Claude
bec9228c55
Confirmed live: install_frigate()'s fresh-install path overwrote a working, hand-crafted docker-compose.yml (Frigate + mosquitto + frigate-notify) with zero backup, because that file's shape didn't match what frigate.sh's own "existing install" detection knew how to recognize. Every service's own detection is a judgment call about what counts as "already installed" and can miss a real setup built outside this repo's conventions. lib/common.sh gains backup_if_exists(FILE) — copies FILE to FILE.bak.<timestamp> if it exists, no-ops otherwise (including DRY_RUN). Applied before every service's own `cat > docker-compose.yml`/`cat > .env` write across all 60 services that do one (115 call sites), plus a matching standalone-mode stub added to every service's own bootstrap block, same convention already used for port_in_use/find_free_port. This doesn't replace a service's own update/fresh-reinstall detection — it's the safety net underneath it, so a wrong detection costs a .bak file to restore from instead of the original silently disappearing. Also fixes the actual gap that surfaced this: services/frigate.sh's Authelia offer only checked for Authelia installed locally on Frigate's own box, which is never true for a dedicated NVR box with no local Caddy either (the common shape — Caddy lives elsewhere, snippet-generation mode already handles that). Now offers Authelia protection unconditionally and, when Authelia isn't local, asks whether it lives on the same machine as Caddy (still "import authelia", since that's local to wherever Caddy ends up) or on a genuinely separate third machine (the explicit header-pinned forward_auth form, per CLAUDE.md's "forward_auth to a remote Authelia" note, needed because a bare authelia:9091 shortcut only works one hop).
352 lines
15 KiB
Bash
352 lines
15 KiB
Bash
#!/bin/bash
|
|
# services/rustdesk.sh — RustDesk self-hosted remote desktop relay server.
|
|
# Part of the modular post-install system (sourced by setup.sh).
|
|
#
|
|
# Can also be run standalone on any machine:
|
|
# sudo bash rustdesk.sh
|
|
# (Docker must already be installed when run standalone)
|
|
#
|
|
# RustDesk is an open-source TeamViewer alternative. This installs the
|
|
# SERVER-SIDE relay/rendezvous daemon — clients still need the RustDesk app.
|
|
# For cross-VLAN / cross-internet access, point RELAY at this server's FQDN.
|
|
#
|
|
# Ports that must reach this host (firewall/router):
|
|
# 21115 TCP — NAT type test
|
|
# 21116 TCP — ID register / heartbeat / relay rendezvous
|
|
# 21116 UDP — UDP hole-punching
|
|
# 21117 TCP — relay traffic (the "HBBR" relay daemon)
|
|
# 21118 TCP — WebSocket (browser client support)
|
|
# 21119 TCP — WebSocket HTTPS (browser client support)
|
|
|
|
# ── Standalone bootstrap ──────────────────────────────────────────────────────
|
|
# Detected when the script is executed directly rather than sourced by setup.sh.
|
|
# Sets up helpers and globals, then defers execution until after the function
|
|
# definition at the bottom of this file.
|
|
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
|
[[ "$(id -u)" == "0" ]] || { echo "Run with sudo: sudo bash $0"; exit 1; }
|
|
|
|
_SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
_COMMON="$_SELF_DIR/../lib/common.sh"
|
|
|
|
if [[ -f "$_COMMON" ]]; then
|
|
# Full repo present — use the real helpers (picks up ~/docker/.config too)
|
|
# shellcheck source=../lib/common.sh
|
|
source "$_COMMON"
|
|
else
|
|
# One-off copy — inline minimal stubs so the script works without the repo
|
|
log_info() { echo -e "\033[0;34m[INFO]\033[0m $*"; }
|
|
log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
|
|
log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
|
|
log_error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
|
|
|
|
require_docker() {
|
|
command -v docker &>/dev/null || {
|
|
log_error "Docker not found. Install it first:"
|
|
log_error " curl -fsSL https://get.docker.com | sudo sh"
|
|
return 1
|
|
}
|
|
docker compose version &>/dev/null || {
|
|
log_error "Docker Compose plugin missing:"
|
|
log_error " sudo apt-get install -y docker-compose-plugin"
|
|
return 1
|
|
}
|
|
}
|
|
|
|
ensure_docker_dir_ownership() {
|
|
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$@" 2>/dev/null || true
|
|
}
|
|
|
|
port_in_use() {
|
|
local _port="$1" _proto="${2:-tcp}"
|
|
local _flag="-tlnH"
|
|
[ "$_proto" = "udp" ] && _flag="-ulnH"
|
|
ss "$_flag" "sport = :${_port}" 2>/dev/null | grep -q .
