add vnc, guacamole, etc.

.config/bspwm/bspwmrc

@@ -8,7 +8,7 @@ bspc rule -a Xmessage border=on state=floating
 bspc rule -a Zathura state=tiled
 bspc rule -a generic-st-window state=floating manage=on sticky=on border=on
 bspc rule -a floating-feh state=floating
-bspc rule -a send-to-9 desktop=9
+bspc rule -a send-to-9 desktop=09
 
 bspc rule -a steam desktop=1
 bspc rule -a discord desktop=2
@@ -27,4 +27,4 @@ bspc config top_padding 20
 # post-wm configuration
 disp
 
-bspc desktop -f 1
+bspc desktop -f 01

.config/sxhkd/sxhkdrc

@@ -19,6 +19,9 @@ ctrl + b; d
 super + b
 	brave-launcher
 
+ctrl + b; b
+	brave-launcher
+
 # kill sxhkd with USR1 and restart bspwm
 super + r
 	pkill -USR1 -x sxhkd; \
@@ -83,6 +86,9 @@ super + space; {_,shift + } {1-9,0}
 ctrl + b; {_,shift + } {1-9,0}
 	bspc {desktop -f,node -d} '0{1-9,0}'
 
+ctrl + b; space; {_,shift + } {1-9,0}
+	bspc {desktop -f,node -d} '1{1-9,0}'
+
 # change a node to tiling, floating, or fullscreen
 super + {t,f,s}
 	bspc node -t {tiled,floating,fullscreen}
@@ -153,3 +159,7 @@ KP_Subtract
 
 @KP_Subtract
 	xdotool mouseup 3
+
+# you're using tmux and you need ctrl+b
+ctrl + b; ~ctrl + b
+	echo ctrlb passthrough

boxes/copernicus/custom_command

@@ -0,0 +1 @@
+sudo nixos-rebuild --flake . switch --impure -I nixos-config=./

boxes/copernicus/services/default.nix

@@ -6,5 +6,6 @@
     ./grafana.nix
     ./nextcloud.nix
     ./paperless.nix
+    ./guacamole
   ];
 }

boxes/copernicus/services/guacamole/default.nix

@@ -0,0 +1,45 @@
+{ lib, config, pkgs, ...}:
+
+{
+  services = {
+    guacamole-server = {
+      enable = true;
+      host = "127.0.0.1";
+      port = 4823;
+      userMappingXml = (
+        builtins.toFile "mapping.xml" (
+          builtins.replaceStrings
+            [ "hashedUserPassword" ]
+            [(
+              lib.removeSuffix
+                "\n"
+                # echo -n PASSWORD | openssl dgst -sha256 | awk -F' ' '{print $2}'
+                ( builtins.readFile /home/usr/wg-keys/guacamole-server-credentials )
+            )]
+            ( builtins.readFile ./mapping.xml )
+        )
+      );
+    };
+
+    guacamole-client = {
+      enable = true;
+      enableWebserver = true;
+      settings = {
+        guacd-port = 4823;
+        guacd-hostname = "127.0.0.1";
+      };
+    };
+
+    tomcat.serverXml = builtins.readFile ./server.xml;
+
+    openssh = {
+      enable = true;
+      listenAddresses = [
+        {
+          addr = "127.0.0.1";
+          port = 22;
+        }
+      ];
+    };
+  };
+}

boxes/copernicus/services/guacamole/mapping.xml

@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<user-mapping>
+     <authorize
+        username="ryan"
+        password="hashedUserPassword"
+        encoding="sha256">
+
+      <connection name="[copernicus] ssh">
+          <protocol>ssh</protocol>
+          <param name="hostname">127.0.0.1</param>
+          <param name="port">22</param>
+      </connection>
+
+      <connection name="[copernicus] vnc (all screens)">
+          <protocol>vnc</protocol>
+          <param name="hostname">127.0.0.1</param>
+          <param name="port">5900</param>
+      </connection>
+
+      <connection name="[copernicus] vnc (screen 0)">
+          <protocol>vnc</protocol>
+          <param name="hostname">127.0.0.1</param>
+          <param name="port">5901</param>
+      </connection>
+
+      <connection name="[copernicus] vnc (screen 1)">
+          <protocol>vnc</protocol>
+          <param name="hostname">127.0.0.1</param>
+          <param name="port">5902</param>
+      </connection>
+
+      <connection name="[copernicus] vnc (screen 2)">
+          <protocol>vnc</protocol>
+          <param name="hostname">127.0.0.1</param>
+          <param name="port">5903</param>
+      </connection>
+
+      <connection name="[copernicus] vnc (screen 3)">
+          <protocol>vnc</protocol>
+          <param name="hostname">127.0.0.1</param>
+          <param name="port">5904</param>
+      </connection>
+
+      <connection name="[copernicus] vnc (screen 4)">
+          <protocol>vnc</protocol>
+          <param name="hostname">127.0.0.1</param>
+          <param name="port">5905</param>
+      </connection>
+
+    </authorize>
+</user-mapping>

