From 1db6e28353466cc9c40f14c276e6ba5afa7999b9 Mon Sep 17 00:00:00 2001
From: Jens Ahrensfeld <jens@jayfield.org>
Date: Sun, 12 May 2024 14:11:16 +0200
Subject: [PATCH] Added noVNC

---
 Dockerfile                       | 43 +++++++-------
 app/app.sh                       |  7 ++-
 run.sh                           |  2 +-
 vnc/turbovncserver-security.conf | 97 ++++++++++++++++++++++++++++++++
 vnc/turbovncserver.conf          | 74 ++++++++++++++++++++++++
 5 files changed, 199 insertions(+), 24 deletions(-)
 create mode 100644 vnc/turbovncserver-security.conf
 create mode 100644 vnc/turbovncserver.conf

diff --git a/Dockerfile b/Dockerfile
index c36cea8..c94a4f8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,41 +6,42 @@ ENV PASSWORD=vnc4me
 RUN apt-get update
 
 # Build tools
-RUN apt-get install -y git build-essential libtool autotools-dev automake cmake nasm
-RUN apt-get install -y x11vnc libx11-dev libxext-dev xvfb
-RUN apt-get install -y libpam0g-dev
+RUN apt-get install -y dbus-x11 x11-xkb-utils xkb-data
 RUN apt-get install -y python3
-
-FROM base as sources
-ADD https://github.com/libjpeg-turbo/libjpeg-turbo.git /tmp/turbojpeg
-ADD https://github.com/TurboVNC/turbovnc.git /tmp/turbovnc
-ADD https://archive.mesa3d.org/mesa-24.0.7.tar.xz /tmp/mesa
-
-FROM sources as build
-WORKDIR "/tmp/turbojpeg/build"
-RUN cmake -G"Unix Makefiles" ..
-RUN make -j4 && make install
-
-WORKDIR "/tmp/turbovnc/build"
-RUN cmake -G"Unix Makefiles" -DTVNC_BUILDVIEWER:BOOL=false ..
-RUN make -j4 && make install
-
-
+RUN apt-get install -y wget
+RUN apt-get install -y git make gcc
 RUN apt-get install -y icewm
 RUN apt-get install -y x11-apps
 
+FROM base as build
+ADD https://github.com/TurboVNC/turbovnc/releases/download/3.1.1/turbovnc_3.1.1_amd64.deb /tmp/
+ADD https://github.com/novnc/websockify.git /tmp/websockify
+ADD https://github.com/novnc/noVNC.git /tmp/noVNC
+
+WORKDIR "/tmp"
+RUN dpkg -i turbovnc_3.1.1_amd64.deb
+
+WORKDIR "/tmp/websockify"
+RUN make -j4
+
 # develop only
-RUN apt-get install -y net-tools socat
+RUN apt-get install -y net-tools socat python3-numpy
 
 ENV PATH=$PATH:/opt/TurboVNC/bin
 RUN	mkdir ~/.vnc/
 RUN	echo $PASSWORD | vncpasswd -f > ~/.vnc/passwd
 RUN	chmod 0600 ~/.vnc/passwd
-COPY vnc/xstartup.turbovnc ~/.vnc/
 
 EXPOSE 5900
 
+COPY vnc/xstartup.turbovnc /root/.vnc/
+COPY vnc/turbovncserver-security.conf /etc/
+RUN	chmod 0600 /etc/turbovncserver-security.conf
+COPY vnc/turbovncserver.conf /etc/
 COPY app/*.sh /app/
+
+RUN openssl req -x509 -nodes -newkey rsa:2048 -keyout /tmp/novnc.key -out /tmp/novnc.pem -days 3650 -subj "/C=US/ST=NY/L=NY/O=NY/OU=NY/CN=NY emailAddress=email@example.com"
+
 CMD ["/app/app.sh"]
 
 # https://dunedlin.wordpress.com/2020/10/24/a-minimal-x11-install/
diff --git a/app/app.sh b/app/app.sh
index 820eed7..2a053e0 100755
--- a/app/app.sh
+++ b/app/app.sh
@@ -1,8 +1,11 @@
 #!/bin/bash
 
