BetterDesk/docker-compose.yml

# BetterDesk Console - Docker Compose Setup
# This is a complete Docker setup that includes RustDesk servers and BetterDesk Console

version: '3.8'

services:
  # RustDesk HBBS (Signal Server) with BetterDesk API
  hbbs:
    image: rustdesk/rustdesk-server:latest
    container_name: betterdesk-hbbs
    hostname: betterdesk-hbbs
    command: >
      sh -c "
      # Wait for binaries to be copied if they exist
      if [ -f /usr/local/bin/hbbs-betterdesk ]; then
        echo 'Using BetterDesk enhanced binary';
        /usr/local/bin/hbbs-betterdesk -k _ --api-port 21114;
      else
        echo 'Using standard RustDesk binary';
        hbbs -k _;
      fi"
    ports:
      - "21115:21115"           # TCP hole punching
      - "21116:21116/tcp"       # TCP relay
      - "21116:21116/udp"       # UDP hole punching
      - "21114:21114"           # HTTP API (BetterDesk)
    volumes:
      - rustdesk-data:/root     # RustDesk data persistence
    environment:
      - ALWAYS_USE_RELAY=N
      - ENCRYPTED_ONLY=1
    networks:
      - betterdesk-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "nc", "-z", "localhost", "21116"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # RustDesk HBBR (Relay Server) with BetterDesk
  hbbr:
    image: rustdesk/rustdesk-server:latest
    container_name: betterdesk-hbbr
    hostname: betterdesk-hbbr
    command: >
      sh -c "
      # Wait for binaries to be copied if they exist
      if [ -f /usr/local/bin/hbbr-betterdesk ]; then
        echo 'Using BetterDesk enhanced binary';
        /usr/local/bin/hbbr-betterdesk -k _;
      else
        echo 'Using standard RustDesk binary';
        hbbr -k _;
      fi"
    ports:
      - "21117:21117"           # Relay port
    volumes:
      - rustdesk-data:/root     # Shared data with HBBS
    networks:
      - betterdesk-net
    restart: unless-stopped
    depends_on:
      hbbs:
        condition: service_healthy

  # BetterDesk Console Web Interface
  betterdesk-console:
    build:
      context: .
      dockerfile: Dockerfile.console
    container_name: betterdesk-console
    hostname: betterdesk-console
    ports:
      - "5000:5000"             # Web console port
    volumes:
      - rustdesk-data:/opt/rustdesk:ro    # Read-only access to RustDesk data
      - console-data:/app/data            # Console-specific data
    environment:
      - DB_PATH=/opt/rustdesk/db_v2.sqlite3
      - API_KEY_PATH=/opt/rustdesk/.api_key
      - PUB_KEY_PATH=/opt/rustdesk/id_ed25519.pub
      - HBBS_API_URL=http://hbbs:21114/api
      - FLASK_SECRET_KEY=${FLASK_SECRET_KEY:-$(openssl rand -hex 32)}
      - FLASK_ENV=production
      # Optional: Set custom admin credentials (remove to use auto-generated)
      # - ADMIN_USERNAME=admin
      # - ADMIN_PASSWORD=YourSecurePassword123
      # - SKIP_AUTO_MIGRATION=false
    networks:
      - betterdesk-net
    restart: unless-stopped
    depends_on:
      - hbbs
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # Nginx Reverse Proxy (Optional)
  nginx:
    image: nginx:alpine
    container_name: betterdesk-nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./ssl:/etc/nginx/ssl:ro
    networks:
      - betterdesk-net
    restart: unless-stopped
    depends_on:
      - betterdesk-console
    profiles:
      - nginx   # Only start with: docker-compose --profile nginx up

volumes:
  rustdesk-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${RUSTDESK_DATA_PATH:-./data}
  
  console-data:
    driver: local

networks:
  betterdesk-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16

# Security Notice:
# - Watchtower has been removed (archived project - security risk)
# - For updates, manually pull new images: docker-compose pull && docker-compose up -d
# - Or use modern alternatives like Renovate, Dependabot, or manual update scripts