feat(firmware): add target-safe updates

Store firmware releases in the default tenant and filter kiosk pins and rollouts by detected firmware target or OS compatibility.

Author: mrinc

.github/workflows/build.yml

@@ -145,9 +145,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - target: aarch64-unknown-linux-gnu
+          - rust_target: aarch64-unknown-linux-gnu
+            firmware_target: betterframe-rpi5-aarch64
+            label: Raspberry Pi 5
             runs-on: blacksmith-8vcpu-ubuntu-2404-arm
-          - target: x86_64-unknown-linux-gnu
+          - rust_target: x86_64-unknown-linux-gnu
+            firmware_target: betterframe-pc-x86_64
+            label: PC x86_64
             runs-on: blacksmith-8vcpu-ubuntu-2404
     runs-on: ${{ matrix.runs-on }}
     # Trixie container matches Pi OS Trixie's glibc + apt packages.
@@ -174,29 +178,30 @@ jobs:
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
-          targets: ${{ matrix.target }}
+          targets: ${{ matrix.rust_target }}
 
       - name: cargo build --release
         working-directory: kiosk
         env:
-          BF_BUILD_ARCH: ${{ matrix.target }}
+          BF_BUILD_ARCH: ${{ matrix.rust_target }}
+          BF_FIRMWARE_TARGET: ${{ matrix.firmware_target }}
           BF_BUILD_VERSION: ${{ inputs.version }}
           BF_AXIOM_KEY: ${{ secrets.BF_AXIOM_KEY }}
           BF_AXIOM_DATASET: ${{ secrets.BF_AXIOM_DATASET }}
-        run: cargo build --release --target ${{ matrix.target }}
+        run: cargo build --release --target ${{ matrix.rust_target }}
 
       - name: Strip + rename
         working-directory: kiosk
         run: |
-          strip target/${{ matrix.target }}/release/betterframe-kiosk
-          cp target/${{ matrix.target }}/release/betterframe-kiosk \
-             betterframe-kiosk-${{ inputs.version }}-${{ matrix.target }}
+          strip target/${{ matrix.rust_target }}/release/betterframe-kiosk
+          cp target/${{ matrix.rust_target }}/release/betterframe-kiosk \
+             betterframe-kiosk-${{ inputs.version }}-${{ matrix.firmware_target }}
 
       - name: Upload to GitHub Release (binary)
         uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ inputs.tag }}
-          files: kiosk/betterframe-kiosk-${{ inputs.version }}-${{ matrix.target }}
+          files: kiosk/betterframe-kiosk-${{ inputs.version }}-${{ matrix.firmware_target }}
 
       - name: Auto-import into BF server
         if: env.BF_AUTOIMPORT_URL != '' && env.BF_AUTOIMPORT_API_KEY != ''
@@ -205,15 +210,15 @@ jobs:
           BF_AUTOIMPORT_API_KEY: ${{ secrets.BF_AUTOIMPORT_API_KEY }}
         working-directory: kiosk
         run: |
-          bin="betterframe-kiosk-${{ inputs.version }}-${{ matrix.target }}"
+          bin="betterframe-kiosk-${{ inputs.version }}-${{ matrix.firmware_target }}"
           base64 -w 0 "$bin" > "${bin}.b64"
           jq -nc \
             --arg v "${{ inputs.version }}" \
             --arg c "${{ inputs.channel }}" \
-            --arg a "${{ matrix.target }}" \
-            --arg n "GitHub Actions build of ${{ inputs.tag }} (${{ github.sha }})" \
+            --arg t "${{ matrix.firmware_target }}" \
+            --arg n "GitHub Actions ${{ matrix.label }} build of ${{ inputs.tag }} (${{ github.sha }})" \
             --rawfile b "${bin}.b64" \
-            '{version:$v, channel:$c, arch:$a, release_notes:$n, content_b64:$b}' \
+            '{version:$v, channel:$c, target:$t, release_notes:$n, content_b64:$b}' \
             > "${bin}.import.json"
           for attempt in 1 2 3; do
             if curl -sSf --retry 2 --retry-delay 5 -X POST \
@@ -230,8 +235,8 @@ jobs:
       - name: Upload artifact (always)
         uses: actions/upload-artifact@v7
         with:
-          name: betterframe-kiosk-${{ matrix.target }}
-          path: kiosk/betterframe-kiosk-${{ inputs.version }}-${{ matrix.target }}
+          name: betterframe-kiosk-${{ matrix.firmware_target }}
+          path: kiosk/betterframe-kiosk-${{ inputs.version }}-${{ matrix.firmware_target }}
           retention-days: 14
 
   # ---- Flashable Pi OS Trixie image (aarch64 only) -------------------------
@@ -258,14 +263,14 @@ jobs:
       - name: Pull kiosk aarch64 binary from this run's artifact
         uses: actions/download-artifact@v8
         with:
-          name: betterframe-kiosk-aarch64-unknown-linux-gnu
+          name: betterframe-kiosk-betterframe-rpi5-aarch64
           path: staging/
 
       - name: Render BF logo for plymouth
         run: |
           sudo apt-get -y update
           sudo apt-get -y install --no-install-recommends librsvg2-bin
-          mv staging/betterframe-kiosk-${{ inputs.version }}-aarch64-unknown-linux-gnu \
+          mv staging/betterframe-kiosk-${{ inputs.version }}-betterframe-rpi5-aarch64 \
              staging/betterframe-kiosk
           chmod +x staging/betterframe-kiosk
           rsvg-convert -w 480 server/src/web-static/betterframe-logo.svg -o staging/logo.png

kiosk/src/firmware.rs

@@ -37,6 +37,16 @@ pub const ARCH: &str = match option_env!("BF_BUILD_ARCH") {
     None => "aarch64-unknown-linux-gnu",
 };
 
