Add Host API and fix kiosk performance
This commit is contained in:
Audiobuzz
@@ -0,0 +1,53 @@
|
||||
# fleet-hostapi — workstation host-info agent
|
||||
|
||||
A tiny **read-only, loopback-only** Go HTTP service that runs on the diskless
|
||||
workstation and reports facts about the machine the kiosk renders on. It is the
|
||||
OS-side implementation of the contract in [`../../HOST-API.md`](../../HOST-API.md)
|
||||
(authored alongside the kiosk-app SPA that consumes it).
|
||||
|
||||
```
|
||||
GET http://localhost:9099/v1/host -> application/json (os, hardware, net, kiosk, agent)
|
||||
GET http://localhost:9099/healthz -> 200 ok
|
||||
```
|
||||
|
||||
## Properties (and why)
|
||||
|
||||
- **Loopback only.** Binds `127.0.0.1`; refuses to start on any routable address.
|
||||
Host facts must never reach the boot LAN.
|
||||
- **Read only.** No endpoint mutates anything; it reads `/proc`, `/sys`,
|
||||
`/etc/os-release`, and the build-time facts file.
|
||||
- **No per-host state baked in** (invariant #1). Host-specific fields (kernel,
|
||||
hostname, IP, MAC, board, uptime) are read at **runtime**. The only baked facts
|
||||
are image-generic — image version + weston/chromium versions — written to
|
||||
`/etc/fleet-hostinfo.json` by the build provisioner.
|
||||
- **Stdlib only → reproducible build** (the verity hash is a security property).
|
||||
Built `CGO_ENABLED=0 -trimpath -buildvcs=false -ldflags=-buildid=`; identical
|
||||
bytes across builds with the same Go toolchain.
|
||||
- **CORS + Private Network Access.** The SPA is cross-origin and the fetch is a
|
||||
Chromium private-network request, so responses carry
|
||||
`Access-Control-Allow-Private-Network: true`. The matching browser-side
|
||||
allowance is in `files/kiosk/chromium-kiosk-policy.json`
|
||||
(`InsecurePrivateNetworkRequestsAllowedForUrls`, scoped to the kiosk origin).
|
||||
|
||||
## Build / install
|
||||
|
||||
Done by the `2b-hostapi` provisioner in `diskless.pkr.hcl`: installs the Go
|
||||
toolchain, builds the static binary to `/usr/local/bin/fleet-hostapi`, writes the
|
||||
facts file, installs + enables `fleet-hostapi.service`, and adds the binary to
|
||||
fapolicyd trust (2c-STIG-postfix). The toolchain is removed in 2d hygiene — only
|
||||
the static binary ships.
|
||||
|
||||
Local build:
|
||||
|
||||
```bash
|
||||
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -buildvcs=false \
|
||||
-ldflags '-s -w -buildid=' -o fleet-hostapi .
|
||||
```
|
||||
|
||||
## Config (env, set in the unit)
|
||||
|
||||
| Var | Default | Notes |
|
||||
|---|---|---|
|
||||
| `FLEET_HOSTAPI_ADDR` | `127.0.0.1:9099` | must be loopback |
|
||||
| `FLEET_HOSTAPI_ALLOW_ORIGIN` | `*` | tighten to the kiosk origin in prod |
|
||||
| `FLEET_HOSTAPI_FACTS` | `/etc/fleet-hostinfo.json` | build-time facts |
|
||||
@@ -0,0 +1,52 @@
|
||||
[Unit]
|
||||
Description=Fleet workstation host-info API (loopback, read-only)
