RemoteDesk/packaging/edge

RemoteDesk Edge Service

This package contains the independent RemoteDesk Edge control plane and authenticated TCP byte relay. It does not contain coturn, terminate RDP TLS/NLA, decrypt WebRTC media, or create endpoint sessions.

Configure

1. Generate three different random values of at least 32 bytes for REMOTEDESK_EDGE_API_TOKEN, REMOTEDESK_EDGE_PRESENCE_TOKEN, and REMOTEDESK_EDGE_TICKET_SECRET. Agents receive only the Presence token; it cannot query devices or allocate relay/TURN credentials.
2. Set the public relay address, POP ID, and region in /etc/remotedesk-edge/edge.env.
3. Publish 127.0.0.1:7080 through an HTTPS reverse proxy. The process refuses a public HTTP API bind.
4. Publish 127.0.0.1:7444 through a TCP/TLS load balancer that preserves connection affinity.
5. Optionally copy turn-pops.json.example, reference one independent environment secret per coturn POP, and append --turn-config /etc/remotedesk-edge/turn-pops.json to the systemd command.
6. Run systemctl enable --now remotedesk-edge.service.

The package also includes an optional coturn baseline at /etc/remotedesk-edge/coturn.conf.example, a secret-only environment template, remotedesk-turn.service, and remotedesk-verify-coturn. Install the distribution coturn package, copy both templates without the .example suffix, set explicit listening/relay/external addresses, install a trusted certificate and private key, then enable the TURN unit. Verification requires the REST secret and trusted CA path and performs STUN plus TURN UDP, TCP, and TLS data loops:

sudo REMOTEDESK_TURN_REST_SECRET='...' \
  REMOTEDESK_TURN_VERIFY_HOST=turn.example.com \
  REMOTEDESK_TURN_VERIFY_CA=/path/to/ca.pem \
  remotedesk-verify-coturn

GET /health is unauthenticated and exposes only service health, local capability flags, and aggregate counters. POST /v1/presence, DELETE /v1/presence, POST /v1/signals/poll, and POST /v1/signals/ack accept either the dedicated Presence token or the administrator token. Signal poll/ack additionally require a fresh one-use nonce and an Ed25519 proof from the current Agent device key; the shared Presence token alone cannot poll another device. Presence lookup, path selection, relay allocation, TURN credentials, and administrator signal status require Authorization: Bearer <REMOTEDESK_EDGE_API_TOKEN>; never distribute that administrator token to Agents or Windows Clients.

POST /v1/signals/requests is a public Client-authenticated route: it accepts a valid Client-key-signed session intent only while the target has a live Presence route. POST /v1/signals/status returns that request only when the caller repeats its stored Client public key and original signature. Requests use canonical domain-separated signing bytes, expire within 120 seconds, are idempotent by request ID, and enter bounded global, per-device, and per-Client/device queues. The Agent independently verifies that Client key against its local pairing store and checks the requested permission and target user before sending a device-key-signed acceptance or rejection. An accepted terminal/file request allocates independent one-use Client and Agent relay tickets; each endpoint receives only its own role. Operators can read non-secret status from the administrator-only GET /v1/signals/requests/<request-id>.

Accepted, unexpired sessions may use public body-authenticated POST /v1/negotiation/send and POST /v1/negotiation/poll routes. Each envelope is signed by the bound Client or Agent Ed25519 key and covers request/session IDs, endpoint role, operation, strict sequence, ICE generation, message kind, payload, one-use nonce, and a maximum 30-second lifetime. The bounded peer-only mailbox carries SDP offer/answer, ICE candidates/end, and explicit restart messages. It does not create a WebRTC peer connection, deploy coturn, or carry media.

Relay allocations return role-specific, HMAC-protected, one-use tickets. Tickets bind the allocation, session, role, POP, expiry, and shared byte quota. The relay forwards opaque bytes and applies a global idle timeout; terminal/file endpoints establish the original pinned Agent TLS and WebSocket inside that byte stream. Public endpoints must connect through a system-trusted TLS/L4 ingress; raw relay TCP is accepted by clients only for loopback testing.

The packaged configuration intentionally contains no usable secret and the service is not started automatically after installation.