# coder/desktop — Coder desktop template

A Coder template for <https://coder.nic-oconnor.com>: a KDE Plasma desktop in
the browser (the [KasmVNC module](https://registry.coder.com/modules/coder/kasmvnc))
running as a pod on the homelab Kubernetes cluster, set up from this repo by the
[dotfiles module](https://registry.coder.com/modules/coder/dotfiles).

## Push / update

```sh
coder login https://coder.nic-oconnor.com
coder templates push desktop -d coder/desktop -y
```

The in-cluster provisioner uses the `coder` service account, whose workspace
Role is bound in the `coder` namespace — which is where workspaces go.

## The image

`image/Dockerfile` builds `git.nic-oconnor.com/public/coder-desktop-kde:noble`:
`codercom/enterprise-desktop:ubuntu-noble` plus KDE Plasma (with Dolphin,
Konsole, Kate) and KasmVNC. Both are baked in because only `/home/coder` is
persisted, so installing them at start time would cost minutes on every
start. The package is public on Gitea, so the cluster pulls it without a
secret. Rebuild after changing the Dockerfile:

```sh
docker build -t git.nic-oconnor.com/public/coder-desktop-kde:noble coder/desktop/image
docker push git.nic-oconnor.com/public/coder-desktop-kde:noble
```

The pod pulls with `Always`, so workspaces pick the new image up on their
next start.

Workarounds the Dockerfile carries:

- `kwin-x11` is installed explicitly. It is only a Recommends of
  `kde-plasma-desktop`, and without it Plasma starts with no window manager.
- `/usr/local/bin/startkde -> startplasma-x11`. KasmVNC's `-select-de kde`
  (what the module runs) checks for `startkde`, which Plasma 5.20+ renamed,
  and otherwise fails with "Desktop Environment not installed".
- KWin compositing is off in `/etc/xdg/kwinrc`: there is no GPU, and
  software compositing over VNC only adds lag. Turn it back on in System
  Settings if you want it.

## What a workspace gets

- The image above, running as the `coder` user (uid 1000) with passwordless
  sudo.
- A PVC (`truenas-iscsi`, default 30 GiB) at `/home/coder`. Everything the
  dotfiles install into `$HOME` survives stops, and so do the Plasma settings.
  System packages the dotfiles add (zsh, the docker CLI) are reinstalled on
  each start.
- The KasmVNC app, path-based (`subdomain = false`) because the deployment has
  no wildcard access URL.
- A "Dotfiles" startup script: clones this repo into
  `~/.config/coderv2/dotfiles` and runs `bootstrap.sh` (log:
  `~/.dotfiles.log`), plus a "Refresh Dotfiles" button. The first run takes
  about 5 minutes.
- Pod requests 0.5 CPU / 1 GiB; the CPU and memory parameters set limits (the
  nodes are ~4 CPU / ~5 GiB and mostly requested already).

## 1Password secrets

bootstrap's `secrets/` module needs `OP_SERVICE_ACCOUNT_TOKEN` when there is
no TTY. Paste it into the **1Password service-account token** parameter when
you create the workspace. It is ephemeral: used for that build only, then
`~/.config/dotfiles/op.env` on the home volume carries it. Leave it empty and
bootstrap still applies everything else; `secrets`, `mcp-config` and `hermes`
are reported as not completed. Fix that later from a workspace terminal with
`~/.config/coderv2/dotfiles/secrets/install.sh`, then refresh the dotfiles.

## Why noble

The `enterprise-desktop:ubuntu` tag is now 26.04 (resolute), and KasmVNC
publishes no resolute package. The image is pinned to noble with KasmVNC
1.5.0; revisit once KasmVNC ships a resolute `.deb`, and keep
`kasm_version` in `main.tf` in step with `KASMVNC_VERSION`.