desktop, extracted from the platform
x11vnc against display :0 — the session the owner is actually logged into, not a second one Officer installs. sidecar/, api/, web/ and the host setup script, moved out of src/ whole. Dormant when it moved: the websocket was commented out in server.tsx and the router in hono.ts since 2026-08-13, and no officer-vnc process was running on any machine. Nothing regressed and nothing was restored — this took switched-off code out of the platform. The point of the move is what the platform stopped knowing. Its sidecar/protocol.ts carried a VNC section — vnc:start, vnc:ensure-password, vnc:stop, four reply variants, VncStartParams, VncSessionInfo — and sidecar-registry.ts carried startVnc, ensureVncPassword, stopVnc and isVncConnected. That is the platform speaking a plugin's vocabulary, which CLAUDE.md names as a rule and this was the clearest breach of. All of it is in sidecar/protocol.ts here now. The permission made a round trip worth recording. It was kind: 'execution' — "runs as the server owner and cannot be shared" — and a plugin permission has no kind, deliberately, because a permission nobody can delegate is a contradiction. So the property is expressed as ownerOnly: ['/'] instead: every path under this plugin refused to anyone but the owner. Same answer, reached from the paths rather than from a kind, and the first real use of a mechanism that landed the same day. The property is real — there is one physical screen and it is the owner's. Not finished, and BLOCKERS.md says so rather than the commit implying otherwise: the websocket is dormant because a plugin cannot claim a WebSocket provider, host setup needs a reboot and no manifest can express that, and there is no artwork. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
Executable
+173
@@ -0,0 +1,173 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
# Officer Remote Desktop Setup — Ubuntu GNOME desktop on Xorg, mirrored over VNC.
|
||||
#
|
||||
# The platform mirrors the single physical display :0 with x11vnc (see vnc-manager.ts). x11vnc can only
|
||||
# capture an Xorg server, NOT a Wayland compositor — so we install the full GNOME desktop but force GDM
|
||||
# onto the Xorg session (WaylandEnable=false). Auto-login is enabled so a user session owns :0 for the
|
||||
# mirror to attach to. Switching the display manager takes effect on the next reboot.
|
||||
# Usage: ./scripts/setup/setup-desktop.sh
|
||||
|
||||
echo "=== Officer Remote Desktop Setup (Ubuntu GNOME on Xorg) ==="
|
||||
echo ""
|
||||
|
||||
DESKTOP_USER="$(whoami)"
|
||||
|
||||
# --- Step 1: Install GNOME desktop + GDM + x11vnc ---
|
||||
echo "[1/6] Installing ubuntu-desktop, GDM, x11vnc..."
|
||||
sudo apt update -qq
|
||||
sudo DEBIAN_FRONTEND=noninteractive apt install -y -qq \
|
||||
ubuntu-desktop \
|
||||
gdm3 \
|
||||
x11vnc \
|
||||
dbus-x11
|
||||
echo " Done."
|
||||
# No tigervnc package is needed. The VNC sidecar writes the .vnc/passwd rfbauth file with
|
||||
# `x11vnc -storepasswd` (see vnc-manager.ts). tigervnc-common was installed here for `vncpasswd`,
|
||||
# but it does not ship that binary — it only provides tigervncconfig — so the rfbauth file was never
|
||||
# created and the desktop could not authenticate.
|
||||
|
||||
# --- Step 2: Force GDM onto Xorg + enable auto-login (x11vnc cannot mirror Wayland) ---
|
||||
echo "[2/6] Forcing Xorg session and auto-login in GDM..."
|
||||
GDM_CONF=/etc/gdm3/custom.conf
|
||||
sudo mkdir -p /etc/gdm3
|
||||
[ -f "$GDM_CONF" ] || echo "[daemon]" | sudo tee "$GDM_CONF" > /dev/null
|
||||
# Ensure a [daemon] section exists to anchor the keys under.
|
||||
sudo grep -qE '^\[daemon\]' "$GDM_CONF" || echo "[daemon]" | sudo tee -a "$GDM_CONF" > /dev/null
|
||||
|
||||
# Set key=value under [daemon]: rewrite an existing (possibly commented) line, else insert after [daemon].
|
||||
set_gdm_key() {
|
||||
local key="$1" val="$2"
|
||||
if sudo grep -qE "^[[:space:]]*#?[[:space:]]*${key}=" "$GDM_CONF"; then
|
||||
sudo sed -i "s|^[[:space:]]*#\?[[:space:]]*${key}=.*|${key}=${val}|" "$GDM_CONF"
|
||||
else
|
||||
sudo sed -i "/^\[daemon\]/a ${key}=${val}" "$GDM_CONF"
|
||||
fi
|
||||
}
|
||||
|
||||
set_gdm_key WaylandEnable false
|
||||
set_gdm_key AutomaticLoginEnable true
|
||||
set_gdm_key AutomaticLogin "$DESKTOP_USER"
|
||||
echo " Xorg forced (WaylandEnable=false), auto-login as $DESKTOP_USER."