|
||||
Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/HOST-API.md
|
||||
# Needs networking up only to read the primary IP/MAC; the listener is loopback.
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=exec
|
||||
ExecStart=/usr/local/bin/fleet-hostapi
|
||||
Environment=FLEET_HOSTAPI_ADDR=127.0.0.1:9099
|
||||
# Lab default: any origin may read (it's a loopback, read-only facts service on a
|
||||
# single-purpose kiosk). Tighten to the exact kiosk origin in production, e.g.
|
||||
# Environment=FLEET_HOSTAPI_ALLOW_ORIGIN=http://boot.fleet.lab
|
||||
Environment=FLEET_HOSTAPI_ALLOW_ORIGIN=*
|
||||
Environment=FLEET_HOSTAPI_FACTS=/etc/fleet-hostinfo.json
|
||||
Restart=on-failure
|
||||
RestartSec=2
|
||||
|
||||
# --- sandboxing (STIG-friendly; the agent only READS /proc, /sys, /etc) -------
|
||||
# Runs as a transient unprivileged user with no capabilities; everything it
|
||||
# reads is world-readable, so it needs no privilege at all.
|
||||
DynamicUser=yes
|
||||
CapabilityBoundingSet=
|
||||
AmbientCapabilities=
|
||||
NoNewPrivileges=yes
|
||||
ProtectSystem=strict
|
||||
ProtectHome=yes
|
||||
PrivateTmp=yes
|
||||
ProtectKernelTunables=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectKernelLogs=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectClock=yes
|
||||
ProtectHostname=yes
|
||||
ProtectProc=default
|
||||
RestrictNamespaces=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictSUIDSGID=yes
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
SystemCallArchitectures=native
|
||||
SystemCallFilter=@system-service
|
||||
SystemCallFilter=~@privileged @resources
|
||||
RestrictAddressFamilies=AF_INET AF_INET6
|
||||
# Kernel-enforced loopback-only egress/ingress (belt + suspenders to the bind).
|
||||
IPAddressAllow=localhost
|
||||
IPAddressDeny=any
|
||||
UMask=0077
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,7 @@
|
||||
// fleet-hostapi: the workstation host-info agent (HOST-API.md contract).
|
||||
// Stdlib only — no external modules — so the build needs no network and is
|
||||
// trivially reproducible (a hard requirement: the rootfs/verity hash must be a
|
||||
// pure function of the inputs). Keep it dependency-free.
|
||||
module fleet-hostapi
|
||||
|
||||
go 1.21
|
||||
@@ -0,0 +1,400 @@
|
||||
// fleet-hostapi — read-only workstation host-info agent for the kiosk.
|
||||
//
|
||||
// Implements the contract in HOST-API.md: a tiny HTTP service on the diskless
|
||||
// workstation that reports facts about the machine the kiosk renders on. The
|
||||
// kiosk SPA (served from the boot server, a different origin) fetches
|
||||
//
|
||||
// GET http://localhost:9099/v1/host -> application/json
|
||||
//
|
||||
// Design constraints (see CLAUDE.md invariants):
|
||||
// - LOOPBACK ONLY. Never bind a routable address — this leaks host facts and
|
||||
// must never reach the boot LAN.
|
||||
// - READ ONLY. No endpoint mutates anything; the agent only reads /proc, /sys,
|
||||
// /etc/os-release, and a build-time facts file.
|
||||
// - NO PER-HOST STATE baked into the image. Everything host-specific (kernel,
|
||||
// hostname, IP, MAC, board, uptime) is read at RUNTIME. The only baked facts
|
||||
// are image-generic (image version + weston/chromium versions), written to a
|
||||
// facts file by the build provisioner — same for every host of a release.
|
||||
// - Stdlib only -> reproducible build (the verity hash is a security property).
|
||||
//
|
||||
// CORS + Private Network Access: the SPA is cross-origin AND the fetch is a
|
||||
// Chromium "private network" request, so every response (incl. the OPTIONS
|
||||
// preflight) carries Access-Control-Allow-Private-Network: true.
|
||||
package main
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"encoding/json"
|
||||
"flag"
|
||||
"log"
|
||||
"math"
|
||||
"net"
|
||||
"net/http"
|
||||
"os"
|
||||
"runtime"
|
||||
"strconv"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
)
|
||||
|
||||
// agentVersion is overridable at build time via -ldflags "-X main.agentVersion=…".
