vnc sidecar: per-user desktop sessions via sidecar architecture

replaces the single hardcoded systemd VNC service with a dynamic
sidecar that manages per-user VNC sessions on demand. any authenticated
user can now access their own desktop, not just Super Admin.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/setup-desktop.sh

@@ -1,22 +1,15 @@
 #!/bin/bash
 set -euo pipefail
 
-# Officer Remote Desktop Setup
-# Run as the user who will own the VNC session (not root).
-# Usage: ./scripts/setup-desktop.sh <vnc-password> [resolution]
-
-VNC_PASS="${1:-$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 8)}"
-RESOLUTION="${2:-1920x1080}"
-USER_NAME="$(whoami)"
-ENV_FILE="$(cd "$(dirname "$0")/.." && pwd)/.env"
+# Officer Remote Desktop Setup — System packages only.
+# Per-user VNC config is handled by user provisioning (provision.ts).
+# Usage: ./scripts/setup-desktop.sh
 
 echo "=== Officer Remote Desktop Setup ==="
-echo "User:       $USER_NAME"
-echo "Resolution: $RESOLUTION"
 echo ""
 
 # --- Step 1: Install system packages ---
-echo "[1/8] Installing system packages..."
+echo "[1/4] Installing system packages..."
 sudo apt update -qq
 sudo apt install -y -qq \
   xfce4 xfce4-goodies \
@@ -26,7 +19,7 @@ sudo apt install -y -qq \
 echo "  Done."
 
 # --- Step 2: Install Brave browser (native .deb, not snap) ---
-echo "[2/8] Installing Brave browser..."
+echo "[2/4] Installing Brave browser..."
 if ! command -v brave-browser-stable > /dev/null 2>&1; then
   sudo curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg \
     https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
@@ -35,8 +28,7 @@ if ! command -v brave-browser-stable > /dev/null 2>&1; then
   sudo apt update -qq
   sudo apt install -y -qq brave-browser > /dev/null 2>&1
 fi
-# Fix launcher symlink (the installed /usr/bin/brave-browser-stable is a copy
-# that breaks because $HERE resolves to /usr/bin instead of /opt/brave.com/brave)
+# Fix launcher symlink
 if [ -f /opt/brave.com/brave/brave-browser ]; then
   sudo rm -f /usr/bin/brave-browser-stable
   sudo ln -s /opt/brave.com/brave/brave-browser /usr/bin/brave-browser-stable
@@ -46,97 +38,31 @@ sudo mkdir -p /etc/brave
 echo '--password-store=basic' | sudo tee /etc/brave/brave-flags.conf > /dev/null
 echo "  Done."
 
-# --- Step 3: Configure VNC password ---
-echo "[3/8] Configuring VNC password..."
-mkdir -p ~/.vnc
-echo "$VNC_PASS" | vncpasswd -f > ~/.vnc/passwd
-chmod 600 ~/.vnc/passwd
-# Plain-text password + port for the Officer server to read
-echo -n "$VNC_PASS" > ~/.vnc/password
-chmod 600 ~/.vnc/password
-echo "5901" > ~/.vnc/port
-echo "  Done."
-
-# --- Step 4: Create xstartup ---
-echo "[4/8] Creating VNC xstartup..."
-cat > ~/.vnc/xstartup << 'XSTARTUP'
-#!/bin/sh
-unset SESSION_MANAGER
-unset DBUS_SESSION_BUS_ADDRESS
-eval $(dbus-launch --sh-syntax)
-export DBUS_SESSION_BUS_ADDRESS
-exec startxfce4
-XSTARTUP
-chmod +x ~/.vnc/xstartup
-echo "  Done."
-
-# --- Step 5: Remove GNOME Keyring (prevents password prompts on login) ---
-echo "[5/8] Removing GNOME Keyring..."
+# --- Step 3: Remove GNOME Keyring (prevents password prompts on login) ---
+echo "[3/4] Removing GNOME Keyring..."
 sudo apt remove -y --purge gnome-keyring > /dev/null 2>&1 || true
 rm -rf ~/.local/share/keyrings
 echo "  Done."
 
-# --- Step 6: Create systemd service ---
-echo "[6/8] Creating systemd service..."
-sudo tee /etc/systemd/system/officer-vnc.service > /dev/null << EOF
-[Unit]
-Description=TigerVNC Server for Officer Remote Desktop
-After=syslog.target network.target
-
-[Service]
-Type=simple
-User=$USER_NAME
-ExecStartPre=/bin/sh -c '/usr/bin/vncserver -kill :1 > /dev/null 2>&1 || true'
-ExecStart=/usr/bin/vncserver :1 -geometry $RESOLUTION -depth 24 -localhost yes -fg
-ExecStop=/usr/bin/vncserver -kill :1
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-sudo systemctl daemon-reload
-sudo systemctl enable --now officer-vnc
-echo "  Done."
-
-# --- Step 7: Set default browser ---
-echo "[7/8] Setting default browser..."
-sleep 2  # Wait for VNC session to start
+# --- Step 4: Set default browser ---
+echo "[4/4] Setting default browser..."
 if command -v brave-browser-stable > /dev/null 2>&1; then
   sudo update-alternatives --set x-www-browser /opt/brave.com/brave/brave 2>/dev/null || true
-  DISPLAY=:1 xdg-settings set default-web-browser brave-browser.desktop 2>/dev/null || true
   echo "  Brave set as default."
 else
   echo "  No supported browser found, skipping."
 fi
 
-# --- Step 8: Add env vars ---
-echo "[8/8] Updating .env..."
-if [ -f "$ENV_FILE" ]; then
-  grep -q '^VNC_PASSWORD=' "$ENV_FILE" && sed -i "s/^VNC_PASSWORD=.*/VNC_PASSWORD=$VNC_PASS/" "$ENV_FILE" || echo "VNC_PASSWORD=$VNC_PASS" >> "$ENV_FILE"
-  grep -q '^VNC_PORT=' "$ENV_FILE" && sed -i "s/^VNC_PORT=.*/VNC_PORT=5901/" "$ENV_FILE" || echo "VNC_PORT=5901" >> "$ENV_FILE"
-else
-  echo "VNC_PASSWORD=$VNC_PASS" >> "$ENV_FILE"
-  echo "VNC_PORT=5901" >> "$ENV_FILE"
-fi
-echo "  Done."
-
-# --- Verify ---
-echo ""
-echo "=== Verification ==="
-sleep 2
-if systemctl is-active --quiet officer-vnc; then
-  echo "VNC service: running"
-else
-  echo "VNC service: FAILED — check 'journalctl -u officer-vnc'"
-fi
-
-LISTEN=$(ss -tlnp | grep 5901 | head -1)
-if echo "$LISTEN" | grep -q '127.0.0.1'; then
-  echo "VNC binding: localhost only (secure)"
-else
-  echo "VNC binding: WARNING — check 'ss -tlnp | grep 5901'"
+# --- Cleanup old systemd service if it exists ---
+if systemctl list-unit-files officer-vnc.service &>/dev/null; then
+  echo ""
+  echo "Removing old officer-vnc systemd service..."
+  sudo systemctl stop officer-vnc 2>/dev/null || true
+  sudo systemctl disable officer-vnc 2>/dev/null || true
+  sudo rm -f /etc/systemd/system/officer-vnc.service
+  sudo systemctl daemon-reload
+  echo "  Done."
 fi
 
 echo ""
-echo "Setup complete. Restart the Officer server and navigate to /desktop."
+echo "Setup complete. Per-user VNC sessions are managed by the VNC sidecar."