# Old IPMI browser chart

Independent adapter chart for [solarkennedy/ipmi-kvm-docker](https://github.com/solarkennedy/ipmi-kvm-docker).
The public package is available from `https://brunner.ninja/charts`.

This intentionally runs obsolete Chromium and Java for legacy BMC compatibility.
Authentication and container/network isolation reduce exposure; they cannot make
an obsolete browser safe against every exploit. Use a dedicated VM instead if
sharing the Kubernetes host kernel is outside your risk tolerance.

The browser runs as UID/GID 1000 with a read-only root filesystem, zero Linux
capabilities, no privilege escalation, RuntimeDefault seccomp, no service-account
token, and bounded ephemeral writable mounts. A short init container runs as
UID 0 with the same restrictions solely to copy bundled noVNC assets out of the
upstream image's private `/root` directory. It downloads nothing. X11 TCP is
disabled and VNC listens on localhost; only noVNC HTTP/WebSocket is served.
Chromium retains upstream's `--no-sandbox` compatibility flag.

One shared desktop is used by every authorized visitor. Closing your tab does
not log out of the BMC. Sign out in the legacy browser after use. Pod replacement
clears the browser profile, downloads, and BMC sessions; there is no authoritative
data or PVC to back up. Do not save BMC passwords in the browser.

NetworkPolicy denies all traffic by default. Supply `networkPolicy.ingressFrom`
for the authenticated ingress controller and `networkPolicy.egress` or an
additional platform policy for intended destinations. Public DNS is used without
Kubernetes search suffixes. Never expose the Service directly or enable an
Ingress without authentication. The chart does not install an identity provider.

Validate with `./test.py`; use `./test.py --runtime` for a Podman smoke test of
the rendered container configuration, actual Chromium/X11 processes, HTTP and
WebSocket/RFB handshake. It requires Helm, Python with PyYAML, and Podman.
`./install.sh -f your-values.yaml` is a manual homelab recovery entry point;
normal deployments are owned by Argo CD.

Upstream publishes only the mutable `latest` tag. `Chart.yaml.appVersion` is
its canonical image tag, consumed by both containers. The exact upstream tag
`latest` is also the base Git tag. Since this is not SemVer, `git describe
--tags --long` maps reversibly to `0.0.0-latest-<count>-g<commit>`, including
count zero. Chart.yaml.version is a packaging placeholder, never a release
counter. CI tests, derives that immutable chart version, packages and publishes
it, then promotes only `bootstrap/oldipmi.yaml` in homelab-gitops. Images pull
anonymously. CI uses PACKAGE_USERNAME/PACKAGE_TOKEN and GITOPS_TOKEN, with no
Kubernetes credentials, on the established Podman-capable linux_amd64 runner.

[Homelab configuration](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/oldipmi)
selects the chart, domain, authentication middleware, and Cilium network policy.