Add web (Chromium) session support

Introduce a new 'web' session type that runs Chromium in an isolated Xvfb display and exposes it via a loopback x11vnc bridge. Adds internal/web package implementing process management, framebuffer/input bridging, and session lifecycle. Extend config to include URL and browser_no_sandbox, add web resolution modes and validation (only http/https, manual/current/terminal rules). Integrate server handling and geometry selection for web sessions. Update Dockerfile, README, and config template to document and include Chromium and fonts. Add unit tests for config, server geometry, and web helper argument generation.

Author: bi119aTe5hXk

Dockerfile

@@ -12,6 +12,10 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/sunrayd ./cmd/sunr
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
+    chromium \
+    chromium-sandbox \
+    fonts-noto-cjk \
+    fonts-noto-color-emoji \
     freerdp2-x11 \
     x11vnc \
     xauth \

README.md

@@ -2,7 +2,8 @@
 
 SunRay2Server is an experimental Go server for Sun Ray 2 terminals. It accepts
 the Sun Ray authentication/display protocol and routes each terminal to a
-local test page or a remote SSH, VNC, or RDP session.
+local test page, a full-screen web dashboard, or a remote SSH, VNC, or RDP
+session.
 
 The current card reader integration reliably distinguishes `no-card` and
 `card-present`. Some firmware reports `card_id=0`, so exact card routing is
@@ -12,13 +13,14 @@ available only when the terminal provides a real ID.
 
 - Sun Ray authentication, display, keyboard, pointer, and wheel input.
 - `card-test` and interactive `geometry-test` sessions.
+- Full-screen Chromium web sessions with live page updates and input.
 - SSH with a PTY and framebuffer terminal.
 - VNC with per-session credentials, scaling, and CopyRect updates.
 - RDP through FreeRDP + Xvfb + x11vnc.
 - Optional passive smart-card/ATR observation on TCP 4120.
 - No audio forwarding yet. Sun Ray and VNC transports are not encrypted;
   use them only on a trusted network or through a secure tunnel.
-- A physical monitor is not required. RDP uses an in-container Xvfb display.
+- A physical monitor is not required. Web and RDP sessions use Xvfb.
 
 ## Build and test
 
@@ -57,7 +59,7 @@ sections:
 
 - `server`: TCP listener, fallback/canvas resolution, packet pacing, logging,
   and optional smart-card probing.
-- `sessions`: named `card-test`, `geometry-test`, `vnc`, `ssh`, or `rdp`
+- `sessions`: named `card-test`, `geometry-test`, `web`, `vnc`, `ssh`, or `rdp`
   sessions.
 - `routing`: maps `no_card`, `card_present`, exact card IDs, or terminal serials
   to session names. Terminal-specific routes take precedence over defaults.
@@ -77,6 +79,10 @@ server:
 sessions:
   card-test:
     type: card-test
+  dashboard:
+    type: web
+    url: https://example.com/
+    resolution_mode: current
   office-vnc:
     type: vnc
     address: 192.168.30.10:5900
@@ -124,14 +130,40 @@ all four colored edges fit without panning, then copy the displayed value to
 `server.display_width` and `server.display_height`. A tested Sun Ray 2 with a
 1920x1080 monitor used `1400x1050`; measure each installation.
 
-VNC and RDP resolution modes:
+VNC, RDP, and web resolution modes:
 
 - `current`: the configured/current Sun Ray canvas (default).
 - `terminal`: the original `startRes` reported by the terminal.
 - `manual`: session-level `display_width` and `display_height`.
 - VNC also supports `vnc`, which keeps the remote framebuffer at native size;
   a larger desktop may pan on the Sun Ray.
 
+### Web dashboards
+
+A `web` session opens its `url` as a full-screen Chromium application inside a
+private Xvfb display. The page remains loaded: JavaScript timers, WebSocket,
+SSE, and page-managed updates continue normally, with no periodic reload.
+Framebuffer changes are forwarded through the local VNC bridge.
+
+```yaml
+sessions:
+  dashboard:
+    type: web
+    url: https://example.com/
+    resolution_mode: current
+    browser_no_sandbox: true # commonly required by Docker/LXC
+```
+
+Mouse, wheel, and keyboard input are forwarded to Chromium. `Ctrl+R` or `F5`
+reloads, `Alt+Left` goes back, and `Alt+Right` goes forward. Web sessions support
+the same `current`, `terminal`, and `manual` resolution modes as RDP.
+
+Chromium's sandbox is enabled by default in the application. Docker and nested
+LXC environments commonly block the required namespaces, so the supplied YAML
+template explicitly sets `browser_no_sandbox: true`. This weakens browser
+isolation: use trusted URLs and set it back to `false` when the host supports
+Chromium's sandbox.
+
 ### SSH
 
 SSH requires exactly one host-key policy: `known_hosts_file`,
@@ -146,8 +178,9 @@ RDP sessions require `hostname`, `username`, and a password/password file. The
 LAN test with a self-signed server. Supported policies are `deny`, `ignore`,
 `tofu`, `name:<certificate-name>`, and `fingerprint:<hash>`.
 
