jmri: add Phase 4 TigerVNC server on :1 (port 5901) — replaces X11 forwarding

ansible/roles/jmri/tasks/main.yml

@@ -245,9 +245,9 @@
     daemon_reload: true
 
 # ---------------------------------------------------------------------------
-# Phase 3 — X11 remote GUI access
+# Phase 3 — X11 remote GUI access (retained for fallback; VNC preferred)
 # ---------------------------------------------------------------------------
-- name: Install xauth (required for SSH X11 forwarding)
+- name: Install xauth (required for SSH X11 forwarding fallback)
   ansible.builtin.apt:
     name: xauth
     state: present
@@ -271,6 +271,56 @@
       X11UseLocalhost yes
   notify: Restart sshd
 
+# ---------------------------------------------------------------------------
+# Phase 4 — VNC server (TigerVNC)
+# Persistent virtual display on :1 (port 5901). Replaces X11 forwarding.
+# ---------------------------------------------------------------------------
+- name: Install TigerVNC server
+  ansible.builtin.apt:
+    name: tigervnc-standalone-server
+    state: present
+    update_cache: false
+
+- name: Create .vnc directory for jmri user
+  ansible.builtin.file:
+    path: "{{ jmri_home }}/.vnc"
+    state: directory
+    owner: "{{ jmri_user }}"
+    group: "{{ jmri_group }}"
+    mode: '0700'
+
+- name: Set VNC password for jmri user
+  ansible.builtin.shell:
+    cmd: "printf '{{ jmri_vnc_password }}' | vncpasswd -f > {{ jmri_home }}/.vnc/passwd"
+  become_user: "{{ jmri_user }}"
+  no_log: true
+  changed_when: true
+
+- name: Set correct permissions on VNC password file
+  ansible.builtin.file:
+    path: "{{ jmri_home }}/.vnc/passwd"
+    owner: "{{ jmri_user }}"
+    group: "{{ jmri_group }}"
+    mode: '0600'
+
+- name: Deploy jmri-vnc systemd unit
+  ansible.builtin.template:
+    src: jmri-vnc.service.j2
+    dest: /etc/systemd/system/jmri-vnc.service
+    owner: root
+    group: root
+    mode: '0644'
+  notify:
+    - Reload systemd
+    - Restart jmri-vnc
+
+- name: Enable and start jmri-vnc service
+  ansible.builtin.systemd:
+    name: jmri-vnc
+    enabled: true
+    state: started
+    daemon_reload: true
+
 - name: Deploy jmri-gui script
   ansible.builtin.template:
     src: jmri-gui.j2