VoxIP Kiosk OS 1.0.0: Raspberry Pi kiosk with web management

Chromium kiosk without a desktop for the Raspberry Pi 3, a Flask web
interface on port 8080 (kiosk, system and network management), a
restricted root helper, network changes with automatic rollback, a
healthcheck timer, install/update/uninstall scripts and a pi-gen image
build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

systemd/voxip-boot-import.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=VoxIP configuratie en SSH-sleutels importeren vanaf de bootpartitie
+Documentation=file:///usr/share/doc/voxip-kiosk/README.md
+After=local-fs.target
+Before=voxip-kiosk-manager.service voxip-kiosk-browser.service ssh.service
+ConditionPathExistsGlob=|/boot/firmware/voxip-config.json
+ConditionPathExistsGlob=|/boot/firmware/voxip-authorized_keys
+ConditionPathExistsGlob=|/boot/voxip-config.json
+ConditionPathExistsGlob=|/boot/voxip-authorized_keys
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/lib/voxip-kiosk/voxip-kiosk-helper boot-import
+
+[Install]
+WantedBy=multi-user.target

systemd/voxip-kiosk-agent.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=VoxIP Kiosk agent (navigatie, offlinepagina, verversen)
+Documentation=file:///usr/share/doc/voxip-kiosk/README.md
+After=voxip-kiosk-browser.service
+
+[Service]
+Type=simple
+User=kiosk
+Group=kiosk
+RuntimeDirectory=voxip-kiosk-agent
+RuntimeDirectoryMode=0755
+ExecStart=/usr/lib/voxip-kiosk/voxip-kiosk-agent
+Restart=always
+RestartSec=5
+SyslogIdentifier=voxip-kiosk-agent
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+
+[Install]
+WantedBy=multi-user.target

systemd/voxip-kiosk-browser.service

@@ -0,0 +1,36 @@
+[Unit]
+Description=VoxIP Kiosk Chromium
+Documentation=file:///usr/share/doc/voxip-kiosk/README.md
+Requires=voxip-kiosk-x.service
+After=voxip-kiosk-x.service voxip-boot-import.service
+# Restarting or stopping X restarts/stops the browser as well.
+PartOf=voxip-kiosk-x.service
+# A crash loop stops after 6 starts in 10 minutes; the healthcheck logs it
+# and retries after a cool-down (see voxip-kiosk-healthcheck).
+StartLimitIntervalSec=600
+StartLimitBurst=6
+
+[Service]
+Type=simple
+User=kiosk
+Group=kiosk
+Environment=DISPLAY=:0
+Environment=XAUTHORITY=/run/voxip-kiosk-x/Xauthority
+Environment=HOME=/home/kiosk
+RuntimeDirectory=voxip-kiosk-browser
+RuntimeDirectoryMode=0755
+StateDirectory=voxip-kiosk-browser
+StateDirectoryMode=0700
+ExecStart=/usr/lib/voxip-kiosk/voxip-kiosk-browser
+# voxip-kiosk-browser exits 1 after a crash when browser_restart is on, 0 when it is off.
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=15
+KillMode=control-group
+OOMScoreAdjust=-100
+LogRateLimitIntervalSec=30s
+LogRateLimitBurst=300
+SyslogIdentifier=voxip-kiosk-browser
+
+[Install]
+WantedBy=multi-user.target

systemd/voxip-kiosk-healthcheck.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=VoxIP Kiosk healthcheck
+Documentation=file:///usr/share/doc/voxip-kiosk/README.md
+
+[Service]
+Type=oneshot
+RuntimeDirectory=voxip-kiosk-health
+RuntimeDirectoryPreserve=yes
+ExecStart=/usr/lib/voxip-kiosk/voxip-kiosk-healthcheck
+SyslogIdentifier=voxip-kiosk-healthcheck
+TimeoutStartSec=60

systemd/voxip-kiosk-healthcheck.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=VoxIP Kiosk healthcheck (elke minuut)
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=1min
+AccuracySec=10s
+
+[Install]
+WantedBy=timers.target

systemd/voxip-kiosk-manager.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=VoxIP Kiosk Manager (webbeheer)
+Documentation=file:///usr/share/doc/voxip-kiosk/README.md
+After=network.target voxip-boot-import.service
+StartLimitIntervalSec=300
+StartLimitBurst=10
+
+[Service]
+Type=simple
+User=voxip
+Group=voxip
+# systemd-journal: read logs; video: vcgencmd (voltage/throttling)
+SupplementaryGroups=systemd-journal video
+ExecStart=/usr/lib/voxip-kiosk/voxip-kiosk-manager
+Restart=always
+RestartSec=3
+UMask=0027
+LogsDirectory=voxip-kiosk
+LogsDirectoryMode=0750
+SyslogIdentifier=voxip-kiosk-manager
+# No NoNewPrivileges/ProtectSystem/ProtectHome: the helper started through
+# "sudo -n voxip-kiosk-helper" inherits this unit's mount namespace and must
+# be able to write /etc (hostname, NetworkManager profiles). The web process
+# itself runs unprivileged as user voxip and can only write its own dirs.
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+LockPersonality=yes
+
+[Install]
+WantedBy=multi-user.target

systemd/voxip-kiosk-x.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=VoxIP Kiosk X-server (vt7)
+Documentation=file:///usr/share/doc/voxip-kiosk/README.md
+After=systemd-user-sessions.service systemd-logind.service
+Conflicts=getty@tty7.service
+StartLimitIntervalSec=600
+StartLimitBurst=10
+
+[Service]
+Type=simple
+User=kiosk
+Group=kiosk
+# A logind session on tty7 gives the kiosk user access to the display and input devices.
+PAMName=login
+TTYPath=/dev/tty7
+TTYReset=yes
+TTYVHangup=yes
+StandardInput=tty
+StandardOutput=journal
+StandardError=journal
+UtmpIdentifier=tty7
+UtmpMode=user
+RuntimeDirectory=voxip-kiosk-x
+RuntimeDirectoryMode=0700
+ExecStartPre=+/usr/bin/chvt 7
+ExecStart=/usr/lib/voxip-kiosk/voxip-kiosk-x
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=multi-user.target

systemd/voxip-network-guard.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=VoxIP netwerkherstel bij opstarten (rollback en noodreset)
+Documentation=file:///usr/share/doc/voxip-kiosk/README.md
+DefaultDependencies=no
+After=local-fs.target
+Before=NetworkManager.service network-pre.target shutdown.target
+Wants=network-pre.target
+Conflicts=shutdown.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/lib/voxip-kiosk/voxip-kiosk-helper network-boot-guard
+
+[Install]
+WantedBy=multi-user.target