vnc sidecar: per-user desktop sessions via sidecar architecture
replaces the single hardcoded systemd VNC service with a dynamic sidecar that manages per-user VNC sessions on demand. any authenticated user can now access their own desktop, not just Super Admin. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 4.6
@@ -3,20 +3,12 @@ set -euo pipefail
|
||||
|
||||
echo "=== Cleaning up Remote Desktop setup ==="
|
||||
|
||||
# Stop and remove VNC service
|
||||
echo "[1/6] Removing VNC service..."
|
||||
sudo systemctl stop officer-vnc 2>/dev/null || true
|
||||
sudo systemctl disable officer-vnc 2>/dev/null || true
|
||||
sudo rm -f /etc/systemd/system/officer-vnc.service
|
||||
sudo systemctl daemon-reload
|
||||
vncserver -kill :1 2>/dev/null || true
|
||||
|
||||
# Remove VNC config
|
||||
echo "[2/6] Removing VNC config..."
|
||||
echo "[1/5] Removing VNC config..."
|
||||
rm -rf ~/.vnc
|
||||
|
||||
# Remove Brave
|
||||
echo "[3/6] Removing Brave..."
|
||||
echo "[2/5] Removing Brave..."
|
||||
sudo apt remove -y --purge brave-browser 2>/dev/null || true
|
||||
sudo rm -f /usr/share/keyrings/brave-browser-archive-keyring.gpg
|
||||
sudo rm -f /etc/apt/sources.list.d/brave-browser-release.list
|
||||
@@ -25,20 +17,20 @@ sudo rm -f /usr/bin/brave-browser-stable
|
||||
rm -rf ~/.config/BraveSoftware
|
||||
|
||||
# Remove Chromium (snap + deb)
|
||||
echo "[4/6] Removing Chromium..."
|
||||
echo "[3/5] Removing Chromium..."
|
||||
sudo snap remove chromium 2>/dev/null || true
|
||||
sudo apt remove -y --purge chromium-browser 2>/dev/null || true
|
||||
rm -rf ~/.config/chromium
|
||||
|
||||
# Remove XFCE, TigerVNC, dbus-x11
|
||||
echo "[5/6] Removing XFCE, TigerVNC, dbus-x11..."
|
||||
echo "[4/5] Removing XFCE, TigerVNC, dbus-x11..."
|
||||
sudo apt remove -y --purge xfce4 xfce4-goodies tigervnc-standalone-server tigervnc-common dbus-x11 2>/dev/null || true
|
||||
sudo apt autoremove -y 2>/dev/null || true
|
||||
rm -rf ~/.config/xfce4
|
||||
rm -rf ~/.cache/xfce4
|
||||
|
||||
# Remove keyring data
|
||||
echo "[6/6] Removing keyring data..."
|
||||
echo "[5/5] Removing keyring data..."
|
||||
rm -rf ~/.local/share/keyrings
|
||||
rm -f ~/.config/autostart/gnome-keyring-*.desktop
|
||||
sudo apt install -y -qq gnome-keyring > /dev/null 2>&1 || true # Restore if needed by other apps
|
||||
|
||||
@@ -160,6 +160,29 @@ while IFS='|' read -r email username; do
|
||||
sudo mkdir -p "$HOME_DIR/.local/bin"
|
||||
sudo mkdir -p "$HOME_DIR/.pi/agent/sessions"
|
||||
|
||||
# VNC environment
|
||||
VNC_DIR="$HOME_DIR/.vnc"
|
||||
sudo mkdir -p "$VNC_DIR"
|
||||
if [ ! -f "$VNC_DIR/passwd" ]; then
|
||||
VNC_PASS=$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 8)
|
||||
echo -n "$VNC_PASS" | sudo tee "$VNC_DIR/password" > /dev/null
|
||||
echo -n "$VNC_PASS" | vncpasswd -f | sudo tee "$VNC_DIR/passwd" > /dev/null
|
||||
sudo tee "$VNC_DIR/xstartup" > /dev/null << 'XSTARTUP'
|
||||
#!/bin/sh
|
||||
unset SESSION_MANAGER
|
||||
unset DBUS_SESSION_BUS_ADDRESS
|
||||
eval $(dbus-launch --sh-syntax)
|
||||
export DBUS_SESSION_BUS_ADDRESS
|
||||
exec startxfce4
|
||||
XSTARTUP
|
||||
sudo chmod +x "$VNC_DIR/xstartup"
|
||||
sudo chmod 600 "$VNC_DIR/passwd"
|
||||
sudo chmod 600 "$VNC_DIR/password"
|
||||
ok "Provisioned VNC environment"
|
||||
else
|
||||
skip "VNC environment"
|
||||
fi
|
||||
|
||||
# Set ownership and permissions last
|
||||
# chmod 770 so only owner and group can access (service user is added to group above)
|
||||
sudo chown -R "$shell_user:$shell_user" "$USER_ROOT"
