From e4b04f95fe76652683ad6fe6ad6fee80260fc477 Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Mon, 15 Jun 2026 18:41:15 +0800
Subject: [PATCH] feat(xrdp): provision and enforce standard user login instead
 of root

---
 setup-xfce-xrdp.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/setup-xfce-xrdp.yaml b/setup-xfce-xrdp.yaml
index 756c419..1304426 100644
--- a/setup-xfce-xrdp.yaml
+++ b/setup-xfce-xrdp.yaml
@@ -16,4 +16,11 @@
     - name: Include XRDP server role when enabled
       ansible.builtin.include_role:
         name: roles/vhosts/remote_desktop_xrdp_server
+      vars:
+        xfce_manage_user: true
+        xfce_user: "{{ xworkspace_console_user | default('ai-workspace') }}"
+        xfce_user_password_plaintext: "{{ xworkspace_console_auth_token | default('admin') }}"
+        xfce_user_groups:
+          - sudo
+          - docker
       when: xworkspace_console_enable_xrdp | bool