Update KasmVNC user group and config settings

- Use `usermod` to add user to ssl-cert group for compatibility.
- Simplify KasmVNC config with protocol and SSL parameters.
- Ensure UDP communication is confined to localhost for security.

.github/workflows/ci.yaml

@@ -17,6 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: coder/coder/.github/actions/setup-tf@main
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
@@ -29,6 +30,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0 # Needed to get tags
+      - uses: coder/coder/.github/actions/setup-tf@main
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest

CONTRIBUTING.md

@@ -47,6 +47,7 @@ You can test a module locally by updating the source as follows
 ```tf
 module "example" {
   source = "git::https://github.com/<USERNAME>/<REPO>.git//<MODULE-NAME>?ref=<BRANCH-NAME>"
+  # You may need to remove the 'version' field, it is incompatible with some sources.
 }
 ```
 

aws-region/main.test.ts

@@ -1,6 +1,5 @@
 import { describe, expect, it } from "bun:test";
 import {
-  executeScriptInContainer,
   runTerraformApply,
   runTerraformInit,
   testRequiredVariables,

azure-region/main.test.ts

@@ -1,6 +1,5 @@
 import { describe, expect, it } from "bun:test";
 import {
-  executeScriptInContainer,
   runTerraformApply,
   runTerraformInit,
   testRequiredVariables,

coder-login/main.test.ts

@@ -1,10 +1,5 @@
-import { describe, expect, it } from "bun:test";
+import { describe } from "bun:test";
-import {
+import { runTerraformInit, testRequiredVariables } from "../test";
-  executeScriptInContainer,
-  runTerraformApply,
-  runTerraformInit,
-  testRequiredVariables,
-} from "../test";
 
 describe("coder-login", async () => {
   await runTerraformInit(import.meta.dir);

cursor/main.test.ts

@@ -1,6 +1,5 @@
 import { describe, expect, it } from "bun:test";
 import {
-  executeScriptInContainer,
   runTerraformApply,
   runTerraformInit,
   testRequiredVariables,

exoscale-zone/main.test.ts

@@ -1,6 +1,5 @@
 import { describe, expect, it } from "bun:test";
 import {
-  executeScriptInContainer,
   runTerraformApply,
   runTerraformInit,
   testRequiredVariables,

filebrowser/README.md

@@ -14,7 +14,7 @@ A file browser for your workspace.
 ```tf
 module "filebrowser" {
   source   = "registry.coder.com/modules/filebrowser/coder"
-  version  = "1.0.19"
+  version  = "1.0.22"
   agent_id = coder_agent.example.id
 }
 ```
@@ -28,7 +28,7 @@ module "filebrowser" {
 ```tf
 module "filebrowser" {
   source   = "registry.coder.com/modules/filebrowser/coder"
-  version  = "1.0.19"
+  version  = "1.0.22"
   agent_id = coder_agent.example.id
   folder   = "/home/coder/project"
 }
@@ -39,7 +39,7 @@ module "filebrowser" {
 ```tf
 module "filebrowser" {
   source        = "registry.coder.com/modules/filebrowser/coder"
-  version       = "1.0.19"
+  version       = "1.0.22"
   agent_id      = coder_agent.example.id
   database_path = ".config/filebrowser.db"
 }

filebrowser/run.sh

@@ -18,7 +18,7 @@ if [ "${DB_PATH}" != "filebrowser.db" ]; then
 fi
 
 # set baseurl to be able to run if sudomain=false; if subdomain=true the SERVER_BASE_PATH value will be ""
-filebrowser config set --baseurl "${SERVER_BASE_PATH}" > ${LOG_PATH} 2>&1
+filebrowser config set --baseurl "${SERVER_BASE_PATH}"$${DB_FLAG} > ${LOG_PATH} 2>&1
 
 printf "📂 Serving $${ROOT_DIR} at http://localhost:${PORT} \n\n"
 

github-upload-public-key/main.test.ts

@@ -1,3 +1,4 @@
+import { type Server, serve } from "bun";
 import { describe, expect, it } from "bun:test";
 import {
   createJSONResponse,
@@ -9,7 +10,6 @@ import {
   testRequiredVariables,
   writeCoder,
 } from "../test";
-import { Server, serve } from "bun";
 
 describe("github-upload-public-key", async () => {
   await runTerraformInit(import.meta.dir);
@@ -21,10 +21,12 @@ describe("github-upload-public-key", async () => {
   it("creates new key if one does not exist", async () => {
     const { instance, id, server } = await setupContainer();
     await writeCoder(id, "echo foo");
-    let exec = await execContainer(id, [
+
+    const url = server.url.toString().slice(0, -1);
+    const exec = await execContainer(id, [
       "env",
-      "CODER_ACCESS_URL=" + server.url.toString().slice(0, -1),
+      `CODER_ACCESS_URL=${url}`,
-      "GITHUB_API_URL=" + server.url.toString().slice(0, -1),
+      `GITHUB_API_URL=${url}`,
       "CODER_OWNER_SESSION_TOKEN=foo",
       "CODER_EXTERNAL_AUTH_ID=github",
       "bash",
@@ -42,10 +44,12 @@ describe("github-upload-public-key", async () => {
     const { instance, id, server } = await setupContainer();
     // use keyword to make server return a existing key
     await writeCoder(id, "echo findkey");
-    let exec = await execContainer(id, [
+
+    const url = server.url.toString().slice(0, -1);
+    const exec = await execContainer(id, [
       "env",
-      "CODER_ACCESS_URL=" + server.url.toString().slice(0, -1),
+      `CODER_ACCESS_URL=${url}`,
-      "GITHUB_API_URL=" + server.url.toString().slice(0, -1),
+      `GITHUB_API_URL=${url}`,
       "CODER_OWNER_SESSION_TOKEN=foo",
       "CODER_EXTERNAL_AUTH_ID=github",
       "bash",
@@ -95,7 +99,7 @@ const setupServer = async (): Promise<Server> => {
         }
 
