---
docker_container: rustdesk
image_name: "rustdesk/rustdesk-server-s6"
image_version: "latest"

# Public name clients use, and the name Caddy serves. hbbs hands this out as the
# relay address, and a WebSocket client rewrites a hostname to
# wss://<host>/ws/relay (an IP would get neither TLS nor the path).
host: rust.tanshu.com
rustdesk_relay_server: "{{ host }}:21117"

host_directory: rustdesk
data_location: "/var/lib/{{ host_directory }}/data"

docker_network: "{{ docker_container }}_net"
caddy_container: caddy

# hbbs/hbbr also speak their own TCP/UDP protocol on 21115-21117, which is not
# HTTP and so cannot go through Caddy. Leave this off to keep the host's only
# open ports at 80/443: clients then have to enable WebSocket, and every session
# is relayed. Turn it on for clients that do not use WebSocket.
rustdesk_publish_raw_ports: false
rustdesk_raw_ports:
  - "21115:21115"
  - "21116:21116"
  - "21116:21116/udp"
  - "21117:21117"

rustdesk_published_ports: "{{ rustdesk_raw_ports if rustdesk_publish_raw_ports | bool else [] }}"

# hbbs writes id_ed25519/id_ed25519.pub under /data on first start. Clients are
# configured with the public key, and ENCRYPTED_ONLY makes hbbr check it too.
rustdesk_encrypted_only: true

# "Y" pushes every session through the relay. WebSocket clients are relay-only
# regardless, so this only matters for clients on the raw ports.
rustdesk_always_use_relay: false

rustdesk_env:
  RELAY: "{{ rustdesk_relay_server }}"
  ENCRYPTED_ONLY: "{{ '1' if rustdesk_encrypted_only | bool else '0' }}"
  ALWAYS_USE_RELAY: "{{ 'Y' if rustdesk_always_use_relay | bool else 'N' }}"

# Caddy terminates TLS on 443 and carries the WebSocket transports: 21118 is
# hbbs's WebSocket listener, 21119 hbbr's. Neither is published on the host.
caddyfile_path: /var/lib/caddy/conf/Caddyfile
snippet_block: |
  {{ host }} {
      reverse_proxy /ws/id* {{ docker_container }}:21118 {
          header_up X-Real-IP {remote_host}
      }

      reverse_proxy /ws/relay* {{ docker_container }}:21119 {
          header_up X-Real-IP {remote_host}
      }
  }