Files
2026-04-20 09:09:50 -07:00

536 lines
18 KiB
YAML

# =============================================================================
# VesperOS Configuration Profile Schema
# Package : vesperprofiled-config-schema
# Version : 1.0.0
# Installed at: /usr/share/vesperprofiled/schema/profile.schema.yml
#
# vesperprofiled reads this file at startup to determine which payload
# types and fields are valid for this installation. OEMs may ship a
# trimmed version of this schema to restrict which payloads their build
# supports — only payload types listed here will be accepted.
#
# Schema versioning:
# schema-version — incremented when fields are added or removed.
# vesperprofiled checks that its own compiled-in schema-version matches
# or is compatible with the installed schema package version.
# Compatibility rule: daemon >= schema version (newer daemon, older schema ok).
#
# OEM customisation:
# To restrict available payload types, create a trimmed copy of this file
# and ship it as your own vesperprofiled-config-schema package with a
# custom Provides: field. Remove entire payload blocks for unsupported types.
# The daemon will reject any profile containing an unlisted payload type.
# =============================================================================
schema-version: "1.0.0"
# ---------------------------------------------------------------------------
# Allowed payload types for this schema version.
# Remove entries to restrict what profiles may contain on this platform.
# ---------------------------------------------------------------------------
allowed-payload-types:
- mdm
- scep
- pkcs12
- cert
- cert-preference
- cert-transparency
- wifi
- ethernet
- vpn
- vpn-per-app
- email
- exchange
- caldav
- calendar-subscription
- carddav
- ldap
- passcode
- restrictions
- kiosk
- asam
- proxy-http
- dns-proxy
- domains
- network-usage-rules
- cellular
- web-filter
- web-clip
- font
- notifications
- sso
- active-directory
- ad-certificate
- time-server
- software-update
- firewall
- privacy
- parental-controls
- removal-password
- identification
- google-account
- home-screen
- desktop
- screensaver
- global-preferences
- shared-device
- education
- airprint
- airplay
- airplay-security
- system-policy
- system-policy-rule
- smartcard
- kernel-extension-policy
- media-management
- full-disk-encryption
- fde-escrow
- first-boot
- setup-assistant # alias for first-boot; always include alongside first-boot
# ---------------------------------------------------------------------------
# Signing requirements by payload type.
# Payloads listed here REQUIRE a signed (CMS/PKCS#7) profile envelope.
# Unsigned profiles containing any of these types will be rejected.
# ---------------------------------------------------------------------------
signing-required:
- mdm
- removal-password
- kiosk
- asam
# ---------------------------------------------------------------------------
# Singleton payload types.
# Only one instance of each of these is permitted per profile.
# ---------------------------------------------------------------------------
singletons:
- mdm
- passcode
- restrictions
- kiosk
- asam
- proxy-http
- web-filter
- global-preferences
- shared-device
- parental-controls
- removal-password
- identification
- home-screen
- airplay-security
- system-policy
- first-boot
- setup-assistant
# ---------------------------------------------------------------------------
# Payload field definitions.
# Each entry documents the fields for one payload type.
# The daemon uses this for validation — unknown fields in a profile
# are logged as warnings but do not block installation.
# Required fields that are missing will block installation.
# ---------------------------------------------------------------------------
payloads:
# ── Top-level profile fields ─────────────────────────────────────────────
profile:
required: [id, uuid, version]
optional:
version: { type: integer, value: 1 }
id: { type: string, pattern: "reverse-dns" }
uuid: { type: string, pattern: "uuid-v4" }
scope: { type: enum, values: [system, user], default: user }
meta: { type: object }
lifecycle: { type: object }
consent: { type: object }
lifecycle:
optional:
removal: { type: enum, values: [free, locked, password], default: free }
expires-at: { type: string, pattern: "iso8601" }
expires-after: { type: integer, description: "Seconds from install" }
ota-refresh-after: { type: string, pattern: "iso8601" }
# ── MDM ──────────────────────────────────────────────────────────────────
mdm:
required: [server-url, identity-cert-uuid, access-rights, push-topic]
optional:
checkin-url: { type: string }
sign-messages: { type: boolean, default: false }
checkout-on-removal: { type: boolean, default: false }
use-development-push: { type: boolean, default: false }
capabilities: { type: array }
# ── SCEP ─────────────────────────────────────────────────────────────────
scep:
required: [url, challenge]
optional:
instance-name: { type: string }
subject: { type: array }
key: { type: object }
san: { type: object }
ca-fingerprint: { type: string, encoding: base64 }
retries: { type: integer, default: 3 }
retry-delay-seconds: { type: integer, default: 10 }
# ── Certificates ─────────────────────────────────────────────────────────
pkcs12:
required: [data]
optional:
password: { type: string }
all-apps-access: { type: boolean, default: false }
cert:
required: [data]
cert-preference:
required: [name, cert-uuid]
# ── Wi-Fi ────────────────────────────────────────────────────────────────
wifi:
required: [ssid]
optional:
hidden: { type: boolean, default: false }
auto-join: { type: boolean, default: true }
security: { type: object }
mac-address-mode: { type: enum, values: [hardware, random], default: hardware }
hotspot: { type: object }
proxy: { type: object }
eap: { type: object }
qos-marking: { type: object }
# ── Ethernet ─────────────────────────────────────────────────────────────
ethernet:
optional:
interface: { type: string, default: first-active }
eap: { type: object }
# ── VPN ──────────────────────────────────────────────────────────────────
vpn:
optional:
display-name: { type: string }
full-tunnel: { type: boolean, default: false }
on-demand: { type: object }
ikev2: { type: object }
l2tp: { type: object }
custom: { type: object }
vpn-per-app:
required: [vpn-uuid]
optional:
app-mappings: { type: array }
browser-domains: { type: array }
# ── Mail accounts ─────────────────────────────────────────────────────────
email:
required: [account, incoming, outgoing]
optional:
smime: { type: object }
restrictions: { type: object }
exchange:
required: [server, account]
optional:
sync: { type: object }
smime: { type: object }
restrictions: { type: object }
caldav:
required: [host, username]
optional:
description: { type: string }
port: { type: integer }
ssl: { type: boolean, default: true }
principal-url: { type: string }
password: { type: string }
use-oauth: { type: boolean, default: false }
calendar-subscription:
required: [url]
optional:
description: { type: string }
username: { type: string }
password: { type: string }
ssl: { type: boolean, default: true }
carddav:
required: [host, username]
optional:
description: { type: string }
port: { type: integer }
ssl: { type: boolean, default: true }
principal-url: { type: string }
password: { type: string }
use-oauth: { type: boolean, default: false }
# ── Directory ─────────────────────────────────────────────────────────────
ldap:
required: [host]
optional:
description: { type: string }
ssl: { type: boolean, default: true }
username: { type: string }
password: { type: string }
search-settings: { type: array }
# ── Security policies ─────────────────────────────────────────────────────
passcode:
optional:
require: { type: boolean, default: true }
allow-simple: { type: boolean, default: true }
require-alphanumeric: { type: boolean, default: false }
min-length: { type: integer, default: 6 }
min-complex-chars: { type: integer, default: 0 }
expiry: { type: object }
lockout: { type: object }
force-change-at-next-login: { type: boolean, default: false }
custom-regex: { type: object }
restrictions:
optional:
apps: { type: object }
hardware: { type: object }
network: { type: object }
cloud: { type: object }
browser: { type: object }
content-ratings: { type: object }
sharing: { type: object }
open-in: { type: object }
user: { type: object }
input: { type: object }
kiosk:
required: [app]
optional:
hardware: { type: object }
accessibility:{ type: object }
asam:
required: [allowed-apps]
removal-password:
required: [password]
# ── Network ───────────────────────────────────────────────────────────────
proxy-http:
required: [proxy]
dns-proxy:
required: [app-bundle-id]
optional:
extension-bundle-id: { type: string }
config: { type: object }
domains:
optional:
email-domains: { type: array }
web-domains: { type: array }
tracking-relaxed-domains: { type: array }
network-usage-rules:
required: [rules]
cellular:
optional:
attach-apn: { type: object }
apns: { type: array }
# ── Content filtering ─────────────────────────────────────────────────────
web-filter:
required: [mode]
optional:
built-in: { type: object }
plugin: { type: object }
# ── UI shortcuts ──────────────────────────────────────────────────────────
web-clip:
required: [label, url]
optional:
removable: { type: boolean, default: true }
full-screen: { type: boolean, default: false }
icon: { type: string, encoding: base64 }
target-app: { type: string }
font:
required: [font-name, data]
# ── Device experience ─────────────────────────────────────────────────────
notifications:
required: [apps]
sso:
optional:
display-name: { type: string }
kerberos: { type: object }
identification:
optional:
full-name: { type: string }
email: { type: string }
username: { type: string }
password: { type: string }
prompt: { type: string }
google-account:
required: [address]
optional:
description: { type: string }
display-name: { type: string }
services: { type: object }
home-screen:
optional:
dock: { type: array }
pages: { type: array }
desktop:
optional:
wallpaper: { type: object }
screensaver:
optional:
module: { type: string }
idle-seconds: { type: integer, default: 300 }
locked: { type: boolean, default: false }
# ── Enterprise / desktop ──────────────────────────────────────────────────
active-directory:
required: [server]
optional:
admin-username: { type: string }
admin-password: { type: string }
computer-name: { type: string }
organizational-unit: { type: string }
user-experience: { type: object }
password-policy: { type: object }
mobile-accounts: { type: object }
local-admin-groups: { type: array }
uid-mapping: { type: string }
gid-mapping: { type: string }
trust-change-interval-days: { type: integer }
restrict-ddns-interfaces: { type: array }
allow-multi-domain-auth: { type: boolean }
ad-certificate:
required: [server, template, authority]
optional:
acquisition: { type: enum, values: [rpc, http], default: rpc }
description: { type: string }
key: { type: object }
renewal: { type: object }
prompt-for-credentials: { type: boolean, default: false }
cert-transparency:
optional:
disabled: { type: object }
required: { type: object }
time-server:
required: [server]
software-update:
optional:
catalog-url: { type: string }
automatic: { type: object }
deferral: { type: object }
allow-pre-release: { type: boolean, default: false }
require-admin-to-install: { type: boolean, default: false }
firewall:
optional:
enabled: { type: boolean, default: false }
block-all-incoming: { type: boolean, default: false }
stealth-mode: { type: boolean, default: false }
apps: { type: array }
privacy:
required: [services]
parental-controls:
optional:
apps: { type: object }
web: { type: object }
time-limits: { type: object }
content: { type: object }
global-preferences:
optional:
multi-session-enabled: { type: boolean, default: false }
shared-device:
optional:
enabled: { type: boolean, default: true }
temporary-session: { type: object }
user-session: { type: object }
quota-mb: { type: integer }
education:
required: [organization]
optional:
resource-cert-uuid: { type: string }
device-groups: { type: array }
users: { type: array }
departments: { type: array }
# ── AirPlay / AirPrint ────────────────────────────────────────────────────
airprint:
required: [printers]
airplay:
optional:
allowlist: { type: array }
passwords: { type: array }
airplay-security:
required: [security, access]
optional:
password: { type: string }
# ── macOS / desktop system policy ─────────────────────────────────────────
system-policy:
optional:
gatekeeper-enabled: { type: boolean, default: true }
allow-identified-developers: { type: boolean, default: true }
system-policy-rule:
required: [rules]
smartcard:
optional:
on-token-removal: { type: enum, values: [none, lock, logout], default: none }
cert-trust: { type: enum, values: [off, basic, ocsp, hard], default: off }
enabled: { type: boolean, default: true }
enforce: { type: boolean, default: false }
user-pairing: { type: boolean, default: true }
one-card-per-user: { type: boolean, default: false }
allow-unmapped-users: { type: boolean, default: true }
kernel-extension-policy:
optional:
allow-user-approvals: { type: boolean, default: false }
allowed-extensions: { type: array }
media-management:
required: [media]
full-disk-encryption:
optional:
state: { type: enum, values: [on, off], default: off }
defer: { type: object }
recovery-key:{ type: object }
escrow-cert: { type: string, encoding: base64 }
cert-uuid: { type: string }
fde-escrow:
required: [location, encrypt-cert-uuid]
optional:
device-key: { type: string, default: serial-number }
# ── First boot ────────────────────────────────────────────────────────────
first-boot:
optional:
skip: { type: array, description: "Pane names to skip on first boot" }
setup-assistant:
optional:
skip: { type: array, description: "Alias for first-boot — same fields" }