         // case: key already exists
-        if (req.headers.get("Authorization") == "Bearer findkey") {
+        if (req.headers.get("Authorization") === "Bearer findkey") {
           return createJSONResponse([
             {
               key: "foo",

jetbrains-gateway/README.md

@@ -14,7 +14,7 @@ This module adds a JetBrains Gateway Button to open any workspace with a single
 ```tf
 module "jetbrains_gateway" {
   source         = "registry.coder.com/modules/jetbrains-gateway/coder"
-  version        = "1.0.13"
+  version        = "1.0.21"
   agent_id       = coder_agent.example.id
   agent_name     = "example"
   folder         = "/home/coder/example"
@@ -32,7 +32,7 @@ module "jetbrains_gateway" {
 ```tf
 module "jetbrains_gateway" {
   source         = "registry.coder.com/modules/jetbrains-gateway/coder"
-  version        = "1.0.13"
+  version        = "1.0.21"
   agent_id       = coder_agent.example.id
   agent_name     = "example"
   folder         = "/home/coder/example"
@@ -46,7 +46,7 @@ module "jetbrains_gateway" {
 ```tf
 module "jetbrains_gateway" {
   source         = "registry.coder.com/modules/jetbrains-gateway/coder"
-  version        = "1.0.13"
+  version        = "1.0.21"
   agent_id       = coder_agent.example.id
   agent_name     = "example"
   folder         = "/home/coder/example"
@@ -61,7 +61,7 @@ module "jetbrains_gateway" {
 ```tf
 module "jetbrains_gateway" {
   source         = "registry.coder.com/modules/jetbrains-gateway/coder"
-  version        = "1.0.13"
+  version        = "1.0.21"
   agent_id       = coder_agent.example.id
   agent_name     = "example"
   folder         = "/home/coder/example"

jetbrains-gateway/main.test.ts

@@ -14,6 +14,26 @@ describe("jetbrains-gateway", async () => {
     folder: "/home/foo",
   });
 
+  it("should create a link with the default values", async () => {
+    const state = await runTerraformApply(import.meta.dir, {
+      // These are all required.
+      agent_id: "foo",
+      agent_name: "foo",
+      folder: "/home/coder",
+    });
+    expect(state.outputs.url.value).toBe(
+      "jetbrains-gateway://connect#type=coder&workspace=default&owner=default&agent=foo&folder=/home/coder&url=https://mydeployment.coder.com&token=$SESSION_TOKEN&ide_product_code=IU&ide_build_number=241.14494.240&ide_download_link=https://download.jetbrains.com/idea/ideaIU-2024.1.tar.gz",
+    );
+
+    const coder_app = state.resources.find(
+      (res) => res.type === "coder_app" && res.name === "gateway",
+    );
+
+    expect(coder_app).not.toBeNull();
+    expect(coder_app?.instances.length).toBe(1);
+    expect(coder_app?.instances[0].attributes.order).toBeNull();
+  });
+
   it("default to first ide", async () => {
     const state = await runTerraformApply(import.meta.dir, {
       agent_id: "foo",

jetbrains-gateway/main.tf

@@ -18,6 +18,12 @@ variable "agent_id" {
   description = "The ID of a Coder agent."
 }
 
+variable "slug" {
+  type        = string
+  description = "The slug for the coder_app. Allows resuing the module with the same template."
+  default     = "gateway"
+}
+
 variable "agent_name" {
   type        = string
   description = "Agent name."
@@ -243,10 +249,11 @@ data "coder_parameter" "jetbrains_ide" {
 }
 
 data "coder_workspace" "me" {}
+data "coder_workspace_owner" "me" {}
 
 resource "coder_app" "gateway" {
   agent_id     = var.agent_id
-  slug         = "gateway"
+  slug         = var.slug
   display_name = local.display_name
   icon         = local.icon
   external     = true
@@ -254,6 +261,8 @@ resource "coder_app" "gateway" {
   url = join("", [
     "jetbrains-gateway://connect#type=coder&workspace=",
     data.coder_workspace.me.name,
+    "&owner=",
+    data.coder_workspace_owner.me.name,
     "&agent=",
     var.agent_name,
     "&folder=",

jfrog-oauth/main.test.ts

@@ -116,7 +116,7 @@ EOF`;
     const proxies = ["foo", "bar", "baz"]
       .map((r) => `https://${user}:@${fakeFrogApi}/go/${r}`)
       .join(",");
-    expect(proxyEnv["value"]).toEqual(proxies);
+    expect(proxyEnv.value).toEqual(proxies);
 
     const coderScript = findResourceInstance(state, "coder_script");
     expect(coderScript.script).toContain(

jfrog-token/main.test.ts

@@ -151,7 +151,7 @@ EOF`;
     const proxies = ["foo", "bar", "baz"]
       .map((r) => `https://${user}:${token}@${fakeFrogApi}/go/${r}`)
       .join(",");
-    expect(proxyEnv["value"]).toEqual(proxies);
+    expect(proxyEnv.value).toEqual(proxies);
 
