jensandClaude Sonnet 5
eb63f46978
Video and audio no longer share one iframe-based /screen/<name> page. Firefox refuses to load iframe content signed by a certificate whose warning hasn't been accepted at the top level, with no way to click through inside the iframe (Chrome is more lenient, which is why this briefly looked fine there). "Open Screen" is now a plain top-level link straight to noVNC's own URL (new tab, normal Accept-the-Risk applies), and the "Enable Sound" toggle moved to the main setup page - meant to be left open in its own tab while playing. Because that page now hosts a persistent AudioContext/WebSocket, its auto-refresh no longer fires just because a game is running (only during active installs), since a full-page refresh would have killed that connection every 3s. Two real certificate bugs found and fixed along the way: - CN=NY (a meaningless placeholder) -> CN=localhost + SAN (DNS:localhost, IP:127.0.0.1). Firefox validates the WebSocket-Secure connection's cert against the hostname independently of the page load and rejected the CN mismatch there even after the page-level warning was accepted. - Worse: adding -addext without also pinning basicConstraints=CA:FALSE left the cert defaulting to CA:TRUE - i.e. flagged as a Certificate Authority, not a server cert. Firefox hard-refuses that with no override option at all (not a normal clickable warning), which is why "the warning appears but won't let me proceed" even after the CN fix. Fixed by explicitly setting basicConstraints=critical,CA:FALSE plus keyUsage/extendedKeyUsage=serverAuth. Confirmed fixed: Firefox now shows the same clickable self-signed warning Chrome always did, and the noVNC connection completes successfully after accepting it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NiNnj78HGx1KWyCCo39HSz
53 lines
2.3 KiB
Docker
53 lines
2.3 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM ich777/novnc-baseimage
|
|
|
|
ENV DISPLAY_NUM=99
|
|
ENV GAMES_HOME=/opt/games
|
|
ENV SCRIPTS_HOME=/opt/scripts
|
|
ENV PATH=${PATH}:${SCRIPTS_HOME}
|
|
|
|
# unzip/smbclient/python3 are needed at runtime: the games are no longer baked into the
|
|
# image, setup_server.py serves an HTML install UI (backed by smbget+unzip) that the user
|
|
# drives on ${SETUP_PORT} instead of anything being auto-downloaded at container start.
|
|
# pulseaudio/pulseaudio-utils/libasound2-plugins carry game audio out to the browser (see
|
|
# scripts/pcm_ws_bridge.py) - VNC/noVNC only ever streams video, never audio.
|
|
RUN apt-get update && \
|
|
apt-get -y install --no-install-recommends dosbox scummvm alsa-utils unzip smbclient python3 \
|
|
pulseaudio pulseaudio-utils libasound2-plugins && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Route ALSA's default device through PulseAudio, so dosbox/scummvm need no special config -
|
|
# every game's audio ends up mixed into Pulse's one default sink, captured by pcm_ws_bridge.py.
|
|
RUN printf 'pcm.!default pulse\nctl.!default pulse\n' > /etc/asound.conf
|
|
|
|
# CN/SAN set to localhost/127.0.0.1: some browsers (Firefox) validate the WebSocket-Secure
|
|
# connection's certificate against the hostname independently of the page load, and reject a
|
|
# CN mismatch there even after you've clicked through the warning for the HTML page itself.
|
|
# basicConstraints/keyUsage/extendedKeyUsage must be set explicitly to mark this as a leaf
|
|
# (end-entity) server cert - without them, openssl req -x509 defaults to CA:TRUE, which
|
|
# Firefox refuses outright (not a clickable warning, a hard block) for a TLS server cert.
|
|
RUN openssl req -x509 -nodes -newkey rsa:2048 -keyout /tmp/novnc.key -out /tmp/novnc.pem -days 3650 \
|
|
-subj "/C=US/ST=NY/L=NY/O=NY/OU=NY/CN=localhost" \
|
|
-addext "subjectAltName=DNS:localhost,IP:127.0.0.1" \
|
|
-addext "basicConstraints=critical,CA:FALSE" \
|
|
-addext "keyUsage=critical,digitalSignature,keyEncipherment" \
|
|
-addext "extendedKeyUsage=serverAuth"
|
|
RUN touch /root/.Xauthority
|
|
|
|
RUN mkdir -p ${GAMES_HOME}
|
|
VOLUME ${GAMES_HOME}
|
|
|
|
ADD scripts ${SCRIPTS_HOME}
|
|
WORKDIR /
|
|
|
|
EXPOSE 60${DISPLAY_NUM}
|
|
EXPOSE 70${DISPLAY_NUM}
|
|
EXPOSE 71${DISPLAY_NUM}
|
|
EXPOSE 8090-8099
|
|
EXPOSE 5900
|
|
|
|
ENTRYPOINT ["/opt/scripts/server_start.sh", "/opt/scripts/server.sh"]
|
|
|
|
# see also
|
|
# https://github.com/ich777/docker-krusader
|