|
|
}
|
|
|
|
find_free_port() {
|
|
local _varname="$1" _port="$2" _proto="${3:-tcp}"
|
|
while port_in_use "$_port" "$_proto"; do
|
|
_port=$((_port + 1))
|
|
done
|
|
eval "$_varname='$_port'"
|
|
}
|
|
|
|
# Match common.sh's eval-based pattern so local vars in install_* are set correctly
|
|
prompt_text() {
|
|
local _q="$1" _def="$2" _var="$3" _r
|
|
[[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
|
|
read -r -p " $_q " _r
|
|
eval "$_var='${_r:-$_def}'"
|
|
}
|
|
|
|
prompt_yn() {
|
|
local _q="$1" _def="$2" _var="$3" _r
|
|
[[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
|
|
read -r -p " $_q " _r
|
|
eval "$_var='${_r:-$_def}'"
|
|
}
|
|
|
|
write_readme() {
|
|
local _dir="$1"; shift
|
|
mkdir -p "$_dir"
|
|
cat > "$_dir/README.md"
|
|
}
|
|
backup_if_exists() {
|
|
local _file="$1"
|
|
[ -f "$_file" ] || return 0
|
|
cp -p "$_file" "${_file}.bak.$(date +%Y%m%d-%H%M%S)" 2>/dev/null
|
|
}
|
|
fi
|
|
|
|
# Globals — ACTUAL_USER/ACTUAL_HOME must come before DOCKER_DIR
|
|
# ($HOME under sudo is /root, not the real user's home)
|
|
ACTUAL_USER="${ACTUAL_USER:-${SUDO_USER:-$USER}}"
|
|
ACTUAL_HOME="$(getent passwd "$ACTUAL_USER" 2>/dev/null | cut -d: -f6 || echo "${HOME:-/root}")"
|
|
DOCKER_DIR="${DOCKER_DIR:-$ACTUAL_HOME/docker}"
|
|
DRY_RUN="${DRY_RUN:-false}"
|
|
UNATTENDED="${UNATTENDED:-false}"
|
|
SITE_TZ="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
|
|
SITE_DOMAIN="${SITE_DOMAIN:-example.com}"
|
|
SITE_CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
|
|
CADDY_REMOTE_HOST="${CADDY_REMOTE_HOST:-}"
|
|
|
|
register_service() { :; } # no-op — no wizard to register into
|
|
_RUN_STANDALONE=1
|
|
fi
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
register_service rustdesk utilities "Self-hosted remote desktop relay (RustDesk)" 21117
|
|
|
|
install_rustdesk() {
|
|
require_docker || return 1
|
|
log_info "Installing RustDesk server..."
|
|
|
|
# ── Instance selection ───────────────────────────────────────────────────
|
|
# First instance keeps the plain "rustdesk" name/paths/ports exactly as
|
|
# before (zero behavior change for anyone with a single instance). Only
|
|
# asking to add a second one introduces suffixed naming — same pattern as
|
|
# services/mattermost.sh and services/wordpress.sh. The 6 ports
|
|
# (21115-21119 TCP + 21116 UDP) are fixed *inside* the container — the
|
|
# image doesn't expose an env var to change them — so an additional
|
|
# instance shifts the whole host-side block by a fixed offset instead of
|
|
# scanning port-by-port, the same approach services/traccar.sh uses for
|
|
# its device-protocol range.
|
|
local RD_DIR="$DOCKER_DIR/rustdesk"
|
|
local INSTANCE_SUFFIX="" CONTAINER="rustdesk"
|
|
local PORT_OFFSET=0
|
|
|
|
if [ "$DRY_RUN" = true ]; then
|
|
echo "[DRY-RUN] Would offer to add a new, separate instance if one already exists"
|
|
echo "[DRY-RUN] Would create \$DOCKER_DIR/rustdesk(-<name>) (rustdesk_data/)"
|
|
echo "[DRY-RUN] Would deploy rustdesk/rustdesk-server-s6:latest"
|
|
echo "[DRY-RUN] Ports: 21115-21119 TCP, 21116 UDP — whole block shifted for additional instances"
|
|
echo "[DRY-RUN] Would prompt for server FQDN/IP (RELAY env var)"
|
|
return 0
|
|
fi
|
|
|
|
if [ -d "$RD_DIR" ]; then
|
|
echo ""
|
|
echo " RustDesk is already installed at $RD_DIR."