     const coderScript = findResourceInstance(state, "coder_script");
     expect(coderScript.script).toContain(

jupyterlab/README.md

@@ -16,7 +16,7 @@ A module that adds JupyterLab in your Coder template.
 ```tf
 module "jupyterlab" {
   source   = "registry.coder.com/modules/jupyterlab/coder"
-  version  = "1.0.19"
+  version  = "1.0.22"
   agent_id = coder_agent.example.id
 }
 ```

jupyterlab/main.test.ts

@@ -1,20 +1,20 @@
 import { describe, expect, it } from "bun:test";
 import {
+  execContainer,
   executeScriptInContainer,
+  findResourceInstance,
+  runContainer,
   runTerraformApply,
   runTerraformInit,
   testRequiredVariables,
-  findResourceInstance,
+  type TerraformState,
-  runContainer,
-  TerraformState,
-  execContainer,
 } from "../test";
 
 // executes the coder script after installing pip
 const executeScriptInContainerWithPip = async (
   state: TerraformState,
   image: string,
-  shell: string = "sh",
+  shell = "sh",
 ): Promise<{
   exitCode: number;
   stdout: string[];

jupyterlab/main.tf

@@ -9,6 +9,9 @@ terraform {
   }
 }
 
+data "coder_workspace" "me" {}
+data "coder_workspace_owner" "me" {}
+
 # Add required variables for your modules and remove any unneeded variables
 variable "agent_id" {
   type        = string
@@ -36,6 +39,12 @@ variable "share" {
   }
 }
 
+variable "subdomain" {
+  type        = bool
+  description = "Determines whether JupyterLab will be accessed via its own subdomain or whether it will be accessed via a path on Coder."
+  default     = true
+}
+
 variable "order" {
   type        = number
   description = "The order determines the position of app in the UI presentation. The lowest order is shown first and apps with equal order are sorted by name (ascending order)."
@@ -49,17 +58,18 @@ resource "coder_script" "jupyterlab" {
   script = templatefile("${path.module}/run.sh", {
     LOG_PATH : var.log_path,
     PORT : var.port
+    BASE_URL : var.subdomain ? "" : "/@${data.coder_workspace_owner.me.name}/${data.coder_workspace.me.name}/apps/jupyterlab"
   })
   run_on_start = true
 }
 
 resource "coder_app" "jupyterlab" {
   agent_id     = var.agent_id
-  slug         = "jupyterlab"
+  slug         = "jupyterlab" # sync with the usage in URL
   display_name = "JupyterLab"
-  url          = "http://localhost:${var.port}"
+  url          = var.subdomain ? "http://localhost:${var.port}" : "http://localhost:${var.port}/@${data.coder_workspace_owner.me.name}/${data.coder_workspace.me.name}/apps/jupyterlab"
   icon         = "/icon/jupyter.svg"
-  subdomain    = true
+  subdomain    = var.subdomain
   share        = var.share
   order        = var.order
 }

jupyterlab/run.sh

@@ -1,5 +1,9 @@
 #!/usr/bin/env sh
 
+if [ -n "${BASE_URL}" ]; then
+  BASE_URL_FLAG="--ServerApp.base_url=${BASE_URL}"
+fi
+
 BOLD='\033[0;1m'
 
 printf "$${BOLD}Installing jupyterlab!\n"
@@ -15,11 +19,17 @@ if ! command -v jupyterlab > /dev/null 2>&1; then
   fi
   # install jupyterlab
   pipx install -q jupyterlab
-  echo "🥳 jupyterlab has been installed\n\n"
+  printf "%s\n\n" "🥳 jupyterlab has been installed"
 else
-  echo "🥳 jupyterlab is already installed\n\n"
+  printf "%s\n\n" "🥳 jupyterlab is already installed"
 fi
 
-echo "👷 Starting jupyterlab in background..."
+printf "👷 Starting jupyterlab in background..."
-echo "check logs at ${LOG_PATH}"
+printf "check logs at ${LOG_PATH}"
-$HOME/.local/bin/jupyter-lab --ServerApp.ip='0.0.0.0' --ServerApp.port=${PORT} --no-browser --ServerApp.token='' --ServerApp.password='' > ${LOG_PATH} 2>&1 &
+$HOME/.local/bin/jupyter-lab --no-browser \
+  "$BASE_URL_FLAG" \
+  --ServerApp.ip='*' \
+  --ServerApp.port="${PORT}" \
+  --ServerApp.token='' \
+  --ServerApp.password='' \
+  > "${LOG_PATH}" 2>&1 &

kasmvnc/README.md

@@ -0,0 +1,42 @@
+---
+display_name: KasmVNC
+description: A modern open source VNC server
+icon: ../.icons/kasmvnc.svg
+maintainer_github: coder
+verified: true
+tags: [helper, vnc, desktop]
+---
+
+# KasmVNC
+
+Automatically install [KasmVNC](https://kasmweb.com/kasmvnc) in a workspace, and create an app to access it via the dashboard.
+
+```tf
+module "kasmvnc" {
+  source              = "registry.coder.com/modules/kasmvnc/coder"
+  version             = "1.0.23"
+  agent_id            = coder_agent.example.id
+  desktop_environment = "xfce"
+}
+```
+
+> **Note:** This module only works on workspaces with a pre-installed desktop environment. As an example base image you can use `codercom/enterprise-desktop` image.
+
+> **Note:** You can also use the kasmtech [custom images](https://kasmweb.com/docs/latest/guide/custom_images.html) by extending them as following:
+
+```Dockerfile
+FROM kasmweb/postman:1.16.0
+ARG USER=kasm-user
+USER root
+# Overwrite the existing config file to disable ssl
+RUN cat <<EOF > /etc/kasmvnc/kasmvnc.yaml
+network:
+  protocol: http
+  ssl:
+    require_ssl: false
+  udp:
+    public_ip: 127.0.0.1
+EOF
+RUN addgroup $USER ssl-cert
+USER $USER
+```

