add lockdown mode

hosts

@@ -1,2 +1,2 @@
-[raspberrypi-kiosk]
+[raspberrypi_kiosk]
 raspberrypi.local ansible_user=pi ansible_password=raspberry ansible_become_method=sudo ansible_become_user=root

roles/raspberrypi-kiosk/defaults/main.yaml

@@ -1 +1,6 @@
 kiosk_url: https://floatingqrcode.com/
+lockdown: false
+proxy:
+  http_proxy: ""
+  https_proxy: ""
+  no_proxy: ""

roles/raspberrypi-kiosk/tasks/main.yaml

@@ -1,3 +1,15 @@
+- name: Perform system upgrades
+  apt:
+    update_cache: true
+    upgrade: dist
+  environment: 
+    http_proxy: "{{ proxy.http_proxy }}"
+    HTTP_PROXY: "{{ proxy.http_proxy }}"
+    https_proxy: "{{ proxy.https_proxy }}"
+    HTTPS_PROXY: "{{ proxy.https_proxy }}"
+    no_proxy: "{{ proxy.no_proxy }}"
+    NO_PROXY: "{{ proxy.no_proxy }}"
+
 - name: Install Cage window manager and Midori browser
   apt:
     update_cache: yes
@@ -6,8 +18,28 @@
       - xwayland
       - gtk3-nocsd
       - midori
+      - chromium-browser
+  environment: 
+    http_proxy: "{{ proxy.http_proxy }}"
+    HTTP_PROXY: "{{ proxy.http_proxy }}"
+    https_proxy: "{{ proxy.https_proxy }}"
+    HTTPS_PROXY: "{{ proxy.https_proxy }}"
+    no_proxy: "{{ proxy.no_proxy }}"
+    NO_PROXY: "{{ proxy.no_proxy }}"
 
-- name: Configure autologin
+- name: Configure proxy
+  blockinfile:
+    path: /etc/environment
+    block: |
+      http_proxy="{{ proxy.http_proxy }}"
+      HTTP_PROXY="{{ proxy.http_proxy }}"
+      https_proxy="{{ proxy.https_proxy }}"
+      HTTPS_PROXY="{{ proxy.https_proxy }}"
+      no_proxy="{{ proxy.no_proxy }}"
+      NO_PROXY="{{ proxy.no_proxy }}"
+  notify: Reboot
+
+- name: Enable autologin
   command: raspi-config nonint do_boot_behaviour B2
 
 - name: Install kiosk script
@@ -15,3 +47,16 @@
     src: kiosk.sh.j2
     dest: /etc/profile.d/kiosk.sh
   notify: Reboot
+
+# This help prevent sd card corruption over time
+- name: Enable overlayfs
+  command: raspi-config nonint do_overlayfs 0
+  when: lockdown
+  notify: Reboot
+
+- name: Turn off ssh server
+  service:
+    name: ssh
+    enabled: false
+  when: lockdown
+  notify: Reboot

roles/raspberrypi-kiosk/templates/kiosk.sh.j2

@@ -3,6 +3,7 @@
 if [ "$(tty)" = "/dev/tty1" ]; then
     while true; do
         GTK_CSD=0 cage -d -s -- midori -e fullscreen -a {{ kiosk_url }}
+        #cage -d -s -- chromium-browser --noerrdialogs --disable-infobars --kiosk {{ kiosk_url }}
         sleep 1
     done
 fi

site.yaml

@@ -1,11 +1,3 @@
-- hosts: all
-  become: true
-  tasks:
-    - name: Perform system update
-      apt:
-        update_cache: true
-        upgrade: dist
-
 - hosts: all
   become: true
   roles: