KasmVNC module

[bpmct]

A discussion dedicated to the KasmVNC module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	20 / 20	5 / 20	5 / 10	54 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows a single example (desktop_environment = "xfce", subdomain = true). The module has two major access modes (subdomain vs. path-based via subdomain = false) and eight desktop-environment options, but no additional examples or mode documentation are provided.
Visual preview	5	0	No image, GIF, or video is embedded in the README. The frontmatter references an SVG icon file, which does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No variable in main.tf carries a secret (no API keys, tokens, or passwords are inputs). The README example contains no inline secrets. The dummy VNC password in run.sh is explicitly commented as unused since auth is via Coder's session tunnel.
Non-hardcoded auth path	4	4	The module requires no external credentials; access is governed entirely by Coder's built-in workspace auth and tunnel. No raw keys appear in templates or examples.

Restricted-Environment Readiness — 5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The download URL is hardcoded in run.sh as https://github.com/kasmtech/KasmVNC/releases/download/v${KASM_VERSION}. No module input variable overrides this base URL. kasm_version only pins the release tag; it does not redirect the source.
Bring-your-own binary	10	5	run.sh calls check_installed() which tests command -v kasmvncserver and skips the entire download/install block if the binary is already present. However, this behaviour is not documented in the README—no section tells users they can pre-bake KasmVNC into their image.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (e.g., github.com/kasmtech/KasmVNC) or provides guidance for air-gapped / restricted environments.
Runs without sudo	2	0	run.sh explicitly requires sudo -n true before installation and exits with "ERROR: sudo NOPASSWD access required!" if unavailable. sudo apt-get, sudo dnf, etc. are used for core install steps. The user-config fallback only covers the YAML config file, not the package installation.

Engineering Quality — 5 / 10

Criterion	Max	Score	Notes
Input quality	6	3	All eight variables have clear descriptions and sensible defaults. desktop_environment and share include validation blocks. However, port (a number) lacks a range validation (e.g., 1–65535), and kasm_version lacks a format check—both are straightforward cases where validation is appropriate.
Test coverage	4	2	main.test.ts runs terraform apply for five of the eight valid desktop environments and checks required-variable enforcement. It does not exercise the subdomain = false (path-based) mode, custom ports, alternate share values, or the pre-installed-binary skip path.

Overall — 54 / 100

Raw 36 / 67 → round(36 / 67 × 100) = 54

Track: Utility (VNC remote-desktop server; not an AI agent or IDE)

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.