kasmvnc/main.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from "bun:test";
+import {
+  runTerraformApply,
+  runTerraformInit,
+  testRequiredVariables,
+} from "../test";
+
+const allowedDesktopEnvs = ["xfce", "kde", "gnome", "lxde", "lxqt"] as const;
+type AllowedDesktopEnv = (typeof allowedDesktopEnvs)[number];
+
+type TestVariables = Readonly<{
+  agent_id: string;
+  desktop_environment: AllowedDesktopEnv;
+  port?: string;
+  kasm_version?: string;
+}>;
+
+describe("Kasm VNC", async () => {
+  await runTerraformInit(import.meta.dir);
+  testRequiredVariables<TestVariables>(import.meta.dir, {
+    agent_id: "foo",
+    desktop_environment: "gnome",
+  });
+
+  it("Successfully installs for all expected Kasm desktop versions", async () => {
+    for (const v of allowedDesktopEnvs) {
+      const applyWithEnv = () => {
+        runTerraformApply<TestVariables>(import.meta.dir, {
+          agent_id: "foo",
+          desktop_environment: v,
+        });
+      };
+
+      expect(applyWithEnv).not.toThrow();
+    }
+  });
+});

kasmvnc/main.tf

@@ -0,0 +1,63 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = ">= 0.12"
+    }
+  }
+}
+
+variable "agent_id" {
+  type        = string
+  description = "The ID of a Coder agent."
+}
+
+variable "port" {
+  type        = number
+  description = "The port to run KasmVNC on."
+  default     = 6800
+}
+
+variable "kasm_version" {
+  type        = string
+  description = "Version of KasmVNC to install."
+  default     = "1.3.2"
+}
+
+variable "desktop_environment" {
+  type        = string
+  description = "Specifies the desktop environment of the workspace. This should be pre-installed on the workspace."
+  validation {
+    condition     = contains(["xfce", "kde", "gnome", "lxde", "lxqt"], var.desktop_environment)
+    error_message = "Invalid desktop environment. Please specify a valid desktop environment."
+  }
+}
+
+resource "coder_script" "kasm_vnc" {
+  agent_id     = var.agent_id
+  display_name = "KasmVNC"
+  icon         = "/icon/kasmvnc.svg"
+  script = templatefile("${path.module}/run.sh", {
+    PORT : var.port,
+    DESKTOP_ENVIRONMENT : var.desktop_environment,
+    VERSION : var.kasm_version
+  })
+  run_on_start = true
+}
+
+resource "coder_app" "kasm_vnc" {
+  agent_id     = var.agent_id
+  slug         = "kasm-vnc"
+  display_name = "kasmVNC"
+  url          = "http://localhost:${var.port}"
+  icon         = "/icon/kasmvnc.svg"
+  subdomain    = true
+  share        = "owner"
+  healthcheck {
+    url       = "http://localhost:${var.port}/app"
+    interval  = 5
+    threshold = 5
+  }
+}