-The supplied Docker image includes `xfreerdp`, `Xvfb`, and `x11vnc`. A native
-installation must provide those programs in `PATH`.
+The supplied Docker image includes Chromium, Japanese/emoji fonts, `xfreerdp`,
+`Xvfb`, and `x11vnc`. A native installation must provide the relevant programs
+in `PATH`.
 
 ## Docker Compose
 
@@ -231,9 +264,9 @@ On compact keyboards, `Pause/Break` may require `Fn`.
 - **The display is slow or resends repeat:** keep `log_input_events: false`,
   reduce the logical resolution, and try a larger `packet_delay` such as
   `300us` or `1ms`.
-- **RDP stops before showing a desktop:** verify that `xfreerdp`, `Xvfb`, and
-  `x11vnc` are present; in a customized container also verify `/tmp/.X11-unix`
-  permissions.
+- **Web or RDP stops before showing a desktop:** verify that Chromium or
+  `xfreerdp`, plus `Xvfb` and `x11vnc`, are present; in a customized container
+  also verify `/tmp/.X11-unix` permissions.
 - **The interactive Compose menu warns about terminfo:** set
   `COMPOSE_MENU=false`; this is a Compose CLI warning, not a Sun Ray error.
 

config.yaml.template

@@ -1,5 +1,5 @@
 # SunRay2Server configuration template.
-# Copy this file to config.yaml and adjust the VNC address before deployment.
+# Copy this file to config.yaml and adjust the desired session routes.
 version: 1
 
 server:
@@ -37,6 +37,22 @@ sessions:
   geometry-test:
     type: geometry-test
 
+  # Full-screen Chromium dashboard. The page stays loaded, so JavaScript,
+  # timers, SSE and WebSocket updates continue without periodic reloads.
+  # Keyboard/mouse input is forwarded through the same local VNC bridge used
+  # by RDP. Ctrl+R/F5 reload; Alt+Left/Alt+Right navigate history.
+  example-web:
+    type: web
+    url: https://example.com/
+    # current, terminal, or manual.
+    resolution_mode: current
+    # display_width: 1400
+    # display_height: 1050
+    # Docker and nested LXC commonly block Chromium's sandbox namespaces, so
+    # the Compose-ready example enables this compatibility mode. Set it to
+    # false when the host supports Chromium's sandbox, and use trusted URLs.
+    browser_no_sandbox: true
+
   example-vnc:
     type: vnc
     address: 192.168.30.10:5900
@@ -104,6 +120,8 @@ routing:
     card_present: example-vnc
     # For calibration, temporarily use:
     # no_card: geometry-test
+    # To show the web page without a card, use:
+    # no_card: example-web
 
     # Exact IDs override card_present when the terminal can report a real ID.
     # cards:
@@ -115,5 +133,6 @@ routing:
     "00144fd19044":
       no_card: card-test
       card_present: example-vnc
+      # no_card: example-web
       # cards:
       #   "0x0123456789abcdef": example-vnc

internal/config/config.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -25,6 +26,9 @@ const (
 	RDPResolutionCurrent  = "current"
 	RDPResolutionTerminal = "terminal"
 	RDPResolutionManual   = "manual"
+	WebResolutionCurrent  = "current"
+	WebResolutionTerminal = "terminal"
+	WebResolutionManual   = "manual"
 )
 
 type Config struct {
@@ -66,6 +70,8 @@ type Session struct {
 	DisplayWidth          int     `yaml:"display_width,omitempty"`
 	DisplayHeight         int     `yaml:"display_height,omitempty"`
 	Certificate           string  `yaml:"certificate,omitempty"`
+	URL                   string  `yaml:"url,omitempty"`
+	BrowserNoSandbox      bool    `yaml:"browser_no_sandbox,omitempty"`
 }
 
