KasmVNC module

[bpmct]

A discussion dedicated to the KasmVNC module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
8 / 25	20 / 20	2 / 20	10 / 10	53 / 100

Drilldown

Presentation & Onboarding — 8 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows one basic example with desktop_environment = "xfce" and subdomain = true. No examples for different modes (e.g., path-based sharing vs subdomain, different desktop environments with specific considerations). Half credit for minimal coverage.
Coder-context framing	8	2	README mentions "create an app to access it via the dashboard" but lacks explanation of what KasmVNC adds on top of Coder or how Coder fits in the VNC access flow. Minimal framing.
Visual preview	5	0	No image, GIF, or video in README. Icon reference does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. The VNC password is generated internally in the script and explicitly noted as unused (server runs without auth, protected by Coder session token). No secrets to mark. Full credit.
Non-hardcoded auth path	4	4	Module relies on Coder's session token/tunnel for authentication rather than requiring users to manage VNC passwords. Clean auth path.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable to override the GitHub download URL. The base_url is hardcoded to https://github.com/kasmtech/KasmVNC/releases/download/v${KASM_VERSION} in run.sh. Version can be changed via kasm_version variable but the base URL cannot be redirected to an internal mirror.
Bring-your-own binary	5	0	No documented way to skip installation when KasmVNC is pre-installed. The script has check_installed() that detects existing installations and skips the download, but this is not documented in the README.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The GitHub download URL is only visible in source code.
Runs without sudo	2	2	Script explicitly checks for sudo and degrades gracefully: "if command -v sudo &> /dev/null && sudo -n true 2> /dev/null; then kasm_config_file=/etc/kasmvnc/kasmvnc.yaml SUDO=sudo else kasm_config_file=$HOME/.vnc/kasmvnc.yaml SUDO='' echo 'WARNING: Sudo access not available, using user config dir!'". Core functionality (starting VNC server) works without sudo. Full credit.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. desktop_environment has validation for allowed values. Sensible defaults provided (port = 6800, kasm_version = "1.4.0", subdomain = true, share = "owner"). share variable also has validation.
Test coverage	4	4	Clear testing story with main.test.ts covering business logic (tests all allowed desktop environments). TypeScript tests verify terraform apply succeeds for each desktop environment option.

Overall — 53 / 100

Raw 40 / 75 → round(40 / 75 × 100) = 53

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.