kasmvnc/run.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+
+#!/bin/bash
+
+# Function to check if vncserver is already installed
+check_installed() {
+  if command -v vncserver &> /dev/null; then
+    echo "A binary with name vncserver already installed."
+    return 0 # Don't exit, just indicate it's installed
+  else
+    return 1 # Indicates not installed
+  fi
+}
+
+# Function to download a file using wget, curl, or busybox as a fallback
+download_file() {
+  local url=$1
+  local output=$2
+  if command -v wget &> /dev/null; then
+    wget $url -O $output
+  elif command -v curl &> /dev/null; then
+    curl -fsSL $url -o $output
+  elif command -v busybox &> /dev/null; then
+    busybox wget -O $output $url
+  else
+    echo "Neither wget, curl, nor busybox is installed. Please install one of them to proceed."
+    exit 1
+  fi
+}
+
+# Function to install kasmvncserver for debian-based distros
+install_deb() {
+  local url=$1
+  download_file $url /tmp/kasmvncserver.deb
+  sudo apt-get update
+  DEBIAN_FRONTEND=noninteractive sudo apt-get install --yes -qq --no-install-recommends --no-install-suggests /tmp/kasmvncserver.deb
+  sudo usermod -aG ssl-cert $USER
+  rm /tmp/kasmvncserver.deb
+}
+
+# Function to install kasmvncserver for Oracle 8
+install_rpm_oracle8() {
+  local url=$1
+  download_file $url /tmp/kasmvncserver.rpm
+  sudo dnf config-manager --set-enabled ol8_codeready_builder
+  sudo dnf install oracle-epel-release-el8 -y
+  sudo dnf localinstall /tmp/kasmvncserver.rpm -y
+  sudo usermod -aG kasmvnc-cert $USER
+  rm /tmp/kasmvncserver.rpm
+}
+
+# Function to install kasmvncserver for CentOS 7
+install_rpm_centos7() {
+  local url=$1
+  download_file $url /tmp/kasmvncserver.rpm
+  sudo yum install epel-release -y
+  sudo yum install /tmp/kasmvncserver.rpm -y
+  sudo usermod -aG kasmvnc-cert $USER
+  rm /tmp/kasmvncserver.rpm
+}
+
+# Function to install kasmvncserver for rpm-based distros
+install_rpm() {
+  local url=$1
+  download_file $url /tmp/kasmvncserver.rpm
+  sudo rpm -i /tmp/kasmvncserver.rpm
+  rm /tmp/kasmvncserver.rpm
+}
+
+# Function to install kasmvncserver for Alpine Linux
+install_alpine() {
+  local url=$1
+  download_file $url /tmp/kasmvncserver.tgz
+  tar -xzf /tmp/kasmvncserver.tgz -C /usr/local/bin/
+  rm /tmp/kasmvncserver.tgz
+}
+
+# Check if vncserver is installed, and install if not
+if ! check_installed; then
+  # Detect system information
+  distro=$(grep "^ID=" /etc/os-release | awk -F= '{print $2}')
+  version=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+  arch=$(uname -m)
+
+  echo "Detected Distribution: $distro"
+  echo "Detected Version: $version"
+  echo "Detected Architecture: $arch"
+
+  # Map arch to package arch
+  if [[ "$arch" == "x86_64" ]]; then
+    if [[ "$distro" == "ubuntu" || "$distro" == "debian" || "$distro" == "kali" ]]; then
+      arch="amd64"
+    else
+      arch="x86_64"
+    fi
+  elif [[ "$arch" == "aarch64" || "$arch" == "arm64" ]]; then
+    if [[ "$distro" == "ubuntu" || "$distro" == "debian" || "$distro" == "kali" ]]; then
+      arch="arm64"
+    else
+      arch="aarch64"
+    fi
+  else
+    echo "Unsupported architecture: $arch"
+    exit 1
+  fi
+
+  echo "Installing KASM version: ${VERSION}"
+  case $distro in
+    ubuntu | debian | kali)
+      case $version in
+        "20.04")
+          install_deb "https://github.com/kasmtech/KasmVNC/releases/download/v${VERSION}/kasmvncserver_focal_${VERSION}_$${arch}.deb"
+          ;;
+        "22.04")
+          install_deb "https://github.com/kasmtech/KasmVNC/releases/download/v${VERSION}/kasmvncserver_jammy_${VERSION}_$${arch}.deb"
+          ;;
+        "24.04")
+          install_deb "https://github.com/kasmtech/KasmVNC/releases/download/v${VERSION}/kasmvncserver_noble_${VERSION}_$${arch}.deb"
+          ;;
+        *)
+          echo "Unsupported Ubuntu/Debian/Kali version: $${version}"
+          exit 1
+          ;;
+      esac
+      ;;
+    oracle)
+      if [[ "$version" == "8" ]]; then
+        install_rpm_oracle8 "https://github.com/kasmtech/KasmVNC/releases/download/v${VERSION}/kasmvncserver_oracle_8_${VERSION}_$${arch}.rpm"
+      else
+        echo "Unsupported Oracle version: $${version}"
+        exit 1
+      fi
+      ;;
+    centos)
+      if [[ "$version" == "7" ]]; then
+        install_rpm_centos7 "https://github.com/kasmtech/KasmVNC/releases/download/v${VERSION}/kasmvncserver_centos_core_${VERSION}_$${arch}.rpm"
+      else
+        install_rpm "https://github.com/kasmtech/KasmVNC/releases/download/v${VERSION}/kasmvncserver_centos_core_${VERSION}_$${arch}.rpm"
+      fi
+      ;;
+    alpine)
+      if [[ "$version" == "3.17" || "$version" == "3.18" || "$version" == "3.19" || "$version" == "3.20" ]]; then
+        install_alpine "https://github.com/kasmtech/KasmVNC/releases/download/v${VERSION}/kasmvnc.alpine_$${version}_$${arch}.tgz"
+      else
+        echo "Unsupported Alpine version: $${version}"
+        exit 1
+      fi
+      ;;
+    fedora | opensuse)
+      install_rpm "https://github.com/kasmtech/KasmVNC/releases/download/v${VERSION}/kasmvncserver_$${distro}_$${version}_${VERSION}_$${arch}.rpm"
+      ;;
+    *)
+      echo "Unsupported distribution: $${distro}"
+      exit 1
+      ;;
+  esac
+else
+  echo "Skipping installation."
+fi
+
+# Try to create /etc/kasmvnc/kasmvnc.yaml system-wide
+# we don't fail as some images might be missing sudo permissions
+sudo mkdir -p /etc/kasmvnc || true
+sudo bash -c "cat > /etc/kasmvnc/kasmvnc.yaml <<EOF
+network:
+  protocol: http
+  websocket_port: ${PORT}
+  ssl:
+    require_ssl: false
+  udp:
+    public_ip: 127.0.0.1
+EOF" || true
+
+
+# There could already be a config file in the image at /etc/kasmvnc/kasmvnc.yaml, but we need to set the websocket port
+mkdir -p "$HOME/.vnc"
+cat > "$HOME/.vnc/kasmvnc.yaml" <<EOF
+network:
+  protocol: http
+  websocket_port: ${PORT}
+  ssl:
+    require_ssl: false
+    pem_certificate:
+    pem_key:
+  udp:
+    public_ip: 127.0.0.1
+EOF
+
+# This password is not used since we start the server without auth.
+# The server is protected via the Coder session token / tunnel
+# and does not listen publicly
+echo -e "password\npassword\n" | vncpasswd -wo -u $USER
+
+# Start the server
+printf "🚀 Starting KasmVNC server...\n"
+vncserver -select-de ${DESKTOP_ENVIRONMENT} -disableBasicAuth > /tmp/kasmvncserver.log 2>&1 &

