Add ntp time source and browser policy

files/etc/NetworkManager/dispatcher.d/10-chrony-dhcp-ntp

@@ -0,0 +1,36 @@
+#!/bin/bash
+# NetworkManager dispatcher: feed DHCP option 42 (NTP servers) into chrony.
+#
+# Replaces the old dhclient.d/chrony.sh bridge — we use NetworkManager's internal
+# DHCP now (the network-manager dracut port), and NM exports the lease's NTP
+# servers to dispatcher scripts as $DHCP4_NTP_SERVERS. chrony.conf carries
+# `sourcedir /run/chrony-dhcp`, so writing <iface>.sources there and reloading
+# makes chronyd use the DHCP-provided server. The image's baked public pool is
+# stripped (see the provisioner), so the host syncs ONLY from the lab NTP server
+# — no time egress from the workstation.
+#
+# Installed 0755 root:root at /etc/NetworkManager/dispatcher.d/. Lenient on
+# purpose: a hiccup here must never break networking.
+
+interface="$1"
+action="$2"
+
+case "$action" in
+    up|dhcp4-change|reapply) ;;
+    *) exit 0 ;;
+esac
+
+dir=/run/chrony-dhcp
+file="$dir/${interface}.sources"
+mkdir -p "$dir"
+
+if [ -n "${DHCP4_NTP_SERVERS:-}" ]; then
+    : > "$file"
+    for s in $DHCP4_NTP_SERVERS; do
+        printf 'server %s iburst\n' "$s" >> "$file"
+    done
+    # Pick up the new sources without restarting chronyd.
+    chronyc reload sources >/dev/null 2>&1 || true
+fi
+
+exit 0

files/kiosk/chromium-kiosk-policy.json

@@ -6,6 +6,7 @@
   "DeviceMetricsReportingEnabled": false,
 
   "BrowserSignin": 0,
+  "SigninAllowed": false,
   "SyncDisabled": true,
 
   "SafeBrowsingProtectionLevel": 0,