Map the documented ADMIN_PASSWORD setting to the internal Go and Node.js first-run admin seed variables so Docker installs honor custom passwords. Refs #204.
Mount console-data read-only into the server container and set AUTH_DB_PATH
so RustDesk clients receive panel folders/groups in SQLite deployments.
Wait for auth.db on first boot and start console before Go in single-container
layouts to avoid empty /api/device-group/accessible responses.
Refs #138
Add a device verification/enrollment workflow so new registrations are
held for operator review instead of connecting silently.
Go server (signal + api):
- Signal-mode pending: in 'managed' mode, unknown stock RustDesk clients
are queued (pending_device_<id>) instead of being silently rejected.
- Rich approve: handleApproveDevice accepts display_name, sync_mode and
normalized tags; handleRejectDevice supports an optional ban.
Node.js console:
- registrations.ejs approve modal (name, sync mode, tags, folder) and
reject modal with ban option; betterdeskApi + routes wire display_name,
sync_mode, tags and folder assignment through to the Go server.
- EN/PL/ZH i18n for all new strings.
Installers (managed default for FRESH installs only; existing installs
stay on the Go default 'open' or their DB-persisted mode):
- betterdesk.sh / betterdesk.ps1 write ENROLLMENT_MODE=managed to the
server env only when no existing database is detected (FRESH_INSTALL).
- Docker single + multi container entrypoints detect fresh volumes via a
sentinel plus id_ed25519/db_v2.sqlite3 presence and default to managed;
ENROLLMENT_MODE is now passed through supervisord and all compose files.
This commit was made possible thanks to Insolve.
Root cause: Dockerfile.server ran as USER betterdesk (UID 10001) but
Docker volume files retain UID/GID from host or previous container.
Private key id_ed25519 (mode 600) owned by different UID = unreadable.
Fix:
- Add docker/server-entrypoint.sh: starts as root, chown+chmod volume
files to betterdesk user, then drops privileges via su-exec
- Add su-exec to Dockerfile.server runtime packages
- Remove USER betterdesk directive (entrypoint handles privilege drop)
- Add explicit chmod 600 + chown for id_ed25519 in all-in-one entrypoint
UNITRONIX