63 lines
1.7 KiB
Markdown
63 lines
1.7 KiB
Markdown
|
# VNC Desktop Setup
|
||
|
|
|
||
|
|
Web-accessible virtual desktop at `vnc.quinefoundation.com`, running TigerVNC + noVNC in a Podman container.
|
||
|
|
|
||
|
|
## First-time setup
|
||
|
|
|
||
|
|
### 1. Create the VNC password secret
|
||
|
|
|
||
|
|
```bash
|
||
|
|
printf "VNC_PASSWORD=yourpassword\n" | nix run nixpkgs#age -- \
|
||
|
|
-r "$(cat /root/petersweb-infra/nixos/keys/mainframe.pub)" \
|
||
|
|
-o /root/petersweb-infra/nixos/secrets/vnc-password.age
|
||
|
|
```
|
||
|
|
|
||
|
|
### 2. Create the nginx basic auth secret
|
||
|
|
|
||
|
|
Generate an htpasswd entry (requires `apache2-utils` or `httpd-tools`):
|
||
|
|
|
||
|
|
```bash
|
||
|
|
htpasswd -n admin
|
||
|
|
# Enter password when prompted; copy the output line (e.g. admin:$apr1$...)
|
||
|
|
```
|
||
|
|
|
||
|
|
Encrypt it:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
printf "admin:\$apr1\$...\n" | nix run nixpkgs#age -- \
|
||
|
|
-r "$(cat /root/petersweb-infra/nixos/keys/mainframe.pub)" \
|
||
|
|
-o /root/petersweb-infra/nixos/secrets/vnc-htpasswd.age
|
||
|
|
```
|
||
|
|
|
||
|
|
### 3. Build and push the container image
|
||
|
|
|
||
|
|
```bash
|
||
|
|
cd nixos/vnc-desktop
|
||
|
|
docker build -t forge.quinefoundation.com/ironmagma/vnc-desktop:latest .
|
||
|
|
docker push forge.quinefoundation.com/ironmagma/vnc-desktop:latest
|
||
|
|
```
|
||
|
|
|
||
|
|
### 4. Commit the new secrets and apply
|
||
|
|
|
||
|
|
```bash
|
||
|
|
git add nixos/secrets/vnc-password.age nixos/secrets/vnc-htpasswd.age
|
||
|
|
git commit -m "add vnc secrets"
|
||
|
|
git push
|
||
|
|
./nixos/apply.sh
|
||
|
|
```
|
||
|
|
|
||
|
|
## Accessing the desktop
|
||
|
|
|
||
|
|
Visit `https://vnc.quinefoundation.com/vnc.html` in a browser. You'll be prompted for:
|
||
|
|
|
||
|
|
1. **HTTP basic auth** — the username/password from step 2 above
|
||
|
|
2. **VNC password** — the `VNC_PASSWORD` from step 1 above
|
||
|
|
|
||
|
|
## SSHing to the host from inside the container
|
||
|
|
|
||
|
|
The host machine is reachable as `hetzner-host` from within the container, and the host's SSH keys are mounted read-only at `/root/host-ssh/`:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
ssh -i /root/host-ssh/id_rsa root@hetzner-host
|
||
|
|
```
|