setup: Ubuntu GNOME-on-Xorg desktop + setup.sh hardening

setup-desktop.sh now installs ubuntu-desktop + gdm3 + x11vnc and forces the
Xorg session (WaylandEnable=false) with auto-login — x11vnc can only mirror an
Xorg :0, not Wayland. vnc-manager.ts resolves the X authority from the GDM
per-session path (/run/user/<uid>/gdm/Xauthority) with a ~/.Xauthority fallback.

setup.sh fixes:
- desktop step gates on `dpkg -s ubuntu-desktop` (was the decommissioned
  officer-vnc service, which never matched so setup-desktop re-ran every time)
- remove Pi (install, --list-models validation, verification check)
- export GOPATH before the cliamp build so `go install` lands where it's checked
  even when Go was already present this run
- write PUBLIC_BUILD_ENV=production and quote all .env values
- guard the interactive .env block behind a TTY check so non-interactive runs
  skip cleanly instead of aborting on read EOF under set -e
- restart systemd-logind only when a key actually changed
- sed prefix-strip instead of `tr -d` (which deletes characters, not a prefix)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/setup-desktop.sh

@@ -1,24 +1,63 @@
 #!/bin/bash
 set -euo pipefail
 
-# Officer Remote Desktop Setup — System packages only.
-# Per-user VNC config is handled by user provisioning (provision.ts).
+# Officer Remote Desktop Setup — Ubuntu GNOME desktop on Xorg, mirrored over VNC.
+#
+# The platform mirrors the single physical display :0 with x11vnc (see vnc-manager.ts). x11vnc can only
+# capture an Xorg server, NOT a Wayland compositor — so we install the full GNOME desktop but force GDM
+# onto the Xorg session (WaylandEnable=false). Auto-login is enabled so a user session owns :0 for the
+# mirror to attach to. Switching the display manager takes effect on the next reboot.
 # Usage: ./scripts/setup-desktop.sh
 
-echo "=== Officer Remote Desktop Setup ==="
+echo "=== Officer Remote Desktop Setup (Ubuntu GNOME on Xorg) ==="
 echo ""
 
-# --- Step 1: Install system packages ---
-echo "[1/4] Installing system packages..."
+DESKTOP_USER="$(whoami)"
+
+# --- Step 1: Install GNOME desktop + GDM + x11vnc ---
+echo "[1/5] Installing ubuntu-desktop, GDM, x11vnc..."
 sudo apt update -qq
 sudo DEBIAN_FRONTEND=noninteractive apt install -y -qq \
-  xfce4 xfce4-goodies \
-  tigervnc-standalone-server tigervnc-common \
+  ubuntu-desktop \
+  gdm3 \
+  x11vnc \
   dbus-x11
 echo "  Done."
 
-# --- Step 2: Install Brave browser (native .deb, not snap) ---
-echo "[2/4] Installing Brave browser..."
+# --- Step 2: Force GDM onto Xorg + enable auto-login (x11vnc cannot mirror Wayland) ---
+echo "[2/5] Forcing Xorg session and auto-login in GDM..."
+GDM_CONF=/etc/gdm3/custom.conf
+sudo mkdir -p /etc/gdm3
+[ -f "$GDM_CONF" ] || echo "[daemon]" | sudo tee "$GDM_CONF" > /dev/null
+# Ensure a [daemon] section exists to anchor the keys under.
+sudo grep -qE '^\[daemon\]' "$GDM_CONF" || echo "[daemon]" | sudo tee -a "$GDM_CONF" > /dev/null
+
+# Set key=value under [daemon]: rewrite an existing (possibly commented) line, else insert after [daemon].
+set_gdm_key() {
+  local key="$1" val="$2"
+  if sudo grep -qE "^[[:space:]]*#?[[:space:]]*${key}=" "$GDM_CONF"; then
+    sudo sed -i "s|^[[:space:]]*#\?[[:space:]]*${key}=.*|${key}=${val}|" "$GDM_CONF"
+  else
+    sudo sed -i "/^\[daemon\]/a ${key}=${val}" "$GDM_CONF"
+  fi
+}
+
+set_gdm_key WaylandEnable false
+set_gdm_key AutomaticLoginEnable true
+set_gdm_key AutomaticLogin "$DESKTOP_USER"
+echo "  Xorg forced (WaylandEnable=false), auto-login as $DESKTOP_USER."
+
+# --- Step 3: Make GDM the default display manager ---
+echo "[3/5] Setting GDM as the default display manager..."
+echo "/usr/sbin/gdm3" | sudo tee /etc/X11/default-display-manager > /dev/null
+sudo systemctl enable gdm3 >/dev/null 2>&1 || sudo systemctl enable gdm >/dev/null 2>&1 || true
+sudo systemctl set-default graphical.target >/dev/null 2>&1 || true
+# Disable any prior display manager (e.g. lightdm from an XFCE setup) so it doesn't fight GDM.
+sudo systemctl disable lightdm >/dev/null 2>&1 || true
+echo "  Done (takes effect on next reboot)."
+
+# --- Step 4: Install Brave browser (native .deb, not snap) ---
+echo "[4/5] Installing Brave browser..."
 if ! command -v brave-browser-stable > /dev/null 2>&1; then
   sudo curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg \
     https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
@@ -32,24 +71,20 @@ if [ -f /opt/brave.com/brave/brave-browser ]; then
   sudo rm -f /usr/bin/brave-browser-stable
   sudo ln -s /opt/brave.com/brave/brave-browser /usr/bin/brave-browser-stable
 fi
-# Tell Brave to use basic password store (no GNOME Keyring prompts)
+# Tell Brave to use basic password store (no keyring prompts)
 sudo mkdir -p /etc/brave
 echo '--password-store=basic' | sudo tee /etc/brave/brave-flags.conf > /dev/null
 echo "  Done."
 
-# --- Step 3: Remove GNOME Keyring (prevents password prompts on login) ---
-echo "[3/4] Removing GNOME Keyring..."
+# --- Step 5: Remove GNOME Keyring + set default browser (prevents password prompts on login) ---
+echo "[5/5] Removing GNOME Keyring and setting default browser..."
 sudo apt remove -y --purge gnome-keyring > /dev/null 2>&1 || true
 rm -rf ~/.local/share/keyrings
-echo "  Done."
-
-# --- Step 4: Set default browser ---
-echo "[4/4] Setting default browser..."
 if command -v brave-browser-stable > /dev/null 2>&1; then
   sudo update-alternatives --set x-www-browser /opt/brave.com/brave/brave 2>/dev/null || true
   echo "  Brave set as default."
 else
-  echo "  No supported browser found, skipping."
+  echo "  No supported browser found, skipping default."
 fi
 
 # --- Cleanup old systemd service if it exists ---
@@ -64,4 +99,5 @@ if systemctl list-unit-files officer-vnc.service &>/dev/null; then
 fi
 
 echo ""
-echo "Setup complete. Per-user VNC sessions are managed by the VNC sidecar."
+echo "Setup complete. The screen mirror (x11vnc on :0) is managed by the VNC sidecar."
+echo "REBOOT to switch into the GNOME-on-Xorg session with auto-login."