Try xpra / xpra-html as Guacamole alternative

[MoritzWeber0]

We should try out https://github.com/Xpra-org/xpra/ & https://github.com/Xpra-org/xpra-html5 as Guacamole alternative.

The idea comes from https://medium.com/omi-uulm/an-initial-approach-to-deliver-an-x11-application-as-a-web-service-79cc0f70bbed. Thanks @vik378 for sharing the link.

[MoritzWeber0]

So far, I tried the following:

wget -O "/usr/share/keyrings/xpra.asc" https://xpra.org/xpra.asc
cd /etc/apt/sources.list.d
wget https://raw.githubusercontent.com/Xpra-org/xpra/master/packaging/repos/bookworm/xpra.sources
apt update
apt install xpra

Start the server with:

XPRA_PASSWORD=mysecret xpra start --start=autostart --bind-tcp=0.0.0.0:10000,auth=env

The server runs without root permissions.

The password can be passed to the url via the password query parameter, but it's not removed from the URL and therefore is vulnerable to session hijacking (for example, another user can gain access if the token is exposed during screen share or when the URL is shared with another user).

Also, I want to play a bit with the "Share server" option.