boxes/copernicus/services/guacamole/server.xml

@@ -0,0 +1,188 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!-- Note:  A "Server" is not itself a "Container", so you may not
+     define subcomponents such as "Valves" at this level.
+     Documentation at /docs/config/server.html
+ -->
+<Server port="8005" shutdown="SHUTDOWN">
+  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
+  <!-- Security listener. Documentation at /docs/config/listeners.html
+  <Listener className="org.apache.catalina.security.SecurityListener" />
+  -->
+  <!-- APR library loader. Documentation at /docs/apr.html -->
+  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
+  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
+  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
+  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
+
+  <!-- Global JNDI resources
+       Documentation at /docs/jndi-resources-howto.html
+  -->
+  <GlobalNamingResources>
+    <!-- Editable user database that can also be used by
+         UserDatabaseRealm to authenticate users
+    -->
+    <Resource name="UserDatabase" auth="Container"
+              type="org.apache.catalina.UserDatabase"
+              description="User database that can be updated and saved"
+              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+              pathname="conf/tomcat-users.xml" />
+  </GlobalNamingResources>
+
+  <!-- A "Service" is a collection of one or more "Connectors" that share
+       a single "Container" Note:  A "Service" is not itself a "Container",
+       so you may not define subcomponents such as "Valves" at this level.
+       Documentation at /docs/config/service.html
+   -->
+  <Service name="Catalina">
+
+    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
+    <!--
+    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
+        maxThreads="150" minSpareThreads="4"/>
+    -->
+
+
+    <!-- A "Connector" represents an endpoint by which requests are received
+         and responses are returned. Documentation at :
+         Java HTTP Connector: /docs/config/http.html
+         Java AJP  Connector: /docs/config/ajp.html
+         APR (HTTP/AJP) Connector: /docs/apr.html
+         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
+    -->
+    <Connector port="10001" protocol="HTTP/1.1"
+               connectionTimeout="20000"
+               address="192.168.1.210"
+               redirectPort="10443"
+               maxParameterCount="1000"
+               />
+
+    <Connector port="6733" protocol="HTTP/1.1"
+               connectionTimeout="20000"
+               address="10.100.0.2"
+               redirectPort="10442"
+               maxParameterCount="1000"
+               />
+    <!-- A "Connector" using the shared thread pool-->
+    <!--
+    <Connector executor="tomcatThreadPool"
+               port="8080" protocol="HTTP/1.1"
+               connectionTimeout="20000"
+               redirectPort="8443"
+               maxParameterCount="1000"
+               />
+    -->
+    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
+         This connector uses the NIO implementation. The default
+         SSLImplementation will depend on the presence of the APR/native
+         library and the useOpenSSL attribute of the AprLifecycleListener.
+         Either JSSE or OpenSSL style configuration may be used regardless of
+         the SSLImplementation selected. JSSE style configuration is used below.
+    -->
+    <!--
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
+               maxThreads="150" SSLEnabled="true"
+               maxParameterCount="1000"
+               >
+        <SSLHostConfig>
+            <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
+                         type="RSA" />
+        </SSLHostConfig>
+    </Connector>
+    -->
+    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
+         This connector uses the APR/native implementation which always uses
+         OpenSSL for TLS.
+         Either JSSE or OpenSSL style configuration may be used. OpenSSL style
+         configuration is used below.
+    -->
+    <!--
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
+               maxThreads="150" SSLEnabled="true"
+               maxParameterCount="1000"
+               >
+        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
+        <SSLHostConfig>
+            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
+                         certificateFile="conf/localhost-rsa-cert.pem"
+                         certificateChainFile="conf/localhost-rsa-chain.pem"
+                         type="RSA" />
+        </SSLHostConfig>
+    </Connector>
+    -->
+
+    <!-- Define an AJP 1.3 Connector on port 8009 -->
+    <!--
+    <Connector protocol="AJP/1.3"
+               address="::1"
+               port="8009"
+               redirectPort="8443"
+               maxParameterCount="1000"
+               />
+    -->
+
+    <!-- An Engine represents the entry point (within Catalina) that processes
+         every request.  The Engine implementation for Tomcat stand alone
+         analyzes the HTTP headers included with the request, and passes them
+         on to the appropriate Host (virtual host).
+         Documentation at /docs/config/engine.html -->
+
+    <!-- You should set jvmRoute to support load-balancing via AJP ie :
+    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
+    -->
+    <Engine name="Catalina" defaultHost="localhost">
+
+      <!--For clustering, please take a look at documentation at:
+          /docs/cluster-howto.html  (simple how to)
+          /docs/config/cluster.html (reference documentation) -->
+      <!--
+      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+      -->
+
+      <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+           via a brute-force attack -->
+      <Realm className="org.apache.catalina.realm.LockOutRealm">
+        <!-- This Realm uses the UserDatabase configured in the global JNDI
+             resources under the key "UserDatabase".  Any edits
+             that are performed against this UserDatabase are immediately
+             available for use by the Realm.  -->
+        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+               resourceName="UserDatabase"/>
+      </Realm>
+
+      <Host name="localhost"  appBase="webapps"
+            unpackWARs="true" autoDeploy="true">
+
+        <!-- SingleSignOn valve, share authentication between web applications
+             Documentation at: /docs/config/valve.html -->
+        <!--
+        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
+        -->
+
+        <!-- Access log processes all example.
+             Documentation at: /docs/config/valve.html
+             Note: The pattern used is equivalent to using pattern="common" -->
+        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
+               prefix="localhost_access_log" suffix=".txt"
+               pattern="%h %l %u %t &quot;%r&quot; %s %b" />
+
+      </Host>
+    </Engine>
+  </Service>
+</Server>

