coder: desktop template (KasmVNC + dotfiles) for the homelab cluster

Kubernetes template for coder.nic-oconnor.com: an XFCE desktop served by the KasmVNC module, with this repo applied by the dotfiles module. Home is a truenas-iscsi PVC so $HOME tools and op.env survive stops. Pinned to enterprise-desktop:ubuntu-noble + KasmVNC 1.5.0 because the plain `ubuntu` tag is now resolute, which KasmVNC has no package for. Path-based app (no wildcard access URL). An ephemeral 1Password token parameter lets bootstrap's secrets module run unattended on first start. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-18 13:08:35 -04:00
parent ffedc84cfb
commit 1524fa8203
5 changed files with 476 additions and 0 deletions
@@ -0,0 +1,50 @@
+# coder/desktop — Coder desktop template
+
+A Coder template for <https://coder.nic-oconnor.com>: an XFCE desktop in the
+browser (the [KasmVNC module](https://registry.coder.com/modules/coder/kasmvnc))
+running as a pod on the homelab Kubernetes cluster, set up from this repo by the
+[dotfiles module](https://registry.coder.com/modules/coder/dotfiles).
+
+## Push / update
+
+```sh
+coder login https://coder.nic-oconnor.com
+coder templates push desktop -d coder/desktop -y
+```
+
+The in-cluster provisioner uses the `coder` service account, whose workspace
+Role is bound in the `coder` namespace — which is where workspaces go.
+
+## What a workspace gets
+
+- `codercom/enterprise-desktop:ubuntu-noble`: XFCE, git, python3, and the
+  `coder` user (uid 1000) with passwordless sudo.
+- A PVC (`truenas-iscsi`, default 30 GiB) at `/home/coder`. Everything the
+  dotfiles install into `$HOME` survives stops; system packages (zsh, docker
+  CLI, KasmVNC) are reinstalled on each start because the root filesystem
+  is not persisted.
+- The KasmVNC app, path-based (`subdomain = false`) because the deployment has
+  no wildcard access URL.
+- A "Dotfiles" startup script: clones this repo into
+  `~/.config/coderv2/dotfiles` and runs `bootstrap.sh` (log:
+  `~/.dotfiles.log`), plus a "Refresh Dotfiles" button. The first run takes
+  about 5 minutes.
+- Pod requests 0.5 CPU / 1 GiB; the CPU and memory parameters set limits (the
+  nodes are ~4 CPU / ~5 GiB and mostly requested already).
+
+## 1Password secrets
+
+bootstrap's `secrets/` module needs `OP_SERVICE_ACCOUNT_TOKEN` when there is
+no TTY. Paste it into the **1Password service-account token** parameter when
+you create the workspace. It is ephemeral: used for that build only, then
+`~/.config/dotfiles/op.env` on the home volume carries it. Leave it empty and
+bootstrap still applies everything else; `secrets`, `mcp-config` and `hermes`
+are reported as not completed. Fix that later from a workspace terminal with
+`~/.config/coderv2/dotfiles/secrets/install.sh`, then refresh the dotfiles.
+
+## Why these pins
+
+- `ubuntu-noble`, not `ubuntu`: the `ubuntu` tag is now 26.04 (resolute), and
+  KasmVNC publishes no resolute package, so the module's install 404s.
+- `kasm_version = "1.5.0"`: the newest KasmVNC release, which has a noble
+  build. Revisit both once KasmVNC ships a resolute `.deb`.