mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-10-25 14:00:53 +00:00
UNITRONIX
d57fe3dc49
Adds local verification and distribution of signed generic incoming-only agent releases, mobile-friendly QR activation, and the supporting generator interfaces. Includes the current staged console, documentation, localization, and builder changes.\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
174 lines
7.3 KiB
Bash
174 lines
7.3 KiB
Bash
# BetterDesk Node.js Console Configuration
|
|
# Template for fresh install / merge on update (issue #158).
|
|
# Placeholders __NAME__ are substituted by the installer merge-env script.
|
|
|
|
PORT=5000
|
|
HOST=0.0.0.0
|
|
NODE_ENV=production
|
|
# Console log verbosity: error | warn | info | debug (default: warn in production)
|
|
LOG_LEVEL=warn
|
|
|
|
# RustDesk paths (critical for key/QR code generation)
|
|
RUSTDESK_DIR=__RUSTDESK_DIR__
|
|
KEYS_PATH=__RUSTDESK_DIR__
|
|
PUB_KEY_PATH=__PUB_KEY_PATH__
|
|
API_KEY_PATH=__API_KEY_PATH__
|
|
|
|
# Database (SQLite default; PostgreSQL when DB_TYPE=postgres)
|
|
DB_TYPE=__DB_TYPE__
|
|
DB_PATH=__DB_PATH__
|
|
DATABASE_URL=__DATABASE_URL__
|
|
|
|
# Auth database location (panel users, sessions — passwords live in auth.db / PostgreSQL)
|
|
DATA_DIR=__DATA_DIR__
|
|
|
|
# BetterDesk Support Generator (module templates and signed Support Agent bundles)
|
|
# The signing seed is a secret and must never be committed or exposed in logs.
|
|
# Embedded local builds are host-only: Linux hosts build Linux targets, Windows
|
|
# hosts build Windows targets, and macOS hosts build macOS targets. A full
|
|
# cross-platform matrix requires a separately verified build provider.
|
|
BETTERDESK_CLIENT_REPO=UNITRONIX/BetterDesk-Client
|
|
BETTERDESK_CLIENT_ALLOWED_REPOS=UNITRONIX/BetterDesk-Client
|
|
BETTERDESK_CLIENT_RELEASE_TAG=
|
|
BETTERDESK_GITHUB_TOKEN=
|
|
BETTERDESK_CUSTOM_CLIENT_SIGNING_SEED=
|
|
# The embedded provider builds BetterDesk-Client with signed config embedded in
|
|
# each binary. The built-in local provider is the default.
|
|
BETTERDESK_CLIENT_GENERATOR_MODE=embedded
|
|
BETTERDESK_CLIENT_REF=master
|
|
BETTERDESK_CLIENT_BUILD_COMMAND=
|
|
# Generic incoming-only releases are signed in BetterDesk-Client GitHub Actions.
|
|
# Set the base64 Ed25519 public key matching the protected Actions signing secret.
|
|
# BETTERDESK_SUPPORT_RELEASE_PUBLIC_KEY=
|
|
# Required for a remote provider: JSON array/object with the exact targets
|
|
# that provider can build and verify. Never claim the whole matrix implicitly.
|
|
# BETTERDESK_CLIENT_PROVIDER_TARGETS_JSON={"targets":[{"platform":"windows","arch":"x64","format":"portable"}]}
|
|
# BETTERDESK_CLIENT_PROVIDER_TARGETS_FILE=/etc/betterdesk/client-provider-targets.json
|
|
BETTERDESK_CLIENT_GITHUB_ACTIONS=off
|
|
BETTERDESK_CLIENT_BUILD_WORKFLOW=support-build.yml
|
|
BETTERDESK_CLIENT_BUILD_TIMEOUT_MS=3600000
|
|
BETTERDESK_CLIENT_BUILD_MIN_FREE_MB=3072
|
|
AGENT_ARTIFACT_DIR=__DATA_DIR__/agent-builds
|
|
AGENT_BUILD_WORKER=on
|
|
AGENT_BUILD_POLL_MS=5000
|
|
AGENT_BUILD_COOLDOWN_MS=1000
|
|
|
|
# Go server HTTP API (REST + RustDesk handlers — canonical port)
|
|
GO_API_PORT=__GO_API_PORT__
|
|
HBBS_API_URL=__HBBS_API_URL__
|
|
BETTERDESK_API_URL=__BETTERDESK_API_URL__
|
|
|
|
# SMTP (optional — can also be configured in Settings → Email)
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_SECURE=false
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
SMTP_FROM=
|
|
SMTP_ALERT_EMAIL=
|
|
SMTP_TLS_VERIFY=false
|
|
|
|
# Public panel URL used in notification emails (optional)
|
|
PANEL_PUBLIC_URL=
|
|
|
|
# Public IP or DNS shown in RustDesk client configuration on the dashboard
|
|
# when operators open the panel via localhost or an internal hostname (optional)
|
|
PANEL_PUBLIC_HOST=
|
|
|
|
# Public RustDesk client endpoints when console, ID/relay, and API use different hostnames (optional)
|
|
# Used for Dashboard client config, QR codes, and deploy strings. Leave empty for auto-detection.
|
|
PUBLIC_SERVER_ID=
|
|
PUBLIC_RELAY_SERVER=
|
|
PUBLIC_API_URL=
|
|
|
|
# Backward compat: http://host:21121 → proxy to Go
|
|
API_ENABLED=true
|
|
API_PORT=__API_PORT__
|
|
API_HOST=0.0.0.0
|
|
RUSTDESK_API_PROXY=true
|
|
RUSTDESK_API_TLS=auto
|
|
|
|
