Vestibule Admin

Kiosk identity

Basic information about this kiosk. The name is shown in UI banners; the home URL is where the browser navigates after a session reset.

Kiosk name Home URL Navigated to on every session reset, wake, and idle timeout. Attract URL (optional) Stored in the config schema; the attract-screen feature ships with the presence-detection work (Phase 5+). The field is harmless to leave empty.

URL policy

Controls which URLs the kiosk can navigate to. This is the modern replacement for the 2001 VB6 trick of renaming IEXPLORE.EXE to .bak.

Mode Safelist — block every domain except the list below (default, recommended). Domain-based: an entry grants the domain and its subdomains, and nothing else. Open — all URLs allowed. Use only with OS-level lockdown. Blocklist — all URLs allowed except those listed below. Allowlist — only URLs containing a listed string are allowed. Legacy substring semantics; an empty list allows everything. Prefer safelist.

Entries (one per line) Domains, one per line. An entry grants the domain and every subdomain; pasted URLs are normalized to their hostname. Include the domains of third-party resources (CDNs, SSO, analytics) the kiosk content needs — they are blocked too.

Session behavior

Controls how and when the kiosk session resets. All resets wipe browsing data — there is no "soft reset".

Idle timeout (seconds) After this many seconds of no user input, the session resets. Default: 300 (5 min).

On reset Reset only — clear all data, navigate to home. Lock only — show unlock overlay, keep current tab visible behind it. Both — reset then show unlock overlay (default, recommended).

Data persistence allowlist (per-domain, advanced) Domains listed here keep cookies, localStorage, and indexedDB across session resets. Use for SSO flows that require persistent auth (e.g., a patient-portal that takes longer than idle_timeout to complete). Every persisted domain is a potential data leak — list only what you absolutely need.

Power management

How Vestibule handles device sleep. Vestibule detects wake and resets — it does not block sleep. The OS power profile decides whether the device sleeps; that's a deployment-time decision.

Mode Aware — detect wake from sleep, reset session on resume (default, recommended). Always on — block idle sleep via OS inhibit APIs (Phase 3). Use only if OS power profile wasn't set at deploy time.

On wake Reset only — clear all data, navigate to home. Lock only — show unlock overlay. Both — reset then show unlock overlay (default, recommended). Nothing — ignore wake events (testing only; never use in production).

Unlock method

How operators release the kiosk. This is separate from the admin password that protects this wizard.

Method Password — single password (Argon2id hash stored by usher at 0600). PIN — numeric PIN (Argon2id hash stored by usher at 0600). TOTP + password — time-based one-time password plus password (Phase 5+).

Kiosk unlock password Used to release the kiosk session (via the unlock button in the hidden menu). usher stores the Argon2id hash at ~/.config/vestibule/unlock.hash (0600) and verifies every attempt against it. The hash never touches browser storage. Confirm unlock password

Review & save

Confirm the configuration below. Saving overwrites any existing configuration.

Welcome to Vestibule