rmancinasandClaude Opus 5
cfda6b19b7
Registering a machine meant reading a multi-step page, installing Node, and running three commands in the right order. Now it is one line per platform. The hub serves scripts/install.sh and scripts/install.ps1 with its own address and the enrolment token substituted in, so the published command carries everything and there is nothing to fill in: curl -fsSL https://support.freakma.com/install.sh?token=TOKEN | sh irm https://support.freakma.com/install.ps1?token=TOKEN | iex That output is piped straight into a shell, so the token — the only untrusted value in either file — is refused unless it matches the base64url shape that randomToken produces. Each script checks for a usable runtime and stops with instructions rather than guessing, warns when nothing is serving RFB on the loopback, installs per-user with no root or administrator, and registers a login-scoped service: launchd on macOS, a lingering systemd user service on Linux, a logon task on Windows. The Windows script uses Node 22 when it is present and falls back to the bundled executable otherwise, which is what lets one command cover both Windows 11 and Server 2008 R2. It registers a logon task rather than a service on purpose: services run in session 0 and cannot draw on the interactive desktop, so the "ask first" consent prompt would never appear. Also adds /docs — a per-OS setup guide with service management and a troubleshooting table — and reworks the enrolment page into OS tabs that open on whichever platform the reader is sitting at. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
65 lines
2.3 KiB
JavaScript
65 lines
2.3 KiB
JavaScript
'use strict';
|
|
|
|
const path = require('path');
|
|
|
|
function bool(v, dflt) {
|
|
if (v === undefined || v === '') return dflt;
|
|
return /^(1|true|yes|on)$/i.test(String(v));
|
|
}
|
|
|
|
function list(v) {
|
|
return String(v || '')
|
|
.split(',')
|
|
.map((s) => s.trim().toLowerCase())
|
|
.filter(Boolean);
|
|
}
|
|
|
|
const config = {
|
|
port: Number(process.env.PORT || 8080),
|
|
host: process.env.HOST || '0.0.0.0',
|
|
|
|
// garagedoor-node-ws central auth
|
|
authUrl: (process.env.AUTH_URL || 'http://192.168.4.208:8000').replace(/\/$/, ''),
|
|
|
|
// Admins: username allowlist, or garagedoor `level` at/above this threshold.
|
|
adminUsers: list(process.env.ADMIN_USERS),
|
|
adminLevel: process.env.ADMIN_LEVEL === '' || process.env.ADMIN_LEVEL === undefined
|
|
? null
|
|
: Number(process.env.ADMIN_LEVEL),
|
|
|
|
dbPath: process.env.DB_PATH || path.join(__dirname, '..', 'data', 'rcs.db'),
|
|
|
|
// Key material for AES-256-GCM at-rest encryption of VNC passwords / agent keys.
|
|
encryptionKey: process.env.ENCRYPTION_KEY || '',
|
|
|
|
// Public base URL, used when rendering invite links. Falls back to the request host.
|
|
publicUrl: (process.env.PUBLIC_URL || '').replace(/\/$/, ''),
|
|
|
|
ticketTtlMs: Number(process.env.TICKET_TTL_MS || 30_000),
|
|
inviteDefaultTtlMs: Number(process.env.INVITE_TTL_MS || 24 * 60 * 60 * 1000),
|
|
agentOfflineAfterMs: Number(process.env.AGENT_OFFLINE_AFTER_MS || 90_000),
|
|
consentTimeoutMs: Number(process.env.CONSENT_TIMEOUT_MS || 45_000),
|
|
|
|
// Session invites let unauthenticated people connect. Off by default is safer,
|
|
// but the whole point of this app is handing a link to someone, so: on.
|
|
allowSessionInvites: bool(process.env.ALLOW_SESSION_INVITES, true),
|
|
|
|
trustProxy: bool(process.env.TRUST_PROXY, true),
|
|
logLevel: process.env.LOG_LEVEL || 'info',
|
|
};
|
|
|
|
/**
|
|
* Public base URL for links this hub hands out — invite URLs, and the hub
|
|
* address baked into the install scripts. `PUBLIC_URL` wins; without it the
|
|
* request's own host is used, which is right behind a proxy that sets
|
|
* `X-Forwarded-Proto` and wrong when someone hits the container directly.
|
|
*/
|
|
function baseUrl(req) {
|
|
if (config.publicUrl) return config.publicUrl;
|
|
const proto = req.headers['x-forwarded-proto'] || req.protocol;
|
|
return `${proto}://${req.get('host')}`;
|
|
}
|
|
|
|
module.exports = config;
|
|
module.exports.baseUrl = baseUrl;
|