Existing Docker volumes crashed at startup because ensureAuthTables indexed
token_hash before the column existed on upgraded auth.db files. Bump images to 3.0.0.
The panel updater assumed a native install with Go source on disk. In
Compose/GHCR mode it now uses the embedded image commit, clears stale
binary markers, and directs operators to pull new container images instead.
Mount console-data read-only into the server container and set AUTH_DB_PATH
so RustDesk clients receive panel folders/groups in SQLite deployments.
Wait for auth.db on first boot and start console before Go in single-container
layouts to avoid empty /api/device-group/accessible responses.
Refs #138
RustDesk clients could not log in after v3 when handlers moved to Go but
nothing listened on :21121 (API_ENABLED off) or Go bound the wrong port.
Go serves /api/login on 21114; the console proxies legacy :21121 URLs to
Go. Installers repair .env/systemd, Docker publishes both ports, and
firewall rules allow 21114 and 21121 on full installs.
Also includes betterdesk-support-agent (Fyne desktop helper) and
docs/important/ operator notes (API ports, update flow, agent roadmap).
Wire docker-publish to git tags v*, workflow_dispatch tag input, and
semver prereleases; pin quick-start compose to 3.0.0-alpha by default.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add a device verification/enrollment workflow so new registrations are
held for operator review instead of connecting silently.
Go server (signal + api):
- Signal-mode pending: in 'managed' mode, unknown stock RustDesk clients
are queued (pending_device_<id>) instead of being silently rejected.
- Rich approve: handleApproveDevice accepts display_name, sync_mode and
normalized tags; handleRejectDevice supports an optional ban.
Node.js console:
- registrations.ejs approve modal (name, sync mode, tags, folder) and
reject modal with ban option; betterdeskApi + routes wire display_name,
sync_mode, tags and folder assignment through to the Go server.
- EN/PL/ZH i18n for all new strings.
Installers (managed default for FRESH installs only; existing installs
stay on the Go default 'open' or their DB-persisted mode):
- betterdesk.sh / betterdesk.ps1 write ENROLLMENT_MODE=managed to the
server env only when no existing database is detected (FRESH_INSTALL).
- Docker single + multi container entrypoints detect fresh volumes via a
sentinel plus id_ed25519/db_v2.sqlite3 presence and default to managed;
ENROLLMENT_MODE is now passed through supervisord and all compose files.
This commit was made possible thanks to Insolve.
Privilege separation across all installers so the long-running services no longer run with full administrative rights:
betterdesk.sh: installer keeps root but systemd units now run as a dedicated unprivileged 'betterdesk' system account by default (auto-created via ensure_service_user). Added full systemd hardening for the Go server (NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, ReadWritePaths) and light hardening for the Node.js console. chown migrates existing root-owned data to the service account on update. Opt-out via --run-as-root / BETTERDESK_RUN_AS_ROOT=1; custom account via BETTERDESK_SERVICE_USER. Minimal mode covered too.
betterdesk.ps1: NSSM services now run under their per-service low-privilege virtual accounts (NT SERVICE\<service>) instead of LocalSystem, with scoped icacls grants on the install/data dirs (Set-ServiceLeastPrivilege helper). Applied to the Go server, Node.js console and minimal-mode service. Opt-out via -RunAsRoot / BETTERDESK_RUN_AS_ROOT=1.
Docker: verified already privilege-separated (supervisord drops both programs to user=betterdesk; multi-container images drop via su-exec).
Also bundles in-progress changes to the Go server API, Node.js console services and Docker compose/Dockerfiles.
This commit was made possible thanks to Insolve.
cap_drop: ALL removed capabilities needed by su-exec to drop from root to betterdesk user. The entrypoint scripts chown volumes then su-exec to UID 10001, which calls setgroups() — requires SETGID. Added cap_add with the 4 minimal capabilities across all 3 compose files.
This commit was made possible thanks to Insolve.