|
|
echo " 1) Manage that install (update / full reinstall / cancel)"
|
|
echo " 2) Add a NEW, separate RustDesk relay instance alongside it (its own"
|
|
echo " server and ports — full isolation)"
|
|
echo ""
|
|
local _TOP_CHOICE=""
|
|
prompt_text " Choice [1/2]:" "1" _TOP_CHOICE
|
|
if [ "$_TOP_CHOICE" = "2" ]; then
|
|
local _suffix=""
|
|
while true; do
|
|
prompt_text " Short name for the new instance (letters/numbers/hyphens, e.g. 'work'):" "" _suffix
|
|
_suffix="$(echo "$_suffix" | tr -cs 'a-zA-Z0-9-' '-' | sed 's/^-*//;s/-*$//')"
|
|
if [ -z "$_suffix" ]; then
|
|
log_warning "Name can't be empty."; continue
|
|
fi
|
|
if [ -d "$DOCKER_DIR/rustdesk-$_suffix" ]; then
|
|
log_warning "rustdesk-$_suffix already exists — pick another name."; continue
|
|
fi
|
|
break
|
|
done
|
|
INSTANCE_SUFFIX="$_suffix"
|
|
RD_DIR="$DOCKER_DIR/rustdesk-$_suffix"
|
|
CONTAINER="rustdesk-$_suffix"
|
|
log_info "New instance: $RD_DIR"
|
|
else
|
|
# "Manage that install" on THIS instance — the banner above promises
|
|
# update/fresh/cancel, so actually offer it instead of falling straight
|
|
# through into the same unconditional-overwrite flow as a new install.
|
|
if [[ -f "$RD_DIR/docker-compose.yml" ]]; then
|
|
local MODE=""
|
|
prompt_reinstall_mode MODE
|
|
case "$MODE" in
|
|
update)
|
|
log_info "Refreshing the RustDesk image only — existing config, port, and Caddy setup are left as-is."
|
|
( cd "$RD_DIR" && docker compose pull && docker compose up -d ) \
|
|
&& log_success "RustDesk image refreshed" \
|
|
|| log_warning "Refresh failed — check: docker compose -f $RD_DIR/docker-compose.yml logs"
|
|
return 0
|
|
;;
|
|
cancel)
|
|
log_info "Leaving the existing install as-is."
|
|
return 0
|
|
;;
|
|
fresh) ;; # fall through to the full install flow below
|
|
esac
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# Scan for a free port block unconditionally, shifting the whole 6-port
|
|
# block together — not just when adding an explicit additional instance.
|
|
# A plain first install can just as easily collide with an unrelated
|
|
# service already bound to one of these default ports — see CLAUDE.md's
|
|
# "Port collision avoidance" section.
|
|
while port_in_use "$((21115 + PORT_OFFSET))" \
|
|
|| port_in_use "$((21116 + PORT_OFFSET))" \
|
|
|| port_in_use "$((21116 + PORT_OFFSET))" udp \
|
|
|| port_in_use "$((21117 + PORT_OFFSET))" \
|
|
|| port_in_use "$((21118 + PORT_OFFSET))" \
|
|
|| port_in_use "$((21119 + PORT_OFFSET))"; do
|
|
PORT_OFFSET=$((PORT_OFFSET + 10))
|
|
done
|
|
|
|
mkdir -p "$RD_DIR/rustdesk_data"
|
|
ensure_docker_dir_ownership "$RD_DIR"
|
|
cd "$RD_DIR" || return 1
|
|
|
|
local TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
|
|
local P_NAT=$((21115 + PORT_OFFSET)) P_ID=$((21116 + PORT_OFFSET)) \
|
|
P_RELAY=$((21117 + PORT_OFFSET)) P_WS=$((21118 + PORT_OFFSET)) P_WSS=$((21119 + PORT_OFFSET))
|
|
|
|
echo ""
|
|
echo " RustDesk needs to know its own public hostname or IP."
|
|
echo " Clients will connect to this address for relay traffic."
|
|
echo " Use a FQDN if you have one (e.g. rustdesk.example.com),"
|
|
echo " or your server's public IP if not."
|
|
echo ""
|
|
local RELAY_HOST=""
|
|
prompt_text "Public hostname or IP for this server:" "" RELAY_HOST
|
|
if [ -z "$RELAY_HOST" ]; then
|
|
log_warning "No relay host set — you MUST edit RELAY in .env before clients will work."
|
|
RELAY_HOST="your-server-fqdn-or-ip"
|
|
fi
|
|
|
|
local ENCRYPTED_ONLY="1"
|
|
local _enc=""
|
|
prompt_yn "Require encrypted connections only? (recommended) (y/n):" "y" _enc
|
|
[ "$_enc" = "n" ] || [ "$_enc" = "N" ] && ENCRYPTED_ONLY="0"
|
|
|
|
backup_if_exists docker-compose.yml
|
|
cat > docker-compose.yml << RD_COMPOSE
|
|
name: $CONTAINER
|
|
|
|
services:
|
|
rustdesk:
|
|
image: rustdesk/rustdesk-server-s6:latest
|
|
container_name: $CONTAINER
|
|
hostname: $CONTAINER
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
ports:
|
|
- "${P_NAT}:21115"
|
|
- "${P_ID}:21116"
|
|
- "${P_ID}:21116/udp"
|
|
- "${P_RELAY}:21117"
|
|
- "${P_WS}:21118"
|
|
- "${P_WSS}:21119"
|
|
volumes:
