mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 01:27:11 +00:00
UNITRONIX
cef2ab7c8e
Correlate RelayResponse via pending UUID/initiator store and panel CIDRs; stop FindByIP ticket misdelivery. Opt-in ALLOW_SHARED_NAT_INITIATOR for stock multi-device CGNAT without peer identity inheritance. Refs #399 Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
138 lines
5.3 KiB
Bash
138 lines
5.3 KiB
Bash
# BetterDesk Node.js Console Configuration
|
|
# Template for fresh install / merge on update (issue #158).
|
|
# Placeholders __NAME__ are substituted by the installer merge-env script.
|
|
|
|
PORT=5000
|
|
HOST=0.0.0.0
|
|
NODE_ENV=production
|
|
# Console log verbosity: error | warn | info | debug (default: warn in production)
|
|
LOG_LEVEL=warn
|
|
|
|
# RustDesk paths (critical for key/QR code generation)
|
|
RUSTDESK_DIR=__RUSTDESK_DIR__
|
|
KEYS_PATH=__RUSTDESK_DIR__
|
|
PUB_KEY_PATH=__PUB_KEY_PATH__
|
|
API_KEY_PATH=__API_KEY_PATH__
|
|
|
|
# Database (SQLite default; PostgreSQL when DB_TYPE=postgres)
|
|
DB_TYPE=__DB_TYPE__
|
|
DB_PATH=__DB_PATH__
|
|
DATABASE_URL=__DATABASE_URL__
|
|
|
|
# Auth database location (panel users, sessions — passwords live in auth.db / PostgreSQL)
|
|
DATA_DIR=__DATA_DIR__
|
|
|
|
# Go server HTTP API (REST + RustDesk handlers — canonical port)
|
|
GO_API_PORT=__GO_API_PORT__
|
|
HBBS_API_URL=__HBBS_API_URL__
|
|
BETTERDESK_API_URL=__BETTERDESK_API_URL__
|
|
|
|
# SMTP (optional — can also be configured in Settings → Email)
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_SECURE=false
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
SMTP_FROM=
|
|
SMTP_ALERT_EMAIL=
|
|
SMTP_TLS_VERIFY=false
|
|
|
|
# Public panel URL used in notification emails (optional)
|
|
PANEL_PUBLIC_URL=
|
|
|
|
# Public IP or DNS shown in RustDesk client configuration on the dashboard
|
|
# when operators open the panel via localhost or an internal hostname (optional)
|
|
PANEL_PUBLIC_HOST=
|
|
|
|
# Public RustDesk client endpoints when console, ID/relay, and API use different hostnames (optional)
|
|
# Used for Dashboard client config, QR codes, and deploy strings. Leave empty for auto-detection.
|
|
PUBLIC_SERVER_ID=
|
|
PUBLIC_RELAY_SERVER=
|
|
PUBLIC_API_URL=
|
|
|
|
# Backward compat: http://host:21121 → proxy to Go
|
|
API_ENABLED=true
|
|
API_PORT=__API_PORT__
|
|
API_HOST=0.0.0.0
|
|
RUSTDESK_API_PROXY=true
|
|
RUSTDESK_API_TLS=auto
|
|
|
|
# Server backend (betterdesk = Go server, rustdesk = legacy Rust)
|
|
SERVER_BACKEND=betterdesk
|
|
|
|
# Install-only seed (not used after first admin exists in database — see authService.ensureDefaultAdmin)
|
|
DEFAULT_ADMIN_USERNAME=admin
|
|
DEFAULT_ADMIN_PASSWORD=__DEFAULT_ADMIN_PASSWORD__
|
|
|
|
# Session
|
|
SESSION_SECRET=__SESSION_SECRET__
|
|
|
|
# AES-GCM key for org peer credential vault (#367). Prefer a dedicated 32+ char secret.
|
|
# If empty, the Go server falls back to JWT_SECRET / stored jwt_secret.
|
|
# ORG_PEER_VAULT_KEY=
|
|
|
|
# RustDesk client login sessions (Issue #242 — also configurable in Settings → Authentication → RustDesk clients)
|
|
# Go server reads these on startup; panel updates server_config at runtime via Settings UI.
|
