Require TRUSTED_PROXIES before honoring X-Forwarded headers, and deliver async PunchHole/RelayResponse via ip:port wsPunchConns so shared-NAT peers do not get the wrong signed PK.
Store PUBLIC_* on the console-data volume so panel settings survive compose recreate; keep Compose env override and .env mirror for IaC and bare-metal.
Ephemeral WebSocket RequestRelay sessions were getting an immediate empty binary frame after HTTP 101, which desktop clients parse as RendezvousMessage{union:None} and disconnect before RelayResponse.
Node no longer pre-emptively falls back to :5443 when systemd grants bind capability. Repair HTTPS/TLS syncs PORT=80 with HTTPS_PORT=443; installer health checks and post-toggle tests surface fallback-port mismatches.
Help operators reach the panel at https://domain without :5443 via installer prompts, docs, and cleaner HTTP redirects, and align fresh-install self-signed cert permissions with the #219 deploy flow.
Auto-redeploy TLS material on update/repair, unify SSL menu C with protocol toggle T, and retry post-toggle health checks so the console user can always read keys under $RUSTDESK_PATH/ssl/.
Refs #219
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove internal LAN IP, SSH user, and developer paths from docs and examples; move deploy runbook to gitignored docs/private with a public template; drop Cursor debug logging leftovers; add CI checks to prevent regression.
Co-authored-by: Cursor <cursoragent@cursor.com>
Certbot certs were symlinked into /etc/letsencrypt paths the non-root console could not read, so Node fell back to HTTP on :5000 while config still said HTTPS. Copy material into $RUSTDESK_PATH/ssl/, refresh on renew, and auto-repair legacy symlink installs.
Fixes#219
Co-authored-by: Cursor <cursoragent@cursor.com>
Add PUBLIC_SERVER_ID, PUBLIC_RELAY_SERVER, and PUBLIC_API_URL with Settings UI,
unified endpoint resolution across Dashboard/Keys, and fallbacks via PANEL_PUBLIC_HOST.
Updated the documentation for RustDesk mass-deployment, including the correct `--config` deploy string format and the addition of editable client server address fields. Enhanced the dashboard with features like **Copy deploy string** and **Intune script** snippets. Introduced a new environment variable `PANEL_PUBLIC_HOST` for better configuration management. Added UI elements for improved user experience in client configuration.
Added detailed instructions for configuring Nginx Proxy Manager and other reverse proxies with Docker for RustDesk WSS endpoints. Included troubleshooting tips and diagnostic commands to assist users in resolving common issues related to WebSocket connections and TLS configurations.
Send empty binary keepalive frames on signal WebSockets and ignore empty RustDesk heartbeat replies across the WS protobuf adapter. This prevents reverse-proxied WSS clients from timing out after the advertised keep_alive interval.
Document the Nginx /ws/id and /ws/relay upstream mapping for BetterDesk Docker deployments.
Fixes#144
Reported-by: @odixz
Introduce comprehensive SSL/TLS management across installers and services. Adds interactive SSL menu and `do_configure_ssl` handlers (self-signed with SANs, custom certs, Let's Encrypt guidance, disable, and an Enterprise TLS mode that enables HTTPS on panel, signal, relay and API). Implements platform-specific support: docker compose helper (configure_docker_ssl), systemd and service ExecStart updates for Linux, NSSM support for Windows, .env updates (NODE_EXTRA_CA_CERTS, ALLOW_SELF_SIGNED_CERTS, ENTERPRISE_TLS) and automatic SAN detection (public/LAN IPs, optional domain). Uses long-lived self-signed certs (10 years) with RSA 2048/4096 and fallbacks for older OpenSSL; prompts users on fresh installs to configure HTTPS. Also updates menus and documentation to expose SSL configuration option.
UNITRONIX