sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Add ntp time source and browser policy

Browse Source
This commit is contained in:
Audiobuzz
2026-06-18 09:35:58 +00:00
parent 8f8e24ac28
commit a53357216d
10 changed files with 222 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
diskless.pkr.hcl
+15 -2
View File
@@ -262,6 +262,16 @@ build {
# secure mode, reserving the physical NIC for wpa_supplicant.
"chmod 0755 /usr/lib/dracut/modules.d/95dot1x-macsec/*.sh",
# ---- NTP from DHCP (option 42) -> chrony, no public-pool egress --------
# NM dispatcher writes DHCP-provided NTP servers into chrony's sourcedir
# (replaces the removed dhclient.d/chrony.sh bridge). Strip the baked public
# pool so the host syncs ONLY from the lab NTP server handed via DHCP — the
# workstation never reaches *.pool.ntp.org.
"install -D -m0755 /tmp/etc-stage/NetworkManager/dispatcher.d/10-chrony-dhcp-ntp /etc/NetworkManager/dispatcher.d/10-chrony-dhcp-ntp",
"restorecon /etc/NetworkManager/dispatcher.d/10-chrony-dhcp-ntp",
"sed -i -E 's/^[[:space:]]*(pool|server)[[:space:]]/#&/' /etc/chrony.conf",
"grep -q '^sourcedir /run/chrony-dhcp' /etc/chrony.conf || echo 'sourcedir /run/chrony-dhcp' >> /etc/chrony.conf",
# Inject the fleet NIC drivers into the dracut config
"sed -i 's/@NIC_DRIVERS@/${var.nic_drivers}/' /etc/dracut.conf.d/90-diskless.conf",
@@ -341,15 +351,18 @@ build {
"install -D -m0644 /tmp/kiosk/weston.ini /etc/xdg/weston/weston.ini",
# Chromium managed policy: stops the browser phoning home to Google
# (sign-in, variations, optimization-guide, component/auto update, metrics,
# safe browsing). EPEL chromium reads /etc/chromium/policies/managed/*.json.
# safe browsing). The managed-policy dir differs across chromium builds
# (/etc/chromium vs /etc/chromium-browser), and a policy in the wrong dir is
# silently ignored — so install to BOTH. Verify at runtime via chrome://policy.
# Pairs with the hardening flags in kiosk-session.
"install -D -m0644 /tmp/kiosk/chromium-kiosk-policy.json /etc/chromium/policies/managed/10-kiosk-lockdown.json",
"install -D -m0644 /tmp/kiosk/chromium-kiosk-policy.json /etc/chromium-browser/policies/managed/10-kiosk-lockdown.json",
# URL from the var (weston renderer is set via --use-pixman in the unit).
"install -d -m0755 /etc/kiosk",
"printf 'KIOSK_URL=%s\\n' \"$KIOSK_URL\" > /etc/kiosk/kiosk.env",
"chmod 0644 /etc/kiosk/kiosk.env",
# Label the new files so they survive into the enforcing erofs.
"restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/xdg/weston /etc/kiosk /etc/chromium",
"restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/xdg/weston /etc/kiosk /etc/chromium /etc/chromium-browser",
# Boot graphical and start the kiosk (replaces the tty1 getty).
"systemctl enable kiosk.service",
"systemctl set-default graphical.target",