bootc update --apply, which reboots the machine when a new image was staged — so leave the timer disabled during a show and update between shows, or run bootc update by hand and reboot when it suits you. This has not yet been observed on an installed console. To go back:

bootc rollback
systemctl reboot

The previous deployment is still on disk — rollback does not re-download anything. Proven both directions on a real VM (2026-09-08): bootc switch to a second tag moves /health.version forward after a reboot, and bootc rollback + reboot moves it back, with zero failed units either time. See Upgrading for what does and does not restart.

The RPM path still exists

Everything above is one way to get the same bits Packages installs with dnf on a Fedora you already run. One signed repository feeds both; a dnf user and an image user are running the same openmixer.