#!/bin/bash
# Sets up a Linux desktop you use from your browser, on an exe.dev VM (Ubuntu 24.04):
#   Xfce on KasmVNC (display :1), its web client on port 8444, behind exe.dev login:
#     https://<vm>.exe.xyz:8444/
#   Google Chrome as the default browser, and launchers for the coding agents
#   the VM comes with (Claude Code, Codex, OpenCode, Pi), set up to use exe.dev's
#   LLM integration.
# Run it as the VM's user (exedev); it uses sudo. Safe to run again.
# From https://exe.dev/deploy/linux-desktop
set -euo pipefail
KASMVNC_VERSION=${KASMVNC_VERSION:-1.5.2}
PORT=${PORT:-8444}
U=$(id -un)
H=$HOME
ARCH=$(dpkg --print-architecture)

echo "== packages"
sudo apt-get update -q
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -q --no-install-recommends \
  xfce4 xfce4-terminal xfce4-taskmanager mousepad ristretto dbus-x11 xdg-utils \
  fonts-noto fonts-noto-color-emoji fonts-noto-cjk
if [ "$(dpkg-query -W -f='${Version}' kasmvncserver 2>/dev/null)" != "$KASMVNC_VERSION" ]; then
  curl -fsSL -o /tmp/kasmvnc.deb \
    "https://github.com/kasmtech/KasmVNC/releases/download/v$KASMVNC_VERSION/kasmvncserver_ubuntu_noble_${KASMVNC_VERSION}_$ARCH.deb"
  sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -q /tmp/kasmvnc.deb
  rm -f /tmp/kasmvnc.deb
fi
if ! command -v google-chrome >/dev/null; then
  curl -fsSL -o /tmp/google-chrome.deb \
    https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
  sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -q /tmp/google-chrome.deb
  rm -f /tmp/google-chrome.deb
fi

echo "== desktop"
# KasmVNC reads the snakeoil certificate even when it serves plain HTTP.
sudo adduser -q "$U" ssl-cert
# It also wants a user of its own; we turn its password check off below, since
# exe.dev's login guards the desktop, so this password is random and unused.
if [ ! -s "$H/.kasmpasswd" ]; then
  P=$(openssl rand -hex 16)
  printf '%s\n%s\n' "$P" "$P" | kasmvncpasswd -u "$U" -w >/dev/null
fi
mkdir -p "$H/code" "$H/.vnc" "$H/Desktop" "$H/.local/share/applications" "$H/.config/xfce4"
# KasmVNC: plain HTTP on $PORT (exe.dev's proxy adds HTTPS and the login),
# no password of its own, resized to fit the browser window.
cat > "$H/.vnc/kasmvnc.yaml" <<YAML
network:
  protocol: http
  interface: 0.0.0.0
  websocket_port: $PORT
  ssl:
    require_ssl: false
desktop:
  resolution:
    width: 1600
    height: 900
  allow_resize: true
command_line:
  prompt: false
YAML
cat > "$H/.vnc/xstartup" <<'SH'
#!/bin/sh
unset SESSION_MANAGER DBUS_SESSION_BUS_ADDRESS
exec dbus-launch --exit-with-session startxfce4
SH
chmod +x "$H/.vnc/xstartup"
touch "$H/.vnc/.de-was-selected"
# Chrome is the browser the panel and links open.
printf 'WebBrowser=google-chrome\nTerminalEmulator=xfce4-terminal\n' > "$H/.config/xfce4/helpers.rc"

# A launcher per coding agent, in the menu (Development) and on the desktop.
launcher() { # file name command comment
  cat > "$H/.local/share/applications/$1.desktop" <<DESKTOP
[Desktop Entry]
Type=Application
Name=$2
Comment=$4
Exec=xfce4-terminal --title="$2" --working-directory=$H/code -x bash -lc '$3; exec bash'
Icon=utilities-terminal
Terminal=false
Categories=Development;
DESKTOP
  install -m 755 "$H/.local/share/applications/$1.desktop" "$H/Desktop/$1.desktop"
}
launcher claude-code "Claude Code" claude "Anthropic's coding agent"
launcher codex "Codex" codex "OpenAI's coding agent"
launcher opencode "OpenCode" opencode "Open-source coding agent"
launcher pi "Pi" pi "Minimal coding agent"
cp /usr/share/applications/google-chrome.desktop "$H/Desktop/" && chmod 755 "$H/Desktop/google-chrome.desktop"

echo "== coding agents"
exeuntu configure claude
exeuntu configure codex

echo "== service"
sudo tee /etc/systemd/system/desktop.service >/dev/null <<UNIT
[Unit]
Description=Linux desktop: Xfce on KasmVNC display :1, web client on port $PORT
After=network.target

[Service]
User=$U
WorkingDirectory=$H
# Leftovers of the last desktop. Chrome's lock names the VM, so in a copy of the
# VM (ssh exe.dev cp), Chrome would refuse its profile without this.
ExecStartPre=-/bin/sh -c 'rm -f /tmp/.X1-lock /tmp/.X11-unix/X1 $H/.vnc/*:1.pid $H/.config/google-chrome/Singleton*'
ExecStart=/usr/bin/vncserver :1 -fg -autokill -DisableBasicAuth
# Close Chrome before the desktop, so it doesn't offer to restore pages later.
ExecStop=-/usr/bin/pkill -TERM -x chrome
ExecStop=/bin/sleep 2
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target
UNIT
sudo systemctl daemon-reload
sudo systemctl enable desktop
sudo systemctl restart desktop

echo "== checks"
for i in $(seq 30); do curl -fs -o /dev/null "localhost:$PORT/" && break; sleep 1; done
systemctl is-active desktop
curl -fsS -o /dev/null -w 'KasmVNC: HTTP %{http_code}\n' "localhost:$PORT/"
echo "Desktop: https://$(hostname).exe.xyz:$PORT/"