v1.15.0

What's Changed

• feat(terraform): static public IP (Elastic IP), on by default by @oriolrius in #42

Full Changelog: v1.14.0...v1.15.0

v1.14.0

What's Changed

• chore(ci): Bump astral-sh/setup-uv from 10.3.0 to 10.3.2 by @dependabot[bot] in #40
• feat(desktop): install xdotool and asciinema by @oriolrius in #41

Full Changelog: v1.13.0...v1.14.0

v1.13.0 — idle auto-stop, quiet Chrome with CDP, readable DeepSeek Harness, local.yml

Highlights

Auto-stop when idle (#36)

• New tag idle-stop: a systemd timer checks every 5 min. After 60 min with no keyboard/mouse in the Chrome Remote Desktop session and no typing in any terminal (SSH, tmux, herdr), it saves your chezmoi configuration (re-add, commit, push) and shuts down.
• Shutting down from inside stops the instance: the disk is kept, and no AWS credentials are needed on the VM. Terraform and CloudFormation now set InstanceInitiatedShutdownBehavior = stop explicitly.
• A busy machine (5-minute load above 1.0) is never stopped.
• Variables: idle_stop_enabled, idle_stop_minutes, idle_stop_max_load. Use sudo /usr/local/sbin/idle-stop --dry-run to see what it measures.
• New scripts/resume.sh: starts the stopped instance and prints its new public IP.

Desktop Chrome: quiet policies, Google search, optional CDP (#37)

• chrome_quiet_policies (default on), as managed policies:
  • no password manager or "save password" prompt, and no autofill;
  • no default-browser question, promotional tabs or metrics;
  • no Privacy Sandbox prompt, and no first-run screen;
  • Google as the default search engine, which also skips the EU "Choose your search engine" screen.
• chrome_cdp_enabled (default off): the desktop Chrome exposes CDP on 127.0.0.1:9222 (chrome_cdp_port), reachable through an SSH tunnel.
  • It uses its own profile, because Chrome ≥ 136 refuses CDP on the default one.
  • The dock, the menu and links opened by other programs all start it with CDP.

DeepSeek Harness web UI readable in recordings (#38)

• The shell's font (JetBrainsMono Nerd Font Mono) is used for text, code and the terminal, at larger sizes: text 18 (was 14), code 16 (was 11), terminal 18 (was 13).
• Variables: dsh_font_size, dsh_code_font_size, dsh_terminal_font_size, dsh_font_family.

Personal settings in local.yml (#39)

• Copy local.yml.example to local.yml (git-ignored). The playbook loads it automatically, so your choices (keyboard, model, CDP, idle limit…) apply on every run without -e. -e still wins.
• No secrets in it: pass litellm_api_key once with -e.

Verified on a live VM

• A real idle stop (66 min idle → chezmoi saved and pushed → stopped), then resume.sh.
• chrome://policy shows every policy with status OK, and CDP answers /json/version.
• The dsh UI renders in JetBrainsMono at 18 px.
• A local.yml run changes nothing on a VM already configured that way.

Full Changelog: v1.12.0...v1.13.0

v1.12.0

What's Changed

• feat(deepseek-harness): install DeepSeek Harness through the LiteLLM gateway by @oriolrius in #31

Full Changelog: v1.11.0...v1.12.0

v1.11.0

What's Changed

• feat(dotfiles): chezmoi + GitHub CLI and a tutorial to keep personal config by @oriolrius in #29
• feat: chezit + VictorMono Nerd Font on the console by @oriolrius in #30

Full Changelog: v1.10.0...v1.11.0

v1.10.0 — keyboard layout for Chrome Remote Desktop

Highlights

Keyboard layout is now configurable (#28)

• The Chrome Remote Desktop session used to start with a hard-coded US layout (setxkbmap us). On a Spanish or other non-US keyboard, keys such as ñ, @ and accents came out wrong.

• New Ansible variable keyboard_layout. Its default, us, keeps the previous behaviour, so existing installs don't change. Set it to your layout:

  uv run ansible-playbook playbook.yml -e keyboard_layout=es                  # full install
  uv run ansible-playbook playbook.yml --tags desktop -e keyboard_layout=es   # change it later

• It applies from the next CRD session. To switch the current session right away, run setxkbmap es in a terminal inside the desktop.

• Documented in the README ("Keyboard layout") and in step 6 of both runbooks.

Full Changelog: v1.9.0...v1.10.0

v1.9.0

Version shown in the CRD Recorder app

• The window title reads CRD Recorder v1.9.0.
• The tray tooltip shows the state (CRD Recorder — Recording) and the version on a second line.

Both show the version that is running. crd-recorder-gui --version shows the installed binary; after an upgrade, quit the app from the tray menu and reopen it from the dock.