|
CLIENT_SESSION_EXPIRY_DAYS=7
|
|
CLIENT_SESSION_SLIDING=true
|
|
CLIENT_SESSION_MAX_DAYS=30
|
|
# Legacy Node client API path only (RUSTDESK_API_PROXY=false):
|
|
API_TOKEN_EXPIRY_DAYS=7
|
|
|
|
# HTTPS (set to true and provide certificate paths to enable)
|
|
HTTPS_ENABLED=false
|
|
HTTPS_PORT=5443
|
|
SSL_CERT_PATH=__SSL_CERT_PATH__
|
|
SSL_KEY_PATH=__SSL_KEY_PATH__
|
|
SSL_CA_PATH=
|
|
HTTP_REDIRECT_HTTPS=true
|
|
|
|
# Trust reverse proxy (set Y or 1 behind nginx/Caddy; Y works for Node + Go server)
|
|
TRUST_PROXY=false
|
|
# Comma-separated CIDR/IP allowlist of reverse proxies that may set X-Forwarded-*.
|
|
# Required for Go server when TRUST_PROXY=Y — without this, forwarded headers are ignored (#276).
|
|
# Example (same-host Nginx/Caddy): 127.0.0.1/32,::1/128
|
|
TRUSTED_PROXIES=
|
|
|
|
# Source IPs allowed to start PunchHole/RequestRelay without a registered RustDesk peer.
|
|
# Used by the Node panel WebSocket→TCP proxy for Web Remote (/ws/rendezvous → hbbs).
|
|
# Default in Go is 127.0.0.0/8,::1/128 when unset. Override for split panel↔Go containers
|
|
# (e.g. Docker bridge CIDR of the console). Refs #302.
|
|
# Do NOT add office/CGNAT public /32 here as a shared-NAT workaround — that trusts every
|
|
# egress from that IP as Web Remote. Prefer ALLOW_SHARED_NAT_INITIATOR for multi-device NATs (#399).
|
|
# PANEL_SIGNAL_PROXY_CIDRS=127.0.0.0/8,::1/128
|
|
PANEL_SIGNAL_PROXY_CIDRS=
|
|
|
|
# Opt-in (#399): authorize PunchHole/RequestRelay when multiple live peers share the
|
|
# initiator's public IP and the stock client has no login token / usable udp_port.
|
|
# Uses synthetic id shared-nat-initiator (does not inherit another peer's identity).
|
|
# Weakens managed enrollment outbound gate for that NAT — default off.
|
|
# ALLOW_SHARED_NAT_INITIATOR=N
|
|
|
|
# WebSocket Origin allow-list (comma-separated). Same-host browser upgrades are always allowed.
|
|
# WS_ALLOWED_ORIGINS=https://panel.example.com
|
|
|
|
# Console→Go API: keep on 127.0.0.1 (native install) or http://betterdesk-server:21114/api (Docker).
|
|
# Do not expose the Go API port directly to WAN — use the console proxy on :21121 for RustDesk clients.
|
|
|
|
# CDAP gateway (21122). Use WSS with a trusted certificate for WAN agents.
|
|
# CDAP_TLS_REQUIRED=Y rejects legacy plaintext CDAP; keep N only during migration.
|
|
CDAP_ENABLED=Y
|
|
CDAP_TLS=N
|
|
CDAP_TLS_REQUIRED=N
|
|
|
|
# Billing / NTP (commercialization module — read by betterdesk-server Go process)
|
|
# Stored in console .env; Linux installs load this via EnvironmentFile on betterdesk-server.service.
|
|
# After changes, restart betterdesk-server (Commercialization → Settings can apply + restart).
|
|
NTP_SERVERS=pool.ntp.org,time.google.com,time.cloudflare.com
|
|
BILLING_MAX_CLOCK_SKEW_MS=2000
|
|
BILLING_REQUIRE_SYNCED_CLOCK=1
|
|
BILLING_TRUST_OS_NTP=1
|
|
BILLING_ROUNDING_MINUTES=1
|
|
BILLING_REQUIRE_WORK_REPORT=1
|
|
|
|
# GitHub update source (stable = main branch, development = dev branch)
|
|
UPDATE_GITHUB_BRANCH=main
|
|
# Optional: read-only GitHub PAT for update checks (60 req/h unauthenticated → 5,000/h with token)
|
|
# UPDATE_GITHUB_TOKEN=
|