start.sh

#!/bin/bash
# =============================================================================
# Remote Browser Kit — Production Startup Script
# =============================================================================
set -euo pipefail

# --------------------------------------------------------------------------- #
# Logging helpers                                                               #
# Fix: log to stdout only — /logs is a Windows volume mount and may be        #
# owned by root. tee to file is optional and gracefully skipped if denied.    #
# --------------------------------------------------------------------------- #
LOG_FILE="/logs/startup.log"

log()  {
    local msg
    msg="[$(date '+%Y-%m-%d %H:%M:%S')] [INFO]  $*"
    echo "$msg"
    echo "$msg" >> "$LOG_FILE" 2>/dev/null || true
}
warn() {
    local msg
    msg="[$(date '+%Y-%m-%d %H:%M:%S')] [WARN]  $*"
    echo "$msg"
    echo "$msg" >> "$LOG_FILE" 2>/dev/null || true
}
err()  {
    local msg
    msg="[$(date '+%Y-%m-%d %H:%M:%S')] [ERROR] $*"
    echo "$msg" >&2
    echo "$msg" >> "$LOG_FILE" 2>/dev/null || true
}

# Helper: redirect a background process log to file if writable, else /dev/null
logfile() {
    local f="$1"
    if touch "$f" 2>/dev/null; then
        echo "$f"
    else
        echo "/dev/null"
    fi
}

log "============================================================"
log "Remote Browser Kit starting up"
log "============================================================"

# --------------------------------------------------------------------------- #
# Configuration — all values come from environment with sane defaults         #
# --------------------------------------------------------------------------- #
START_URL="${START_URL:-https://example.com}"
SCREEN_WIDTH="${SCREEN_WIDTH:-1920}"
SCREEN_HEIGHT="${SCREEN_HEIGHT:-1080}"
SCREEN_DEPTH="${SCREEN_DEPTH:-24}"
VNC_PORT="${VNC_PORT:-5900}"
NOVNC_PORT="${NOVNC_PORT:-6080}"
BROWSER_MODE="${BROWSER_MODE:-kiosk}"          # kiosk | fullscreen | normal
INCOGNITO="${INCOGNITO:-false}"
VNC_PASS="${VNC_PASS:-}"                        # empty = no VNC password
SESSION_MODE="${SESSION_MODE:-fresh}"           # fresh | persistent
BROWSER_ZOOM="${BROWSER_ZOOM:-1.0}"
DISPLAY_NAME=":1"

# --------------------------------------------------------------------------- #
# Browser selection                                                            #
# --------------------------------------------------------------------------- #
SUPPORTED_BROWSERS=(chromium firefox edge webkit)
BROWSER="$(echo "${BROWSER:-chromium}" | tr '[:upper:]' '[:lower:]')"

_supported=false
for b in "${SUPPORTED_BROWSERS[@]}"; do
    [ "$b" = "$BROWSER" ] && _supported=true
done
if [ "$_supported" != "true" ]; then
    err "Unsupported BROWSER='$BROWSER'. Supported values: ${SUPPORTED_BROWSERS[*]}"
    exit 1
fi

# Chromium is always built in; Firefox/Edge/WebKit are opt-in build args
# (INCLUDE_FIREFOX/INCLUDE_EDGE/INCLUDE_WEBKIT) — /opt/browsers/.available-*
# is written at build time only for what was actually installed, so a
# requested-but-not-built browser fails clearly here instead of as a raw
# "command not found" once launch_browser() tries to run it.
if [ ! -f "/opt/browsers/.available-${BROWSER}" ]; then
    err "BROWSER='$BROWSER' was requested, but this image was built without it."
    err "Rebuild with the matching flag set to true in 'env', e.g. INCLUDE_${BROWSER^^}=true, then 'browser.cmd build'. See docs/browsers.md for the build matrix."
    exit 1
fi

