May 16, 2026 · Deployment

SCADA Kiosk Mode: Lock Down Operator Consoles Without Tauri

Your client wants a dedicated operator console. The computer should do one thing: show the SCADA dashboard. No web browsing. No opening other apps. No Alt-Tab. Auto-start on power failure. And they ask: "Do we need a native app for that?"

No. You need kiosk mode — a browser locked down to a single website. It takes 10 minutes to set up, works on any OS, and costs nothing.

Why Not Tauri or Electron?

Tauri and Electron wrap web apps in native windows. They are useful when you need things browsers cannot do — serial port access, system tray icons, or native file dialogs. But for a locked-down operator console that just displays dashboards, they add complexity without benefit.

Kiosk mode gives you everything you need from the browser you already have:

• Fullscreen with no address bar, tabs, or browser chrome
• No access to other applications (Alt-Tab blocked)
• No right-click context menus
• Auto-start on boot
• Automatic reconnection if the page crashes

The web UI your SCADA already serves is the kiosk UI. No extra build step, no separate codebase, no wrapper to maintain.

Chrome Kiosk Mode

Chrome and Chromium ship with a built-in kiosk flag. One command gives you a fullscreen, locked-down browser:

<code>chromium-browser \
  --kiosk \
  --no-first-run \
  --disable-translate \
  --disable-infobars \
  --disable-session-crashed-bubble \
  --incognito \
  http://localhost:3000</code>

What each flag does:

• --kiosk — fullscreen, no address bar, no tabs, no close button
• --no-first-run — skip the "Welcome to Chrome" wizard
• --disable-translate — no "Translate this page?" popups
• --disable-infobars — suppress "Chrome is being controlled" notifications
• --disable-session-crashed-bubble — no "Restore session?" dialog after reboot
• --incognito — no cached state between sessions

Auto-Start on Reboot

Linux (Most Industrial Setups)

Create two systemd services — one for the SCADA server, one for the kiosk browser:

<code># /etc/systemd/system/voltrus.service
[Unit]
Description=Voltrus SCADA Server
After=network.target

[Service]
ExecStart=/usr/local/bin/voltrus
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target</code>

<code># /etc/systemd/system/voltrus-kiosk.service
[Unit]
Description=Voltrus Kiosk Browser
After=voltrus.service graphical.target
Wants=voltrus.service

[Service]
User=operator
Environment=DISPLAY=:0
ExecStart=/usr/bin/chromium-browser \
  --kiosk \
  --no-first-run \
  --disable-translate \
  --disable-infobars \
  --disable-session-crashed-bubble \
  --incognito \
  http://localhost:3000
Restart=always
RestartSec=10

[Install]
WantedBy=graphical.target</code>

Enable both:

<code>sudo systemctl enable voltrus
sudo systemctl enable voltrus-kiosk
sudo systemctl start voltrus</code>

After reboot, the SCADA server starts first, then Chrome opens fullscreen to the dashboard. If either process crashes, systemd restarts it within seconds.

macOS

Add two items to System Settings → General → Login Items:

• The Voltrus binary (or a launchd plist in ~/Library/LaunchAgents/)
• A Chrome kiosk shortcut (an AppleScript app that runs the open -a "Google Chrome" --args --kiosk command)

Windows

Create a shortcut in the Startup folder (shell:startup):

<code>chrome.exe --kiosk --no-first-run --disable-infobars http://localhost:3000</code>

For the SCADA server, use the same approach as VPS deployment with Windows Services (via nssm or a simple task scheduler entry).