|
||||
|
||||
# --- Step 3: Make GDM the default display manager ---
|
||||
echo "[3/6] Setting GDM as the default display manager..."
|
||||
echo "/usr/sbin/gdm3" | sudo tee /etc/X11/default-display-manager > /dev/null
|
||||
sudo systemctl enable gdm3 >/dev/null 2>&1 || sudo systemctl enable gdm >/dev/null 2>&1 || true
|
||||
sudo systemctl set-default graphical.target >/dev/null 2>&1 || true
|
||||
# Disable any prior display manager so it doesn't fight GDM. lightdm is named because earlier versions
|
||||
# of this script installed XFCE; a host set up back then still has it and it would win the boot race.
|
||||
sudo systemctl disable lightdm >/dev/null 2>&1 || true
|
||||
echo " Done (takes effect on next reboot)."
|
||||
|
||||
# --- Step 4: Install Brave browser (native .deb, not snap) ---
|
||||
echo "[4/6] Installing Brave browser..."
|
||||
if ! command -v brave-browser-stable > /dev/null 2>&1; then
|
||||
sudo curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg \
|
||||
https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
|
||||
echo "deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main" \
|
||||
| sudo tee /etc/apt/sources.list.d/brave-browser-release.list > /dev/null
|
||||
sudo apt update -qq
|
||||
sudo DEBIAN_FRONTEND=noninteractive apt install -y -qq brave-browser
|
||||
fi
|
||||
# Fix launcher symlink
|
||||
if [ -f /opt/brave.com/brave/brave-browser ]; then
|
||||
sudo rm -f /usr/bin/brave-browser-stable
|
||||
sudo ln -s /opt/brave.com/brave/brave-browser /usr/bin/brave-browser-stable
|
||||
fi
|
||||
# Tell Brave to use basic password store (no keyring prompts)
|
||||
sudo mkdir -p /etc/brave
|
||||
echo '--password-store=basic' | sudo tee /etc/brave/brave-flags.conf > /dev/null
|
||||
echo " Done."
|
||||
|
||||
# --- Step 5: Remove GNOME Keyring + set default browser (prevents password prompts on login) ---
|
||||
echo "[5/6] Removing GNOME Keyring and setting default browser..."
|
||||
sudo apt remove -y --purge gnome-keyring > /dev/null 2>&1 || true
|
||||
rm -rf ~/.local/share/keyrings
|
||||
if command -v brave-browser-stable > /dev/null 2>&1; then
|
||||
sudo update-alternatives --set x-www-browser /opt/brave.com/brave/brave 2>/dev/null || true
|
||||
echo " Brave set as default."
|
||||
else
|
||||
echo " No supported browser found, skipping default."
|
||||
fi
|
||||
|
||||
# --- Step 6: Headless display (keep a desktop when no monitor is attached) ---
|
||||
echo "[6/6] Configuring the headless display..."
|
||||
|
||||
# x11vnc mirrors :0, but with nothing plugged in the connector has no EDID and no CRTC, so GNOME
|
||||
# renders nothing and the mirror is black. Replaying a real monitor's EDID makes the connector look
|
||||
# permanently attached. The EDID has to be captured from a screen that is plugged in *now* — there is
|
||||
# nothing to copy otherwise — so this step is skipped on a headless run and can be re-run later.
|
||||
EDID_DIR=/lib/firmware/edid
|
||||
EDID_FILE="$EDID_DIR/officer-screen.bin"
|
||||
CONNECTED_SYSFS=""
|
||||
for c in /sys/class/drm/card*-*/status; do
|
||||
[ "$(cat "$c" 2>/dev/null)" = "connected" ] || continue
|
||||
CONNECTED_SYSFS="$(basename "$(dirname "$c")")"
|
||||
break
|
||||
done
|
||||
|
||||
if [ -z "$CONNECTED_SYSFS" ] && [ ! -f "$EDID_FILE" ]; then
|
||||
echo " ! No display connected and no EDID saved — skipping."