|
||||
|
||||
+20
-94
@@ -1,22 +1,15 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
# Officer Remote Desktop Setup
|
||||
# Run as the user who will own the VNC session (not root).
|
||||
# Usage: ./scripts/setup-desktop.sh <vnc-password> [resolution]
|
||||
|
||||
VNC_PASS="${1:-$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 8)}"
|
||||
RESOLUTION="${2:-1920x1080}"
|
||||
USER_NAME="$(whoami)"
|
||||
ENV_FILE="$(cd "$(dirname "$0")/.." && pwd)/.env"
|
||||
# Officer Remote Desktop Setup — System packages only.
|
||||
# Per-user VNC config is handled by user provisioning (provision.ts).
|
||||
# Usage: ./scripts/setup-desktop.sh
|
||||
|
||||
echo "=== Officer Remote Desktop Setup ==="
|
||||
echo "User: $USER_NAME"
|
||||
echo "Resolution: $RESOLUTION"
|
||||
echo ""
|
||||
|
||||
# --- Step 1: Install system packages ---
|
||||
echo "[1/8] Installing system packages..."
|
||||
echo "[1/4] Installing system packages..."
|
||||
sudo apt update -qq
|
||||
sudo apt install -y -qq \
|
||||
xfce4 xfce4-goodies \
|
||||
@@ -26,7 +19,7 @@ sudo apt install -y -qq \
|
||||
echo " Done."
|
||||
|
||||
# --- Step 2: Install Brave browser (native .deb, not snap) ---
|
||||
echo "[2/8] Installing Brave browser..."
|
||||
echo "[2/4] Installing Brave browser..."
|
||||
if ! command -v brave-browser-stable > /dev/null 2>&1; then
|
||||
sudo curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg \
|
||||
https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
|
||||
@@ -35,8 +28,7 @@ if ! command -v brave-browser-stable > /dev/null 2>&1; then
|
||||
sudo apt update -qq
|
||||
sudo apt install -y -qq brave-browser > /dev/null 2>&1
|
||||
fi
|
||||
# Fix launcher symlink (the installed /usr/bin/brave-browser-stable is a copy
|
||||
# that breaks because $HERE resolves to /usr/bin instead of /opt/brave.com/brave)
|
||||
# Fix launcher symlink
|
||||
if [ -f /opt/brave.com/brave/brave-browser ]; then
|
||||
sudo rm -f /usr/bin/brave-browser-stable
|
||||
sudo ln -s /opt/brave.com/brave/brave-browser /usr/bin/brave-browser-stable
|
||||
@@ -46,97 +38,31 @@ sudo mkdir -p /etc/brave
|
||||
echo '--password-store=basic' | sudo tee /etc/brave/brave-flags.conf > /dev/null
|
||||
echo " Done."
|
||||
|
||||
# --- Step 3: Configure VNC password ---
|
||||
echo "[3/8] Configuring VNC password..."
|
||||
mkdir -p ~/.vnc
|
||||
echo "$VNC_PASS" | vncpasswd -f > ~/.vnc/passwd
|
||||
chmod 600 ~/.vnc/passwd
|
||||
# Plain-text password + port for the Officer server to read
|
||||
echo -n "$VNC_PASS" > ~/.vnc/password
|
||||
chmod 600 ~/.vnc/password
|
||||
echo "5901" > ~/.vnc/port
|
||||
echo " Done."
|
||||
|
||||
# --- Step 4: Create xstartup ---
|
||||
echo "[4/8] Creating VNC xstartup..."
|
||||
cat > ~/.vnc/xstartup << 'XSTARTUP'
|
||||
#!/bin/sh
|
||||
unset SESSION_MANAGER
|
||||
unset DBUS_SESSION_BUS_ADDRESS
|
||||
eval $(dbus-launch --sh-syntax)
|
||||
export DBUS_SESSION_BUS_ADDRESS
|
||||
exec startxfce4
|
||||
XSTARTUP
|
||||
chmod +x ~/.vnc/xstartup
|
||||
echo " Done."
