37 lines
1.3 KiB
Bash
Executable File
37 lines
1.3 KiB
Bash
Executable File
#!/bin/sh
|
|
# Launches wayvnc with a password that is never stored in the repo or in /etc/wayvnc/config.
|
|
# Installed to /usr/local/bin/start-wayvnc, started from the sway config.
|
|
set -eu
|
|
|
|
BASE_CONFIG=/etc/wayvnc/config
|
|
PASSWORD_FILE=/etc/wayvnc/wayvnc-password
|
|
SENTINEL='CHANGEME-SET-ON-FIRST-BOOT'
|
|
|
|
if [ ! -r "$PASSWORD_FILE" ]; then
|
|
echo "start-wayvnc: $PASSWORD_FILE is missing or unreadable — refusing to start." >&2
|
|
exit 1
|
|
fi
|
|
|
|
PASSWORD="$(head -n 1 "$PASSWORD_FILE" | tr -d '\r\n')"
|
|
|
|
# Fail closed. An operator who forgets this step gets no remote access, rather than a
|
|
# remote-control channel anyone on the LAN can open.
|
|
if [ -z "$PASSWORD" ] || [ "$PASSWORD" = "$SENTINEL" ]; then
|
|
echo "start-wayvnc: no wayvnc password set. Run, as root, on this machine:" >&2
|
|
echo " openssl rand -base64 24 > $PASSWORD_FILE && chmod 600 $PASSWORD_FILE" >&2
|
|
echo " chown $(id -un):$(id -gn) $PASSWORD_FILE" >&2
|
|
echo "Then restart the session. Refusing to start an unauthenticated VNC server." >&2
|
|
exit 1
|
|
fi
|
|
|
|
RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/wayvnc"
|
|
mkdir -p "$RUNTIME_DIR"
|
|
chmod 700 "$RUNTIME_DIR"
|
|
|
|
RUNTIME_CONFIG="$RUNTIME_DIR/config"
|
|
umask 077
|
|
cp "$BASE_CONFIG" "$RUNTIME_CONFIG"
|
|
printf 'password=%s\n' "$PASSWORD" >> "$RUNTIME_CONFIG"
|
|
|
|
exec wayvnc --config="$RUNTIME_CONFIG"
|