# Server backend (betterdesk = Go server, rustdesk = legacy Rust)
|
|
SERVER_BACKEND=betterdesk
|
|
|
|
# Install-only seed (not used after first admin exists in database — see authService.ensureDefaultAdmin)
|
|
DEFAULT_ADMIN_USERNAME=admin
|
|
DEFAULT_ADMIN_PASSWORD=__DEFAULT_ADMIN_PASSWORD__
|
|
|
|
# Session
|
|
SESSION_SECRET=__SESSION_SECRET__
|
|
|
|
# AES-GCM key for org peer credential vault (#367). Prefer a dedicated 32+ char secret.
|
|
# If empty, the Go server falls back to JWT_SECRET / stored jwt_secret.
|
|
# ORG_PEER_VAULT_KEY=
|
|
# Dedicated AES-GCM key for RDP/VNC target credentials. The installer/update
|
|
# flow generates this key when it is missing and never overwrites an existing key.
|
|
REMOTE_TARGET_VAULT_KEY=__REMOTE_TARGET_VAULT_KEY__
|
|
# Managed loopback Guacamole daemon used by the RDP/VNC session broker.
|
|
GUACD_ADDRESS=127.0.0.1:4822
|
|
|
|
# RustDesk client login sessions (Issue #242 — also configurable in Settings → Authentication → RustDesk clients)
|
|
# Go server reads these on startup; panel updates server_config at runtime via Settings UI.
|
|
CLIENT_SESSION_EXPIRY_DAYS=7
|
|
CLIENT_SESSION_SLIDING=true
|
|
CLIENT_SESSION_MAX_DAYS=30
|
|
# Legacy Node client API path only (RUSTDESK_API_PROXY=false):
|
|
API_TOKEN_EXPIRY_DAYS=7
|
|
|
|
# HTTPS (set to true and provide certificate paths to enable)
|
|
HTTPS_ENABLED=false
|
|
HTTPS_PORT=5443
|
|
SSL_CERT_PATH=__SSL_CERT_PATH__
|
|
SSL_KEY_PATH=__SSL_KEY_PATH__
|
|
SSL_CA_PATH=
|
|
HTTP_REDIRECT_HTTPS=true
|
|
|
|
# Trust reverse proxy (set Y or 1 behind nginx/Caddy; Y works for Node + Go server)
|
|
TRUST_PROXY=false
|
|
# Comma-separated CIDR/IP allowlist of reverse proxies that may set X-Forwarded-*.
|
|
# Required for Go server when TRUST_PROXY=Y — without this, forwarded headers are ignored (#276).
|
|
# Example (same-host Nginx/Caddy): 127.0.0.1/32,::1/128
|
|
TRUSTED_PROXIES=
|
|
|
|
# Source IPs allowed to start PunchHole/RequestRelay without a registered RustDesk peer.
|
|
# Used by the Node panel WebSocket→TCP proxy for Web Remote (/ws/rendezvous → hbbs).
|
|
# Default in Go is 127.0.0.0/8,::1/128 when unset. Override for split panel↔Go containers
|
|
# (e.g. Docker bridge CIDR of the console). Refs #302.
|
|
# Do NOT add office/CGNAT public /32 here as a shared-NAT workaround — that trusts every
|
|
# egress from that IP as Web Remote. Prefer ALLOW_SHARED_NAT_INITIATOR for multi-device NATs (#399).
|
|
# PANEL_SIGNAL_PROXY_CIDRS=127.0.0.0/8,::1/128
|
|
PANEL_SIGNAL_PROXY_CIDRS=
|
|
|
|
# Opt-in (#399): authorize PunchHole/RequestRelay when multiple live peers share the
|
|
# initiator's public IP and the stock client has no login token / usable udp_port.
|
|
# Uses synthetic id shared-nat-initiator (does not inherit another peer's identity).
|
|
# Weakens managed enrollment outbound gate for that NAT — default off.
|
|
# ALLOW_SHARED_NAT_INITIATOR=N
|
|
|
|
# WebSocket Origin allow-list (comma-separated). Same-host browser upgrades are always allowed.
|
|
# WS_ALLOWED_ORIGINS=https://panel.example.com
|
|
|
|
# Console→Go API: keep on 127.0.0.1 (native install) or http://betterdesk-server:21114/api (Docker).
|
|
# Do not expose the Go API port directly to WAN — use the console proxy on :21121 for RustDesk clients.
|
|
|
|
# CDAP gateway (21122). Use WSS with a trusted certificate for WAN agents.
|
|
# CDAP_TLS_REQUIRED=Y rejects legacy plaintext CDAP; keep N only during migration.
|
|
CDAP_ENABLED=Y
|
|
CDAP_TLS=N
|
|
CDAP_TLS_REQUIRED=N
|
|
|
|
# Billing / NTP (commercialization module — read by betterdesk-server Go process)
|
|
# Stored in console .env; Linux installs load this via EnvironmentFile on betterdesk-server.service.
|
|
# After changes, restart betterdesk-server (Commercialization → Settings can apply + restart).
|
|
NTP_SERVERS=pool.ntp.org,time.google.com,time.cloudflare.com
|
|
BILLING_MAX_CLOCK_SKEW_MS=2000
|
|
BILLING_REQUIRE_SYNCED_CLOCK=1
|
|
BILLING_TRUST_OS_NTP=1
|
|
BILLING_ROUNDING_MINUTES=1
|
|
BILLING_REQUIRE_WORK_REPORT=1
|
|
|
|
# GitHub update source (stable = main branch, development = dev branch)
|
|
UPDATE_GITHUB_BRANCH=main
|
|
# Optional: read-only GitHub PAT for update checks (60 req/h unauthenticated → 5,000/h with token)
|
|
# UPDATE_GITHUB_TOKEN=
|