net.dcos.Vestibule Vestibule Kiosk lockdown browser toolkit — provision a public terminal in one command Jeremy Anderson info@dcos.net CC0-1.0 MIT https://dcos.net https://dcos.net

Vestibule turns a Linux machine into a public-facing kiosk browser built on LibreWolf ESR plus a small Rust native helper (usher). The device is the kiosk, not an app pretending to be one: the cage Wayland compositor runs LibreWolf as the only client on a VT, under systemd supervision, with every session sanitized on idle timeout, wake-from-sleep, and unlock.

This package is the deployment kit. It ships the usher binary, the Vestibule WebExtension, enterprise policies, and the provisioning scripts. Running it prints the exact host-side command that turns the machine (or any machine with this Flatpak installed) into a kiosk — no manual OS configuration required.

net.dcos.Vestibule.desktop

Safe-by-default navigation.

  • New safelist URL policy mode — the default: every domain is blocked until the operator lists it
  • Domain-based matching replaces substring matching for the safelist; subdomains covered, smuggle attempts blocked
  • Home-origin guarantee: the kiosk home page is always navigable, whatever the list says
  • Blocked top-level navigations land on an in-extension block page instead of a raw connection error
  • Admin wizard validates the home URL against the safelist live and at save time, with one-click domain add
  • 62-assertion unit suite for the URL policy engine (scripts/test-url-policy.js), wired into CI
  • Relicensed MIT (was Apache 2.0)

Production readiness pass.

  • Constant-time admin password verification in the wizard
  • Table-driven smoke test; step-down browser/flavor resolution in the provisioning scripts
  • Launcher dispatch integration-tested across all browser/flavor permutations
  • Deprovision resets each policy directory to its pre-Vestibule baseline

Phase 2 — deployability.

  • cage systemd kiosk session provisioning (native + Flatpak LibreWolf)
  • Windows AssignedAccess / Shell Launcher provisioning wizard
  • Inno Setup installer + this Flatpak packaging
  • Full deprovision on both platforms

Phase 1 — Argon2id unlock, dedicated unlock popup, Windows power events, per-origin cookie preservation, systemd supervision, CI matrix.