nodejs/main.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "bun:test";
+import { describe } from "bun:test";
 import { runTerraformInit, testRequiredVariables } from "../test";
 
 describe("nodejs", async () => {

personalize/main.test.ts

@@ -1,13 +1,9 @@
-import { readableStreamToText, spawn } from "bun";
 import { describe, expect, it } from "bun:test";
 import {
   executeScriptInContainer,
   runTerraformApply,
   runTerraformInit,
   testRequiredVariables,
-  runContainer,
-  execContainer,
-  findResourceInstance,
 } from "../test";
 
 describe("personalize", async () => {

slackme/main.test.ts

@@ -72,7 +72,7 @@ executed`,
   it("formats execution with milliseconds", async () => {
     await assertSlackMessage({
       command: "echo test",
-      format: `$COMMAND took $DURATION`,
+      format: "$COMMAND took $DURATION",
       durationMS: 150,
       output: "echo test took 150ms",
     });
@@ -81,7 +81,7 @@ executed`,
   it("formats execution with seconds", async () => {
     await assertSlackMessage({
       command: "echo test",
-      format: `$COMMAND took $DURATION`,
+      format: "$COMMAND took $DURATION",
       durationMS: 15000,
       output: "echo test took 15.0s",
     });
@@ -90,7 +90,7 @@ executed`,
   it("formats execution with minutes", async () => {
     await assertSlackMessage({
       command: "echo test",
-      format: `$COMMAND took $DURATION`,
+      format: "$COMMAND took $DURATION",
       durationMS: 120000,
       output: "echo test took 2m 0.0s",
     });
@@ -99,7 +99,7 @@ executed`,
   it("formats execution with hours", async () => {
     await assertSlackMessage({
       command: "echo test",
-      format: `$COMMAND took $DURATION`,
+      format: "$COMMAND took $DURATION",
       durationMS: 60000 * 60,
       output: "echo test took 1hr 0m 0.0s",
     });

test.ts

@@ -1,6 +1,6 @@
 import { readableStreamToText, spawn } from "bun";
-import { afterEach, expect, it } from "bun:test";
+import { expect, it } from "bun:test";
-import { readFile, unlink } from "fs/promises";
+import { readFile, unlink } from "node:fs/promises";
 
 export const runContainer = async (
   image: string,
@@ -21,7 +21,8 @@ export const runContainer = async (
     "-c",
     init,
   ]);
-  let containerID = await readableStreamToText(proc.stdout);
+
+  const containerID = await readableStreamToText(proc.stdout);
   const exitCode = await proc.exited;
   if (exitCode !== 0) {
     throw new Error(containerID);
@@ -36,7 +37,7 @@ export const runContainer = async (
 export const executeScriptInContainer = async (
   state: TerraformState,
   image: string,
-  shell: string = "sh",
+  shell = "sh",
 ): Promise<{
   exitCode: number;
   stdout: string[];
@@ -116,6 +117,9 @@ export interface CoderScriptAttributes {
   url: string;
 }
 
+export type ResourceInstance<T extends string = string> =
+  T extends "coder_script" ? CoderScriptAttributes : Record<string, string>;
+
 /**
  * finds the first instance of the given resource type in the given state. If
  * name is specified, it will only find the instance with the given name.
@@ -124,10 +128,7 @@ export const findResourceInstance = <T extends string>(
   state: TerraformState,
   type: T,
   name?: string,
-  // if type is "coder_script" return CoderScriptAttributes
+): ResourceInstance<T> => {
-): T extends "coder_script"
-  ? CoderScriptAttributes
-  : Record<string, string> => {
   const resource = state.resources.find(
     (resource) =>
       resource.type === type && (name ? resource.name === name : true),
@@ -140,7 +141,8 @@ export const findResourceInstance = <T extends string>(
       `Resource ${type} has ${resource.instances.length} instances`,
     );
   }
-  return resource.instances[0].attributes as any;
+
+  return resource.instances[0].attributes as ResourceInstance<T>;
 };
 
 /**
@@ -157,15 +159,15 @@ export const testRequiredVariables = <TVars extends TerraformVariables>(
   });
 
   const varNames = Object.keys(vars);
-  varNames.forEach((varName) => {
+  for (const varName of varNames) {
     // Ensures that every variable provided is required!
-    it("missing variable " + varName, async () => {
+    it(`missing variable: ${varName}`, async () => {
       const localVars: TerraformVariables = {};
-      varNames.forEach((otherVarName) => {
+      for (const otherVarName of varNames) {
         if (otherVarName !== varName) {
           localVars[otherVarName] = vars[otherVarName];
         }
-      });
+      }
 
       try {
         await runTerraformApply(dir, localVars);
@@ -181,7 +183,7 @@ export const testRequiredVariables = <TVars extends TerraformVariables>(
       }
       throw new Error(`${varName} is not a required variable!`);
     });
-  });
+  }
 };
 
