- Introduced server URL validation via `GET /api/bd/server-info` and `probe_server_url`.
- Added LAN discovery capabilities using UDP and optional mDNS for local network panel detection.
- Implemented a local settings window for managing URL, TLS settings, and user preferences.
- Enhanced dashboard with a unified sidebar and improved scrolling behavior.
- Updated documentation and pre-release checklist to reflect new features and requirements.
Updated the entire project to AGPL-3.0, including all components and documentation. The stable releases up to v3.3.x will remain under Apache 2.0 until the next major feature release. Withdrawn and recreated French and Traditional Chinese translations under the new license. Updated relevant documentation and changelog to reflect these changes.
Add betterdesk-show-admin-credentials helper that re-execs as the betterdesk
user so operators can retrieve bootstrap passwords without chmod 777.
Refs #195
Added detailed instructions for configuring Nginx Proxy Manager and other reverse proxies with Docker for RustDesk WSS endpoints. Included troubleshooting tips and diagnostic commands to assist users in resolving common issues related to WebSocket connections and TLS configurations.
Fixes#192 — script and GHCR update flows now drop data/.last_update_result.json
the same way betterdesk.sh already does, so a failed in-panel attempt no longer
sticks around after a successful external update.
Keep apply-i18n-audit and regional patch data for low-cost locale
maintenance without shipping dev scripts to production consoles.
Add collect-gap-keys to regenerate gap-fill input from i18n-check.
Introduce bump-version.js with CI workflows for patch bumps on dev and
stable releases on main, plus panel and installer UI to choose stable vs
development GitHub update branches.
Existing Docker volumes crashed at startup because ensureAuthTables indexed
token_hash before the column existed on upgraded auth.db files. Bump images to 3.0.0.
After RustDesk→BetterDesk migration, HTTP heartbeats can update last seen while
UDP signal registration is still missing. Show a distinct "No signal" badge,
document the two-channel presence model, and publish peer_online on registration.
The panel updater assumed a native install with Go source on disk. In
Compose/GHCR mode it now uses the embedded image commit, clears stale
binary markers, and directs operators to pull new container images instead.
Expose global connection strategy in the web panel with systemd/Docker persistence, extend server health diagnostics, enforce org network policy in the signal handler, and document when relay fallback is expected vs misconfiguration.
Merge .env keys instead of replacing files, patch systemd/NSSM in place,
block panel updates when the server cannot be rebuilt, and stop routine
updates from syncing admin passwords from .env into auth.db/PostgreSQL.
Panel device groups, folders, ACL and assignments moved from auth.db into
the consolidated Postgres schema. Go now uses PanelSyncStore on PostgresDB
when -db is postgres://, with auth.db kept only as a SQLite fallback.
Node requireAuth only accepts 64-char auth.db tokens, so local /api/group
handlers returned 401 after Go JWT login. Proxy group routes to Go again,
always merge peer-tag groups, resolve auth.db path candidates, and map
console user ids for group ACL checks.
Panel groups and folders live in console auth.db, but Go /api/group only
exposed peer tags. Read auth.db (AUTH_DB_PATH), apply allowed_users and
user-group access, and mirror Node getRustDeskDeviceGroups. Keep /api/group
on the Node :21121 proxy for compatibility; document verification steps.
RustDesk clients could not log in after v3 when handlers moved to Go but
nothing listened on :21121 (API_ENABLED off) or Go bound the wrong port.
Go serves /api/login on 21114; the console proxies legacy :21121 URLs to
Go. Installers repair .env/systemd, Docker publishes both ports, and
firewall rules allow 21114 and 21121 on full installs.
Also includes betterdesk-support-agent (Fyne desktop helper) and
docs/important/ operator notes (API ports, update flow, agent roadmap).
Wire docker-publish to git tags v*, workflow_dispatch tag input, and
semver prereleases; pin quick-start compose to 3.0.0-alpha by default.
Co-authored-by: Cursor <cursoragent@cursor.com>
Phases 1-4 of the Go-server centralization plan plus optional-TLS transport.
Go server:
- db: HelpRequest model + SQLite/PostgreSQL stores (help_requests_*.go), GetDeviceOrgID.
- cdap: handleHelpRequest/handleChatMessage handlers, SendChatToDevice delivery.
- api: REST help endpoints (help_handlers.go), publish help_request/chat_message events.
Node.js panel:
- bd-api.routes.js: drop local in-memory Maps, proxy all help/chat/notification
endpoints to the Go server (read-proxy) with status/id/timestamp normalization.
