KasmVNC module

[bpmct]

A discussion dedicated to the KasmVNC module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	0 / 20	10 / 10	63 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides a clear example with sensible defaults (desktop_environment, subdomain). The module has multiple configuration options (port, kasm_version, share, order, group) and the example demonstrates the primary mode.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference exists.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The module does not handle API keys, passwords, or other secrets. The VNC password is generated internally and not exposed as an input.
Non-hardcoded auth path	4	4	No authentication credentials are required. The module uses Coder's session token/tunnel for protection and explicitly disables basic auth (-disableBasicAuth).

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The GitHub download URL is hardcoded in run.sh (base_url="https://github.com/kasmtech/KasmVNC/releases/download/v${KASM_VERSION}"). No module variable allows overriding this URL to point to an internal mirror.
Bring-your-own binary	10	0	No documented way to skip installation when KasmVNC is pre-installed. The script checks if kasmvncserver exists and skips installation, but this is not documented in the README. The check is internal behavior, not a configurable option.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The GitHub download URL is only visible in the source code, not documented for restricted environments.
Runs without sudo	2	0	The run.sh script requires sudo for core functionality (installation via apt-get, dnf, etc.). While there's a fallback for config file location when sudo is unavailable, the script explicitly checks for "sudo NOPASSWD access required!" and exits if not available during installation. The warning messages indicate degraded functionality without sudo, not full operation.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (port=6800, kasm_version="1.4.0", subdomain=true, share="owner"). Validation blocks present for desktop_environment and share variables with clear error messages.
Test coverage	4	4	Clear testing story with main.test.ts covering business logic (tests all allowed desktop environments). TypeScript tests verify terraform apply succeeds for each desktop environment variant. testRequiredVariables validates required inputs.

Overall — 63 / 100

Raw 42 / 67 → round(42 / 67 × 100) = 63

Note: Utility track applied (VNC desktop access tool). Normalized from 77-point denominator (92 - 15 for Utility track section).

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.