rustdesk / rustdesk/rustdesk-server

Allow keypair to be mounted as docker secrets

Open
#287 7 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Rust
Stars
10.4k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

Is your feature request related to a problem? Please describe.

The self hosted docker option allows to mount the keypair as file mounts:

volumes:
  - ./id_ed25519:/data/id_ed25519:ro
  - ./id_ed25519.pub:/data/id_ed25519.pub:ro

Although this works, it's not ideal for such sensitive secrets.

Describe the solution you'd like

Please consider allowing the keypair to be mounted as proper docker secrets:

secrets:
  secret_private:
    file: id_ed25519
  secret_public:
    file: id_ed25519.pub

services:
  rustdesk:
    secrets:
      - secret_private
      - secret_public
    image: rustdesk/rustdesk-server-s6:latest
    # ...

Those secrets would be automatically mounted at the standard docker paths:

/run/secrets/secret_private
/run/secrets/secret_public

Then the app can load the secrets from those files directly.

So from rustdesk's perspective, the ONLY change is to read from /run/secrets/secret_private and /run/secrets/secret_public instead of /data/id_ed25519 and /data/id_ed25519.pub. That's it.

Describe alternatives you've considered

Mounting as file mounts, as shown above.

Additional context

Thanks for considering it.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Search the Rust server and Docker configuration for /data/id_ed25519 and /data/id_ed25519.pub, then trace how the keypair is loaded. Update the configuration to support /run/secrets/secret_private and /run/secrets/secret_public, and verify the keypair loads through the Docker setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, rust
Domain
devops, security
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.