rmancinasandClaude Opus 5
999717f77b
Browser-based remote control (noVNC) with invite links, per-user access control, garagedoor SSO and a persisted client list. The hub proxies RFB rather than pointing the browser at a VNC server. That is what lets it authenticate upstream with a stored password the browser never sees, and enforce view-only by dropping input messages on the client->server stream instead of hiding buttons. Machines are reachable two ways: direct TCP for LAN hosts, or an outbound agent tunnel for anything behind NAT. Node 22's global WebSocket keeps the agent dependency-free, and node:sqlite keeps the image free of native builds. Ships with an end-to-end suite that boots the real server against a fake VNC server and a fake auth service (72 assertions), plus Gitea Actions CI/CD to Portainer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
33 lines
946 B
Bash
33 lines
946 B
Bash
# HTTP listener
|
|
PORT=8080
|
|
HOST=0.0.0.0
|
|
|
|
# Central auth (garagedoor-node-ws)
|
|
AUTH_URL=http://192.168.4.208:8000
|
|
|
|
# Who counts as an admin. Leave BOTH unset and every authenticated user is an
|
|
# admin — fine for a single operator, not for a shared install.
|
|
ADMIN_USERS=rmancinas
|
|
# ADMIN_LEVEL=10
|
|
|
|
# Where the SQLite database lives (the encryption key is written next to it)
|
|
DB_PATH=/data/rcs.db
|
|
|
|
# 32+ random chars. Encrypts stored VNC passwords. Generate with:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
# If unset, one is generated next to the database on first boot.
|
|
ENCRYPTION_KEY=
|
|
|
|
# Base URL used when rendering invite links. Set this once it is behind a proxy.
|
|
PUBLIC_URL=https://remote.mancinas.dev
|
|
|
|
# Turn off to disable no-login support links entirely
|
|
ALLOW_SESSION_INVITES=true
|
|
|
|
# Tuning
|
|
TICKET_TTL_MS=30000
|
|
INVITE_TTL_MS=86400000
|
|
CONSENT_TIMEOUT_MS=45000
|
|
AGENT_OFFLINE_AFTER_MS=90000
|
|
TRUST_PROXY=true
|