Allow forcing password change after prep

pikit-prep.sh

@@ -13,6 +13,7 @@ PIKIT_SSH_KEY="${PIKIT_SSH_KEY:-$HOME/.ssh/pikit}"
 PIKIT_SSH_OPTS="${PIKIT_SSH_OPTS:-}"
 PIKIT_REMOTE_TMP="${PIKIT_REMOTE_TMP:-/tmp/pikit-prep.sh}"
 PIKIT_SELF_DELETE="${PIKIT_SELF_DELETE:-0}"
+PIKIT_FORCE_PASSWORD_CHANGE="${PIKIT_FORCE_PASSWORD_CHANGE:-0}"
 
 MODE="both"
 LOCAL_ONLY=0
@@ -32,6 +33,9 @@ Options:
   --check-only  Run checks only (no prep)
   --local       Force local execution (no SSH copy)
   --help        Show this help
+
+Env:
+  PIKIT_FORCE_PASSWORD_CHANGE=1  Force dietpi to change password on next login
 USAGE
 }
 
@@ -206,6 +210,12 @@ prep_image() {
   # --- Default login ---
   if id -u dietpi >/dev/null 2>&1; then
     echo "dietpi:pikit" | chpasswd && status CLEANED "reset dietpi password" || status FAIL "reset dietpi password"
+    case "${PIKIT_FORCE_PASSWORD_CHANGE,,}" in
+      1|true|yes|on)
+        chage -d 0 dietpi && status CLEANED "force dietpi password change on next login" || status FAIL "force dietpi password change"
+        ;;
+      *) ;;
+    esac
   else
     status SKIP "dietpi user missing"
   fi