install.fairie/home/.chezmoiscripts/universal/run_onchange_after_16-vnc.sh.tmpl

71 lines
6.3 KiB
Cheetah

{{- if (ne .host.distro.family "windows") -}}
#!/usr/bin/env bash
# @file VNC Setup
# @brief Ensures VNC is set-up if system packages are available.
# @description
# This script ensures VNC is setup and enabled. It will run on macOS always since macOS includes
# a VNC server baked into its system. On Linux, it will check for the presence of the `tightvncserver`
# package before configuring and enabling VNC.
#
# The script will set the VNC password using the `VNC_PASSWORD` environment variable or the encrypted
# equivalent stored in `home/.chezmoitemplates/secrets`. If neither are provided, then the default
# password will be equal to `vncpass` since the password must be between 6-8 characters long.
#
# Additionally, the `VNC_READ_PASSWORD` can be defined to allow read-only VNC sessions. The default password
# for a read-only session is `readonly`.
{{- includeTemplate "universal/profile" }}
{{- includeTemplate "universal/logg" }}
if [ -d /Applications ] && [ -d /System ]; then
# System is macOS
# Source: https://apple.stackexchange.com/questions/30238/how-to-enable-os-x-screen-sharing-vnc-through-ssh
# To disable, run: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off
# Only enable when computer is not a corporate / work computer
if [ -z "$HEADLESS_INSTALL" ] && [ -z "$SSH_CONNECTION" ]; then
logg info '**macOS Manual Security Permission** Enabling VNC using the VNC_PASSWORD variable which is vncpass when nothing is specified'
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -allowAccessFor -specifiedUsers -clientopts -setreqperm -reqperm yes -setvnclegacy -vnclegacy yes -setvncpw -vncpw "{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "VNC_PASSWORD")) }}{{ includeTemplate "secrets/VNC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "vncpass" (env "VNC_PASSWORD") }}{{ end }}" -restart -agent -privs -all -users "$USER" && logg success 'Finished running the macOS Remote Management kickstart executable'
fi
else
# System is Linux
### VNC set-up / configuration
# KasmVNC / TigerVNC (or alternative VNC program) is installed
if command -v kasmvncpasswd > /dev/null; then
logg info 'Copying VNC configuration files from ~/.config/vnc/etc/kasmvnc/ to /etc/'
sudo cp -Rf "${XDG_CONFIG_HOME:-$HOME/.config}/vnc/etc/kasmvnc/" /etc/
logg info 'Adding VNC full-control password to ~/.config/vnc/kasmpasswd'
echo -e "{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "VNC_PASSWORD")) }}{{ includeTemplate "secrets/VNC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "vncpass" (env "VNC_PASSWORD") }}{{ end }}\n{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "VNC_PASSWORD")) }}{{ includeTemplate "secrets/VNC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "vncpass" (env "VNC_PASSWORD") }}{{ end }}" | kasmvncpasswd -u {{ .user.name }} -rwo
logg info 'Adding VNC read-only password to ~/.config/vnc/kasmpasswd for user readonly'
echo -e "{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "VNC_READ_PASSWORD")) }}{{ includeTemplate "secrets/VNC_READ_PASSWORD" | decrypt | trim }}{{ else }}{{ default "readonly" (env "VNC_READ_PASSWORD") }}{{ end }}\n{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "VNC_READ_PASSWORD")) }}{{ includeTemplate "secrets/VNC_READ_PASSWORD" | decrypt | trim }}{{ else }}{{ default "readonly" (env "VNC_READ_PASSWORD") }}{{ end }}" | kasmvncpasswd -u guest -r
logg info 'Reloading the systemctl configuration files since a new one for VNC may have been added'
sudo systemctl daemon-reload
logg info 'Enabling / starting the VNC service for the current user / display 1'
sudo systemctl start vncserver@1
sudo systemctl enable vncserver@1
if command -v update-alternatives > /dev/null; then
update-alternatives --set vncserver "$(which kasmvncserver)"
update-alternatives --set vncpasswd "$(which kasmvncpasswd)"
update-alternatives --set Xvnc "$(which Xkasmvnc)"
update-alternatives --set vncconfig "$(which kasmvncconfig)"
fi
fi
if command -v tigervncpasswd > /dev/null; then
if [ ! -d "${XDG_CONFIG_HOME:-$HOME/.config}/vnc" ]; then
mkdir -p "${XDG_CONFIG_HOME:-$HOME/.config}/vnc"
fi
logg info 'Copying VNC configuration files from ~/.config/vnc/etc/tigervnc/ to /etc/'
sudo cp -Rf "${XDG_CONFIG_HOME:-$HOME/.config}/vnc/etc/tigervnc/" /etc/
logg info 'Adding VNC full-control password to ~/.config/vnc/passwd'
echo -n "{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "VNC_PASSWORD")) }}{{ includeTemplate "secrets/VNC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "vncpass" (env "VNC_PASSWORD") }}{{ end }}" | tigervncpasswd -f > "${XDG_CONFIG_HOME:-$HOME/.config}/vnc/passwd"
logg info 'Adding VNC read-only password to ~/.config/vnc/passwd'
echo -n "{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "VNC_READ_PASSWORD")) }}{{ includeTemplate "secrets/VNC_READ_PASSWORD" | decrypt | trim }}{{ else }}{{ default "readonly" (env "VNC_READ_PASSWORD") }}{{ end }}" | tigervncpasswd -f >> "${XDG_CONFIG_HOME:-$HOME/.config}/vnc/passwd"
logg info 'Reloading the systemctl configuration files since a new one for VNC may have been added'
sudo systemctl daemon-reload
logg info 'Enabling / starting the VNC service for the current user / display 1'
sudo systemctl start vncserver@1
sudo systemctl enable vncserver@1
else
logg info 'Skipping VNC setup since the tightvncserver package is not present on the system'
fi
fi
{{ end -}}