27 lines
1.2 KiB
Plaintext
27 lines
1.2 KiB
Plaintext
# wayvnc — installed to /etc/wayvnc/config by build-thin-client-iso.sh.
|
|
# Format is plain key=value, one per line (not TOML, not INI sections).
|
|
#
|
|
# There is deliberately NO `password=` line in this file. wayvnc only accepts the
|
|
# password inline, so committing one here would put a live credential for a full
|
|
# remote-control channel into git. Instead /usr/local/bin/start-wayvnc reads
|
|
# /etc/wayvnc/wayvnc-password (mode 0600, never committed) and writes a merged config
|
|
# into $XDG_RUNTIME_DIR at session start. If that file still holds the build-time
|
|
# sentinel, start-wayvnc refuses to launch — no unauthenticated VNC server, ever.
|
|
|
|
# Bound to all interfaces on purpose: wayvnc is this project's remote-control channel
|
|
# (the confirmed replacement for RDP), so it has to be reachable from the LAN, not
|
|
# just loopback. That is exactly why the auth below is not optional.
|
|
address=0.0.0.0
|
|
port=5900
|
|
|
|
enable_auth=true
|
|
username=@KIOSK_USERNAME@
|
|
|
|
# wayvnc >= 0.7 uses this for RSA-AES auth.
|
|
rsa_private_key_file=/etc/wayvnc/rsa_key.pem
|
|
|
|
# wayvnc <= 0.6 authenticates over TLS instead and needs these two; harmless on newer
|
|
# builds. Both are generated by 0300-wayvnc.hook.chroot, self-signed.
|
|
private_key_file=/etc/wayvnc/tls_key.pem
|
|
certificate_file=/etc/wayvnc/tls_cert.pem
|