- Updated `SERVER_MIGRATION.md` with detailed steps for operators performing manual or out-of-order migrations, including verification of server keys, database migration checks, and client configuration refresh.
- Added a new section in `CHANGELOG.md` to document this update.
- Conducted an audit against upstream RustDesk tag 1.4.8, confirming no breaking changes to the wire format.
- Implemented various fixes including client version string, supported encoding handshake, and multi-session handling.
- Updated language files for Arabic, Czech, Danish, German, English, and Spanish to reflect new UI elements and messages.
- Enhanced clipboard and file transfer functionalities to match upstream behavior.
- Added support for an official all-in-one Docker image (`ghcr.io/unitronix/betterdesk`) as the default installation method.
- Updated installation scripts and documentation to reflect the new single container layout.
- Retained legacy two-container layout option for backward compatibility.
- Adjusted API port from `21114` to `21121` for the new layout.
- Enhanced Docker-related scripts and configuration files to support the new structure.
- Updated various language files to ensure consistency in messaging regarding Docker deployment.
Add folder/direct-device/strategy assignment from User Management, clearer Pro vs Remote Operator labeling, optional restricted device scope mode, and Go/Node scope parity.
Send modifiers and nav keys as Map scancodes (not mixed Legacy controlKey),
restore Auto/Windows hybrid for symbols, and add protobuf regression tests.
Add keyboard-encoder.js for Legacy chr+modifiers and full Map scancode path so Shift, Caps Lock, and symbol keys work reliably on relay sessions including Hyper-V.
Implement keyboard mode options (Legacy, Map, Auto) and a reset keyboard feature in the remote viewer. Update UI to include buttons for selecting keyboard mode and resetting the keyboard state, enhancing user control over remote input settings. Update localization files for new strings across multiple languages.
Auto-redeploy TLS material on update/repair, unify SSL menu C with protocol toggle T, and retry post-toggle health checks so the console user can always read keys under $RUSTDESK_PATH/ssl/.
Refs #219
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove internal LAN IP, SSH user, and developer paths from docs and examples; move deploy runbook to gitignored docs/private with a public template; drop Cursor debug logging leftovers; add CI checks to prevent regression.
Co-authored-by: Cursor <cursoragent@cursor.com>
Certbot certs were symlinked into /etc/letsencrypt paths the non-root console could not read, so Node fell back to HTTP on :5000 while config still said HTTPS. Copy material into $RUSTDESK_PATH/ssl/, refresh on renew, and auto-repair legacy symlink installs.
Fixes#219
Co-authored-by: Cursor <cursoragent@cursor.com>
Add PUBLIC_SERVER_ID, PUBLIC_RELAY_SERVER, and PUBLIC_API_URL with Settings UI,
unified endpoint resolution across Dashboard/Keys, and fallbacks via PANEL_PUBLIC_HOST.
Unify .env and systemd updates on protocol toggle, probe the correct panel
port (5443 vs 5000), and match Client API TLS in post-config tests. Use 307
redirect and skip HSTS for self-signed installs so browsers can return to HTTP.
Ship mesh layer as default-on with updater/installer MESH_ENABLED=Y injection,
Settings groups/recordings UI, device power and filter UX, relay multiplexing,
WoL wake fallback, mesh RBAC permissions, and REST automation docs.
Extend MeshCentral compat with share grants, session recording (.mcrec),
TCP/UDP port relay (p=14), device power API, panel settings and device menu
actions, view-only guest remote access, and i18n across all locales.
Added a compatibility layer for MeshCentral, including a native Go implementation of key endpoints and a unified inventory for mesh agents. Enhanced the UI with new actions for mesh agents, such as terminal access and file management. Updated localization for mesh features and introduced new styles for mesh terminal overlays. Integrated interop testing for simulated and live MeshAgent connections.
Updated the documentation for RustDesk mass-deployment, including the correct `--config` deploy string format and the addition of editable client server address fields. Enhanced the dashboard with features like **Copy deploy string** and **Intune script** snippets. Introduced a new environment variable `PANEL_PUBLIC_HOST` for better configuration management. Added UI elements for improved user experience in client configuration.
Restore agent-client to git and wire agentClientBuildWorker for Tauri builds
(deb/rpm/AppImage/MSI) with branding and Go sidecar staging. Add TLS gate,
settings lock, policy sync, preflight UI, CDAP registry, and Generator
product_type split (agent-client vs support-agent vs rdclient).
Map the documented ADMIN_PASSWORD setting to the internal Go and Node.js first-run admin seed variables so Docker installs honor custom passwords. Refs #204.
- Introduced server URL validation via `GET /api/bd/server-info` and `probe_server_url`.
- Added LAN discovery capabilities using UDP and optional mDNS for local network panel detection.
- Implemented a local settings window for managing URL, TLS settings, and user preferences.
- Enhanced dashboard with a unified sidebar and improved scrolling behavior.
- Updated documentation and pre-release checklist to reflect new features and requirements.
Updated the entire project to AGPL-3.0, including all components and documentation. The stable releases up to v3.3.x will remain under Apache 2.0 until the next major feature release. Withdrawn and recreated French and Traditional Chinese translations under the new license. Updated relevant documentation and changelog to reflect these changes.
Add betterdesk-show-admin-credentials helper that re-execs as the betterdesk
user so operators can retrieve bootstrap passwords without chmod 777.