 /**

tsconfig.json

@@ -1,10 +1,14 @@
 {
   "compilerOptions": {
-    "target": "esnext",
+    // If we were just compiling for the tests, we could safely target ESNext at
-    "module": "nodenext",
+    // all times, but just because we've been starting to add more runtime logic
+    // files to some of the modules, erring on the side of caution by having a
+    // older compilation target
+    "target": "ES6",
+    "module": "ESNext",
     "strict": true,
     "allowSyntheticDefaultImports": true,
-    "moduleResolution": "nodenext",
+    "moduleResolution": "node",
     "types": ["bun-types"]
   }
 }

vault-jwt/README.md

@@ -15,7 +15,7 @@ This module lets you authenticate with [Hashicorp Vault](https://www.vaultprojec
 ```tf
 module "vault" {
   source         = "registry.coder.com/modules/vault-jwt/coder"
-  version        = "1.0.19"
+  version        = "1.0.20"
   agent_id       = coder_agent.example.id
   vault_addr     = "https://vault.example.com"
   vault_jwt_role = "coder" # The Vault role to use for authentication
@@ -41,7 +41,7 @@ curl -H "X-Vault-Token: ${VAULT_TOKEN}" -X GET "${VAULT_ADDR}/v1/coder/secrets/d
 ```tf
 module "vault" {
   source              = "registry.coder.com/modules/vault-jwt/coder"
-  version             = "1.0.19"
+  version             = "1.0.20"
   agent_id            = coder_agent.example.id
   vault_addr          = "https://vault.example.com"
   vault_jwt_auth_path = "oidc"
@@ -56,7 +56,7 @@ data "coder_workspace_owner" "me" {}
 