 type Routing struct {
@@ -155,6 +161,9 @@ func (c *Config) applyDefaults() {
 		if session.Type == "rdp" && strings.TrimSpace(session.Certificate) == "" {
 			session.Certificate = "deny"
 		}
+		if session.Type == "web" && session.ResolutionMode == "" {
+			session.ResolutionMode = WebResolutionCurrent
+		}
 		c.Sessions[name] = session
 	}
 }
@@ -234,6 +243,23 @@ func (c *Config) Validate() error {
 			default:
 				return fmt.Errorf("session %q has invalid VNC resolution_mode %q", name, resolutionMode)
 			}
+		case "web":
+			pageURL, err := url.ParseRequestURI(strings.TrimSpace(session.URL))
+			if err != nil || pageURL.Host == "" || (pageURL.Scheme != "http" && pageURL.Scheme != "https") {
+				return fmt.Errorf("session %q has invalid web URL %q (only http and https are supported)", name, session.URL)
+			}
+			switch session.ResolutionMode {
+			case WebResolutionCurrent, WebResolutionTerminal:
+				if session.DisplayWidth != 0 || session.DisplayHeight != 0 {
+					return fmt.Errorf("session %q may set display_width and display_height only with resolution_mode manual", name)
+				}
+			case WebResolutionManual:
+				if session.DisplayWidth < 1 || session.DisplayWidth > 8192 || session.DisplayHeight < 1 || session.DisplayHeight > 8192 {
+					return fmt.Errorf("session %q has invalid manual display resolution %dx%d", name, session.DisplayWidth, session.DisplayHeight)
+				}
+			default:
+				return fmt.Errorf("session %q has invalid web resolution_mode %q", name, session.ResolutionMode)
+			}
 		case "ssh", "rdp":
 			if strings.TrimSpace(session.Hostname) == "" {
 				return fmt.Errorf("session %q requires hostname", name)

internal/config/config_test.go

@@ -153,6 +153,34 @@ func TestRDPDefaultsAndValidation(t *testing.T) {
 	}
 }
 
+func TestWebDefaultsAndValidation(t *testing.T) {
+	cfg := Default()
+	cfg.Sessions["web"] = Session{Type: "web", URL: "https://example.test/dashboard"}
+	cfg.applyDefaults()
+	web := cfg.Sessions["web"]
+	if web.ResolutionMode != WebResolutionCurrent {
+		t.Fatalf("unexpected web defaults: %#v", web)
+	}
+	if err := cfg.Validate(); err != nil {
+		t.Fatal(err)
+	}
+
+	web.ResolutionMode = WebResolutionManual
+	web.DisplayWidth, web.DisplayHeight = 1400, 1050
+	cfg.Sessions["web"] = web
+	if err := cfg.Validate(); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, invalidURL := range []string{"", "example.test", "file:///tmp/dashboard.html", "javascript:alert(1)"} {
+		web.URL = invalidURL
+		cfg.Sessions["web"] = web
+		if err := cfg.Validate(); err == nil {
+			t.Errorf("expected web URL %q to fail", invalidURL)
+		}
+	}
+}
+
 func TestVNCPasswordSourcesArePerSessionAndMutuallyExclusive(t *testing.T) {
 	cfg := Default()
 	cfg.Sessions["vnc-one"] = Session{Type: "vnc", Address: "server-one:5900", Password: "one"}
@@ -260,7 +288,7 @@ func TestProjectTemplateLoads(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if cfg.Sessions["card-test"].Type != "card-test" || cfg.Sessions["geometry-test"].Type != "geometry-test" || cfg.Sessions["example-vnc"].Type != "vnc" {
+	if cfg.Sessions["card-test"].Type != "card-test" || cfg.Sessions["geometry-test"].Type != "geometry-test" || cfg.Sessions["example-vnc"].Type != "vnc" || cfg.Sessions["example-web"].Type != "web" {
 		t.Fatalf("unexpected template sessions: %#v", cfg.Sessions)
 	}
 }

internal/server/server.go

@@ -25,6 +25,7 @@ import (
 	"sunray2server/internal/rdp"
 	"sunray2server/internal/sshclient"
 	"sunray2server/internal/vnc"
+	"sunray2server/internal/web"
 )
 
 type Config struct {
@@ -392,6 +393,14 @@ func (s *Server) runSession(ctx context.Context, key string, active activeDispla
 			}
 		}
 		s.startRDP(ctx, key, active, generation, definition, password, logger)
+	case "web":
+		connecting := display.CardStatusImage(s.config.Image, "WEB", definition.URL, "CONNECT")
+		if s.isCurrentSession(key, active.client, generation) {
+			if err := active.client.ShowImage(active.width, active.height, connecting); err != nil && !errors.Is(err, net.ErrClosed) {
+				logger.Warn("web connecting screen failed", "error", err)
+			}
+		}
+		s.startWeb(ctx, key, active, generation, definition, logger)
 	}
 }
 