 export DISPLAY=:${DISPLAY_NUM}
+RFB_PORT=59${DISPLAY_NUM}
+NOVNC_PORT=80${DISPLAY_NUM}
+
 echo Display at ${DISPLAY} with ${SCREEN_W}x${SCREEN_H}x24
-exec /opt/TurboVNC/bin/Xvnc ${DISPLAY} -geometry ${SCREEN_W}x${SCREEN_H} -depth 24 +xinerama -securitytypes none >/var/log/xvfb.log &
 exec icewm-session -o /var/log/icewm.log &
+exec /opt/TurboVNC/bin/Xvnc ${DISPLAY} -geometry ${SCREEN_W}x${SCREEN_H} -depth 24 +xinerama -securitytypes none >/var/log/xvfb.log &
 exec socat TCP-LISTEN:60${DISPLAY_NUM},fork,bind=0.0.0.0 UNIX-CONNECT:/tmp/.X11-unix/X${DISPLAY_NUM} &
-bash --login
+exec /tmp/websockify/run --web=/tmp/noVNC/ --cert=/tmp/novnc.pem --key=/tmp/novnc.key ${NOVNC_PORT} localhost:${RFB_PORT}
diff --git a/run.sh b/run.sh
index 2a86add..c0b883c 100755
--- a/run.sh
+++ b/run.sh
@@ -1,4 +1,4 @@
 #/bin/bash
 
