.

apps/rego-tunnel/build/build.sh

@@ -2,7 +2,7 @@
 # Build and push the Cisco VPN Docker image
 # Run this from the build directory
 
-set -e
+set -euo pipefail
 
 IMAGE_NAME="${IMAGE_NAME:-git.alexzaw.dev/alexz/cisco-vpn}"
 IMAGE_TAG="${IMAGE_TAG:-latest}"

apps/rego-tunnel/build/scripts/entrypoint.sh

@@ -1,38 +1,24 @@
 #!/bin/bash
-# Entrypoint: VNC setup + DNS fix + systemd
+# Entrypoint: VNC password setup + DNS fix + systemd
 
-# Setup VNC password from environment variable (passed by runtipi)
-if [ -n "$VNC_PASSWORD" ]; then
+set -euo pipefail
+
+# Setup TigerVNC password file from env var (passed by runtipi)
+# TigerVNC expects /root/.vnc/passwd when using SecurityTypes=VncAuth.
+if [ -n "${VNC_PASSWORD:-}" ]; then
     mkdir -p /root/.vnc
-    x11vnc -storepasswd "$VNC_PASSWORD" /root/.vnc/pass >/dev/null 2>&1 || true
-    rm -f /tmp/.X1-lock /tmp/.X11-unix/X1 2>/dev/null || true
-    Xvfb "$DISPLAY" -screen 0 ${XVFB_WxHxD:-1280x800x24} +extension RANDR &
-    pids+=($!)
-    sleep 0.5
-    fluxbox >/tmp/fluxbox.log 2>&1 &
-    pids+=($!)
-    x11vnc -display "$DISPLAY" -rfbauth /root/.vnc/pass -forever -shared -rfbport "$VNC_PORT" -quiet &
-    pids+=($!)
-    websockify --web=/usr/share/novnc/ 0.0.0.0:"$NOVNC_PORT" localhost:5900 >/tmp/websockify.log 2>&1 &
-    pids+=($!)
+    printf '%s\n%s\n' "$VNC_PASSWORD" "$VNC_PASSWORD" | vncpasswd -f > /root/.vnc/passwd
+    chmod 600 /root/.vnc/passwd
 fi
 
-# Backup current DNS config
 cp /etc/resolv.conf /tmp/resolv.conf.bak 2>/dev/null || true
 cp /etc/hosts /tmp/hosts.bak 2>/dev/null || true
-
-# Unmount Docker's bind mounts (allows VPN to modify DNS)
 umount /etc/resolv.conf 2>/dev/null || true
 umount /etc/hosts 2>/dev/null || true
-
-# Restore DNS config as regular files
 cat /tmp/resolv.conf.bak > /etc/resolv.conf 2>/dev/null || echo "nameserver 8.8.8.8" > /etc/resolv.conf
 cat /tmp/hosts.bak > /etc/hosts 2>/dev/null || echo "127.0.0.1 localhost" > /etc/hosts
 
-# Enable IP forwarding
 echo 1 > /proc/sys/net/ipv4/ip_forward
 echo "[entrypoint] IP forwarding enabled"
 
-
-# Start systemd
 exec /sbin/init