|
||||
var agentVersion = "1.0.0"
|
||||
|
||||
// ---- response shape (HOST-API.md) — all fields optional, omit what's unknown --
|
||||
|
||||
type osInfo struct {
|
||||
Name string `json:"name,omitempty"`
|
||||
Version string `json:"version,omitempty"`
|
||||
Kernel string `json:"kernel,omitempty"`
|
||||
Image string `json:"image,omitempty"`
|
||||
}
|
||||
|
||||
type hwInfo struct {
|
||||
CPU string `json:"cpu,omitempty"`
|
||||
Cores int `json:"cores,omitempty"`
|
||||
MemGB int `json:"memGB,omitempty"`
|
||||
GPU string `json:"gpu,omitempty"`
|
||||
Board string `json:"board,omitempty"`
|
||||
}
|
||||
|
||||
type netInfo struct {
|
||||
Hostname string `json:"hostname,omitempty"`
|
||||
IP string `json:"ip,omitempty"`
|
||||
MAC string `json:"mac,omitempty"`
|
||||
}
|
||||
|
||||
type kioskInfo struct {
|
||||
Uptime string `json:"uptime,omitempty"`
|
||||
Weston string `json:"weston,omitempty"`
|
||||
Chromium string `json:"chromium,omitempty"`
|
||||
}
|
||||
|
||||
type agentInfo struct {
|
||||
Version string `json:"version,omitempty"`
|
||||
}
|
||||
|
||||
type hostResponse struct {
|
||||
OS osInfo `json:"os"`
|
||||
Hardware hwInfo `json:"hardware"`
|
||||
Net netInfo `json:"net"`
|
||||
Kiosk kioskInfo `json:"kiosk"`
|
||||
Agent agentInfo `json:"agent"`
|
||||
}
|
||||
|
||||
// buildFacts is the image-generic, build-time facts file (written by the Packer
|
||||
// provisioner). Distinct from anything per-host.
|
||||
type buildFacts struct {
|
||||
Image string `json:"image"`
|
||||
Weston string `json:"weston"`
|
||||
Chromium string `json:"chromium"`
|
||||
}
|
||||
|
||||
func main() {
|
||||
addr := flag.String("addr", env("FLEET_HOSTAPI_ADDR", "127.0.0.1:9099"), "listen address (MUST be loopback)")
|
||||
origin := flag.String("allow-origin", env("FLEET_HOSTAPI_ALLOW_ORIGIN", "*"), "Access-Control-Allow-Origin value")
|
||||
factsPath := flag.String("facts", env("FLEET_HOSTAPI_FACTS", "/etc/fleet-hostinfo.json"), "build-time facts file")
|
||||
flag.Parse()
|
||||
|
||||
// Refuse to bind anything that isn't loopback — a hard guardrail against a
|
||||
// misconfiguration exposing host facts on the boot LAN.
|
||||
if host, _, err := net.SplitHostPort(*addr); err != nil || !isLoopback(host) {
|
||||
log.Fatalf("refusing to listen on %q: bind address must be loopback (127.0.0.1/::1)", *addr)
|
||||
}
|
||||
|
||||
facts := loadFacts(*factsPath)
|
||||
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("/v1/host", func(w http.ResponseWriter, r *http.Request) {
|
||||
cors(w, *origin)
|
||||
if r.Method == http.MethodOptions {
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
return
|
||||
}
|
||||
if r.Method != http.MethodGet {
|
||||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.Header().Set("Cache-Control", "no-store")
|
||||
enc := json.NewEncoder(w)
|
||||
enc.SetIndent("", " ")
|
||||
_ = enc.Encode(collect(facts))
|
||||
})
|
||||
// Liveness for the unit / debugging (no host facts).
|
||||
mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Header().Set("Content-Type", "text/plain")
|
||||
_, _ = w.Write([]byte("ok\n"))
|
||||
})
|
||||
|
||||
srv := &http.Server{
|
||||
Addr: *addr,
|
||||
Handler: mux,
|
||||
ReadHeaderTimeout: 5 * time.Second,
|
||||
ReadTimeout: 10 * time.Second,
|
||||
WriteTimeout: 10 * time.Second,
|
||||
IdleTimeout: 60 * time.Second,
|
||||
}
|
||||
log.Printf("fleet-hostapi %s listening on %s (loopback, read-only)", agentVersion, *addr)
|
||||
log.Fatal(srv.ListenAndServe())
|
||||
}
|
||||
|
||||
func cors(w http.ResponseWriter, origin string) {
|
||||
// Private Network Access: the kiosk page (boot-server origin, an insecure/
|
||||
// public context) fetching localhost is a "private network" request — the
|
||||
// preflight needs this header or Chromium blocks it. See HOST-API.md.
|
||||
w.Header().Set("Access-Control-Allow-Origin", origin)
|
||||
w.Header().Set("Access-Control-Allow-Private-Network", "true")
|
||||
w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
|
||||
w.Header().Set("Vary", "Origin")
|
||||
}
|
||||
|
||||
// collect gathers all host facts. Each source is best-effort: a failed read
|
||||
// leaves its field empty (the SPA renders "—" for missing fields).
