add lockdown mode

roles/raspberrypi-kiosk/defaults/main.yaml

@@ -1,5 +1,5 @@
 kiosk_url: https://floatingqrcode.com/
-
+lockdown: false
 proxy:
   http_proxy: ""
   https_proxy: ""

roles/raspberrypi-kiosk/tasks/main.yaml

@@ -39,7 +39,7 @@
       NO_PROXY="{{ proxy.no_proxy }}"
   notify: Reboot
 
-- name: Configure autologin
+- name: Enable autologin
   command: raspi-config nonint do_boot_behaviour B2
 
 - name: Install kiosk script
@@ -47,3 +47,16 @@
     src: kiosk.sh.j2
     dest: /etc/profile.d/kiosk.sh
   notify: Reboot
+
+# This help prevent sd card corruption over time
+- name: Enable overlayfs
+  command: raspi-config nonint do_overlayfs 0
+  when: lockdown
+  notify: Reboot
+
+- name: Turn off ssh server
+  service:
+    name: ssh
+    enabled: false
+  when: lockdown
+  notify: Reboot