|
|
- ./rustdesk_data:/data
|
|
RD_COMPOSE
|
|
|
|
backup_if_exists .env
|
|
cat > .env << RD_ENV
|
|
# ── General ───────────────────────────────────────────────────────────────────
|
|
TZ=$TZ_VAL
|
|
|
|
# ── RustDesk server ───────────────────────────────────────────────────────────
|
|
# RELAY: public FQDN or IP that clients use to reach the relay daemon (HBBR).
|
|
# Include the port if it's non-standard: hostname:$P_RELAY
|
|
RELAY=$RELAY_HOST:$P_RELAY
|
|
|
|
# ENCRYPTED_ONLY: 1 = only clients with the matching public key can connect.
|
|
# After first startup, copy the key from ./rustdesk_data/id_ed25519.pub to
|
|
# each client: Settings → Network → Key.
|
|
ENCRYPTED_ONLY=$ENCRYPTED_ONLY
|
|
|
|
# KEY_PRIV and KEY_PUB — optional: paste key file contents here instead of
|
|
# relying on the volume-mounted file. Useful for portability.
|
|
# KEY_PRIV=<content of ./rustdesk_data/id_ed25519>
|
|
# KEY_PUB=<content of ./rustdesk_data/id_ed25519.pub>
|
|
RD_ENV
|
|
|
|
chmod 600 .env
|
|
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$RD_DIR"
|
|
log_success "RustDesk${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)} configured at $RD_DIR (ports $P_NAT-$P_WSS)"
|
|
|
|
write_readme "$RD_DIR" << MD
|
|
# RustDesk${INSTANCE_SUFFIX:+ — $INSTANCE_SUFFIX} — self-hosted remote desktop relay
|
|
|
|
Open-source TeamViewer alternative. This is the server-side relay/rendezvous
|
|
daemon. Clients use the RustDesk desktop/mobile app to connect.
|
|
$( [ -n "$INSTANCE_SUFFIX" ] && echo "
|
|
This is a separate, fully isolated instance (own server, own key, own port
|
|
block) — not shared clients with another RustDesk instance.")
|
|
|
|
## After starting: get the public key
|
|
|
|
\`\`\`bash
|
|
cat $RD_DIR/rustdesk_data/id_ed25519.pub
|
|
\`\`\`
|
|
|
|
Paste this key into each client:
|
|
**Settings → Network → ID/Relay Server**
|
|
- ID Server: $RELAY_HOST:$P_ID
|
|
- Relay Server: $RELAY_HOST:$P_RELAY
|
|
- Key: <paste id_ed25519.pub contents>
|
|
|
|
## Firewall / router rules required
|
|
|
|
Open these ports to this server's IP:
|
|
| Port | Protocol | Purpose |
|
|
|------|----------|---------|
|
|
| $P_NAT | TCP | NAT type test |
|
|
| $P_ID | TCP+UDP | ID register / hole-punching |
|
|
| $P_RELAY | TCP | Relay traffic |
|
|
| $P_WS | TCP | WebSocket |
|
|
| $P_WSS | TCP | WebSocket HTTPS |
|
|
|
|
## Cross-VLAN setup
|
|
Use the server's FQDN (not LAN IP) in RELAY so clients on any VLAN
|
|
or on the internet can reach the relay. DNS must resolve the FQDN to
|
|
the server's public IP.
|
|
|
|
## Manage
|
|
\`\`\`bash
|
|
cd $RD_DIR
|
|
docker compose up -d # start
|
|
docker compose down # stop
|
|
docker compose logs -f # logs
|
|
docker compose pull && docker compose up -d # update
|
|
\`\`\`
|
|
MD
|
|
|
|
local START_RD=""
|
|
prompt_yn "Start RustDesk server${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)} now? (y/n):" "y" START_RD
|
|
if [ "$START_RD" = "y" ] || [ "$START_RD" = "Y" ]; then
|
|
docker compose up -d \
|
|
&& log_success "RustDesk${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)} started" \
|
|
|| log_warning "Failed to start — check: docker compose logs"
|
|
echo ""
|
|
echo " After startup, get the public key:"
|
|
echo " cat $RD_DIR/rustdesk_data/id_ed25519.pub"
|
|
echo " Paste it into client Settings → Network → Key."
|
|
fi
|
|
|
|
echo ""
|
|
echo " Relay host: $RELAY_HOST"
|
|
echo " Ports $P_NAT-$P_WSS must be open in your firewall/router."
|
|
echo ""
|
|
}
|
|
|
|
# Run immediately when executed directly (deferred until after function definition)
|
|
[[ "${_RUN_STANDALONE:-0}" == 1 ]] && install_rustdesk
|