Agent (native Go + Tauri sidecar):
- config.go/agent.go: optional EnforceTLS, ServerCertPin (SPKI pin), TLSInsecureSkipVerify
with env overlays and dialOptions() cert pinning via VerifyPeerCertificate.
- HTTP (ws://) stays a fully supported transport: TLS enforcement is an explicit
operator opt-in (never auto-derived from the URL scheme). The agent logs a warning
recommending wss:// for untrusted networks instead of blocking the connection.
- config.rs/sidecar.rs: propagate enforce_tls + server_cert_pin from AgentConfig
through SidecarConfig to the Go agent config; warn on plaintext ws:// to remote hosts.
This commit was made possible thanks to Insolve.
Complete the web console locale set so all 26 language files share the EN/PL baseline with no missing keys, extra keys, empty values, or English fallback values.
Keep strict i18n audit behavior and disabled auto-fix flow so incomplete translations are surfaced for manual review instead of being filled with English fallback text.
Validated with the strict web-nodejs i18n audit, JSON parsing for all locale files, placeholder preservation checks, and VS Code diagnostics.
This commit was made possible thanks to Insolve.
.gitignore: scope /lib/ and /lib64/ to repo root only — was matching Tauri src/lib directories. Go server: re-issue device_token on re-registration so agents that lost config can recover auth. Go agent: emit SESSION_START/SESSION_END stdout events for overlay integration, handle DESKTOP_STOP stdin command.
This commit was made possible thanks to Insolve.
- Create SPONSORS.md with dedicated section for INSOLVE (insolve.pl) and acknowledgment tier definitions (Honorary Supporter, Corporate Sponsor, Individual Backer).
- Add Honorary Supporter section with logo to README header linking to insolve.pl and SPONSORS.md.
- Relocate logo asset from repo root to docs/assets/insolve-logo.png.
This commit was made possible thanks to Insolve.
Send empty binary keepalive frames on signal WebSockets and ignore empty RustDesk heartbeat replies across the WS protobuf adapter. This prevents reverse-proxied WSS clients from timing out after the advertised keep_alive interval.
Document the Nginx /ws/id and /ws/relay upstream mapping for BetterDesk Docker deployments.
Fixes#144
Reported-by: @odixz
- Implemented server management service providing resource snapshots, file browser, service control, and audit logging.
- Added terminal proxy for WebSocket-backed PTY, allowing browser-based shell access with user authentication and role-based access control.
- Created server management view with tabs for overview, terminal, file management, and services, including UI elements for displaying system metrics and managing files/services.
Co-authored-by: Copilot <copilot@github.com>
- deployServerBinary: use rename(2) for atomic replace, fixes ETXTBSY
when target Go binary is busy (Linux kernel handles inode swap).
Falls back to copyFileSync on cross-device rename or non-Linux.
Windows: rename target out of the way first, then move new in.
- settings.js: mark 'server' phase as error when build succeeded but
deploy failed (was incorrectly marking 'done' from build alone).
- settings.js: completion modal now shows error title, error message
and pre-formatted stderr when serverDeploy.success === false.
- i18n: added complete_with_errors, modal_done_with_errors_title in
en/pl.
Multiple coordinated changes: frontend, backend (Tauri Rust), and web server.
Key points:
- Web remote unified to /remote/🆔 redirects legacy /remote-desktop, updated device actions, and removed old viewer rendering.
- Added adaptive quality to RDClient to avoid low-FPS stalls and defaulted to Balanced@30 with runtime promotion/demotion logic.
- Fixed session/tab cleanup to avoid stale tabs and made session teardown more robust.
- Improved agent startup responsiveness: get_agent_status now avoids slow SystemSnapshot::collect(); added a separate get_system_info command for expensive telemetry. Frontend invokes now use timeouts and parallel checks so the UI never hangs, and SetupWizard normalizes addresses before validation.
- Windows privilege check changed to CheckTokenMembership against Administrators group so menu items remain visible to admin users even without UAC elevation; tray menu items are always visible and checked on click.
- Registration/probing: server scheme (HTTPS vs HTTP) is probed and cached; API URL builder updated accordingly.
- UI/UX: added bottom navigation bar, help-session event handling, diagnostics feedback, locale display name support, CSS updates (including bundling Material Symbols font); included material-symbols-rounded.ttf and adjusted CSP to allow fonts.googleapis.com / fonts.gstatic.com.
- Added docs/PATCH_PLAN_2026-04-18.md with patch plan and rationale.
These changes aim to make the desktop agent snappier at startup, unify the web remote entrypoint, improve remote streaming stability, and harden privilege/UX behaviors.