Node.js (no recompile required):
- H-04: RUSTDESK_API_DISABLE_TOTP now requires explicit _ACKNOWLEDGED flag
- M-03: drop Referer-based skip from apiLimiter; add dedicated widgetLimiter
- M-06: gate /api/system/info, /logs/recent, /database/stats, /docker/containers, /speed-test behind requirePermission('metrics.view')
- L-01: startup banner now warns when TRUST_PROXY is off in production / errors when TOTP bypass is set without acknowledgement
Scripts / Docker:
- M-04: betterdesk.sh migration tool invocation switched from eval(cmd-string) to bash array exec
- M-05: all admin / PostgreSQL password generators switched from openssl rand -base64+tr+head to openssl rand -hex 16 (full entropy)
- L-02: docker-compose.yml / single.yml / quick.yml services gain security_opt: no-new-privileges and cap_drop: ALL
Documentation:
- I-04: add SECURITY.md (supported versions, reporting channels, SLA, scope, hardening defaults)
Go server (requires rebuild on host: cd betterdesk-server && go build ./...):
- H-03: /metrics now gated by METRICS_IP_ALLOWLIST / METRICS_PUBLIC; per-username login + 2FA rate-limit added on top of per-IP
- M-07: enrollment (/api/devices/register*) and branding (GET /api/branding) endpoints rate-limited per IP
- I-02: bd-mgmt WebSocket gets SetReadLimit(16 MiB) to bound memory
- L-04: auth middleware skips noisy public probes and redacts /peers/{id} segments
This commit was made possible thanks to Insolve.
Complete Czech console translation from PR #133, update Docker quick-start admin credential lookup from PR #134, and fix live device-status updates found while reviewing PR #35.
Refs: #133, #134, #35
Co-authored-by: Karel Lowprize K <lowprize@gmail.com>
Suggested-by: Rafael Monteiro <96262868+rafaelgm@users.noreply.github.com>
Root cause: config.js defaults apiHost to 127.0.0.1 (localhost-only).
Inside Docker containers, this means port 21121 only listens on the
loopback interface, making it unreachable from outside the container
despite docker port mapping.
docker-compose.single.yml already had API_HOST=0.0.0.0, but
docker-compose.yml (multi-container) and docker-compose.quick.yml
(GHCR pre-built) were missing it.
Fixes:
- docker-compose.yml: Add HOST=0.0.0.0 and API_HOST=0.0.0.0
- docker-compose.quick.yml: Add HOST=0.0.0.0 and API_HOST=0.0.0.0
- Dockerfile.console: Add ENV API_HOST=0.0.0.0
- Dockerfile (single): Add ENV API_HOST=0.0.0.0
- docker/entrypoint.sh: Export API_HOST and HOST defaults
- docker/supervisord.conf: Add API_HOST and HOST to console env
Fixes#78
Three related issues reported by user:
1. SQLITE_READONLY: docker-compose.quick.yml mounted /opt/rustdesk as :ro
but console needs read access to .api_key (mode 600). Removed :ro.
2. EACCES .session_secret: Dockerfile.console ran as USER betterdesk
(UID 10001) but volume files owned by different host UID.
3. docker exec fails: container in restart loop due to permission crash.
Fix:
- Add docker/console-entrypoint.sh: starts as root, chown data dirs
to betterdesk user, then drops privileges via su-exec
- Add su-exec to Dockerfile.console runtime packages
- Remove USER betterdesk (entrypoint handles privilege drop)
- Remove :ro from /opt/rustdesk volume mount in docker-compose.quick.yml
Introduce a SessionManager for relay-based remote sessions in the Tauri MGMT client: new SessionCommand API, start/stop/session input routing, clipboard/recording/quality controls, and notification read/dismiss state. Wire AppState with new mutexes and show main window on startup. CI: add SBOM generation (anchore) and Trivy vulnerability scan steps. Misc: change console Docker DB path, large README/CHANGELOG updates (chat E2E, unattended access/WOL, i18n expansion, CDAP/SDK docs), and many web-nodejs assets/locales/routes/views/services and server-side changes.
Change ForceRelay TCP path to return a PunchHoleResponse with NatType=SYMMETRIC instead of sending a server-generated RelayResponse, so clients will send RequestRelay with their own UUIDs and both sides use the same UUID (resolves relay pairing mismatch, Issue #66). Add diagnostic log.Printf calls in handleRequestRelay (UDP) and handleRequestRelayTCP to aid relay pairing debugging. Update docs and CI: add GHCR "pull access denied" troubleshooting and package visibility guidance to DOCKER_QUICKSTART.md, docker-compose.quick.yml, and the docker-publish workflow summary (addresses Issue #67). Also update changelog entry in .github/copilot-instructions.md and add related files to .gitignore.
Add Docker quickstart flow and CI to publish images to GitHub Container Registry. Creates a new GitHub Actions workflow (.github/workflows/docker-publish.yml) that builds multi-arch images (server, console, all-in-one) and pushes to ghcr.io. Adds docker-compose.quick.yml using pre-built GHCR images and a DOCKER_QUICKSTART.md with a 30s one‑line quick start, troubleshooting, and configuration notes. Update README Docker section to surface the quick start and adjust docker-compose.yml header to reference the quick file. Also update .github/copilot-instructions.md to document the Docker quick start and publishing phase.
github-actions[bot]