---
docker_container: rustdesk
image_name: "rustdesk/rustdesk-server-s6"
image_version: "latest"

# Clients use this name and Caddy serves it. hbbs hands it out as the relay
# address, so it must be a hostname and not an IP.
host: rust.tanshu.com
rustdesk_relay_server: "{{ host }}:21117"

host_directory: rustdesk
data_location: "/var/lib/{{ host_directory }}/data"

docker_network: "{{ docker_container }}_net"
caddy_container: caddy

# hbbs and hbbr speak their own protocol on 21115-21117, which Caddy cannot
# carry. Leave this off to keep only 80/443 open. Every session is then relayed
# and clients must use WebSocket. Turn it on for clients that do not.
rustdesk_publish_raw_ports: false
rustdesk_raw_ports:
  - "21115:21115"
  - "21116:21116"
  - "21116:21116/udp"
  - "21117:21117"

rustdesk_published_ports: "{{ rustdesk_raw_ports if rustdesk_publish_raw_ports | bool else [] }}"

# hbbs writes its key pair under /data on first start. Clients need the public
# half, and ENCRYPTED_ONLY makes hbbr check it too.
rustdesk_encrypted_only: true

# Y pushes every session through the relay. WebSocket clients are relay-only
# regardless, so this only matters for clients on the raw ports.
rustdesk_always_use_relay: false

rustdesk_env:
  RELAY: "{{ rustdesk_relay_server }}"
  ENCRYPTED_ONLY: "{{ '1' if rustdesk_encrypted_only | bool else '0' }}"
  ALWAYS_USE_RELAY: "{{ 'Y' if rustdesk_always_use_relay | bool else 'N' }}"

# Caddy terminates TLS on 443 and carries the WebSockets: 21118 is hbbs's
# listener, 21119 hbbr's. Neither port is published on the host.
caddyfile_path: /var/lib/caddy/conf/Caddyfile
snippet_block: |
  {{ host }} {
      reverse_proxy /ws/id* {{ docker_container }}:21118 {
          header_up X-Real-IP {remote_host}
      }

      reverse_proxy /ws/relay* {{ docker_container }}:21119 {
          header_up X-Real-IP {remote_host}
      }
  }