|
||||
func collect(f buildFacts) hostResponse {
|
||||
var resp hostResponse
|
||||
|
||||
// os
|
||||
rel := parseKV("/etc/os-release")
|
||||
resp.OS.Name = firstNonEmpty(rel["NAME"], rel["ID"])
|
||||
resp.OS.Version = firstNonEmpty(rel["VERSION_ID"], rel["VERSION"])
|
||||
resp.OS.Kernel = kernelRelease()
|
||||
resp.OS.Image = f.Image
|
||||
|
||||
// hardware
|
||||
resp.Hardware.CPU = cpuModel()
|
||||
resp.Hardware.Cores = runtime.NumCPU()
|
||||
resp.Hardware.MemGB = memGB()
|
||||
resp.Hardware.GPU = gpuModel()
|
||||
resp.Hardware.Board = boardModel()
|
||||
|
||||
// net
|
||||
resp.Net.Hostname, _ = os.Hostname()
|
||||
resp.Net.IP, resp.Net.MAC = primaryIfaceAddr()
|
||||
|
||||
// kiosk
|
||||
resp.Kiosk.Uptime = uptimeHuman()
|
||||
resp.Kiosk.Weston = f.Weston
|
||||
resp.Kiosk.Chromium = f.Chromium
|
||||
|
||||
resp.Agent.Version = agentVersion
|
||||
return resp
|
||||
}
|
||||
|
||||
// ---- collectors -----------------------------------------------------------
|
||||
|
||||
func kernelRelease() string {
|
||||
var u syscall.Utsname
|
||||
if err := syscall.Uname(&u); err != nil {
|
||||
return ""
|
||||
}
|
||||
return charsToString(u.Release[:])
|
||||
}
|
||||
|
||||
func cpuModel() string {
|
||||
f, err := os.Open("/proc/cpuinfo")
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
defer f.Close()
|
||||
sc := bufio.NewScanner(f)
|
||||
for sc.Scan() {
|
||||
line := sc.Text()
|
||||
// x86: "model name". arm64: "Hardware"/"Processor" if present.
|
||||
for _, key := range []string{"model name", "Hardware", "Processor"} {
|
||||
if strings.HasPrefix(line, key) {
|
||||
if _, v, ok := strings.Cut(line, ":"); ok {
|
||||
return strings.TrimSpace(v)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
_ = sc.Err() // best-effort read; empty result on any error
|
||||
return ""
|
||||
}
|
||||
|
||||
func memGB() int {
|
||||
for _, line := range readLines("/proc/meminfo") {
|
||||
if strings.HasPrefix(line, "MemTotal:") {
|
||||
fields := strings.Fields(line) // MemTotal: <kB> kB
|
||||
if len(fields) >= 2 {
|
||||
if kb, err := strconv.ParseFloat(fields[1], 64); err == nil {
|
||||
return int(math.Round(kb / 1024.0 / 1024.0))
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
// boardModel: vendor + product from DMI (world-readable sysfs — NOT product_serial,
|
||||
// which is root-only and per-host; we never read it).
|
||||
func boardModel() string {
|
||||
vendor := strings.TrimSpace(readFile("/sys/class/dmi/id/sys_vendor"))
|
||||
product := strings.TrimSpace(readFile("/sys/class/dmi/id/product_name"))
|
||||
if vendor == "" && product == "" {
|
||||
vendor = strings.TrimSpace(readFile("/sys/class/dmi/id/board_vendor"))
|
||||
product = strings.TrimSpace(readFile("/sys/class/dmi/id/board_name"))
|
||||
}
|
||||
return strings.TrimSpace(strings.TrimSpace(vendor + " " + product))
|
||||
}
|
||||
|
||||
// gpuModel: best-effort from the first DRM card's PCI ids. No PCI-ID database —
|
||||
// we map the few known vendors and otherwise emit the raw ids. Often empty on a
|
||||
// headless/virtio build VM; that's fine (optional field).
