jmri: add Phase 4 TigerVNC server on :1 (port 5901) — replaces X11 forwarding

ansible/roles/jmri/templates/jmri-gui.j2

@@ -1,41 +1,40 @@
 #!/bin/bash
-# jmri-gui — launch JMRI GUI over SSH -X (X11 forwarding)
+# jmri-gui — launch JMRI GUI on VNC virtual display
 # Managed by Ansible — do not edit manually.
 #
 # Usage (connect as jmri user):
-#   ssh -X jmri@main-street-station jmri-gui panelpro
-#   ssh -X jmri@main-street-station jmri-gui decoderpro
-#   ssh -X jmri@main-street-station jmri-gui status
+#   ssh jmri@main-street-station jmri-gui panelpro
+#   ssh jmri@main-street-station jmri-gui decoderpro
+#   ssh jmri@main-street-station jmri-gui status
 #
-# ~/.ssh/config recommended:
-#   Host main-street-station
-#       User jmri
-#       ForwardX11 yes
+# Then connect a VNC client to main-street-station.local.mk-labs.cloud:5901
+# VNC password is in the Ansible vault (vault_jmri_vnc_password)
 
 set -euo pipefail
 
 JMRI_DIR="{{ jmri_install_dir }}"
 JMRI_SERVICE="jmri.service"
 MONITOR_SERVICE="jmri-monitor.service"
+VNC_SERVICE="jmri-vnc.service"
+DISPLAY=":{{ jmri_vnc_display }}"
+export DISPLAY
 
 usage() {
     echo "Usage: jmri-gui <panelpro|decoderpro|status>"
     exit 1
 }
 
-check_display() {
-    if [ -z "${DISPLAY:-}" ]; then
-        echo "ERROR: No DISPLAY set. Connect with: ssh -X jmri@main-street-station"
-        exit 1
-    fi
-}
-
 status() {
     echo "=== JMRI daemon ==="
     systemctl status "$JMRI_SERVICE" --no-pager -l 2>&1 | head -8
     echo ""
+    echo "=== VNC server ==="
+    systemctl status "$VNC_SERVICE" --no-pager -l 2>&1 | head -5
+    echo ""
     echo "=== Layout monitor ==="
     systemctl status "$MONITOR_SERVICE" --no-pager -l 2>&1 | head -5
+    echo ""
+    echo "Connect VNC client to: $(hostname -f):{{ jmri_vnc_port }}"
 }
 
 launch() {
@@ -48,31 +47,33 @@ launch() {
         *)          usage ;;
     esac
 
-    check_display
+    # Ensure VNC server is running
+    if ! systemctl is-active --quiet "$VNC_SERVICE" 2>/dev/null; then
+        echo "Starting VNC server..."
+        sudo systemctl start "$VNC_SERVICE"
+        sleep 2
+    fi
 
-    # Stop the daemon if running
+    # Stop the JMRI daemon if running
     if systemctl is-active --quiet "$JMRI_SERVICE" 2>/dev/null; then
         echo "Stopping JMRI daemon..."
         sudo systemctl stop "$JMRI_SERVICE"
     fi
 
-    echo "Launching $binary (last-used profile)..."
-    echo "Close the window to return to daemon mode."
+    echo "Launching $binary on VNC display $DISPLAY..."
+    echo "Connect your VNC client to: $(hostname -f):{{ jmri_vnc_port }}"
+    echo "VNC password: see Ansible vault (vault_jmri_vnc_password)"
     echo ""
 
-    # SSH sets DISPLAY to localhost:N (TCP) — translate to unix socket form
-    # so Java's AWT xauth lookup matches the forwarded cookie.
-    export DISPLAY=$(echo "$DISPLAY" | sed 's/localhost:/:/') 
-
     # Force AWT out of headless mode
     export JMRI_OPTIONS="-Djava.awt.headless=false"
 
-    # Run without --profile so JMRI uses its last-session preference.
-    # The daemon service uses --profile explicitly for headless reliability.
-    "$JMRI_DIR/$binary"
+    # Launch on the VNC display — no --profile so JMRI uses last-session preference
+    "$JMRI_DIR/$binary" &
 
+    echo "$binary launched in background on VNC display."
+    echo "Close it from the VNC client, then run 'jmri-gui status' to check state."
     echo ""
-    echo "$binary closed."
 
     # Restart daemon if layout switch is still on
     if systemctl is-active --quiet "$MONITOR_SERVICE" 2>/dev/null; then
@@ -96,8 +97,7 @@ for perm in perms:
 sys.exit(1)
 EOF
         then
-            echo "Layout is ON — restarting JMRI daemon."
-            sudo systemctl start "$JMRI_SERVICE"
+            echo "Layout is ON — JMRI daemon will restart when GUI is closed."
         else
             echo "Layout is OFF — JMRI daemon will not restart."
         fi

ansible/roles/jmri/templates/jmri-vnc.service.j2

@@ -0,0 +1,28 @@
+[Unit]
+Description=JMRI VNC virtual display (:{{ jmri_vnc_display }})
+After=network.target
+# Start before jmri.service so the display is ready when JMRI launches
+Before=jmri.service
+
+[Service]
+Type=simple
+User={{ jmri_user }}
+Group={{ jmri_group }}
+ExecStart=/usr/bin/Xtigervnc \
+    :{{ jmri_vnc_display }} \
+    -rfbport {{ jmri_vnc_port }} \
+    -geometry {{ jmri_vnc_geometry }} \
+    -depth {{ jmri_vnc_depth }} \
+    -SecurityTypes VncAuth \
+    -PasswordFile {{ jmri_home }}/.vnc/passwd \
+    -localhost no \
+    -AlwaysShared \
+    -NeverShared no \
+    -AcceptKeyEvents \
+    -AcceptPointerEvents \
+    -desktop "JMRI"
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target