This package contains the independent RemoteDesk Edge control plane and authenticated TCP byte relay. It does not contain coturn, terminate RDP TLS/NLA, decrypt WebRTC media, or create endpoint sessions.

Configure

Initialize the service. This generates three independent 48-byte random credentials without printing them and writes an owner-protected environment file:
```
sudo remotedesk-edge-setup \
  --public-relay-address relay.example.com:7443 \
  --pop-id cn-east-1 \
  --region cn-east
```
Publish 127.0.0.1:7080 through an HTTPS reverse proxy, for example as https://api.example.com/. The process refuses a public HTTP API bind.
Publish 127.0.0.1:7444 through a TCP/TLS load balancer at the exact authority passed to --public-relay-address. TLS is terminated at the load balancer; connection affinity is required.
Set the Agent's REMOTEDESK_EDGE_API_URL to the public HTTPS API and copy only REMOTEDESK_EDGE_PRESENCE_TOKEN from /etc/remotedesk-edge/edge.env into its protected environment. Never distribute the API token or ticket secret.
Run systemctl enable --now remotedesk-edge.service, or pass --start to the setup command after both public listeners are ready.
Optionally copy turn-pops.json.example, reference one independent environment secret per coturn POP, and append --turn-config /etc/remotedesk-edge/turn-pops.json to the systemd command.

Use --force only for an intentional credential rotation. Rotation immediately invalidates Agent registration and outstanding relay tickets, so update every Agent Presence token before restarting the service.

The package also includes an optional coturn baseline at /etc/remotedesk-edge/coturn.conf.example, a secret-only environment template, remotedesk-turn.service, and remotedesk-verify-coturn. Install the distribution coturn package, copy both templates without the .example suffix, set explicit listening/relay/external addresses, install a trusted certificate and private key, then enable the TURN unit. Verification requires the REST secret and trusted CA path and performs STUN plus TURN UDP, TCP, and TLS data loops:

sudo REMOTEDESK_TURN_REST_SECRET='...' \
  REMOTEDESK_TURN_VERIFY_HOST=turn.example.com \
  REMOTEDESK_TURN_VERIFY_CA=/path/to/ca.pem \
  remotedesk-verify-coturn

GET /health is unauthenticated and exposes only service health, local capability flags, and aggregate counters. POST /v1/presence, DELETE /v1/presence, POST /v1/signals/poll, and POST /v1/signals/ack accept either the dedicated Presence token or the administrator token. Every one of these Agent routes also requires a fresh one-use nonce and an Ed25519 proof from the current Agent device key. Registration and removal proofs bind the derived device ID, public key, region, gateway, connection, action, and lease lifetime, so the shared Presence token alone cannot create, overwrite, remove, or poll another device route. The Agent creates and protects this device identity automatically on first startup; operators do not provide a key file. Presence lookup, path selection, relay allocation, TURN credentials, and administrator signal status require Authorization: Bearer <REMOTEDESK_EDGE_API_TOKEN>; never distribute that administrator token to Agents or Windows Clients.

POST /v1/signals/requests is a public Client-authenticated route: it accepts a valid Client-key-signed session intent only while the target has a live Presence route. POST /v1/signals/status returns that request only when the caller repeats its stored Client public key and original signature. Requests use canonical domain-separated signing bytes, expire within 120 seconds, are idempotent by request ID, and enter bounded global, per-device, and per-Client/device queues. The Agent independently verifies that Client key against its local pairing store and checks the requested permission and target user before sending a device-key-signed acceptance or rejection. An accepted terminal/file request allocates independent one-use Client and Agent relay tickets; each endpoint receives only its own role. Operators can read non-secret status from the administrator-only GET /v1/signals/requests/<request-id>.

Accepted, unexpired sessions may use public body-authenticated POST /v1/negotiation/send and POST /v1/negotiation/poll routes. Each envelope is signed by the bound Client or Agent Ed25519 key and covers request/session IDs, endpoint role, operation, strict sequence, ICE generation, message kind, payload, one-use nonce, and a maximum 30-second lifetime. The bounded peer-only mailbox carries SDP offer/answer, ICE candidates/end, and explicit restart messages. It does not create a WebRTC peer connection, deploy coturn, or carry media.

Relay allocations return role-specific, HMAC-protected, one-use tickets. Tickets bind the allocation, session, role, POP, expiry, and shared byte quota. The relay forwards opaque bytes and applies a global idle timeout; terminal/file endpoints establish the original pinned Agent TLS and WebSocket inside that byte stream. Public endpoints must connect through a system-trusted TLS/L4 ingress; raw relay TCP is accepted by clients only for loopback testing.

The packaged configuration intentionally contains no usable secret and the service is not started automatically after installation.