mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 09:35:39 +00:00
UNITRONIX
fbcc93dd77
Accept PunchHole/RequestRelay from PANEL_SIGNAL_PROXY_CIDRS (default loopback) so panel-proxied Web Remote works again without weakening #302. Also default Docker AIO NTP/billing env vars (#299). Refs #302
120 lines
4.4 KiB
Bash
120 lines
4.4 KiB
Bash
# BetterDesk Node.js Console Configuration
|
|
# Template for fresh install / merge on update (issue #158).
|
|
# Placeholders __NAME__ are substituted by the installer merge-env script.
|
|
|
|
PORT=5000
|
|
HOST=0.0.0.0
|
|
NODE_ENV=production
|
|
# Console log verbosity: error | warn | info | debug (default: warn in production)
|
|
LOG_LEVEL=warn
|
|
|
|
# RustDesk paths (critical for key/QR code generation)
|
|
RUSTDESK_DIR=__RUSTDESK_DIR__
|
|
KEYS_PATH=__RUSTDESK_DIR__
|
|
PUB_KEY_PATH=__PUB_KEY_PATH__
|
|
API_KEY_PATH=__API_KEY_PATH__
|
|
|
|
# Database (SQLite default; PostgreSQL when DB_TYPE=postgres)
|
|
DB_TYPE=__DB_TYPE__
|
|
DB_PATH=__DB_PATH__
|
|
DATABASE_URL=__DATABASE_URL__
|
|
|
|
# Auth database location (panel users, sessions — passwords live in auth.db / PostgreSQL)
|
|
DATA_DIR=__DATA_DIR__
|
|
|
|
# Go server HTTP API (REST + RustDesk handlers — canonical port)
|
|
GO_API_PORT=__GO_API_PORT__
|
|
HBBS_API_URL=__HBBS_API_URL__
|
|
BETTERDESK_API_URL=__BETTERDESK_API_URL__
|
|
|
|
# SMTP (optional — can also be configured in Settings → Email)
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_SECURE=false
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
SMTP_FROM=
|
|
SMTP_ALERT_EMAIL=
|
|
SMTP_TLS_VERIFY=false
|
|
|
|
# Public panel URL used in notification emails (optional)
|
|
PANEL_PUBLIC_URL=
|
|
|
|
# Public IP or DNS shown in RustDesk client configuration on the dashboard
|
|
# when operators open the panel via localhost or an internal hostname (optional)
|
|
PANEL_PUBLIC_HOST=
|
|
|
|
# Public RustDesk client endpoints when console, ID/relay, and API use different hostnames (optional)
|
|
# Used for Dashboard client config, QR codes, and deploy strings. Leave empty for auto-detection.
|
|
PUBLIC_SERVER_ID=
|
|
PUBLIC_RELAY_SERVER=
|
|
PUBLIC_API_URL=
|
|
|
|
# Backward compat: http://host:21121 → proxy to Go
|
|
API_ENABLED=true
|
|
API_PORT=__API_PORT__
|
|
API_HOST=0.0.0.0
|
|
RUSTDESK_API_PROXY=true
|
|
RUSTDESK_API_TLS=auto
|
|
|
|
# Server backend (betterdesk = Go server, rustdesk = legacy Rust)
|
|
SERVER_BACKEND=betterdesk
|
|
|
|
# Install-only seed (not used after first admin exists in database — see authService.ensureDefaultAdmin)
|
|
DEFAULT_ADMIN_USERNAME=admin
|
|
DEFAULT_ADMIN_PASSWORD=__DEFAULT_ADMIN_PASSWORD__
|
|
|
|
# Session
|
|
SESSION_SECRET=__SESSION_SECRET__
|
|
|
|
# RustDesk client login sessions (Issue #242 — also configurable in Settings → Authentication → RustDesk clients)
|
|
# Go server reads these on startup; panel updates server_config at runtime via Settings UI.
|
|
CLIENT_SESSION_EXPIRY_DAYS=7
|
|
CLIENT_SESSION_SLIDING=true
|
|
CLIENT_SESSION_MAX_DAYS=30
|
|
# Legacy Node client API path only (RUSTDESK_API_PROXY=false):
|
|
API_TOKEN_EXPIRY_DAYS=7
|
|
|
|
# HTTPS (set to true and provide certificate paths to enable)
|
|
HTTPS_ENABLED=false
|
|
HTTPS_PORT=5443
|
|
SSL_CERT_PATH=__SSL_CERT_PATH__
|
|
SSL_KEY_PATH=__SSL_KEY_PATH__
|
|
SSL_CA_PATH=
|
|
HTTP_REDIRECT_HTTPS=true
|
|
|
|
# Trust reverse proxy (set Y or 1 behind nginx/Caddy; Y works for Node + Go server)
|
|
TRUST_PROXY=false
|
|
# Comma-separated CIDR/IP allowlist of reverse proxies that may set X-Forwarded-*.
|
|
# Required for Go server when TRUST_PROXY=Y — without this, forwarded headers are ignored (#276).
|
|
# Example (same-host Nginx/Caddy): 127.0.0.1/32,::1/128
|
|
TRUSTED_PROXIES=
|
|
|
|
# Source IPs allowed to start PunchHole/RequestRelay without a registered RustDesk peer.
|
|
# Used by the Node panel WebSocket→TCP proxy for Web Remote (/ws/rendezvous → hbbs).
|
|
# Default in Go is 127.0.0.0/8,::1/128 when unset. Override for split panel↔Go containers
|
|
# (e.g. Docker bridge CIDR of the console). Refs #302.
|
|
# PANEL_SIGNAL_PROXY_CIDRS=127.0.0.0/8,::1/128
|
|
PANEL_SIGNAL_PROXY_CIDRS=
|
|
|
|
# WebSocket Origin allow-list (comma-separated). Same-host browser upgrades are always allowed.
|
|
# WS_ALLOWED_ORIGINS=https://panel.example.com
|
|
|
|
# Console→Go API: keep on 127.0.0.1 (native install) or http://betterdesk-server:21114/api (Docker).
|
|
# Do not expose the Go API port directly to WAN — use the console proxy on :21121 for RustDesk clients.
|
|
|
|
# Billing / NTP (commercialization module — read by betterdesk-server Go process)
|
|
# Stored in console .env; Linux installs load this via EnvironmentFile on betterdesk-server.service.
|
|
# After changes, restart betterdesk-server (Commercialization → Settings can apply + restart).
|
|
NTP_SERVERS=pool.ntp.org,time.google.com,time.cloudflare.com
|
|
BILLING_MAX_CLOCK_SKEW_MS=2000
|
|
BILLING_REQUIRE_SYNCED_CLOCK=1
|
|
BILLING_TRUST_OS_NTP=1
|
|
BILLING_ROUNDING_MINUTES=1
|
|
BILLING_REQUIRE_WORK_REPORT=1
|
|
|
|
# GitHub update source (stable = main branch, development = dev branch)
|
|
UPDATE_GITHUB_BRANCH=main
|
|
# Optional: read-only GitHub PAT for update checks (60 req/h unauthenticated → 5,000/h with token)
|
|
# UPDATE_GITHUB_TOKEN=
|