Thank you for this!

[jello3d]

This is great work - super clean and efficient.

I have wanted to deploy HA to some kiosk machines. The problem is that the sensors I need require the tray, and the tray is not in any way protected from tampering. I'm thinking a basic password to prevent accessing the settings interface, and a checkbox to remove the options from the tray icon, along with a way to restart the tray app if killed.

While it's technically possible to edit the settings.json, that's easier to deal with than direct access to the interface.

Thanks again

[v1k70rk4]

Thanks, glad you like it!

Good idea. I had a look through the code and it's a small enough job, so I've opened #155 for it. The plan: a Kiosk mode in the Danger Zone, where you pick the Windows users who keep the full app, and everyone else only sees "Kiosk mode" in the tray, with no window or menu. Instead of a password, the settings become read-only for them through Windows file permissions, since a password wouldn't stop anyone who can close the app or edit the file. The tray app starts at logon and comes back if it's closed or crashes, and all of it goes to the event log.

If the Home Assistant 2026.11 beta doesn't eat up my time, it could be ready around the 2026.11 release. Follow #155 for updates.

[v1k70rk4]

@jello3d Kiosk mode is in, and I'd be glad if you gave it a go on one of those machines: 10.11.0-beta.2 is out for testing.

Two ways to get it:

• download the installer from the release page: https://github.com/v1k70rk4/HASS.Agent.NET10/releases/tag/v10.11.0-beta.2
• or, on a PC that already has 10.10.2, tick Beta updates in the Danger Zone and install it from the update entity in Home Assistant.

It turned out a bit different from what I wrote above, the other way round in fact: in the Danger Zone you tick the Windows users who get the kiosk app, and everyone else keeps the full one (administrators can't be ticked, they always keep the full app). For a kiosk user the tray shows only the icon, no menu and no window, the settings folder is read-only for them through Windows permissions, and a scheduled task starts the app at logon and brings it back within a second if it's closed or crashes (within a minute if it's killed from Task Manager). The service installs updates silently, so a kiosk PC updates from Home Assistant like any other. Everything it does goes to the event log under its own source. The details are here: https://github.com/v1k70rk4/HASS.Agent.NET10/blob/main/docs/features/kiosk.md

It's tested on my own machines with local users; a domain user as the kiosk user is the one thing I couldn't test, so if that's your setup, I'm doubly interested in how it behaves. Anything odd, write here or in a new issue.

[jello3d]

I hate to ask this... because you did address the issue the correct and appropriate way (THANK YOU SO MUCH)... but I have an edge case where other admins are also kiosk users - long story, but it's better than it sounds. I understand that hiding the tray options would only be obfuscation, not actual protection... but it would have the effect I was hoping for. We don't necessarily need to password the interface, as long as the tray icon doesn't launch it. That would force someone to go digging, and they aren't in a position to do that.

So, maybe an extra checkbox to disable the tray options for all? pretty please?

[v1k70rk4]

@jello3d Done, it's in 10.11.0-beta.3: administrators can be ticked too. It turned out to be a small code change: the HASS.Agent Kiosk group alone decides now, administrator or not, so an admin added with Windows' own tools gets the kiosk tray as well. The window asks first, since for an administrator it is a cover, not a lock: they can take themselves out of the group or turn kiosk mode off, and the full app is back at their next logon. As long as the admin doesn't know how to turn it off, it protects just fine. 🙂 The one thing that stays: in the window you can't tick yourself; from the command line you can.

Release: https://github.com/v1k70rk4/HASS.Agent.NET10/releases/tag/v10.11.0-beta.3 (or Beta updates in the Danger Zone, as before). Let me know how it goes on your machines.

[v1k70rk4]

10.11.0 is out as a stable release now, with the administrator-as-kiosk-user change in it: https://github.com/v1k70rk4/HASS.Agent.NET10/releases/tag/v10.11.0. Thanks for the idea and for trying the betas.