|
||||
func gpuModel() string {
|
||||
for _, card := range []string{"card0", "card1"} {
|
||||
base := "/sys/class/drm/" + card + "/device/"
|
||||
vid := strings.TrimSpace(readFile(base + "vendor"))
|
||||
did := strings.TrimSpace(readFile(base + "device"))
|
||||
if vid == "" {
|
||||
continue
|
||||
}
|
||||
name := map[string]string{
|
||||
"0x8086": "Intel",
|
||||
"0x1002": "AMD",
|
||||
"0x10de": "NVIDIA",
|
||||
"0x1af4": "Red Hat (virtio-gpu)",
|
||||
"0x1234": "QEMU",
|
||||
"0x1a03": "ASPEED",
|
||||
}[strings.ToLower(vid)]
|
||||
ids := strings.TrimPrefix(strings.ToLower(vid), "0x")
|
||||
if did != "" {
|
||||
ids += ":" + strings.TrimPrefix(strings.ToLower(did), "0x")
|
||||
}
|
||||
if name != "" {
|
||||
return name + " [" + ids + "]"
|
||||
}
|
||||
return "[" + ids + "]"
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// primaryIfaceAddr returns the preferred outbound IPv4 + the MAC of the
|
||||
// interface that owns it. Uses a UDP "connect" (no packet is sent) to let the
|
||||
// kernel pick the route's source address.
|
||||
func primaryIfaceAddr() (ip string, mac string) {
|
||||
c, err := net.Dial("udp", "192.0.2.1:9") // TEST-NET-1, never reachable; no traffic on UDP connect
|
||||
if err != nil {
|
||||
return "", ""
|
||||
}
|
||||
defer c.Close()
|
||||
la, ok := c.LocalAddr().(*net.UDPAddr)
|
||||
if !ok || la.IP == nil {
|
||||
return "", ""
|
||||
}
|
||||
ip = la.IP.String()
|
||||
// find the interface carrying this IP -> its MAC
|
||||
ifaces, err := net.Interfaces()
|
||||
if err != nil {
|
||||
return ip, ""
|
||||
}
|
||||
for _, ifc := range ifaces {
|
||||
addrs, _ := ifc.Addrs()
|
||||
for _, a := range addrs {
|
||||
if n, ok := a.(*net.IPNet); ok && n.IP.Equal(la.IP) {
|
||||
return ip, ifc.HardwareAddr.String()
|
||||
}
|
||||
}
|
||||
}
|
||||
return ip, ""
|
||||
}
|
||||
|
||||
// uptimeHuman formats system uptime as "3h 12m". On a kiosk appliance the system
|
||||
// boots straight into the kiosk, so system uptime ≈ kiosk-session uptime —
|
||||
// reported here to avoid coupling to (and exec'ing) systemd for the unit time.
|
||||
func uptimeHuman() string {
|
||||
var si syscall.Sysinfo_t
|
||||
if err := syscall.Sysinfo(&si); err != nil {
|
||||
return ""
|
||||
}
|
||||
d := time.Duration(si.Uptime) * time.Second
|
||||
days := int(d.Hours()) / 24
|
||||
hours := int(d.Hours()) % 24
|
||||
mins := int(d.Minutes()) % 60
|
||||
switch {
|
||||
case days > 0:
|
||||
return strconv.Itoa(days) + "d " + strconv.Itoa(hours) + "h " + strconv.Itoa(mins) + "m"
|
||||
case hours > 0:
|
||||
return strconv.Itoa(hours) + "h " + strconv.Itoa(mins) + "m"
|
||||
default:
|
||||
return strconv.Itoa(mins) + "m"
|
||||
}
|
||||
}
|
||||
|
||||
// ---- helpers --------------------------------------------------------------
|
||||
|
||||
func loadFacts(path string) buildFacts {
|
||||
var f buildFacts
|
||||
b, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return f // file absent at runtime -> image/weston/chromium just omitted
|
||||
}
|
||||
_ = json.Unmarshal(b, &f)
|
||||
return f
|
||||
}
|
||||
|
||||
func env(k, def string) string {
|
||||
if v := os.Getenv(k); v != "" {
|
||||
return v
|
||||
}
|
||||
return def
|
||||
}
|
||||
|
||||
func isLoopback(host string) bool {
|
||||
if host == "localhost" {
|
||||
return true
|
||||
}
|
||||
ip := net.ParseIP(host)
|
||||
return ip != nil && ip.IsLoopback()
|
||||
}
|
||||
|
||||
func parseKV(path string) map[string]string {
|
||||
m := map[string]string{}
|
||||
for _, line := range readLines(path) {
|
||||
k, v, ok := strings.Cut(line, "=")
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
m[strings.TrimSpace(k)] = strings.Trim(strings.TrimSpace(v), `"`)
|
||||
}
|
||||
return m
|
||||
}
|
||||
|
||||
func readLines(path string) []string {
|
||||
b := readFile(path)
|
||||
if b == "" {
|
||||
return nil
|
||||
}
|
||||
return strings.Split(strings.TrimRight(b, "\n"), "\n")
|
||||
}
|
||||
|
||||
func readFile(path string) string {
|
||||
b, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return string(b)
|
||||
}
|
||||
|
||||
func firstNonEmpty(vals ...string) string {
|
||||
for _, v := range vals {
|
||||
if v != "" {
|
||||
return v
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// charsToString converts a NUL-terminated Utsname field (int8 or uint8 across
|
||||
// arches) to a Go string.