Full changelog: v1.8.1...v1.9.0 (#26)

v1.8.1

Clearer recorder log, faster app build

CRD Recorder log

• "Recording stopped" appears once ffmpeg has finished the file, after "Recorder stopping".
• Restarts after a resize or session end are shown as normal info. Only unexpected restarts (e.g. an ffmpeg crash) are warnings.
• ffmpeg's x11grab errors when the screen changes size are no longer shown; journald still keeps them.
• The recorder's recent history comes first, so the log is in time order.

Recorder

• No more "Killing process … (sleep)" at stop, and no "Killed ffmpeg …" job notice from bash after an ffmpeg crash.

CI

• App build: ~1.5 min on PRs and ~30 s on release tags (was 12 min).

Full changelog: v1.8.0...v1.8.1 (#25)

v1.8.0

CRD session recording + CRD Recorder app

New: recorder component (uv run ansible-playbook playbook.yml --tags recorder)

• crd-recorder.service records the Chrome Remote Desktop session with ffmpeg: 1 frame/s, UTC date/time in the top-left corner, H.264 in MKV, files cut on every full UTC hour in ~/recordings/.
  • Starts and stops with chrome-remote-desktop@ubuntu; on stop the current file is always finalized.
  • Finds CRD's X display itself (no hard-coded :20). A resize or session end starts a new file; a crash is restarted by systemd.
  • Settings in /etc/default/crd-recorder, logs in journalctl -u crd-recorder.
• CRD Recorder (crd-recorder-gui, Go + GTK 3) is a tray app that starts with the XFCE session.
  • The tray icon shows the real recorder state: red dot recording, grey ring stopped, amber waiting, blue restarting.
  • Start/Stop recording (a sudoers rule allows exactly those two systemctl commands).
  • Upload sends finished recordings to a Transfer.sh server (default https://x.joor.net), oldest first, never the file still being written. The returned URLs are listed with a Copy button.
  • Log view of the recorder's journal; settings in ~/.config/crd-recorder-gui/.
  • Single instance: the tray or dock icon brings the window forward.
• Desktop: the top panel has a system tray, and the dock has a CRD Recorder launcher.

Upgrading: Ansible removes the old XFCE-autostart recorder and finalizes its current file. Recording is enabled on first install only; afterwards your Start/Stop choice is kept.

Assets: crd-recorder-gui-linux-amd64 (+ .sha256), downloaded by Ansible. Built by CI on every v* tag.

Full changelog: v1.7.0...v1.8.0 (#24)

v1.7.0 — Terraform route, student runbooks, desktop fixes

Highlights

Terraform, equivalent to CloudFormation

• New terraform/ creates the same instance and security group as cloudformation.yaml: t3a.xlarge, 25 GB gp3, ports 22 and 8888-8889, key pair ec2-key.
• It also creates a minimal public VPC, so it works in accounts without a default VPC, such as the course sandbox.
• Provisioning is unchanged: the same Ansible playbook.

No more JUPYTER_IP

• The inventory finds the host by itself through scripts/host-ip.sh: JUPYTER_IP if set, else the Terraform output, else the running instance of the ec2-console CloudFormation stack.

Step-by-step student runbooks

• docs/RUNBOOK-terraform.md (recommended) and docs/RUNBOOK-cloudformation.md.
• They cover tools, AWS login, SSH key, launch, Ansible, guided Chrome Remote Desktop setup, stop/start to save money, and teardown.
• The README now links to them instead of duplicating the steps. It also has current eu-west-1 prices with a monthly cost column.

Desktop and tooling

• Fix: the "Authentication is required to create a color managed device" prompt no longer appears in Chrome Remote Desktop sessions (polkit rule for colord).
• Fix: the XFCE dock launchers (Kitty, Files, Chrome, VS Code) are now deployed. The panel config referenced them, but they were never shipped, so the icons showed as broken.
• New: herdr (runtime for coding agents) installed with the terminal tag.

CI

• Checkov: skip the CKV_AWS_260 false positive on the DBAI port-80 rule, which only opens to explicit CIDRs or the VM's own IP. This makes main green again.

Also included since v1.6.0 (DBAI course path, dbai/)

• #11 adopt-student-root: S6 adoption after a zero-change plan
• #12 verify the replacement host identity before reconnecting
• #14 / #15 / #16 full S6 restore route, timed recovery evidence, and console.sh recover triage
• #17 S2–S7 profiles qualified, S8 k3s transition, exam preflight
• #18 the recovery chat ping uses the nan.builders course-chat
• #19 / #20 / #21 operations capacity qualification and operations-0.3.0 (30 GB root, own-EIP port 80)

Full Changelog: v1.6.0...v1.7.0