rustdesk-server-starry

rustdesk-server-starry is an unofficial, community-maintained overlay for the official rustdesk/rustdesk-server project. It focuses on HBBS (the ID/signalling server) and adds policy-driven Relay selection plus authenticated-client transport compatibility, while avoiding a permanently diverged fork of upstream source. How the overlay works Each build starts from an exact official RustDesk Server revision. The scripts/apply_overlay.py script verifies fixed source anchors, injects the Starry modules, and is designed to be idempotent: applying it a second time should produce no further changes. If an upstream structural change invalidates an anchor or a test, publication stops rather than shipping a partially patched server. Capabilities described in the README - Ordered Relay selection using both endpoints' country, city, subdivision, ASN, and ISP facts. - Validated MMDB download, replacement, retention, and scheduled update. - RustDesk-client-compatible Secure TCP negotiation and encrypted transport on native HBBS TCP 21116. - Optional persistent WebSocket signalling on /ws/id, including WSS-to-WSS and WSS-to-native Relay sessions. - Certificate-verified /ws/relay health filtering. - Akari-only candidate Relay active probing with dual-end RTT/jitter/loss and trusted HBBR load scoring, prefix-cache hysteresis, and a legacy single-Relay fallback. - Default-off, short-lived Ed25519 authorization for Akari FastCompat and role-bound FastMediaV1, with a separately supervised HBBR AKR1 UDP data plane. - Generation-safe Profile Activation Leases for Akari, including matching Ready ACK, explicit current-lease deactivation, bounded verified rapid re-registration, and official-client-compatible defaults. - Schema v5 last-known-good activation with generation, digest, and synchronous subsystem acknowledgements. - Optional strict Ed25519 connection JWT audit/enforcement for PunchHoleRequest and direct RequestRelay on native TCP, Secure TCP, and WSS; UDP initiation is explicitly unsupported. - SP1 Control-Agent/Relay bootstrap, bounded Relay enrollment, persistent identities, and a no-side-effect v5-to-v4 downgrade export. - Immutable Relay snapshots, side-effect-free allocation simulation, and a separate Linux Control Agent protected by mTLS, scoped service JWTs, and atomic configuration transactions. Component boundaries - HBBS: modified by the overlay; run the Starry hbbs binary or image command. - HBBR: reliable Relay plus optional AKR1 UDP; keeps the upstream TCP/WS byte-forwarding path, answers public quality probes without load, exposes detailed state only through authenticated telemetry, and optionally routes encrypted Akari AKF1 datagrams after role-bound grants. - Control Agent: optional Starry component, Linux only in v1.3; keep HBBS local control on loopback and expose the Agent only on a private management path with mTLS and scoped service JWTs. Configuration writes are disabled by default. - Account/API server: not included. Account login, address books, device data, and administration require a separately selected API implementation. The README stresses that account API login, the HBBS signalling connection, the optional Starry Control API, and the HBBR data path are separate protocol layers. Starry does not turn a third-party API into a Relay and does not replace the RustDesk client. The optional FastMedia UDP listener is independent from the ordinary HBBR stream, which always remains the reliable fallback. Release status Current development release is a patch-v1.3.1 preview. Docker images are published at ghcr.io/q1ngyang/rustdesk-server-starry. The candidate matrix is Docker linux/amd64 plus Linux x86_64 binaries and amd64 DEB packages. ARM is best-effort source compatibility; Windows is an experimental non-blocking build, and neither is a promised v1.3.1 artifact. The preview is opt-in, keeps both Fast switches off by default, and is published only as a GitHub prerelease and the rolling preview image. Stable approval still requires end-to-end FastMedia and real-device release gates. Documentation English is the default documentation language, with a Simplified Chinese counterpart for every narrative guide. Copy-ready configuration and orchestration files are shared by both languages. The classified documentation index covers local sources, a container manual, release notes, and technical references. Guides include getting started, Docker image usage, Docker deployment, native deployment, multi-node deployment, reverse proxy and TLS, client configuration, account/API integration, configuration reference, connection authentication, Control Agent, Profile Activation Lease v1, Fast Relay authorization v1, FastMedia Relay UDP v1, Starry Pairing v1, GEO rules basics and advanced, operations and verification, troubleshooting, upgrade and rollback, and architecture and build. Licence and disclaimers The official RustDesk Server source and the Starry overlay are distributed under the GNU Affero General Public License v3.0. Published binaries and images are built from the corresponding pinned upstream revision plus this overlay. The project states it is not affiliated with or endorsed by RustDesk, MaxMind, any MMDB mirror provider, or any AI service provider. The image does not include a GeoLite2 database; operators must select lawful, trusted data sources and comply with their licences. Parts of the code and documentation were generated or revised with AI assistance and remain subject to the same project licence without additional warranty.