noconnorandClaude Opus 5
1524fa8203
Kubernetes template for coder.nic-oconnor.com: an XFCE desktop served by the KasmVNC module, with this repo applied by the dotfiles module. Home is a truenas-iscsi PVC so $HOME tools and op.env survive stops. Pinned to enterprise-desktop:ubuntu-noble + KasmVNC 1.5.0 because the plain `ubuntu` tag is now resolute, which KasmVNC has no package for. Path-based app (no wildcard access URL). An ephemeral 1Password token parameter lets bootstrap's secrets module run unattended on first start. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
51 lines
2.3 KiB
Markdown
51 lines
2.3 KiB
Markdown
# coder/desktop — Coder desktop template
|
|
|
|
A Coder template for <https://coder.nic-oconnor.com>: an XFCE desktop in the
|
|
browser (the [KasmVNC module](https://registry.coder.com/modules/coder/kasmvnc))
|
|
running as a pod on the homelab Kubernetes cluster, set up from this repo by the
|
|
[dotfiles module](https://registry.coder.com/modules/coder/dotfiles).
|
|
|
|
## Push / update
|
|
|
|
```sh
|
|
coder login https://coder.nic-oconnor.com
|
|
coder templates push desktop -d coder/desktop -y
|
|
```
|
|
|
|
The in-cluster provisioner uses the `coder` service account, whose workspace
|
|
Role is bound in the `coder` namespace — which is where workspaces go.
|
|
|
|
## What a workspace gets
|
|
|
|
- `codercom/enterprise-desktop:ubuntu-noble`: XFCE, git, python3, and the
|
|
`coder` user (uid 1000) with passwordless sudo.
|
|
- A PVC (`truenas-iscsi`, default 30 GiB) at `/home/coder`. Everything the
|
|
dotfiles install into `$HOME` survives stops; system packages (zsh, docker
|
|
CLI, KasmVNC) are reinstalled on each start because the root filesystem
|
|
is not persisted.
|
|
- The KasmVNC app, path-based (`subdomain = false`) because the deployment has
|
|
no wildcard access URL.
|
|
- A "Dotfiles" startup script: clones this repo into
|
|
`~/.config/coderv2/dotfiles` and runs `bootstrap.sh` (log:
|
|
`~/.dotfiles.log`), plus a "Refresh Dotfiles" button. The first run takes
|
|
about 5 minutes.
|
|
- Pod requests 0.5 CPU / 1 GiB; the CPU and memory parameters set limits (the
|
|
nodes are ~4 CPU / ~5 GiB and mostly requested already).
|
|
|
|
## 1Password secrets
|
|
|
|
bootstrap's `secrets/` module needs `OP_SERVICE_ACCOUNT_TOKEN` when there is
|
|
no TTY. Paste it into the **1Password service-account token** parameter when
|
|
you create the workspace. It is ephemeral: used for that build only, then
|
|
`~/.config/dotfiles/op.env` on the home volume carries it. Leave it empty and
|
|
bootstrap still applies everything else; `secrets`, `mcp-config` and `hermes`
|
|
are reported as not completed. Fix that later from a workspace terminal with
|
|
`~/.config/coderv2/dotfiles/secrets/install.sh`, then refresh the dotfiles.
|
|
|
|
## Why these pins
|
|
|
|
- `ubuntu-noble`, not `ubuntu`: the `ubuntu` tag is now 26.04 (resolute), and
|
|
KasmVNC publishes no resolute package, so the module's install 404s.
|
|
- `kasm_version = "1.5.0"`: the newest KasmVNC release, which has a noble
|
|
build. Revisit both once KasmVNC ships a resolute `.deb`.
|