From 7d8341d3ba4dd0f780b611dc06e268f311a6da52 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Wed, 15 Jul 2026 22:23:33 +0000 Subject: [PATCH] note the leftover officer-vnc.service unit in TODO the hand-installed systemd unit kept a parallel xfce session on :1 alive and respawned it on every kill, independently of the platform. obsolete now that the desktop panel mirrors :0; disabled, but the unit file is still on disk. Co-Authored-By: Claude Opus 4.8 --- TODO.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/TODO.md b/TODO.md index de61383a..6eb04149 100644 --- a/TODO.md +++ b/TODO.md @@ -40,6 +40,15 @@ Deferred work. Context: Officer is collapsing from multi-tenant / open-source-re ## Infra (alpha) +- [ ] **Delete `/etc/systemd/system/officer-vnc.service`.** Hand-installed unit (not in this repo) + that ran `vncserver :1 -geometry 1920x1080 -localhost yes -fg` with `Restart=on-failure`, + enabled at boot — it kept a whole parallel XFCE session alive on `:1` (283 MB, 166 tasks) + independently of the platform, and silently respawned it whenever the display was killed. + Obsolete now that the Desktop panel mirrors `:0` via x11vnc. Disabled 2026-07-15 + (`systemctl disable --now`), but the unit file is still on disk. Nothing in the codebase + recreates it and nothing documents it, so delete the file rather than leave a mystery service + one `systemctl enable` away from returning. + - [ ] **`ufw` blocks port 9010 on the LAN.** Default deny incoming; only `22/tcp`, `80/tcp`, `443/tcp`, and everything on `tailscale0` are allowed — so `http://192.168.47.196:9010` is unreachable from the LAN while localhost and Tailscale work.