feat: self-hosted remote support over VNC

Browser-based remote control (noVNC) with invite links, per-user access control, garagedoor SSO and a persisted client list. The hub proxies RFB rather than pointing the browser at a VNC server. That is what lets it authenticate upstream with a stored password the browser never sees, and enforce view-only by dropping input messages on the client->server stream instead of hiding buttons. Machines are reachable two ways: direct TCP for LAN hosts, or an outbound agent tunnel for anything behind NAT. Node 22's global WebSocket keeps the agent dependency-free, and node:sqlite keeps the image free of native builds. Ships with an end-to-end suite that boots the real server against a fake VNC server and a fake auth service (72 assertions), plus Gitea Actions CI/CD to Portainer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 23:37:35 -07:00
commit 999717f77b
34 changed files with 7057 additions and 0 deletions
@@ -0,0 +1,94 @@
+name: Build and Deploy Remote Control Support
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "server/**"
+      - "public/**"
+      - "agent/**"
+      - "Dockerfile"
+      - "docker-compose.yml"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - ".gitea/workflows/**"
+  workflow_dispatch:
+
+env:
+  REGISTRY: git.mancinas.io
+
+jobs:
+  test:
+    name: Test
+    runs-on: docker
+    container:
+      image: node:22-alpine
+    steps:
+      - uses: actions/checkout@v4
+      - run: corepack enable
+      - run: pnpm install --frozen-lockfile
+      # Boots the real server against a fake VNC server and a fake auth service.
+      - run: pnpm test
+
+  build:
+    name: Build Image
+    needs: [test]
+    runs-on: docker
+    container:
+      image: docker:27-dind
+      options: --privileged
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Install Node.js for actions
+        run: apk add --no-cache nodejs npm
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/remote-control-support-webapp
+          tags: |
+            type=ref,event=branch
+            type=raw,value=latest,enable={{is_default_branch}}
+      - uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64
+
+  deploy:
+    name: Deploy to Portainer
+    needs: [build]
+    runs-on: docker
+    container:
+      image: node:18-alpine
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cssnr/portainer-stack-deploy-action@v1
+        with:
+          url: ${{ secrets.PORTAINER_URL }}
+          token: ${{ secrets.PORTAINER_API_KEY }}
+          name: ${{ secrets.PORTAINER_STACK_NAME }}
+          file: docker-compose.yml
+          type: file
+          pull_image: true
+          endpoint_id: ${{ secrets.PORTAINER_ENDPOINT_ID }}
+          env_data: |
+            {
+              "IMAGE": "${{ env.REGISTRY }}/${{ github.repository_owner }}/remote-control-support-webapp:latest",
+              "AUTH_URL": "${{ secrets.AUTH_URL }}",
+              "ADMIN_USERS": "${{ secrets.ADMIN_USERS }}",
+              "ENCRYPTION_KEY": "${{ secrets.ENCRYPTION_KEY }}",
+              "PUBLIC_URL": "${{ secrets.PUBLIC_URL }}"
+            }