blog: add xrdp + Remmina RDP access instructions for the Pi browser post

blog/posts/shared-browser-raspberry-pi-hermes-agent.html

@@ -123,12 +123,20 @@
 
         <h2>Step 1: Set Up the Pi</h2>
 
-        <p>Install Raspberry Pi OS Lite (no desktop needed — the browser runs headless-on-headless). SSH into the Pi and install Chromium:</p>
+        <p>Install Raspberry Pi OS Lite. SSH into the Pi and install Chromium, a lightweight desktop environment, and xrdp for remote desktop access:</p>
 
         <pre><code>sudo apt update
-sudo apt install chromium-browser -y</code></pre>
+sudo apt install chromium-browser xfce4 xrdp -y</code></pre>
 
-        <p>That's it. No desktop environment, no X server, no VNC. Chromium runs in headless mode with the debugging port exposed.</p>
+        <p>Enable xrdp and start it:</p>
+
+        <pre><code>sudo systemctl enable --now xrdp</code></pre>
+
+        <p>That's the entire install. xfce4 gives you a minimal desktop, xrdp serves it over RDP, and Chromium is the browser your agent will drive.</p>
+
+        <div class="pro-tip">
+            <strong>Pro tip:</strong> If you prefer a lighter desktop, use <code>xorgxrdp</code> with a basic window manager like <code>openbox</code> instead of xfce4. The Pi only needs to display a browser — you don't need a full desktop environment. But xfce4 is the simplest path and works well on a Pi 4 or 5.
+        </div>
 
         <h2>Step 2: The Tunnel Script</h2>
 
@@ -187,7 +195,37 @@ exec ssh \
 
         <p>You should get a JSON response with the browser version, WebSocket URL, and available pages. If you see the JSON, the tunnel is working.</p>
 
-        <p>To see the browser visually from your local machine, open Chrome or Brave and navigate to <code>chrome://inspect</code>. Click "Configure" and add <code>localhost:9222</code> (or the Pi's local IP if you're on the same network). You'll see all open tabs and can inspect them live.</p>
+        <h2>Access the Pi Desktop with Remmina</h2>
+
+        <p>Now that xrdp is running on the Pi, you can log into its full desktop from any machine on your local network. This is where you'll log into your accounts — Stripe, LinkedIn, Google, whatever your agent needs to access.</p>
+
+        <p>On your main workstation, install Remmina:</p>
+
+        <pre><code>sudo apt install remmina -y</code></pre>
+
+        <p>Open Remmina and create a new RDP connection:</p>
+
+        <ol>
+            <li><strong>Server</strong> — the Pi's IP address on your local network (e.g., <code>192.168.1.100</code>)</li>
+            <li><strong>User name</strong> — the user you created on the Pi (<code>pi</code> or your custom user)</li>
+            <li><strong>Password</strong> — that user's password</li>
+            <li><strong>Resolution</strong> — 1280x720 or 1920x1080, depending on your screen</li>
+        </ol>
+
+        <p>Click Connect. You'll see the xfce4 desktop of your Raspberry Pi. From here you can:</p>
+
+        <ul>
+            <li><strong>Open Chromium</strong> — launch the browser manually, log into your accounts, and let the session persist</li>
+            <li><strong>Check what your agent is doing</strong> — open <code>chrome://inspect</code> inside the RDP session to see all active tabs</li>
+            <li><strong>Step in</strong> — if your agent gets stuck on a login page or CAPTCHA, you can take over the same browser, resolve it, and let the agent continue</li>
+            <li><strong>Manage the tunnel</strong> — check that the tunnel script is running, restart it if needed</li>
+        </ul>
+
+        <div class="pro-tip">
+            <strong>Pro tip:</strong> Log into your accounts via the RDP session, then close Remmina. The browser stays open on the Pi with active sessions. Your agent can now use those sessions through the CDP tunnel — it inherits your logins without ever seeing your passwords. For a cleaner setup, use a separate Chromium profile for each service: <code>--user-data-dir=/home/pi/profiles/stripe</code> and keep them all running in separate windows.
+        </div>
+
+        <p>To see the browser visually from your local machine without RDP, you can also open Chrome or Brave and navigate to <code>chrome://inspect</code>. Click "Configure" and add <code>localhost:9222</code> (or the Pi's local IP if you're on the same network). You'll see all open tabs and can inspect them live.</p>
 
         <h2>Step 4: Connect Hermes to the Shared Browser</h2>