# Lab 3 Embedded Terminal Deployment

Lab 3 now expects a same-origin WeTTY endpoint mounted at `/wetty` by default.

## Runtime Contract

- Run WeTTY on the lab host, bound to `127.0.0.1`
- Mount it behind the same public origin as the Next.js app
- Let the reverse proxy handle WebSocket upgrade for `/wetty`
- Launch WeTTY as root so it uses `/bin/login` locally
- Keep SSH available as a fallback path, not the primary student UX

Example launch command:

```bash
wetty --host 127.0.0.1 --port 3001 --base /wetty --allow-iframe
```

## Proxmox VM Shape

- Install WeTTY as a system service
- Keep it bound to localhost only
- Reverse proxy `/wetty` to the local WeTTY port over HTTPS

## Docker Shape

- Include WeTTY in the lab image
- Include the `login` and PAM pieces needed for `/bin/login`
- Run WeTTY under an init or supervisor process
- Reverse proxy `/wetty` to the local WeTTY port over HTTPS

If a specific container image cannot support `/bin/login`, the operational fallback is WeTTY SSH mode to localhost.