KasmVNC module

[bpmct]

A discussion dedicated to the KasmVNC module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	2 / 20	10 / 10	60 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides a clear example with sensible defaults (desktop_environment, subdomain). The module has multiple configuration options (port, kasm_version, subdomain, share) and the example demonstrates the primary mode.
Coder-context framing	8	1	README mentions "create an app to access it via the dashboard" and shows coder_agent.example.id, but does not explain what KasmVNC adds on top of Coder or where Coder fits in the VNC access flow. Minimal Coder-context framing.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. The VNC password is generated internally in run.sh and not exposed as a variable. No README examples with inline secrets.
Non-hardcoded auth path	4	4	Module generates password internally (echo -e "password\npassword\n" | kasmvncpasswd) and starts server with -disableBasicAuth. Auth is handled via Coder session token/tunnel. No user-provided credentials required.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module variable to override the download URL. The base_url in run.sh is hardcoded to "https://github.com/kasmtech/KasmVNC/releases/download/v${KASM_VERSION}". Version can be changed via kasm_version variable, but the GitHub domain and path structure cannot be overridden.
Bring-your-own binary	5	0	No documented way to skip installation when KasmVNC is pre-installed. The check_installed function detects existing installations but still proceeds with configuration steps; there's no variable to disable the entire install block.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The GitHub download URL is only visible in run.sh source code, not documented for restricted environments.
Runs without sudo	2	2	Script checks for sudo availability and degrades gracefully. When sudo is unavailable, it uses user config dir ($HOME/.vnc/kasmvnc.yaml) instead of system config (/etc/kasmvnc/kasmvnc.yaml) with warnings. Core functionality (starting kasmvncserver) works without sudo. Full credit earned from code inspection.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (port=6800, kasm_version="1.4.0", subdomain=true, share="owner"). Validation present on desktop_environment (contains check for valid values) and share (owner/authenticated/public check).
Test coverage	4	4	Clear testing story with both .tftest.hcl approach and main.test.ts. TypeScript tests cover required variables and iterate through all allowed desktop environments to verify successful apply. Business logic (desktop environment validation) tested.

Overall — 60 / 100

Raw 45 / 75 → round(45 / 75 × 100) = 60

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.