 DISPLAY_NUM=99
-docker run --rm --net bridge -p 5910:59${DISPLAY_NUM}/tcp -e DISPLAY_NUM=${DISPLAY_NUM} -e SCREEN_W=1536 -e SCREEN_H=960 -it xserver-vnc
+docker run --rm --net bridge -p 5910:59${DISPLAY_NUM}/tcp -e DISPLAY_NUM=${DISPLAY_NUM} -e SCREEN_W=1536 -e SCREEN_H=960 -it $1
diff --git a/vnc/turbovncserver-security.conf b/vnc/turbovncserver-security.conf
new file mode 100644
index 0000000..0c47c35
--- /dev/null
+++ b/vnc/turbovncserver-security.conf
@@ -0,0 +1,97 @@
+# the PAM User/Password authentication method is used.
+# (Default: user ACL is disabled)
+
+#enable-user-acl
+
+# This specifies the maximum desktop size for all TurboVNC sessions started on
+# this host.  If a user attempts to start a session with a larger geometry than
+# this or to use remote desktop resizing to increase the desktop size to a size
+# larger than this, the desktop size will be clamped to this width/height.
+
+#max-desktop-size = 3200x1800
+
+# This specifies the maximum idle timeout (in seconds) for all TurboVNC
+# sessions started on this host.  The idle timeout is the amount of time that
+# a TurboVNC session can remain idle (with no VNC viewer connections) before it
+# will automatically exit.  If this value is set to a number greater than 0,
+# then all TurboVNC sessions on this host will use this idle timeout value by
+# default, and the user will only be allowed to override it with a lower value.
+
+#max-idle-timeout = 86400
+
+# Uncomment the following to globally disable the automatic sending of
+# clipboard changes to TurboVNC sessions from their connected viewers.
+# (Default: clipboard receiving is allowed)
+
+#no-clipboard-recv
+
+# Uncomment the following to globally disable the automatic sending of
+# clipboard changes from TurboVNC sessions to their connected viewers.
+# (Default: clipboard sending is allowed)
+
+#no-clipboard-send
+
+# Uncomment the following to globally disable creating/opening PAM sessions in
+# all TurboVNC sessions started on this host.
+
+#no-pam-sessions
+
+# Uncomment the following to globally disable inbound remote connections to all
+# TurboVNC sessions started on this host.  This effectively forces SSH
+# tunneling to be used for all inbound TurboVNC connections.
+# (Default: inbound remote connections are allowed)
+
+#no-remote-connections
+
+# Uncomment the following to globally disable remote desktop resizing.
+# (Default: remote desktop resizing is allowed)
+
+#no-remote-resize
+
+# Uncomment the following to globally disable the ability to make reverse
+# VNC connections.
+# (Default: reverse connections are allowed)
+
+#no-reverse-connections
+
+# Uncomment the following to globally disable X11 TCP connections to all
+# TurboVNC sessions started on this host.
+
+#no-x11-tcp-connections
+
+# Set pam-service-name to the name of the PAM service that you will use to
+# to process PAM User/Password authentications from TurboVNC.  This service
+# name typically corresponds to a file in /etc/pam.d or to one or more lines in
+# /etc/pam.conf.
+# (Default: turbovnc)
+
+#pam-service-name = turbovnc
+
+# Set the following to a colon-separated list of permitted TLS cipher suites
+# for the TLS* and X509* security types.  (Run 'openssl ciphers aNULL' for a
+# list of possible options for the TLS* security types, and 'openssl ciphers'
+# for a list of possible options for the X509* security types.)  This directive
+# also controls the order in which the cipher suites are advertised to the VNC
+# viewer.
+# (Default: allow any cipher suite supported by the host's OpenSSL
+# implementation)
+
+#permitted-cipher-suites =
+
+# Set the following to any combination of "TLSVnc", "TLSOtp", "TLSPlain",
+# "TLSNone", "X509Vnc", "X509Otp", "X509Plain", "X509None", "VNC", "OTP",
+# "UnixLogin", "Plain", or "None", separated by commas (security types are
+# case-insensitive.)  If the following directive is enabled and a particular
+# security type is not listed in it, then users cannot enable that security
+# type by using Xvnc command-line arguments.  This directive also controls the
+# order in which the corresponding authentication capabilities are advertised
+# to the VNC viewer.  See the man pages and User's Guide for more information.
+# (Default: TLSVnc, TLSOtp, TLSPlain, TLSNone, X509Vnc, X509Otp, X509Plain, X509None, VNC, OTP, UnixLogin, Plain, None)
+
+#permitted-security-types = TLSVnc, TLSOtp, TLSPlain, X509Vnc, X509Otp, X509Plain, VNC, OTP, UnixLogin, Plain
+permitted-security-types = none
+# This specifies the length of the key, in bits, that the TurboVNC Server will
+# generate for any of the TLS* (anonymous TLS) security types.
+# (Default: 2048)
+
+#tls-key-length = 2048
diff --git a/vnc/turbovncserver.conf b/vnc/turbovncserver.conf
new file mode 100644
index 0000000..064d8be
--- /dev/null
+++ b/vnc/turbovncserver.conf
@@ -0,0 +1,74 @@
+##
+## Configuration of the TurboVNC Server.
+##
+## This file uses Perl syntax, although only one-line assignments
+## are allowed.  Assignments can be applied to the following variables:
+##
+##  $geometry    -- desktop geometry, WIDTHxHEIGHT or
+##                  W0xH0+X0+Y0[,W1xH1+X1+Y1,...,WnxHn+Xn+Yn]
+##  $depth       -- color depth in bits per pixel (between 8 and 32)
+##  $desktopName -- X desktop name
+##  $vncUserDir  -- path to TurboVNC user directory (session information,
+##                  VNC passwords, and log files are stored here)
+##  $fontPath    -- X font path
+##  $securityTypes -- comma-separated list of security types to enable
+##                    (passed to Xvnc in the -securitytypes argument)
+##  $generateOTP -- 1 to generate an initial one-time password.  (OTP
+##                  authentication must be enabled and permitted)
+##  $wm          -- the window manager to use (for instance, "mate" or "2d".)
+##                  This variable is ignored if $xstartup or $noxstartup is
+##                  specified.
+##  $useVGL      -- 1 to run the window manager using VirtualGL.  This variable
+##                  is ignored if $xstartup or $noxstartup is specified.
+##  $autokill    -- 1 to automatically kill the TurboVNC session when the
+##                  X startup script finishes or 0 to leave it running
+##  $noVNC       -- directory containing noVNC
+##  $passwdFile  -- path to VNC password file to use with VNC Password
+##                  authentication
+##  $x509CertFile -- path to X.509 signed certificate file (in PEM format) to
+##                   use with X.509 encryption
+##  $x509KeyFile -- path to X.509 private key file (in PEM format) to use with
+##                  X.509 encryption
+##  $xstartup    -- path to alternative X startup script
+##  $noxstartup  -- 1 to start the TurboVNC session with no X startup script
+##  $serverArgs  -- additional arguments to pass to Xvnc (refer to the Xvnc man
+##                  page for a list of accepted arguments)
+##  $useUDS      -- listen on a Unix domain socket rather than a TCP port for
+##                  connections from VNC viewers
+##
+
+## These settings are the default.  Uncomment and edit to change.
+#
+# $geometry = "1240x900";
+# $depth = 24;
+# $desktopName = "TurboVNC ($ENV{USER})";
+# $vncUserDir = "$ENV{HOME}/.vnc";
+# $fontPath = "";
+# $securityTypes = "TLSVnc, TLSOtp, TLSPlain, X509Vnc, X509Otp, X509Plain, VNC, OTP, UnixLogin, Plain";
+# $generateOTP = 0;
+# $wm = "";
+# $useVGL = 0;
+# $autokill = 1;
+# $noVNC = "";
+# $xstartup = "${exedir}xstartup.turbovnc";
+# $noxstartup = 0;
+# $serverArgs = "";
+# $useUDS = 0;
+
+## Here is an example of setting the font path:
+#
+# $fontPath = "/usr/lib/X11/fonts/misc/"
+# $fontPath = "$fontPath,/usr/lib/X11/fonts/75dpi/";
+
+## You might wish to create the TurboVNC user directories under /tmp, to
+## ensure that VNC passwords are always kept on the local filesystem.  To do
+## that, uncomment the line below.  Note that in this case, Xvnc will search
+## for the .Xauthority file in this same directory by default.
+#
+# $vncUserDir = "/tmp/$ENV{USER}-vnc";
+
+## These settings are the default.  Uncomment and edit to change.
+#
+# $passwdFile = "$vncUserDir/passwd";
+# $x509CertFile = "$vncUserDir/x509_cert.pem";
+# $x509KeyFile = "$vncUserDir/x509_private.pem";