rmancinasandClaude Opus 5
999717f77b
Browser-based remote control (noVNC) with invite links, per-user access control, garagedoor SSO and a persisted client list. The hub proxies RFB rather than pointing the browser at a VNC server. That is what lets it authenticate upstream with a stored password the browser never sees, and enforce view-only by dropping input messages on the client->server stream instead of hiding buttons. Machines are reachable two ways: direct TCP for LAN hosts, or an outbound agent tunnel for anything behind NAT. Node 22's global WebSocket keeps the agent dependency-free, and node:sqlite keeps the image free of native builds. Ships with an end-to-end suite that boots the real server against a fake VNC server and a fake auth service (72 assertions), plus Gitea Actions CI/CD to Portainer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
95 lines
2.7 KiB
YAML
95 lines
2.7 KiB
YAML
name: Build and Deploy Remote Control Support
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "server/**"
|
|
- "public/**"
|
|
- "agent/**"
|
|
- "Dockerfile"
|
|
- "docker-compose.yml"
|
|
- "package.json"
|
|
- "pnpm-lock.yaml"
|
|
- ".gitea/workflows/**"
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
REGISTRY: git.mancinas.io
|
|
|
|
jobs:
|
|
test:
|
|
name: Test
|
|
runs-on: docker
|
|
container:
|
|
image: node:22-alpine
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- run: corepack enable
|
|
- run: pnpm install --frozen-lockfile
|
|
# Boots the real server against a fake VNC server and a fake auth service.
|
|
- run: pnpm test
|
|
|
|
build:
|
|
name: Build Image
|
|
needs: [test]
|
|
runs-on: docker
|
|
container:
|
|
image: docker:27-dind
|
|
options: --privileged
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- name: Install Node.js for actions
|
|
run: apk add --no-cache nodejs npm
|
|
- uses: actions/checkout@v4
|
|
- uses: docker/setup-buildx-action@v3
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ secrets.REGISTRY_USERNAME }}
|
|
password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
- id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/remote-control-support-webapp
|
|
tags: |
|
|
type=ref,event=branch
|
|
type=raw,value=latest,enable={{is_default_branch}}
|
|
- uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
file: Dockerfile
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
platforms: linux/amd64
|
|
|
|
deploy:
|
|
name: Deploy to Portainer
|
|
needs: [build]
|
|
runs-on: docker
|
|
container:
|
|
image: node:18-alpine
|
|
if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: cssnr/portainer-stack-deploy-action@v1
|
|
with:
|
|
url: ${{ secrets.PORTAINER_URL }}
|
|
token: ${{ secrets.PORTAINER_API_KEY }}
|
|
name: ${{ secrets.PORTAINER_STACK_NAME }}
|
|
file: docker-compose.yml
|
|
type: file
|
|
pull_image: true
|
|
endpoint_id: ${{ secrets.PORTAINER_ENDPOINT_ID }}
|
|
env_data: |
|
|
{
|
|
"IMAGE": "${{ env.REGISTRY }}/${{ github.repository_owner }}/remote-control-support-webapp:latest",
|
|
"AUTH_URL": "${{ secrets.AUTH_URL }}",
|
|
"ADMIN_USERS": "${{ secrets.ADMIN_USERS }}",
|
|
"ENCRYPTION_KEY": "${{ secrets.ENCRYPTION_KEY }}",
|
|
"PUBLIC_URL": "${{ secrets.PUBLIC_URL }}"
|
|
}
|