Refs #195
Added detailed instructions for configuring Nginx Proxy Manager and other reverse proxies with Docker for RustDesk WSS endpoints. Included troubleshooting tips and diagnostic commands to assist users in resolving common issues related to WebSocket connections and TLS configurations.
Fixes#192 — script and GHCR update flows now drop data/.last_update_result.json
the same way betterdesk.sh already does, so a failed in-panel attempt no longer
sticks around after a successful external update.
Keep apply-i18n-audit and regional patch data for low-cost locale
maintenance without shipping dev scripts to production consoles.
Add collect-gap-keys to regenerate gap-fill input from i18n-check.
Introduce bump-version.js with CI workflows for patch bumps on dev and
stable releases on main, plus panel and installer UI to choose stable vs
development GitHub update branches.
Existing Docker volumes crashed at startup because ensureAuthTables indexed
token_hash before the column existed on upgraded auth.db files. Bump images to 3.0.0.
After RustDesk→BetterDesk migration, HTTP heartbeats can update last seen while
UDP signal registration is still missing. Show a distinct "No signal" badge,
document the two-channel presence model, and publish peer_online on registration.
The panel updater assumed a native install with Go source on disk. In
Compose/GHCR mode it now uses the embedded image commit, clears stale
binary markers, and directs operators to pull new container images instead.
Expose global connection strategy in the web panel with systemd/Docker persistence, extend server health diagnostics, enforce org network policy in the signal handler, and document when relay fallback is expected vs misconfiguration.
Merge .env keys instead of replacing files, patch systemd/NSSM in place,
block panel updates when the server cannot be rebuilt, and stop routine
updates from syncing admin passwords from .env into auth.db/PostgreSQL.
Panel device groups, folders, ACL and assignments moved from auth.db into
the consolidated Postgres schema. Go now uses PanelSyncStore on PostgresDB
when -db is postgres://, with auth.db kept only as a SQLite fallback.
Node requireAuth only accepts 64-char auth.db tokens, so local /api/group
handlers returned 401 after Go JWT login. Proxy group routes to Go again,
always merge peer-tag groups, resolve auth.db path candidates, and map
console user ids for group ACL checks.
Panel groups and folders live in console auth.db, but Go /api/group only
exposed peer tags. Read auth.db (AUTH_DB_PATH), apply allowed_users and
user-group access, and mirror Node getRustDeskDeviceGroups. Keep /api/group
on the Node :21121 proxy for compatibility; document verification steps.
RustDesk clients could not log in after v3 when handlers moved to Go but
nothing listened on :21121 (API_ENABLED off) or Go bound the wrong port.
Go serves /api/login on 21114; the console proxies legacy :21121 URLs to
Go. Installers repair .env/systemd, Docker publishes both ports, and
firewall rules allow 21114 and 21121 on full installs.
Also includes betterdesk-support-agent (Fyne desktop helper) and
docs/important/ operator notes (API ports, update flow, agent roadmap).
Wire docker-publish to git tags v*, workflow_dispatch tag input, and
semver prereleases; pin quick-start compose to 3.0.0-alpha by default.
Co-authored-by: Cursor <cursoragent@cursor.com>
Phases 1-4 of the Go-server centralization plan plus optional-TLS transport.
Go server:
- db: HelpRequest model + SQLite/PostgreSQL stores (help_requests_*.go), GetDeviceOrgID.
- cdap: handleHelpRequest/handleChatMessage handlers, SendChatToDevice delivery.
- api: REST help endpoints (help_handlers.go), publish help_request/chat_message events.
Node.js panel:
- bd-api.routes.js: drop local in-memory Maps, proxy all help/chat/notification
endpoints to the Go server (read-proxy) with status/id/timestamp normalization.
Agent (native Go + Tauri sidecar):
- config.go/agent.go: optional EnforceTLS, ServerCertPin (SPKI pin), TLSInsecureSkipVerify
with env overlays and dialOptions() cert pinning via VerifyPeerCertificate.
- HTTP (ws://) stays a fully supported transport: TLS enforcement is an explicit
operator opt-in (never auto-derived from the URL scheme). The agent logs a warning
recommending wss:// for untrusted networks instead of blocking the connection.
- config.rs/sidecar.rs: propagate enforce_tls + server_cert_pin from AgentConfig
through SidecarConfig to the Go agent config; warn on plaintext ws:// to remote hosts.
This commit was made possible thanks to Insolve.
Complete the web console locale set so all 26 language files share the EN/PL baseline with no missing keys, extra keys, empty values, or English fallback values.
Keep strict i18n audit behavior and disabled auto-fix flow so incomplete translations are surfaced for manual review instead of being filled with English fallback text.
Validated with the strict web-nodejs i18n audit, JSON parsing for all locale files, placeholder preservation checks, and VS Code diagnostics.
This commit was made possible thanks to Insolve.
.gitignore: scope /lib/ and /lib64/ to repo root only — was matching Tauri src/lib directories. Go server: re-issue device_token on re-registration so agents that lost config can recover auth. Go agent: emit SESSION_START/SESSION_END stdout events for overlay integration, handle DESKTOP_STOP stdin command.
This commit was made possible thanks to Insolve.
- Create SPONSORS.md with dedicated section for INSOLVE (insolve.pl) and acknowledgment tier definitions (Honorary Supporter, Corporate Sponsor, Individual Backer).
- Add Honorary Supporter section with logo to README header linking to insolve.pl and SPONSORS.md.
- Relocate logo asset from repo root to docs/assets/insolve-logo.png.
This commit was made possible thanks to Insolve.
UNITRONIX