|
||||
|
||||
# --- Step 5: Remove GNOME Keyring (prevents password prompts on login) ---
|
||||
echo "[5/8] Removing GNOME Keyring..."
|
||||
# --- Step 3: Remove GNOME Keyring (prevents password prompts on login) ---
|
||||
echo "[3/4] Removing GNOME Keyring..."
|
||||
sudo apt remove -y --purge gnome-keyring > /dev/null 2>&1 || true
|
||||
rm -rf ~/.local/share/keyrings
|
||||
echo " Done."
|
||||
|
||||
# --- Step 6: Create systemd service ---
|
||||
echo "[6/8] Creating systemd service..."
|
||||
sudo tee /etc/systemd/system/officer-vnc.service > /dev/null << EOF
|
||||
[Unit]
|
||||
Description=TigerVNC Server for Officer Remote Desktop
|
||||
After=syslog.target network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=$USER_NAME
|
||||
ExecStartPre=/bin/sh -c '/usr/bin/vncserver -kill :1 > /dev/null 2>&1 || true'
|
||||
ExecStart=/usr/bin/vncserver :1 -geometry $RESOLUTION -depth 24 -localhost yes -fg
|
||||
ExecStop=/usr/bin/vncserver -kill :1
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable --now officer-vnc
|
||||
echo " Done."
|
||||
|
||||
# --- Step 7: Set default browser ---
|
||||
echo "[7/8] Setting default browser..."
|
||||
sleep 2 # Wait for VNC session to start
|
||||
# --- Step 4: Set default browser ---
|
||||
echo "[4/4] Setting default browser..."
|
||||
if command -v brave-browser-stable > /dev/null 2>&1; then
|
||||
sudo update-alternatives --set x-www-browser /opt/brave.com/brave/brave 2>/dev/null || true
|
||||
DISPLAY=:1 xdg-settings set default-web-browser brave-browser.desktop 2>/dev/null || true
|
||||
echo " Brave set as default."
|
||||
else
|
||||
echo " No supported browser found, skipping."
|
||||
fi
|
||||
|
||||
# --- Step 8: Add env vars ---
|
||||
echo "[8/8] Updating .env..."
|
||||
if [ -f "$ENV_FILE" ]; then
|
||||
grep -q '^VNC_PASSWORD=' "$ENV_FILE" && sed -i "s/^VNC_PASSWORD=.*/VNC_PASSWORD=$VNC_PASS/" "$ENV_FILE" || echo "VNC_PASSWORD=$VNC_PASS" >> "$ENV_FILE"
|
||||
grep -q '^VNC_PORT=' "$ENV_FILE" && sed -i "s/^VNC_PORT=.*/VNC_PORT=5901/" "$ENV_FILE" || echo "VNC_PORT=5901" >> "$ENV_FILE"
|
||||
else
|
||||
echo "VNC_PASSWORD=$VNC_PASS" >> "$ENV_FILE"
|
||||
echo "VNC_PORT=5901" >> "$ENV_FILE"
|
||||
fi
|
||||
echo " Done."
|
||||
|
||||
# --- Verify ---
|
||||
echo ""
|
||||
echo "=== Verification ==="
|
||||
sleep 2
|
||||
if systemctl is-active --quiet officer-vnc; then
|
||||
echo "VNC service: running"
|
||||
else
|
||||
echo "VNC service: FAILED — check 'journalctl -u officer-vnc'"
|
||||
fi
|
||||
|
||||
LISTEN=$(ss -tlnp | grep 5901 | head -1)
|
||||
if echo "$LISTEN" | grep -q '127.0.0.1'; then
|
||||
echo "VNC binding: localhost only (secure)"
|
||||
else
|
||||
echo "VNC binding: WARNING — check 'ss -tlnp | grep 5901'"
|
||||
# --- Cleanup old systemd service if it exists ---
|
||||
if systemctl list-unit-files officer-vnc.service &>/dev/null; then
|
||||
echo ""
|
||||
echo "Removing old officer-vnc systemd service..."
|
||||
sudo systemctl stop officer-vnc 2>/dev/null || true
|
||||
sudo systemctl disable officer-vnc 2>/dev/null || true
|
||||
sudo rm -f /etc/systemd/system/officer-vnc.service
|
||||
sudo systemctl daemon-reload
|
||||
echo " Done."
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Setup complete. Restart the Officer server and navigate to /desktop."
|
||||
echo "Setup complete. Per-user VNC sessions are managed by the VNC sidecar."
|
||||
|
||||
Reference in New Issue
Block a user