BROWSER_SCRIPT="/opt/browsers/${BROWSER}.sh"
if [ ! -f "$BROWSER_SCRIPT" ]; then
    err "Internal error: no launcher script for '$BROWSER' at $BROWSER_SCRIPT"
    exit 1
fi
# shellcheck source=/dev/null
source "$BROWSER_SCRIPT"

log "Configuration:"
log "  BROWSER        = $BROWSER ($BROWSER_LABEL)"
log "  START_URL      = $START_URL"
log "  RESOLUTION     = ${SCREEN_WIDTH}x${SCREEN_HEIGHT}x${SCREEN_DEPTH}"
log "  BROWSER_MODE   = $BROWSER_MODE"
log "  INCOGNITO      = $INCOGNITO"
log "  SESSION_MODE   = $SESSION_MODE"
log "  BROWSER_ZOOM   = $BROWSER_ZOOM"
log "  VNC_PORT       = $VNC_PORT"
log "  NOVNC_PORT     = $NOVNC_PORT"
log "  VNC_PASSWORD   = $([ -n "$VNC_PASS" ] && echo 'SET' || echo 'NONE (open)')"

export DISPLAY="$DISPLAY_NAME"

# --------------------------------------------------------------------------- #
# Clean up stale X server locks from previous runs                            #
# --------------------------------------------------------------------------- #
log "Cleaning up stale X locks..."
rm -f /tmp/.X1-lock /tmp/.X${DISPLAY_NAME#:}-lock
rm -rf /tmp/.X11-unix
mkdir -p /tmp/.X11-unix
chmod 1777 /tmp/.X11-unix

# --------------------------------------------------------------------------- #
# Start Xvfb virtual display                                                   #
# --------------------------------------------------------------------------- #
log "Starting Xvfb (${SCREEN_WIDTH}x${SCREEN_HEIGHT}x${SCREEN_DEPTH})..."
Xvfb "$DISPLAY_NAME" \
    -screen 0 "${SCREEN_WIDTH}x${SCREEN_HEIGHT}x${SCREEN_DEPTH}" \
    -ac \
    -nolisten tcp \
    > "$(logfile /logs/xvfb.log)" 2>&1 &

XVFB_PID=$!
log "Xvfb PID: $XVFB_PID"

# Wait until Xvfb is ready (up to 10s)
for i in $(seq 1 10); do
    if xdpyinfo -display "$DISPLAY_NAME" >/dev/null 2>&1; then
        log "Xvfb ready after ${i}s"
        break
    fi
    if [ "$i" -eq 10 ]; then
        err "Xvfb failed to start after 10 seconds — aborting"
        exit 1
    fi
    sleep 1
done

# --------------------------------------------------------------------------- #
# Start Openbox window manager                                                  #
# --------------------------------------------------------------------------- #
log "Starting Openbox..."
openbox > "$(logfile /logs/openbox.log)" 2>&1 &
sleep 1

# --------------------------------------------------------------------------- #
# Session mode / profile directory                                            #
#                                                                              #
# Profiles are namespaced per browser (/data/profile/<browser> or             #
# /tmp/<browser>-profile) so switching BROWSER on a persistent volume can't   #
# hand one browser another browser's profile format.                         #
#                                                                              #
# browser_seed_profile() writes each browser's settings template (password   #
# manager disabled, download dir, zoom) into the *actual* profile directory  #
# on every start. It has to be the real directory, not a fixed default       #
# profile path baked into the image — --user-data-dir/-profile always        #
# points elsewhere at launch, so a template copied anywhere else would       #
# never actually be read by the browser.                                     #
# --------------------------------------------------------------------------- #
if [ "$SESSION_MODE" = "persistent" ]; then
    PROFILE_DIR="/data/profile/$BROWSER"
    log "Session mode: PERSISTENT — profile at $PROFILE_DIR"
else
    PROFILE_DIR="/tmp/${BROWSER}-profile"
    log "Session mode: FRESH — ephemeral profile"
    rm -rf "$PROFILE_DIR"
fi
mkdir -p "$PROFILE_DIR"
browser_seed_profile "$PROFILE_DIR"

