Add the RustDesk server playbook

rustdesk/vars/default.yml

@@ -0,0 +1,56 @@
+---
+docker_container: rustdesk
+image_name: "rustdesk/rustdesk-server-s6"
+image_version: "latest"
+
+# Public name clients use, and the name Caddy serves. hbbs hands this out as the
+# relay address, and a WebSocket client rewrites a hostname to
+# wss://<host>/ws/relay (an IP would get neither TLS nor the path).
+host: rust.tanshu.com
+rustdesk_relay_server: "{{ host }}:21117"
+
+host_directory: rustdesk
+data_location: "/var/lib/{{ host_directory }}/data"
+
+docker_network: "{{ docker_container }}_net"
+caddy_container: caddy
+
+# hbbs/hbbr also speak their own TCP/UDP protocol on 21115-21117, which is not
+# HTTP and so cannot go through Caddy. Leave this off to keep the host's only
+# open ports at 80/443: clients then have to enable WebSocket, and every session
+# is relayed. Turn it on for clients that do not use WebSocket.
+rustdesk_publish_raw_ports: false
+rustdesk_raw_ports:
+  - "21115:21115"
+  - "21116:21116"
+  - "21116:21116/udp"
+  - "21117:21117"
+
+rustdesk_published_ports: "{{ rustdesk_raw_ports if rustdesk_publish_raw_ports | bool else [] }}"
+
+# hbbs writes id_ed25519/id_ed25519.pub under /data on first start. Clients are
+# configured with the public key, and ENCRYPTED_ONLY makes hbbr check it too.
+rustdesk_encrypted_only: true
+
+# "Y" pushes every session through the relay. WebSocket clients are relay-only
+# regardless, so this only matters for clients on the raw ports.
+rustdesk_always_use_relay: false
+
+rustdesk_env:
+  RELAY: "{{ rustdesk_relay_server }}"
+  ENCRYPTED_ONLY: "{{ '1' if rustdesk_encrypted_only | bool else '0' }}"
+  ALWAYS_USE_RELAY: "{{ 'Y' if rustdesk_always_use_relay | bool else 'N' }}"
+
+# Caddy terminates TLS on 443 and carries the WebSocket transports: 21118 is
+# hbbs's WebSocket listener, 21119 hbbr's. Neither is published on the host.
+caddyfile_path: /var/lib/caddy/conf/Caddyfile
+snippet_block: |
+  {{ host }} {
+      reverse_proxy /ws/id* {{ docker_container }}:21118 {
+          header_up X-Real-IP {remote_host}
+      }
+
+      reverse_proxy /ws/relay* {{ docker_container }}:21119 {
+          header_up X-Real-IP {remote_host}
+      }
+  }