PLAN: to do — a KVM tab, the keyboard-video-mouse kind

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-24 12:37:25 -07:00
parent 2e4f3a7fe6
commit 72c7f45e19
1 changed files with 26 additions and 0 deletions
@@ -553,6 +553,32 @@ something long in one, switch away and back, refresh — it's all still there.
  item names the heavier pieces (multi-select and bulk actions, folder download, resumable
  uploads, a gallery, search) — worth doing the two together, since they are the same tab.
 - **A KVM tab** — asked for 2026-09-24, not started. A tab that shows a **custom IP-KVM's
  own web page** inside Ham Lab, so the machine's screen, keyboard and mouse are one click
  away. **This is KVM the keyboard-video-mouse switch, not KVM the hypervisor** — the
  Virtualization item above means the other one, and the two must not be confused when
  either is built. No such device exists in the lab yet, so this starts with the hardware
  (PiKVM, JetKVM, TinyPilot, or the home-built one Mitchell has in mind).
  - **Where the entry lives is the design decision.** A KVM earns its keep exactly when the
    machine is *down* — no OS, a bad kernel, a BIOS screen — which is when that host's Ham
    Lab cannot answer. So the tab has to be **hub-side**, a list the hub holds, and it must
    work for machines that run no Ham Lab at all. Configuring it as a `kvm_url` inside each
    node's own `config.json` would fail in precisely the case it is for.
  - **Framing is the first thing to test, before any UI is written.** Most IP-KVMs send
    `X-Frame-Options: DENY` or `frame-ancestors 'none'` and simply refuse to be embedded —
    Ham Lab sends both itself, on its own pages. A device whose nginx can be edited (PiKVM)
    or that is home-built can be told to allow it; one that cannot will show a blank box,
    and then the honest answer is a link that opens it in a tab rather than a fake embed.
  - **Mixed content and certificates.** Ham Lab is served over HTTPS through NPM. A KVM on
    plain HTTP will be blocked by the browser outright, and one with a self-signed
    certificate fails silently inside an iframe. Either give it a proper cert and an NPM
    host, or proxy it through the daemon — which already reverse-proxies nodes and carries
    WebSockets (`proxyNode`), and a KVM's video and input streams are exactly that. Proxying
    also solves the separate login, since the credential could be held once on the hub.
  - Worth settling too: whether the tab is per machine (a machine's KVM shown on its page)
    or one page listing every KVM; and whether a machine with no Ham Lab at all deserves a
    first-class entry on the Machines page, which today only knows hosts that answer.
 ## Open questions
 - Idle-session reaping policy (never / after N days) — leaning never; it's a