{
  "_comment": "Chromium managed policy for the diskless kiosk. Installed to /etc/chromium/policies/managed/. Stops Chromium phoning home to *.google.com / *.googleapis.com (sign-in, variations, optimization guide, component/auto updates, metrics, safe browsing) — none of which a fixed-URL kiosk needs. Pairs with the hardening flags in kiosk-session. Unknown keys are ignored by Chromium, so this is forward/backward safe.",

  "MetricsReportingEnabled": false,
  "UrlKeyedAnonymizedDataCollectionEnabled": false,
  "DeviceMetricsReportingEnabled": false,

  "BrowserSignin": 0,
  "SigninAllowed": false,
  "SyncDisabled": true,

  "SafeBrowsingProtectionLevel": 0,
  "SafeBrowsingExtendedReportingEnabled": false,

  "ComponentUpdatesEnabled": false,
  "ChromeVariations": 2,
  "BrowserNetworkTimeQueriesEnabled": false,

  "SearchSuggestEnabled": false,
  "DefaultSearchProviderEnabled": false,
  "SpellCheckServiceEnabled": false,
  "TranslateEnabled": false,
  "NetworkPredictionOptions": 2,

  "BackgroundModeEnabled": false,
  "PromotionalTabsEnabled": false,
  "WelcomePageOnOSUpgradeEnabled": false,
  "DefaultBrowserSettingEnabled": false,

  "AutofillAddressEnabled": false,
  "AutofillCreditCardEnabled": false,
  "PasswordManagerEnabled": false,
  "ShoppingListEnabled": false,
  "EnableMediaRouter": false,

  "_comment_capability_lockdown": "The distro chromium WRAPPER hardcodes --enable-extensions --enable-user-scripts --enable-printing --enable-sync --auto-ssl-client-auth (not removable via env/conf, only by bypassing the wrapper). Neutralise the capability-broadening ones HERE — policy beats cmdline flags and survives Chromium updates. ExtensionInstallBlocklist=['*'] blocks ALL extension installs, which also kills the user-scripts surface (user scripts need an extension/dev-mode). --enable-sync is already locked by SyncDisabled above. --auto-ssl-client-auth is moot: it only auto-presents a BROWSER-store client cert, and the TPM 802.1X cert isn't one — there are none; to govern explicitly, set AutoSelectCertificateForUrls (left unset = no auto-select). See files/kiosk/kiosk-session + TODO #13.",
  "ExtensionInstallBlocklist": ["*"],

  "_comment_pna": "Private Network Access: the kiosk page (insecure http boot-server origin) fetches the workstation host-info agent at http://localhost:9099 — a cross-origin PRIVATE-network request Chromium blocks by default. The agent sends Access-Control-Allow-Private-Network: true; this is the matching browser-side allowance, scoped to the kiosk ORIGIN ONLY (not '*'). MUST list the origin of kiosk_url (default http://boot.fleet.lab). The machine talking to itself; no internet egress (see HOST-API.md).",
  "InsecurePrivateNetworkRequestsAllowedForUrls": [
    "http://boot.fleet.lab",
    "http://localhost"
  ]
}