From 7520a1a5fb2a2a7588485596c48a002e3f74898b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Kr=C3=BCger?= <valknar@pivoine.art>
Date: Mon, 24 Aug 2026 16:32:36 +0200
Subject: [PATCH] feat(wayvnc): add config and user service for tailnet-only
 VNC access

Binds to the tailscale IP only, with PAM auth over TLS. TLS cert/key
are machine-local secrets and intentionally not tracked.
---
 .config/systemd/user/wayvnc.service | 14 ++++++++++++++
 .config/wayvnc/config               |  6 ++++++
 .gitignore                          |  5 +++++
 3 files changed, 25 insertions(+)
 create mode 100644 .config/systemd/user/wayvnc.service
 create mode 100644 .config/wayvnc/config

diff --git a/.config/systemd/user/wayvnc.service b/.config/systemd/user/wayvnc.service
new file mode 100644
index 0000000..1b24686
--- /dev/null
+++ b/.config/systemd/user/wayvnc.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=wayvnc - VNC server for wlroots Wayland compositors
+After=graphical-session.target
+PartOf=graphical-session.target
+Requisite=graphical-session.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/wayvnc
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=graphical-session.target
diff --git a/.config/wayvnc/config b/.config/wayvnc/config
new file mode 100644
index 0000000..63cac13
--- /dev/null
+++ b/.config/wayvnc/config
@@ -0,0 +1,6 @@
+address=100.64.0.1
+port=5900
+enable_auth=true
+enable_pam=true
+certificate_file=/home/valknar/.config/wayvnc/tls_cert.pem
+private_key_file=/home/valknar/.config/wayvnc/tls_key.pem
diff --git a/.gitignore b/.gitignore
index 30acc99..374e7f9 100755
--- a/.gitignore
+++ b/.gitignore
@@ -58,6 +58,11 @@
 !.config/zed/settings.json
 !.config/uwsm/
 !.config/uwsm/env
+!.config/wayvnc/
+!.config/wayvnc/config
+!.config/systemd/
+!.config/systemd/user/
+!.config/systemd/user/wayvnc.service
 !.config/kitty/
 !.config/kitty/kitty.conf
 !.config/kitty/themes/