Centralize HTTP client creation and add an opt-in TLS hardening gate (BETTERDESK_STRICT_TLS). Refactor repeated reqwest::Client::builder() usages into helper builders that warn once when self-signed certs are accepted and allow enforcing strict validation. Apply changes across agent-client and management codepaths (registration, commands, inventory collector, bd_registration). Also: warn when native agent is configured with plaintext ws:// to non-local hosts, whitelist LOG_FORMAT env var to {"text","json"} in server config, and update the audit docs to reflect these fixes.
Multiple security and maintenance fixes across components:
- betterdesk-mgmt: validate peer_id format to prevent injection in connect_to_peer (reject empty/oversized/invalid chars).
- betterdesk-mgmt (tauri.conf.json): tighten CSP by removing 'unsafe-eval' from script-src.
- betterdesk-agent-client: increase device ID entropy from 4 to 8 bytes (BD- prefix) to reduce collision/brute-force risk.
- betterdesk-server: enforce RBAC (operator+) before upgrading CDAP video WebSocket to block unauthorized access.
- betterdesk-server DBs: exclude soft_deleted peers in GetPeer queries for Postgres and SQLite.
- web-nodejs: add audit log housekeeping (hourly cleanup), add indices for audit_log, and implement cleanupOldAuditLogs(days) in sqlite adapter.
- web-nodejs brandingService: validate logo/favicon URLs to allow only http(s) or relative paths, preventing javascript:/data: XSS/SSRF vectors.
- docs: add AUDIT_BETTERDESK_2026-04-17.md (security audit summary).
These changes tighten client CSP, improve input validation, increase device identifier entropy, ensure RBAC is enforced before websocket upgrades, hide soft-deleted peers from normal queries, and add audit log maintenance and DB indexes for better performance and retention management.
Introduce comprehensive SSL/TLS management across installers and services. Adds interactive SSL menu and `do_configure_ssl` handlers (self-signed with SANs, custom certs, Let's Encrypt guidance, disable, and an Enterprise TLS mode that enables HTTPS on panel, signal, relay and API). Implements platform-specific support: docker compose helper (configure_docker_ssl), systemd and service ExecStart updates for Linux, NSSM support for Windows, .env updates (NODE_EXTRA_CA_CERTS, ALLOW_SELF_SIGNED_CERTS, ENTERPRISE_TLS) and automatic SAN detection (public/LAN IPs, optional domain). Uses long-lived self-signed certs (10 years) with RSA 2048/4096 and fallbacks for older OpenSSL; prompts users on fresh installs to configure HTTPS. Also updates menus and documentation to expose SSL configuration option.
Adds a full Phase-52 RBAC implementation and multiple server/frontend fixes. Key changes: new auth/permissions.go with 28 granular permissions and DefaultRolePermissions, expanded 7-role hierarchy and helpers in auth/roles.go, JWT org context and GenerateOrgToken, requirePermission/requireOrgMembership middlewares (Go + Node.js), DB schema & adapter changes for role_permissions and is_server_admin, org role boundary checks and peer org scoping, and guards for last-admin demotion and self-demotion. Also: TCP EOF/connection-reset log filtering in signal/relay servers, improved startup banner port display, KEYS_PATH auto-detect warning, CSS hover/transition layout fixes, admin password race mitigation, ID-change ghost peer cleanup, added Tauri ACL schema files, and a new RBAC_PHASE52.md doc. Misc: numerous web-nodejs i18n, CSS, JS and route updates and an updated .github/copilot-instructions.md timestamp/summary.
Introduce a SessionManager for relay-based remote sessions in the Tauri MGMT client: new SessionCommand API, start/stop/session input routing, clipboard/recording/quality controls, and notification read/dismiss state. Wire AppState with new mutexes and show main window on startup. CI: add SBOM generation (anchore) and Trivy vulnerability scan steps. Misc: change console Docker DB path, large README/CHANGELOG updates (chat E2E, unattended access/WOL, i18n expansion, CDAP/SDK docs), and many web-nodejs assets/locales/routes/views/services and server-side changes.
Introduce two new desktop apps: betterdesk-mgmt (operator/admin console) and betterdesk-agent-client (lightweight endpoint agent).
Key changes:
- Add complete betterdesk-agent-client scaffold: frontend (index.html, TSX components, i18n, styles, Vite/TS configs, package.json) and Rust Tauri backend (Cargo.toml, build.rs, tauri.conf.json, commands.rs, config.rs, registration.rs, sysinfo_collect.rs, NSIS language file).
- Add betterdesk-mgmt entries and assets (registered in docs) and update repo docs to describe both MGMT and Agent clients.
