# coder/desktop — Coder desktop template

A Coder template for <https://coder.nic-oconnor.com>: an XFCE desktop in the
browser (the [KasmVNC module](https://registry.coder.com/modules/coder/kasmvnc))
running as a pod on the homelab Kubernetes cluster, set up from this repo by the
[dotfiles module](https://registry.coder.com/modules/coder/dotfiles).

## Push / update

```sh
coder login https://coder.nic-oconnor.com
coder templates push desktop -d coder/desktop -y
```

The in-cluster provisioner uses the `coder` service account, whose workspace
Role is bound in the `coder` namespace — which is where workspaces go.

## What a workspace gets

- `codercom/enterprise-desktop:ubuntu-noble`: XFCE, git, python3, and the
  `coder` user (uid 1000) with passwordless sudo.
- A PVC (`truenas-iscsi`, default 30 GiB) at `/home/coder`. Everything the
  dotfiles install into `$HOME` survives stops; system packages (zsh, docker
  CLI, KasmVNC) are reinstalled on each start because the root filesystem
  is not persisted.
- The KasmVNC app, path-based (`subdomain = false`) because the deployment has
  no wildcard access URL.
- A "Dotfiles" startup script: clones this repo into
  `~/.config/coderv2/dotfiles` and runs `bootstrap.sh` (log:
  `~/.dotfiles.log`), plus a "Refresh Dotfiles" button. The first run takes
  about 5 minutes.
- Pod requests 0.5 CPU / 1 GiB; the CPU and memory parameters set limits (the
  nodes are ~4 CPU / ~5 GiB and mostly requested already).

## 1Password secrets

bootstrap's `secrets/` module needs `OP_SERVICE_ACCOUNT_TOKEN` when there is
no TTY. Paste it into the **1Password service-account token** parameter when
you create the workspace. It is ephemeral: used for that build only, then
`~/.config/dotfiles/op.env` on the home volume carries it. Leave it empty and
bootstrap still applies everything else; `secrets`, `mcp-config` and `hermes`
are reported as not completed. Fix that later from a workspace terminal with
`~/.config/coderv2/dotfiles/secrets/install.sh`, then refresh the dotfiles.

## Why these pins

- `ubuntu-noble`, not `ubuntu`: the `ubuntu` tag is now 26.04 (resolute), and
  KasmVNC publishes no resolute package, so the module's install 404s.
- `kasm_version = "1.5.0"`: the newest KasmVNC release, which has a noble
  build. Revisit both once KasmVNC ships a resolute `.deb`.