KasmVNC module

[bpmct]

A discussion dedicated to the KasmVNC module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Network Readiness	Engineering Quality	Overall
13 / 25	20 / 20	0 / 20	10 / 10	57 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides a complete example with sensible defaults (desktop_environment = "xfce", subdomain = true). The module has multiple configuration options (desktop environment choice, subdomain vs path-based sharing) and the example covers the primary mode.
Coder-context framing	8	1	README mentions "access it via the dashboard" and shows Coder resources (coder_agent, coder_app), but does not explain what KasmVNC adds on top of Coder or where Coder fits in the VNC access flow. No explanation of how Coder's tunnel/auth protects the VNC server.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference in frontmatter.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The VNC password is hardcoded in run.sh as "password" with a comment explaining it's unused since the server runs without auth (protected by Coder session token). No API keys or secrets are exposed in README examples.
Non-hardcoded auth path	4	4	Module relies on Coder's session token/tunnel for authentication rather than requiring users to paste credentials. The VNC server is started with -disableBasicAuth and protected via Coder's infrastructure.

Restricted-Network Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the download URL. The base_url in run.sh is hardcoded to "https://github.com/kasmtech/KasmVNC/releases/download/v${KASM_VERSION}". The kasm_version variable only controls the version number, not the source URL.
Bring-your-own binary	6	0	No documented way to skip installation when KasmVNC is pre-installed. The script has a check_installed() function that detects existing installations and skips the download, but this is not documented in the README. Users are not informed they can bake KasmVNC into their image to avoid downloads.
Egress transparency	4	0	No dedicated README section enumerating external endpoints. The GitHub download URL is only visible in run.sh source code. No notes for restricted or air-gapped environments.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (port = 6800, kasm_version = "1.4.0", subdomain = true, share = "owner"). Validation blocks present for desktop_environment (8 valid values) and share (3 valid values).
Test coverage	4	4	Clear testing story with main.test.ts covering business logic (tests all allowed desktop environments). TypeScript tests verify terraform apply succeeds for each desktop environment option. .tftest.hcl not present but TypeScript tests adequately cover the module's configuration matrix.

Overall — 57 / 100

Raw 43 / 75 → round(43 / 75 × 100) = 57

---

Scored against SCORECARD.md on 2026-07-14 with claude-sonnet-4-5.