Allow forcing password change after prep

docs/workflow.md

@@ -9,7 +9,7 @@ This documents the *current* workflow and the *target* workflow once profiles +
    - DietPi dashboard
 3) Update the system if needed.
 4) Run the prep scrub + verify:
-   - `sudo ./pikit-prep.sh`
+   - `sudo PIKIT_FORCE_PASSWORD_CHANGE=1 ./pikit-prep.sh` (recommended)
    - (optional) `sudo ./pikit-prep.sh --check-only`
 5) Image the SD card with DietPi Imager.
 6) Store it as the golden base (e.g., `images/base/pikit-base-YYYYMMDD.img.xz`).
@@ -25,7 +25,7 @@ This documents the *current* workflow and the *target* workflow once profiles +
 5) Open any needed ports in ufw (done as part of testing/config):
    - `sudo ufw allow from <LAN subnet> to any port <port>`
 6) Run the prep scrub + verify:
-   - `sudo ./pikit-prep.sh`
+   - `sudo PIKIT_FORCE_PASSWORD_CHANGE=1 ./pikit-prep.sh` (recommended)
    - (optional) `sudo ./pikit-prep.sh --check-only`
 7) Image the SD card via the QEMU DietPi VM:
    - Insert the SD card into your desktop.
@@ -53,7 +53,7 @@ This documents the *current* workflow and the *target* workflow once profiles +
 5) Run the drift check (planned script):
    - Confirms services + ports match the profile + base.
 6) Run the prep scrub + verify:
-   - `sudo ./pikit-prep.sh`
+   - `sudo PIKIT_FORCE_PASSWORD_CHANGE=1 ./pikit-prep.sh` (recommended)
    - (optional) `sudo ./pikit-prep.sh --check-only`
 7) Image the SD card with DietPi Imager.
 

pikit-prep.sh

@@ -13,6 +13,7 @@ PIKIT_SSH_KEY="${PIKIT_SSH_KEY:-$HOME/.ssh/pikit}"
 PIKIT_SSH_OPTS="${PIKIT_SSH_OPTS:-}"
 PIKIT_REMOTE_TMP="${PIKIT_REMOTE_TMP:-/tmp/pikit-prep.sh}"
 PIKIT_SELF_DELETE="${PIKIT_SELF_DELETE:-0}"
+PIKIT_FORCE_PASSWORD_CHANGE="${PIKIT_FORCE_PASSWORD_CHANGE:-0}"
 
 MODE="both"
 LOCAL_ONLY=0
@@ -32,6 +33,9 @@ Options:
   --check-only  Run checks only (no prep)
   --local       Force local execution (no SSH copy)
   --help        Show this help
+
+Env:
+  PIKIT_FORCE_PASSWORD_CHANGE=1  Force dietpi to change password on next login
 USAGE
 }
 
@@ -206,6 +210,12 @@ prep_image() {
   # --- Default login ---
   if id -u dietpi >/dev/null 2>&1; then
     echo "dietpi:pikit" | chpasswd && status CLEANED "reset dietpi password" || status FAIL "reset dietpi password"
+    case "${PIKIT_FORCE_PASSWORD_CHANGE,,}" in
+      1|true|yes|on)
+        chage -d 0 dietpi && status CLEANED "force dietpi password change on next login" || status FAIL "force dietpi password change"
+        ;;
+      *) ;;
+    esac
   else
     status SKIP "dietpi user missing"
   fi