|
||||
func charsToString(ca []int8) string {
|
||||
b := make([]byte, 0, len(ca))
|
||||
for _, c := range ca {
|
||||
if c == 0 {
|
||||
break
|
||||
}
|
||||
b = append(b, byte(c))
|
||||
}
|
||||
return string(b)
|
||||
}
|
||||
@@ -31,5 +31,11 @@
|
||||
"AutofillCreditCardEnabled": false,
|
||||
"PasswordManagerEnabled": false,
|
||||
"ShoppingListEnabled": false,
|
||||
"EnableMediaRouter": false
|
||||
"EnableMediaRouter": false,
|
||||
|
||||
"_comment_pna": "Private Network Access: the kiosk page (insecure http boot-server origin) fetches the workstation host-info agent at http://localhost:9099 — a cross-origin PRIVATE-network request Chromium blocks by default. The agent sends Access-Control-Allow-Private-Network: true; this is the matching browser-side allowance, scoped to the kiosk ORIGIN ONLY (not '*'). MUST list the origin of kiosk_url (default http://boot.fleet.lab). The machine talking to itself; no internet egress (see HOST-API.md).",
|
||||
"InsecurePrivateNetworkRequestsAllowedForUrls": [
|
||||
"http://boot.fleet.lab",
|
||||
"http://localhost"
|
||||
]
|
||||
}
|
||||
|
||||
+53
-22
@@ -26,6 +26,50 @@ SOCK=wayland-kiosk
|
||||
BROWSER=$(command -v chromium-browser || command -v chromium || true)
|
||||
: "${BROWSER:?chromium not found (expected chromium-browser or chromium in PATH)}"
|
||||
|
||||
# GPU vs software path. This image is FLEET-GENERIC: it boots both real hardware
|
||||
# (e.g. the 820 / Intel HD620 -> i915) AND the virtio build/test VMs (no real
|
||||
# GPU). Probe for a real KMS render node and branch — real GPU gets hardware
|
||||
# raster/compositing (CPU drops off software raster); VMs keep the software path
|
||||
# so weston + Chromium still render there. Pure runtime probe; no per-host state
|
||||
# is baked (invariant #1).
|
||||
GPU=0
|
||||
case "$(basename "$(readlink -f /sys/class/drm/card0/device/driver 2>/dev/null)" 2>/dev/null)" in
|
||||
i915|amdgpu|radeon|nouveau|xe) [ -e /dev/dri/renderD128 ] && GPU=1 ;;
