System | Disable TTY1 on headless systems

MichaIng commented 5 years ago

Background

Usually one can always plug display + keyboard to access the local console on TTY1, besides on SBCs without any display port of course.
On RPi there was the CONFIG_HDMI_OUTPUT dietpi.txt entry and dietpi-config > Display Options > Display Resolution > Headless, to have display output completely disabled during boot process via tvservice -o and framebuffer size set to minimum 16x16.
It was still possible to plug a display and had HDMI enabled automatically, but due to low framebuffer size, one character on console took the whole screen. Thus /boot/config.txt was required in case of emergency local console access (besides serial console, of course).
We found a hidden config.txt setting to disable video output and the whole framebuffer completely from early boot on, without the need to run tvservice -o, implemented with DietPi v6.20. To access local console, it is now required to disable those settings, although framebuffer size can be skipped, which will be commented instead, forced to 0 by the video disable setting. So practically no change in required end user effort to enable emergency local console access. Also this matches the method how we enable headless mode on Odroid C1 and C2 via boot.ini.
On x86_64 (grub bootloader) btw display and keyboard can be disabled via GRUB_CMDLINE_LINUX_DEFAULT="... i8042.nokbd video=LVDS-1:d", although not yet tested on real system (VM only so far).

Disable TTY1 on headless systems

Consequently, since local console is anyway practically not reachable on headless mode without manual /boot/* adjustments, it makes sense to completely disable the local login console on TTY1. SSH always uses PTS[0-9], serial consoles have their own TTYS0/AMA0/... naming scheme.
This can be achieved only via systemctl mask getty@tty1.service and of course with masked systemd-logind.
Only downside: Not only /boot (usually FAT file system) needs to be accessed to re-enable local console from external system, but as well the RootFS (ext4 file system), where the mask needs to be removed via rm /etc/systemd/system/getty@tty1.service
One cannot plug a keyboard to login an run a local command blindly. E.g. one time on Buster a Dropbear upgrade broke SSH login on my RPi. I was able to resolve by attaching a keyboard, login and run systemctl restart dropbear blindly. Very rare case and often a real reboot is required or more than one command, if even SSH is not reachable anymore.
This is independent from boot/kernel console btw, just the local login console on TTY1.

Jep so thinkable, not more than a tiny optimization (one backgroud process less), one more manual step required in emergency case, requires testing in combination with other software titles, possibly attempting to access TTY1.

Reference: https://askubuntu.com/a/1017325

Long term tests

[x] Running headless RPi with full Nextcloud without TTY1 and regularly check logs for anything complaining about it...
[x] Running Jessie+Stretch+Buster testing VMs without TTY1 by default and check for errors on general usage/testing and software installs...

MichaIng commented 5 years ago

Actually without local console access, console-setup (including keyboard-configuration etc) as well has no use. Saves another boot service and 15M disk space.

MichaIng commented 5 years ago

Further thoughts:

Disable keyboard and graphical console on x86_64
Disable all boot messages to tty[0-9].
Disable VCHI + framebuffer completely on RPi? Prevents load of a bunch of video modules on boot since kernel 4.19 and removes a bunch kernel errors on boot (that are known to be present and can be safely ignored when having 16M GPU memory share). But vcgencmd does not work anymore. We use this to check some video values in DietPi-Config, but the related menu entries could be simply hidden/skipped in case of headless active.
```
cat << _EOF_ > /tmp/headless.dts
/dts-v1/;
/plugin/;
```

/ { compatible = "brcm,bcm2835";

    fragment@0 {
            target-path = "/soc/mailbox@7e00b840";
            __overlay__ {
                    status = "disabled";
            };
    };

    fragment@1 {
            target-path = "/soc/fb";
            __overlay__ {
                    status = "disabled";
            };
    };

}; EOF dtc -@ -I dts -O dtb -o /tmp/headless.dtbo /tmp/headless.dts mv /tmp/headless.dtbo /boot/overlays G_CONFIG_INJECT 'dtoverlay=headless' 'dtoverlay=headless' /DietPi/config.txt dtoverlay headless


- Allow to re-enable video + keyboard + tty1 via flag file `/boot/disable_headless`. This will be checked on preboot, if present fully enables all feature required to access local console, then does a reboot (since required for e.g. RPi to enable video).

MichaIng commented 3 years ago

Also the console-setup package wouldn't be required anymore then.

MichaIng commented 1 year ago

SBCs without video capabilities are btw shipped with getty@tty1.service disabled with recent images: https://github.com/MichaIng/DietPi/commit/fb2168c

MichaIng / DietPi