Lock Down the Application Layer

Chrome kiosk mode handles the browser chrome. Add JavaScript event listeners in your SCADA app to block the remaining escape routes:

<code>// Block right-click
document.addEventListener('contextmenu', e => e.preventDefault());

// Block Alt-Tab, Escape, and browser shortcuts
document.addEventListener('keydown', e => {
  const blocked = ['Alt', 'Tab', 'Escape', 'F11', 'F12'];
  if (blocked.includes(e.key)) {
    e.preventDefault();
    return;
  }
  // Block Ctrl+W, Ctrl+T, Ctrl+N, Ctrl+L, etc.
  if (e.ctrlKey || e.metaKey) {
    const combos = ['w', 't', 'n', 'l', 'r', 'p', 's'];
    if (combos.includes(e.key.toLowerCase())) {
      e.preventDefault();
    }
  }
  // Block Ctrl+Shift+I/J/C (DevTools)
  if ((e.ctrlKey || e.metaKey) && e.shiftKey) {
    e.preventDefault();
  }
});</code>

This blocks right-click context menus, the most common browser shortcuts, and developer tools access. Combined with Chrome kiosk flags, the operator sees only the dashboard.

Physical Security

Software lockdown is one layer. For a production control room:

• Touchscreen only — remove the keyboard. No keyboard means no shortcut to escape kiosk mode.
• Locked enclosure — the PC lives in a cabinet. Operators only see the monitor.
• Network isolation — the kiosk PC connects only to the SCADA server, not the internet. Configure this at the switch/router level.
• UPS — an uninterruptible power supply ensures the console survives brief power dips without restarting.

Monitoring the Kiosk

If the kiosk browser crashes or the page goes blank, you want to know. Two approaches:

• systemd watchdog — the Restart=always directive handles process crashes automatically.
• Health check endpoint — set up a cron job that curls /health every 60 seconds and sends an alert if it fails. This catches application-level issues that a process watchdog cannot.

<code># /etc/cron.d/voltrus-health
* * * * * operator curl -sf http://localhost:3000/health || echo "Voltrus down" | mail -s "Kiosk Alert" admin@plant.local</code>

When You Actually Need Tauri

Kiosk mode covers 95% of operator console requirements. You only need a native wrapper like Tauri if:

• Serial port access — the kiosk PC needs to talk to a USB-to-RS485 adapter directly
• Raw TCP/UDP from client — the operator machine connects directly to PLCs (no server in between)
• System tray — you want a background process with a system tray icon
• Auto-update — native apps can self-update more seamlessly than PWAs

For a standard SCADA kiosk that shows dashboards and sends commands through the server, the browser is enough.

Frequently Asked Questions

Do I need Tauri or Electron for SCADA kiosk mode?

No. Chrome and Chromium support native kiosk mode with a command-line flag. You get fullscreen, no address bar, no Alt-Tab, and no way to access other applications — without installing any additional software. Tauri or Electron only make sense if you need things browsers cannot do, like serial port access or system-level tray icons.

How do I auto-start SCADA on reboot?

On Linux, create two systemd services: one for the SCADA server binary and one for the Chrome kiosk browser. Set the browser service to start after the server using After= and WantedBy=graphical.target. On macOS, add both the binary and a Chrome kiosk shortcut to System Settings → General → Login Items. On Windows, add a startup shortcut to the Startup folder.

Can operators bypass kiosk mode?

With proper configuration, no. Chrome kiosk mode disables the address bar, keyboard shortcuts for opening new tabs, and the OS task switcher. Additional JavaScript event listeners block right-click context menus, drag operations, and developer tools shortcuts. For physical security, use a locked enclosure and remove the keyboard (touchscreen only).

What hardware do I need for a SCADA kiosk?

Any machine that can run Chrome. For a wall-mounted operator display, a Raspberry Pi 4 with a touchscreen works. For a dedicated console, a mini PC (Intel NUC, Lenovo Tiny) with a monitor is standard. The SCADA server can run on the same machine or on a separate server accessible over the network.

Does kiosk mode work with Voltrus?

Yes. Voltrus includes a built-in kiosk mode hook that blocks right-click, Alt-Tab, Ctrl+W, Ctrl+T, and other browser shortcuts from the application side. Combined with Chrome kiosk flags, this provides a fully locked-down operator console. Enable it in your Voltrus configuration.

Further Reading

• Deploying SCADA on a $4 VPS
• Running SCADA on a Raspberry Pi
• SCADA Architecture Explained
• Lightweight SCADA Software: What It Actually Means
• On-Premise vs Cloud SCADA