|
||||
esac
|
||||
|
||||
# Lockdown flags (what the managed policy can't cover). The distro chromium
|
||||
# wrapper PREPENDS its own defaults ahead of these — including its own
|
||||
# --disable-features. Chromium does NOT union duplicate --disable-features (the
|
||||
# LAST occurrence wins), and ours is last, so we MERGE the wrapper's disables
|
||||
# (LensOverlay/Gemini/Compose/TabOrganization) into ours — otherwise they are
|
||||
# silently dropped. We deliberately pass NO --enable-features, so the wrapper's
|
||||
# VA-API enables (AcceleratedVideoDecodeLinuxGL, ...) stay in effect.
|
||||
# Phone-home suppression (background networking, component/auto update, domain
|
||||
# reliability, crash upload, pings, search-engine probe) + the comprehensive
|
||||
# lockdown live in the managed policy (/etc/chromium/policies/managed/).
|
||||
COMMON_FLAGS=(
|
||||
--kiosk --noerrdialogs --disable-infobars --incognito --no-first-run
|
||||
--disable-session-crashed-bubble --start-maximized
|
||||
--ozone-platform=wayland
|
||||
--disable-background-networking --disable-component-update
|
||||
--disable-sync --disable-domain-reliability --disable-breakpad
|
||||
--no-pings --no-default-browser-check --metrics-recording-only
|
||||
--disable-search-engine-collection
|
||||
"--disable-features=LensOverlay,OptimizationGuideOnDeviceModel,PromptAPIForGeminiNano,Compose,TabOrganization,Translate,OptimizationHints,OptimizationTargetPrediction,MediaRouter,AutofillServerCommunication,InterestFeedContentSuggestions"
|
||||
--user-data-dir=/tmp/kiosk-profile --disk-cache-dir=/tmp/kiosk-cache
|
||||
)
|
||||
|
||||
if [ "$GPU" = 1 ]; then
|
||||
# Real GPU: hardware raster/compositing. HD620 (gen7 Intel) is sometimes
|
||||
# raster-blocklisted by Chromium, so override the blocklist. The GPU process
|
||||
# opens /dev/dri/renderD128 -> the kiosk user must be in group 'render' (set
|
||||
# at build, diskless.pkr.hcl). With --disable-gpu gone, the wrapper's VA-API
|
||||
# --enable-features finally engage (they need a live GPU process).
|
||||
GPU_FLAGS=(--ignore-gpu-blocklist --enable-gpu-rasterization --enable-zero-copy)
|
||||
else
|
||||
GPU_FLAGS=(--disable-gpu)
|
||||
fi
|
||||
|
||||
# Background: wait (up to ~60s) for weston's socket, then keep Chromium running.
|
||||
(
|
||||
for _ in $(seq 1 120); do
|
||||
@@ -34,30 +78,17 @@ BROWSER=$(command -v chromium-browser || command -v chromium || true)
|
||||
done
|
||||
export WAYLAND_DISPLAY="$SOCK"
|
||||
while :; do
|
||||
# --disable-* / --no-pings etc.: stop Chromium phoning home to Google
|
||||
# (background networking = variations/field-trials + GCM, component &
|
||||
# auto updates, domain reliability, crash upload, hyperlink pings). The
|
||||
# --disable-features list kills the Optimization Guide hints fetch
|
||||
# (optimizationguide-pa.googleapis.com), Translate, Media Router discovery
|
||||
# and Autofill server calls. The comprehensive lockdown (sign-in, metrics,
|
||||
# safe browsing, search suggest, ...) is the managed policy at
|
||||
# /etc/chromium/policies/managed/10-kiosk-lockdown.json; these flags cover
|
||||
# what policy can't. A fixed-URL kiosk needs none of it.
|
||||
"$BROWSER" \
|
||||
--kiosk --noerrdialogs --disable-infobars --incognito --no-first-run \
|
||||
--disable-session-crashed-bubble --start-maximized \
|
||||
--ozone-platform=wayland --disable-gpu \
|
||||
--disable-background-networking --disable-component-update \
|
||||
--disable-sync --disable-domain-reliability --disable-breakpad \
|
||||
--no-pings --no-default-browser-check --metrics-recording-only \
|
||||
--disable-search-engine-collection \
|
||||
--disable-features=Translate,OptimizationHints,OptimizationTargetPrediction,MediaRouter,AutofillServerCommunication,InterestFeedContentSuggestions \
|
||||
--user-data-dir=/tmp/kiosk-profile --disk-cache-dir=/tmp/kiosk-cache \
|
||||
"$KIOSK_URL" || true
|
||||
"$BROWSER" "${COMMON_FLAGS[@]}" "${GPU_FLAGS[@]}" "$KIOSK_URL" || true
|
||||
sleep 2
|
||||
done
|
||||
) &
|
||||
|
||||
# weston as the foreground process (owns the seat; service restarts if it dies).
|
||||
# desktop-shell + explicit socket; --use-pixman = software rendering for VMs.
|
||||
exec weston --use-pixman --socket="$SOCK" --config=/etc/xdg/weston/weston.ini
|
||||
# desktop-shell + explicit socket. On real GPU use weston's GL renderer (enables
|
||||
# the zero-copy dmabuf handoff from Chromium so its frames aren't CPU-copied); on
|
||||
# VMs force --use-pixman (software) — there's no usable DRM/GL device there.
|
||||
if [ "$GPU" = 1 ]; then
|
||||
exec weston --socket="$SOCK" --config=/etc/xdg/weston/weston.ini
|
||||
else
|
||||
exec weston --use-pixman --socket="$SOCK" --config=/etc/xdg/weston/weston.ini
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user