- Update .github/copilot-instructions.md to reflect MGMT/Agent client split and add detailed TODO/feature lists.
- Update .gitignore to exclude build artifacts for both new Tauri apps.
- Add docs/new_agents/client1.md and docs/new_agents/client2.md.
- Minor changes to server DB files and web-nodejs i18n/asset files.
This commit adds the initial scaffolding and core IPC/registration/diag features for the agent and registers the MGMT client in repository docs; further implementation and testing remain.
Add multiple security hardenings across the server and web console: enforce proof-of-possession for /ws/bd-mgmt using Ed25519-signed headers with timestamp/nonce and replay protection (public key binding, canonicalization, storage, verification, and tests); remove legacy API key query param and config-table fallback in favor of scoped api_keys (migrate bootstrap key into api_keys); tighten WebSocket origin handling for relay and signal servers to allow only localhost origins by default unless an explicit allowlist is set; update auth middleware public paths and test helpers to use X-API-Key header; add ensureScopedAPIKey migration and related helpers; add a GitHub Secret Scan workflow and an audit report. Misc: propagate audit logging on bd-mgmt connect/disconnect and validate enrollment public keys during device register.
Introduce persisted chat features and a BetterDesk desktop management WebSocket channel. Adds new REST chat handlers (history, send, read, unread, contacts, groups), bd-mgmt WebSocket and management REST endpoints, and routes in the HTTP server. Extend Database interface and models (ChatMessage, ChatGroup, ChatContact) and implement schema migrations + CRUD for PostgreSQL and SQLite. Adjust auth middleware to allow /ws/bd-mgmt/* and relax server WriteTimeout / increase IdleTimeout to accommodate long-lived WS connections. Also add a 3.0 roadmap document and minor frontend/localization/service updates related to chat and relay.
Prevent breaking RustDesk clients by keeping the API port HTTP-only and removing automatic API TLS: update APITLSEnabled logic (config.go) and remove/add-removal of -tls-api / -force-https from install scripts and service updates (betterdesk.sh, betterdesk.ps1). Fix systemd escaping for admin password and PostgreSQL URL by converting $ → $$ before writing ExecStart/Environment so credentials with $ are preserved. Add MainThread to port diagnostic patterns to avoid false positives for Node.js on newer Linux (betterdesk.sh). Also include minor struct/tag formatting and response key alignment in CDAP Go code and update changelog and copilot instructions. These changes restore client compatibility, harden installer/service writes, and improve diagnostics.
Introduce full CDAP subsystem and devices UI overhaul. Adds a new CDAP WebSocket gateway (cdap/gateway.go) with auth, connection lifecycle, message loop, heartbeat monitor and APIs (cdap/api.go, cdap/auth.go, cdap/handler.go, cdap/manifest.go, cdap/messages.go). Wire CDAP into the server (api/server.go + handlers in api/cdap_handlers.go) exposing REST endpoints for status, device list, info, manifest, state and sending commands. Enhance peer handling: CDAP-connected overlay in peer list/get, device revocation/cascade support in handleDeletePeer (blocklist, connection teardown, events + audit), and new audit action ActionPeerRevoked. Frontend updates include CDAP device page, widgets, commands, styles and services; major devices page UI redesign (responsive folder chips, toolbar, slim table, kebab menu) plus related CSS/JS/views, translations, docs and assets. Overall adds CDAP features, revocation workflow, and a responsive devices UI.
Add IPv6-only relay detection to the installers (betterdesk.sh and betterdesk.ps1). If the public IP is IPv6, the scripts attempt to resolve an IPv4 address and prefer it for relay compatibility, emitting warnings if no IPv4 is found. Also add a Troubleshooting doc section explaining the "Relay Connection Failed (IPv6)" issue, how to check and fix RELAY_SERVERS, and note the auto-detection behavior as of v2.4.0.
Preserve existing DB config during update/repair and add PostgreSQL compatibility and reliability fixes. Added preserve_database_config()/Preserve-DatabaseConfig and invoked them before console reinstall in betterdesk.sh and betterdesk.ps1 to avoid unintentionally switching PostgreSQL → SQLite. Fixed folder/user route responses to use result.id (Postgres-compatible) in web-nodejs routes. Added automatic TOTP column migrations for both SQLite and Postgres in web-nodejs/services/dbAdapter.js. Improved relay error logging and write-error handling in betterdesk-server/relay (server.go, ws.go). Updated docs and tooling: added SELinux troubleshooting (DOCKER_TROUBLESHOOTING.md), Windows build/usage notes for the migrate tool (README.md), and updated changelog/instructions (.github/copilot-instructions.md) and last-updated date.
UNITRONIX