boxes/netbox/default.nix

@@ -17,11 +17,13 @@
       ./nginx.nix
       ./franklincce.nix
       ./wireguard.nix
-      ./nextcloud-bridge.nix
-      ./grafana-bridge.nix
-      ./paperless-bridge.nix
       ./prometheus.nix
       ./socks.nix
+
+      ./nextcloud-bridge.nix
+      ./grafana-bridge.nix
+      ./guacamole-bridge.nix
+      ./paperless-bridge.nix
     ];
 
   nix = {

boxes/netbox/guacamole-bridge.nix

@@ -0,0 +1,23 @@
+{ lib, config, pkgs, ... }:
+{
+  services.nginx.virtualHosts."rcon.beepboop.systems" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://10.100.0.2:6733";
+      proxyWebsockets = true;
+      extraConfig = ''
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $host;
+        proxy_buffering off;
+
+        port_in_redirect off;
+        absolute_redirect off;
+
+        location = / {
+          return 301 /guacamole/;
+        }
+      '';
+    };
+  };
+}

builds/utils.nix

@@ -20,6 +20,7 @@
 , xkbset
 , rbw
 , xclip
+, x11vnc
 , xmessage
 , imagemagick
 }:
@@ -31,14 +32,14 @@ stdenv.mkDerivation rec {
   src = ./utils;
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ bash feh xrandr jq curl fzy ytfzf sshuttle svkbd scrcpy rbw xclip ffcast xkbset xmessage imagemagick ];
+  buildInputs = [ bash feh xrandr jq curl fzy ytfzf sshuttle svkbd scrcpy rbw xclip ffcast xkbset xmessage imagemagick x11vnc ];
 
   installPhase = ''
     mkdir -p $out/bin
 
     for i in $(ls $src/); do
       cp $src/$i $out/bin
-      wrapProgram $out/bin/$i --prefix PATH : ${lib.makeBinPath [ sxhkd bash feh xrandr jq figlet curl fzy xkbset ytfzf sshuttle svkbd scrcpy xrectsel ffcast xmessage imagemagick ]}
+      wrapProgram $out/bin/$i --prefix PATH : ${lib.makeBinPath [ sxhkd bash feh xrandr jq figlet curl fzy xkbset ytfzf sshuttle svkbd scrcpy xrectsel ffcast xmessage imagemagick x11vnc ]}
     done
   '';
 }

builds/utils/start-copernicus-vnc

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+pkill x11vnc
+
+x11vnc -loop -display $DISPLAY -rfbport 5900 -listen 127.0.0.1                 & # main screen
+x11vnc -loop -display $DISPLAY -rfbport 5901 -listen 127.0.0.1 -clip xinerama0 & # screen 0
+x11vnc -loop -display $DISPLAY -rfbport 5902 -listen 127.0.0.1 -clip xinerama1 & # screen 1
+x11vnc -loop -display $DISPLAY -rfbport 5903 -listen 127.0.0.1 -clip xinerama2 & # screen 2
+x11vnc -loop -display $DISPLAY -rfbport 5904 -listen 127.0.0.1 -clip xinerama3 & # screen 3
+x11vnc -loop -display $DISPLAY -rfbport 5905 -listen 127.0.0.1 -clip xinerama4 & # screen 4
+
+read