Kasm: new service

[jackspiering]

Description

Adds Kasm Workspaces (Community Edition) as a new stack, from the all-in-one kasmweb/workspaces:1.19.0 image that Kasm publishes (kasm-workspaces-dind).

• Sidecar is justified. The image ships no tailscale or tailscaled, so the stack puts Kasm on the Tailnet with the standard sidecar and Tailscale Serve.
• Port 4443, not 443. Serve holds 443 on the Tailscale IP, and Kasm's own 443 publish fails in the shared namespace with failed to bind host port 0.0.0.0:443/tcp: address already in use (reproduced). KASM_PORT=4443, and Serve forwards with https+insecure.
• Privileged container, because Kasm runs its own Docker daemon (Docker-in-Docker). Documented under "Deviations from the standard setup".
• No secrets in .env. The admin@kasm.local and user@kasm.local passwords are set in the install wizard on port 3000. The Docker Hub login is optional.
• Pinned to 1.19.0, because Kasm publishes no latest tag.
• Data is in ./kasm-data/opt/ (about 13 GB with one Alpine workspace image, so the README says to reserve space).

The Compose block that issue #325 pastes is Open Notebook, not Kasm. Open Notebook is covered by #322 and #391, so this PR follows the issue title and the linked Kasm repository.

Related Issues

• Closes 🏗️ New Service: kasm Workspaces #325

Verification

• docker compose config --quiet from services/kasm, with dummy values for required variables (the stack has none)
• The stack started, Tailscale is healthy, and the service is reachable through the Tailnet
• The main function of the service works, and its data survives a restart
• rumdl check --config .markdownlint.yml . (0.2.78) on the whole repository, and git diff --check origin/main

Live test, with a scratch copy and the test auth key:

• Tailscale and application containers healthy. The application health check (curl -fsk https://127.0.0.1:4443/api/__healthcheck) returns {"ok": true} after the install.
• Ran the install wizard (Alpine 3.23 desktop image). Serve answered with a Let's Encrypt certificate and HTTP 200, checked from inside the namespace with --resolve.
• Signed in as user@kasm.local through the Serve URL, started a workspace, and loaded vnc.html plus a WebSocket upgrade (101 Switching Protocols) on /desktop/<id>/vnc/websockify through Serve. This also worked with the zone proxy port at 4443 and at 0, so no change in Kasm's settings is needed.
• docker compose up -d --force-recreate: the install, user, and image list survived, and a new workspace started.
• The published 4443 port answered on the host.

Not run:

• Not run in a browser: the preview tools were off, so I drove the wizard and the API with a Socket.IO client and curl. The rendered workspace was not viewed.
• The "Stop Install Wizard" button was not clicked. The README describes it from the wizard's own code.
• The health check before the install was not run. The Kasm port is not listening before the install, so the container shows unhealthy after the 10-minute start_period until the wizard is done. The README says so.
• Hardware requirements and gamepad support (/dev/input) were not tested and are not documented.

Impact on existing users

• None.

Checklist

• I have performed a self-review of my code and followed the templates structure.
• I did not commit a working auth key, password, token, or other credential.
• The service README uses the headings of the template, in the same order, and is up to date.
• I added, removed, or renamed the service in the root README.md, in alphabetical order, or this PR does not change the list of services.

Additional Context

• The wizard on port 3000 stays up after the install and has no sign-in. The README tells users to stop it from its dashboard when done.
• The "Web URL" link on the wizard dashboard points to port 4443, which is the self-signed endpoint. The README tells users to use the Serve address.