|
||||
echo " Plug a monitor in and re-run this script to capture one, otherwise the remote"
|
||||
echo " desktop will be black whenever nothing is attached."
|
||||
else
|
||||
# cardN-HDMI-A-1 -> HDMI-A-1, which is the name the kernel parameters use (card numbering can
|
||||
# change between boots; the connector name does not).
|
||||
if [ -n "$CONNECTED_SYSFS" ]; then
|
||||
CONNECTOR="${CONNECTED_SYSFS#*-}"
|
||||
sudo mkdir -p "$EDID_DIR"
|
||||
sudo cp "/sys/class/drm/$CONNECTED_SYSFS/edid" "$EDID_FILE"
|
||||
echo " Captured EDID from $CONNECTOR ($(stat -c%s "$EDID_FILE") bytes)."
|
||||
echo "$CONNECTOR" | sudo tee "$EDID_DIR/officer-connector" > /dev/null
|
||||
else
|
||||
CONNECTOR="$(cat "$EDID_DIR/officer-connector" 2>/dev/null || echo HDMI-A-1)"
|
||||
echo " Reusing the saved EDID for $CONNECTOR."
|
||||
fi
|
||||
|
||||
# drm.edid_firmware makes the connector report that EDID; the trailing "e" on video= forces it
|
||||
# enabled with nothing attached. amdgpu is not in the initramfs, so /lib/firmware is readable by
|
||||
# the time the driver loads and no initramfs rebuild is needed.
|
||||
KERNEL_ARGS="drm.edid_firmware=$CONNECTOR:edid/officer-screen.bin video=$CONNECTOR:1920x1080e"
|
||||
if grep -q "drm.edid_firmware=" /etc/default/grub; then
|
||||
echo " GRUB already carries a forced EDID — leaving it alone."
|
||||
else
|
||||
sudo cp /etc/default/grub "/etc/default/grub.bak-$(date +%Y%m%d%H%M%S)"
|
||||
CURRENT=$(grep "^GRUB_CMDLINE_LINUX_DEFAULT=" /etc/default/grub | sed 's/^[^"]*"//; s/"$//')
|
||||
sudo sed -i "s|^GRUB_CMDLINE_LINUX_DEFAULT=.*|GRUB_CMDLINE_LINUX_DEFAULT=\"${CURRENT:+$CURRENT }$KERNEL_ARGS\"|" /etc/default/grub
|
||||
sudo update-grub > /dev/null 2>&1
|
||||
echo " Added the forced EDID to the kernel command line (takes effect on reboot)."
|
||||
fi
|
||||
|
||||
# The EDID's preferred mode is whatever the captured panel was, which may be small. GNOME picks
|
||||
# preferred, so raise it at session start.
|
||||
install -d "$HOME/.local/bin" "$HOME/.config/autostart"
|
||||
install -m 755 "$(dirname "$0")/officer-set-display.sh" "$HOME/.local/bin/officer-set-display.sh"
|
||||
cat > "$HOME/.config/autostart/officer-set-display.desktop" <<AUTOSTART
|
||||
[Desktop Entry]
|
||||
Type=Application
|
||||
Name=Officer display mode
|
||||
Comment=Raise the headless display to its largest usable mode at login
|
||||
Exec=$HOME/.local/bin/officer-set-display.sh
|
||||
X-GNOME-Autostart-enabled=true
|
||||
NoDisplay=true
|
||||
AUTOSTART
|
||||
echo " Installed the login-time mode setter."
|
||||
fi
|
||||
echo " Done."
|
||||
|
||||
# --- Cleanup old systemd service if it exists ---
|
||||
if systemctl list-unit-files officer-vnc.service &>/dev/null; then
|
||||
echo ""
|
||||
echo "Removing old officer-vnc systemd service..."
|
||||
sudo systemctl stop officer-vnc 2>/dev/null || true
|
||||
sudo systemctl disable officer-vnc 2>/dev/null || true
|
||||
sudo rm -f /etc/systemd/system/officer-vnc.service
|
||||
sudo systemctl daemon-reload
|
||||
echo " Done."
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Setup complete. The screen mirror (x11vnc on :0) is managed by the VNC sidecar."
|
||||
echo "REBOOT to switch into the GNOME-on-Xorg session with auto-login."
|
||||
Reference in New Issue
Block a user