@@ -522,6 +531,38 @@ func (s *Server) startRDP(ctx context.Context, key string, active activeDisplay,
 	}
 }
 
+func (s *Server) startWeb(ctx context.Context, key string, active activeDisplay, generation uint64, definition appconfig.Session, logger *slog.Logger) {
+	mode, screenWidth, screenHeight := webDisplayGeometry(active, definition)
+	logger.Info("web display geometry selected", "mode", mode, "resolution", resolutionDescription(screenWidth, screenHeight))
+	firstFrame := true
+	session := web.NewSession(web.Config{
+		URL: definition.URL, ScreenWidth: screenWidth, ScreenHeight: screenHeight,
+		BrowserNoSandbox: definition.BrowserNoSandbox, Logger: logger,
+		OnFrame: func(frame *image.RGBA, changed []display.RegionUpdate, resized bool) error {
+			if !s.isCurrentSession(key, active.client, generation) {
+				return context.Canceled
+			}
+			if firstFrame || resized {
+				firstFrame = false
+				if err := active.client.ShowImage(screenWidth, screenHeight, frame); err != nil {
+					return err
+				}
+				return active.client.Send(display.LocalCursor())
+			}
+			return active.client.ShowImageRegions(screenWidth, screenHeight, frame, changed)
+		},
+	})
+	active.client.SetResyncHandler(session.RequestFullFrame)
+	active.client.SetInputHandler(session.HandleInput)
+	if err := session.Run(ctx); err != nil && ctx.Err() == nil {
+		logger.Warn("web session stopped", "url", definition.URL, "error", err)
+		if s.isCurrentSession(key, active.client, generation) {
+			failure := display.CardStatusImage(s.config.Image, "WEB ERROR", definition.URL, "CHECK LOG")
+			_ = active.client.ShowImage(active.width, active.height, failure)
+		}
+	}
+}
+
 func vncDisplayGeometry(active activeDisplay, definition appconfig.Session) (string, int, int) {
 	switch definition.ResolutionMode {
 	case appconfig.VNCResolutionTerminal:
@@ -546,6 +587,17 @@ func rdpDisplayGeometry(active activeDisplay, definition appconfig.Session) (str
 	}
 }
 
+func webDisplayGeometry(active activeDisplay, definition appconfig.Session) (string, int, int) {
+	switch definition.ResolutionMode {
+	case appconfig.WebResolutionTerminal:
+		return definition.ResolutionMode, active.reportedWidth, active.reportedHeight
+	case appconfig.WebResolutionManual:
+		return definition.ResolutionMode, definition.DisplayWidth, definition.DisplayHeight
+	default:
+		return appconfig.WebResolutionCurrent, active.width, active.height
+	}
+}
+
 func resolutionDescription(width, height int) string {
 	if width == 0 && height == 0 {
 		return "VNC framebuffer"

internal/server/server_test.go

@@ -88,6 +88,26 @@ func TestRDPDisplayGeometryModes(t *testing.T) {
 	}
 }
 
+func TestWebDisplayGeometryModes(t *testing.T) {
+	active := activeDisplay{width: 1400, height: 1050, reportedWidth: 1920, reportedHeight: 1080}
+	tests := []struct {
+		definition appconfig.Session
+		mode       string
+		width      int
+		height     int
+	}{
+		{appconfig.Session{}, appconfig.WebResolutionCurrent, 1400, 1050},
+		{appconfig.Session{ResolutionMode: appconfig.WebResolutionTerminal}, appconfig.WebResolutionTerminal, 1920, 1080},
+		{appconfig.Session{ResolutionMode: appconfig.WebResolutionManual, DisplayWidth: 1280, DisplayHeight: 720}, appconfig.WebResolutionManual, 1280, 720},
+	}
+	for _, test := range tests {
+		mode, width, height := webDisplayGeometry(active, test.definition)
+		if mode != test.mode || width != test.width || height != test.height {
+			t.Errorf("mode %q = %q %dx%d, want %q %dx%d", test.definition.ResolutionMode, mode, width, height, test.mode, test.width, test.height)
+		}
+	}
+}
+
 func TestCardSessionSlotUsesDefinitiveInsertEvents(t *testing.T) {
 	tests := []struct {
 		cardType string