#!/bin/bash
# Starts an XFCE4 desktop under TigerVNC and bridges it to a browser-reachable
# noVNC endpoint. Lives outside /home/coder (the per-workspace persistent
# volume) so it always reflects the current image, not whatever was baked in
# on that volume's first-ever creation — same reasoning as acp-bridge-listen.sh.
set -e

mkdir -p ~/.vnc ~/.local/log ~/.local/run

VNC_PASSWD_FILE=~/.vnc/passwd
# Regenerated and printed on every start, not just first-ever — a one-time
# "shown once" value was too easy to lose (see devenv README's VNC section:
# recovering a stale one meant killing the running session anyway). Fine
# since VNC access is already gated by secure-admin's own auth in front of
# this. tigervnc-standalone-server/tigervnc-common ship no vncpasswd
# equivalent on this Ubuntu package split — x11vnc's storepasswd generates a
# file in the same standard VNC password format that Xtigervnc/tigervncserver
# reads; x11vnc itself is never actually run.
VNC_PASSWORD="${VNC_PASSWORD:-$(openssl rand -hex 8)}"
x11vnc -storepasswd "$VNC_PASSWORD" "$VNC_PASSWD_FILE" > /dev/null
chmod 600 "$VNC_PASSWD_FILE"
echo "[ VNC password: $VNC_PASSWORD ]"

cat > ~/.vnc/xstartup <<'XSTARTUP_EOF'
#!/bin/bash
unset SESSION_MANAGER
unset DBUS_SESSION_BUS_ADDRESS
exec startxfce4
XSTARTUP_EOF
chmod +x ~/.vnc/xstartup

# Idempotent: kill any stale server/proxy from a prior start before relaunching
vncserver -kill :1 > /dev/null 2>&1 || true
pkill -f "websockify.*6080" > /dev/null 2>&1 || true

vncserver :1 -geometry 1280x800 -depth 24 -SecurityTypes VncAuth -PasswordFile "$VNC_PASSWD_FILE" > ~/.local/log/vncserver.log 2>&1

setsid nohup websockify --web=/usr/share/novnc/ 6080 localhost:5901 > ~/.local/log/novnc.log 2>&1 < /dev/null &
echo $! > ~/.local/run/novnc.pid

for i in $(seq 1 15); do
  if curl -sf http://localhost:6080/vnc.html > /dev/null 2>&1; then
    echo "[ noVNC ready on :6080 after ~${i}s ]"
    break
  fi
  sleep 1
done