+pub const FIRMWARE_TARGET: &str = match option_env!("BF_FIRMWARE_TARGET") {
+    Some(s) => s,
+    None => match option_env!("BF_BUILD_ARCH") {
+        Some("aarch64-unknown-linux-gnu") => "betterframe-rpi5-aarch64",
+        Some("x86_64-unknown-linux-gnu") => "betterframe-pc-x86_64",
+        Some(s) => s,
+        None => "betterframe-rpi5-aarch64",
+    },
+};
+
 const DEFAULT_BIN_PATH: &str = "/opt/betterframe/kiosk/betterframe-kiosk";
 const FIRMWARE_MARKER: &str = "/var/lib/betterframe/kiosk/firmware-applying.json";
 const FIRMWARE_ATTEMPTS: &str = "/var/lib/betterframe/kiosk/firmware-applying.attempts";
@@ -92,7 +102,8 @@ pub struct UpdateInfo {
 /// channel. Used before pairing to self-update to latest binary.
 pub fn check_public(server: &str, current_version: &str) -> Option<UpdateInfo> {
     let url = format!(
-        "{server}/api/firmware/public/check?arch={arch}&current={cur}",
+        "{server}/api/firmware/public/check?target={target}&arch={arch}&current={cur}",
+        target = FIRMWARE_TARGET,
         arch = ARCH,
         cur = current_version,
     );
@@ -165,7 +176,8 @@ pub fn check(server: &str, key: &str, current_version: &str) -> Option<UpdateInf
     // current_version is semver-shaped (already URL-safe). Empty string is
     // fine — server treats it as "unknown" and offers any release.
     let url = format!(
-        "{server}/api/kiosk/firmware/check?arch={arch}&current={cur}",
+        "{server}/api/kiosk/firmware/check?target={target}&arch={arch}&current={cur}",
+        target = FIRMWARE_TARGET,
         arch = ARCH,
         cur = current_version,
     );

kiosk/src/os_update.rs

@@ -41,6 +41,8 @@ use tracing::{info, warn};
 pub const DEFAULT_COMPATIBILITY: &str = "betterframe-rpi5-aarch64";
 static CANCEL_REQUESTED: AtomicBool = AtomicBool::new(false);
 
+pub fn compatibility_public() -> String { compatibility() }
+
 fn compatibility() -> String {
     if let Ok(s) = fs::read_to_string("/etc/betterframe/os-compatibility") {
         let trimmed = s.trim();

kiosk/src/server.rs

@@ -372,6 +372,7 @@ pub fn initiate_pairing(server: &str) -> (String, String) {
         .json(&serde_json::json!({
             "proposed_name": hostname,
             "hardware_model": hw_model,
+            "firmware_target": crate::firmware::FIRMWARE_TARGET,
             "capabilities": ["rtsp", "gstreamer", "gtk4"]
         }))
         .send()
@@ -667,7 +668,9 @@ pub fn heartbeat(
     let mut payload = serde_json::json!({
         "bundle_version": bundle_version,
         "kiosk_app_version": kiosk_app_version(),
+        "firmware_target": crate::firmware::FIRMWARE_TARGET,
         "os_version": crate::os_update::current_os_version_public(),
+        "os_update_compatibility": crate::os_update::compatibility_public(),
         "displays": display_info,
         "cpu_temp_c": hw.cpu_temp_c,
         "cpu_load_percent": hw.cpu_load_percent,

server/src/plugins/service-admin-http/routes-admin.ts

@@ -60,6 +60,7 @@ import {
   normalizeUpdateSchedule,
   type UpdateSchedule,
 } from "../../shared/update-schedule.js";
+import { currentTenantSchema, withDefaultTenant } from "../../shared/default-tenant.js";
 
 interface DiscoverAddStream {
   profile_name: string;
@@ -2156,8 +2157,10 @@ export function registerAdminRoutes(app: H3, deps: AdminDeps): void {
       });
     }
     const gpioBindings = await deps.repo.listGpioBindings(id);
-    const firmwareReleases = await deps.repo.listFirmwareReleases();
-    const osReleases = await deps.repo.listOsUpdateReleases();
+    const [firmwareReleases, osReleases] = await withDefaultTenant(deps.repo, currentTenantSchema(event), async () => Promise.all([
+      deps.repo.listFirmwareReleases(),
+      deps.repo.listOsUpdateReleases(),
+    ]));
     const logResult = await deps.repo.queryKioskLogs({ kiosk_id: id, limit: 50 });
     return htmlPage(KioskEditPage({
       user: user.username,
@@ -2766,7 +2769,12 @@ export function registerAdminRoutes(app: H3, deps: AdminDeps): void {
     const html = `<form method="post" action="/admin/tenants/switch" style="padding:0.5rem 1rem">
       <label style="font-size:0.75rem; color:#888; display:block; margin-bottom:0.25rem">Tenant</label>
       <select name="tenant_slug" style="width:100%; font-size:0.8rem; padding:0.25rem" onchange="this.form.submit()">${options}</select>
-    </form>`;
+    </form>
+    <script>
+      document.querySelectorAll('[data-core-only="true"]').forEach(function (el) {
+        el.style.display = ${JSON.stringify(current === "default" ? "" : "none")};
+      });
+    </script>`;
     return new Response(html, { headers: { "content-type": "text/html" } });
   });