# --------------------------------------------------------------------------- #
# VNC password setup                                                           #
# --------------------------------------------------------------------------- #
if [ -n "$VNC_PASS" ]; then
    log "Configuring VNC password..."
    mkdir -p "$HOME/.vnc"
    x11vnc -storepasswd "$VNC_PASS" "$HOME/.vnc/passwd" 2>/dev/null
    VNC_AUTH=(-rfbauth "$HOME/.vnc/passwd")
    log "VNC password set successfully"
else
    warn "VNC_PASS not set — VNC is open. Set VNC_PASS in the 'env' file."
    VNC_AUTH=(-nopw)
fi

# --------------------------------------------------------------------------- #
# Start x11vnc                                                                 #
#                                                                              #
# IMPORTANT:                                                                   #
#   -ncache is intentionally NOT used. It multiplies screen height            #
#   (ncache 10 = height × 12 = 1080 × 12 = 12960) which causes Eggplant      #
#   and VNC clients to see wrong resolution.                                  #
#                                                                              #
#   -clip locks the advertised framebuffer to exactly SCREEN_WIDTHxHEIGHT    #
#   so Eggplant always connects at the correct resolution.                    #
# --------------------------------------------------------------------------- #
log "Starting x11vnc on port $VNC_PORT..."
x11vnc \
    -display "$DISPLAY_NAME" \
    -forever \
    "${VNC_AUTH[@]}" \
    -listen 0.0.0.0 \
    -shared \
    -rfbport "$VNC_PORT" \
    -xkb \
    -noxdamage \
    -clip "${SCREEN_WIDTH}x${SCREEN_HEIGHT}+0+0" \
    > "$(logfile /logs/vnc.log)" 2>&1 &

VNC_PID=$!
log "x11vnc PID: $VNC_PID"

# Wait for VNC port to be listening (up to 15s)
for i in $(seq 1 15); do
    if nc -z 127.0.0.1 "$VNC_PORT" 2>/dev/null; then
        log "VNC ready on port $VNC_PORT after ${i}s"
        break
    fi
    if [ "$i" -eq 15 ]; then
        err "x11vnc did not open port $VNC_PORT — aborting"
        exit 1
    fi
    sleep 1
done

# --------------------------------------------------------------------------- #
# Start noVNC web portal                                                       #
# --------------------------------------------------------------------------- #
log "Starting noVNC on port $NOVNC_PORT..."
websockify \
    --web=/usr/share/novnc/ \
    "$NOVNC_PORT" \
    "localhost:$VNC_PORT" \
    > "$(logfile /logs/novnc.log)" 2>&1 &

NOVNC_PID=$!
log "noVNC PID: $NOVNC_PID"

# Wait for noVNC port (up to 10s)
for i in $(seq 1 10); do
    if nc -z 127.0.0.1 "$NOVNC_PORT" 2>/dev/null; then
        log "noVNC ready on port $NOVNC_PORT after ${i}s"
        break
    fi
    if [ "$i" -eq 10 ]; then
        warn "noVNC did not open port $NOVNC_PORT — continuing anyway"
        break
    fi
    sleep 1
done

log "============================================================"
log "All services started. Launching $BROWSER_LABEL -> $START_URL"
log "  VNC:   vnc://localhost:$VNC_PORT"
log "  Web:   http://localhost:$NOVNC_PORT/vnc.html"
log "============================================================"

# --------------------------------------------------------------------------- #
# Launch the selected browser — single run, no auto-restart                   #
# If the user closes it, it stays closed. VNC and noVNC remain alive so the   #
# desktop is still accessible. Restart the container for a fresh session.     #
# launch_browser() (defined in the sourced browsers/<name>.sh) must run the   #
# browser as a plain foreground command, NOT exec — this script needs        #
# control back afterwards to log and fall through to `wait`.                  #
# --------------------------------------------------------------------------- #
log "Starting $BROWSER_LABEL..."
launch_browser > "$(logfile /logs/browser.log)" 2>&1 || true

log "$BROWSER_LABEL has exited. VNC session remains active."
log "To relaunch: docker restart <container>"
log "To reset:    browser.cmd restart <N>"

# Keep container alive — VNC + noVNC stay accessible after browser closes
wait