 module "vault" {
   source         = "registry.coder.com/modules/vault-jwt/coder"
-  version        = "1.0.19"
+  version        = "1.0.20"
   agent_id       = coder_agent.example.id
   vault_addr     = "https://vault.example.com"
   vault_jwt_role = data.coder_workspace_owner.me.groups[0]
@@ -68,7 +68,7 @@ module "vault" {
 ```tf
 module "vault" {
   source            = "registry.coder.com/modules/vault-jwt/coder"
-  version           = "1.0.19"
+  version           = "1.0.20"
   agent_id          = coder_agent.example.id
   vault_addr        = "https://vault.example.com"
   vault_jwt_role    = "coder" # The Vault role to use for authentication

vault-jwt/run.sh

@@ -51,7 +51,7 @@ install() {
       printf "Failed to determine the latest Vault version.\n"
       return 1
     fi
-    VAULT_CLI_VERSION=$${VAULT_CLI_VERSION}
+    VAULT_CLI_VERSION=$${LATEST_VERSION}
   fi
 
   # Check if the vault CLI is installed and has the correct version

vscode-desktop/main.test.ts

@@ -22,7 +22,7 @@ describe("vscode-desktop", async () => {
     );
 
     const coder_app = state.resources.find(
-      (res) => res.type == "coder_app" && res.name == "vscode",
+      (res) => res.type === "coder_app" && res.name === "vscode",
     );
 
     expect(coder_app).not.toBeNull();
@@ -79,7 +79,7 @@ describe("vscode-desktop", async () => {
     });
 
     const coder_app = state.resources.find(
-      (res) => res.type == "coder_app" && res.name == "vscode",
+      (res) => res.type === "coder_app" && res.name === "vscode",
     );
 
     expect(coder_app).not.toBeNull();

vscode-web/README.md

@@ -14,7 +14,7 @@ Automatically install [Visual Studio Code Server](https://code.visualstudio.com/
 ```tf
 module "vscode-web" {
   source         = "registry.coder.com/modules/vscode-web/coder"
-  version        = "1.0.14"
+  version        = "1.0.22"
   agent_id       = coder_agent.example.id
   accept_license = true
 }
@@ -29,7 +29,7 @@ module "vscode-web" {
 ```tf
 module "vscode-web" {
   source         = "registry.coder.com/modules/vscode-web/coder"
-  version        = "1.0.14"
+  version        = "1.0.22"
   agent_id       = coder_agent.example.id
   install_prefix = "/home/coder/.vscode-web"
   folder         = "/home/coder"
@@ -42,7 +42,7 @@ module "vscode-web" {
 ```tf
 module "vscode-web" {
   source         = "registry.coder.com/modules/vscode-web/coder"
-  version        = "1.0.14"
+  version        = "1.0.22"
   agent_id       = coder_agent.example.id
   extensions     = ["github.copilot", "ms-python.python", "ms-toolsai.jupyter"]
   accept_license = true
@@ -56,7 +56,7 @@ Configure VS Code's [settings.json](https://code.visualstudio.com/docs/getstarte
 ```tf
 module "vscode-web" {
   source     = "registry.coder.com/modules/vscode-web/coder"
-  version    = "1.0.14"
+  version    = "1.0.22"
   agent_id   = coder_agent.example.id
   extensions = ["dracula-theme.theme-dracula"]
   settings = {

vscode-web/main.tf

@@ -121,6 +121,18 @@ variable "auto_install_extensions" {
   default     = false
 }
 
+variable "subdomain" {
+  type        = bool
+  description = <<-EOT
+    Determines whether the app will be accessed via it's own subdomain or whether it will be accessed via a path on Coder.
+    If wildcards have not been setup by the administrator then apps with "subdomain" set to true will not be accessible.
+  EOT
+  default     = true
+}
+
+data "coder_workspace_owner" "me" {}
+data "coder_workspace" "me" {}
+
 resource "coder_script" "vscode-web" {
   agent_id     = var.agent_id
   display_name = "VS Code Web"
@@ -138,6 +150,7 @@ resource "coder_script" "vscode-web" {
     EXTENSIONS_DIR : var.extensions_dir,
     FOLDER : var.folder,
     AUTO_INSTALL_EXTENSIONS : var.auto_install_extensions,
+    SERVER_BASE_PATH : local.server_base_path,
   })
   run_on_start = true
 
@@ -158,15 +171,21 @@ resource "coder_app" "vscode-web" {
   agent_id     = var.agent_id
   slug         = var.slug
   display_name = var.display_name
-  url          = var.folder == "" ? "http://localhost:${var.port}" : "http://localhost:${var.port}?folder=${var.folder}"
+  url          = local.url
   icon         = "/icon/code.svg"
-  subdomain    = true
+  subdomain    = var.subdomain
   share        = var.share
   order        = var.order
 
   healthcheck {
-    url       = "http://localhost:${var.port}/healthz"
+    url       = local.healthcheck_url
     interval  = 5
     threshold = 6
   }
 }
+
+locals {
+  server_base_path = var.subdomain ? "" : format("/@%s/%s/apps/%s/", data.coder_workspace_owner.me.name, data.coder_workspace.me.name, var.slug)
+  url              = var.folder == "" ? "http://localhost:${var.port}${local.server_base_path}" : "http://localhost:${var.port}${local.server_base_path}?folder=${var.folder}"
+  healthcheck_url  = var.subdomain ? "http://localhost:${var.port}/healthz" : "http://localhost:${var.port}${local.server_base_path}/healthz"
+}

vscode-web/run.sh

@@ -10,10 +10,16 @@ if [ -n "${EXTENSIONS_DIR}" ]; then
   EXTENSION_ARG="--extensions-dir=${EXTENSIONS_DIR}"
 fi
 
+# Set extension directory
+SERVER_BASE_PATH_ARG=""
+if [ -n "${SERVER_BASE_PATH}" ]; then
+  SERVER_BASE_PATH_ARG="--server-base-path=${SERVER_BASE_PATH}"
+fi
+
 run_vscode_web() {
-  echo "👷 Running $VSCODE_WEB serve-local $EXTENSION_ARG --port ${PORT} --host 127.0.0.1 --accept-server-license-terms --without-connection-token --telemetry-level ${TELEMETRY_LEVEL} in the background..."
+  echo "👷 Running $VSCODE_WEB serve-local $EXTENSION_ARG $SERVER_BASE_PATH_ARG --port ${PORT} --host 127.0.0.1 --accept-server-license-terms --without-connection-token --telemetry-level ${TELEMETRY_LEVEL} in the background..."
   echo "Check logs at ${LOG_PATH}!"
-  "$VSCODE_WEB" serve-local "$EXTENSION_ARG" --port "${PORT}" --host 127.0.0.1 --accept-server-license-terms --without-connection-token --telemetry-level "${TELEMETRY_LEVEL}" > "${LOG_PATH}" 2>&1 &
+  "$VSCODE_WEB" serve-local "$EXTENSION_ARG" "$SERVER_BASE_PATH_ARG" --port "${PORT}" --host 127.0.0.1 --accept-server-license-terms --without-connection-token --telemetry-level "${TELEMETRY_LEVEL}" > "${LOG_PATH}" 2>&1 &
 }
 
 # Check if the settings file exists...
@@ -72,27 +78,25 @@ for extension in "$${EXTENSIONLIST[@]}"; do
   output=$($VSCODE_WEB "$EXTENSION_ARG" --install-extension "$extension" --force)
   if [ $? -ne 0 ]; then
     echo "Failed to install extension: $extension: $output"
-    exit 1
   fi
 done
 
 if [ "${AUTO_INSTALL_EXTENSIONS}" = true ]; then
   if ! command -v jq > /dev/null; then
     echo "jq is required to install extensions from a workspace file."
-    exit 0
+  else
-  fi
+    WORKSPACE_DIR="$HOME"
+    if [ -n "${FOLDER}" ]; then
+      WORKSPACE_DIR="${FOLDER}"
+    fi
 
-  WORKSPACE_DIR="$HOME"
+    if [ -f "$WORKSPACE_DIR/.vscode/extensions.json" ]; then
-  if [ -n "${FOLDER}" ]; then
+      printf "🧩 Installing extensions from %s/.vscode/extensions.json...\n" "$WORKSPACE_DIR"
-    WORKSPACE_DIR="${FOLDER}"
+      extensions=$(jq -r '.recommendations[]' "$WORKSPACE_DIR"/.vscode/extensions.json)
-  fi
+      for extension in $extensions; do
-
+        $VSCODE_WEB "$EXTENSION_ARG" --install-extension "$extension" --force
-  if [ -f "$WORKSPACE_DIR/.vscode/extensions.json" ]; then
+      done
-    printf "🧩 Installing extensions from %s/.vscode/extensions.json...\n" "$WORKSPACE_DIR"
+    fi
-    extensions=$(jq -r '.recommendations[]' "$WORKSPACE_DIR"/.vscode/extensions.json)
-    for extension in $extensions; do
-      $VSCODE_WEB "$EXTENSION_ARG" --install-extension "$extension" --force
-    done
   fi
 fi
 

windows-rdp/main.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "bun:test";
 import {
-  TerraformState,
+  type TerraformState,
   runTerraformApply,
   runTerraformInit,
   testRequiredVariables,