KasmVNC module

[bpmct]

A discussion dedicated to the KasmVNC module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	16 / 16	5 / 20	10 / 10	59 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6 (half)	Only one usage example is shown (xfce, subdomain = true). No example covers alternate major modes such as subdomain = false (path-sharing), share levels, or other desktop environments, despite the module supporting them via variable "desktop_environment", "share", "subdomain".
Visual preview	5	0	README contains no image, GIF, or video of the rendered desktop/app.

Credential Hygiene — 16 / 16 (4 pts N/A)

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16 (full)	No sensitive inputs exist in main.tf; README contains no credentials or placeholder keys. The internal VNC password set in run.sh ("password") is not surfaced as a module input or in README examples.
Non-hardcoded auth path	4	N/A	Module has no authentication/credential concept by construction (VNC access is protected purely by the Coder session tunnel), so this concern does not exist. Excluded from denominator.

Restricted-Environment Readiness — 5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	base_url="https://github.com/kasmtech/KasmVNC/releases/download/v${KASM_VERSION}" in run.sh is hardcoded. kasm_version only changes the version segment, not the host/mirror — no variable overrides the download URL.
Bring-your-own binary	10	5 (half)	check_installed() in run.sh skips install if kasmvncserver is already on PATH, giving a de-facto baked-in-image path, but this behavior is never mentioned or documented in the README.
Egress transparency	3	0	No dedicated network/air-gapped section; the only external endpoint (github.com/kasmtech/KasmVNC/releases) is visible solely in source, not documented.
Runs without sudo	2	0	Script hard-fails with error("sudo NOPASSWD access required!") before install when sudo is unavailable, and all install paths (install_deb, install_rpm, install_apk) require sudo apt-get/yum/zypper/apk. Sudo is required for core install functionality, not just an optional feature.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6 (full)	Variables have descriptions and sensible defaults (port=6800, kasm_version="1.4.0", subdomain=true, share="owner"); desktop_environment and share include validation blocks constraining allowed values.
Test coverage	4	4 (full)	main.test.ts thoroughly exercises business logic: required-variable checks, successful apply across all desktop environments, and an extensive, version-aware matrix of package-name derivation logic (deb/rpm/apk/tarball naming across distros and KasmVNC version boundaries), plus a negative test for malformed kasm_version.

Overall — 59 / 100

Raw 37 / 63 → round(37 / 63 × 100) = 59

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.