add rustdesk role

roles/rustdesk/files/generate-rustdesk-exe.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# shellcheck disable=SC2155
+set -eu -o pipefail
+
+readonly RUSTDESK_SERVER_IP="$(curl -s ifconfig.me)"
+readonly RUSTDESK_SERVER_KEY="$(cat /opt/rustdesk-server/lib/id_ed25519.pub)"
+
+cp /opt/rustdesk-server/lib/rustdesk-client.exe \
+   /opt/rustdesk-server/lib/rustdesk-host="$RUSTDESK_SERVER_IP",key="$RUSTDESK_SERVER_KEY".exe

roles/rustdesk/files/rustdesk-hbbr.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=Rustdesk Relay Server
+
+[Service]
+Type=simple
+LimitNOFILE=10000
+Environment="RUST_LOG_LEVEL=trace"
+WorkingDirectory=/opt/rustdesk-server/lib/
+
+ExecStart=/opt/rustdesk-server/amd64/hbbr
+
+Restart=on-failure
+RestartSec=10
+StartLimitIntervalSec=60
+StartLimitBurst=2
+
+User=rustdesk
+Group=rustdesk
+
+# Security
+ProtectSystem=strict
+ReadWritePaths=/opt/rustdesk-server/lib/
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelTunables=true
+ProtectClock=yes
+RestrictSUIDSGID=true
+
+[Install]
+WantedBy=multi-user.target

roles/rustdesk/files/rustdesk-hbbs.service

@@ -0,0 +1,35 @@
+[Unit]
+Description=Rustdesk Signal Server
+
+[Service]
+Type=simple
+LimitNOFILE=10000
+Environment="RUST_LOG_LEVEL=trace"
+WorkingDirectory=/opt/rustdesk-server/lib/
+
+ExecStartPre=/bin/sh -c 'rm -rf /opt/rustdesk-server/lib/id_ed25519*'
+ExecStartPre=/bin/sh -c 'rm -rf /opt/rustdesk-server/lib/rustdesk-host=*'
+ExecStart=/opt/rustdesk-server/amd64/hbbs
+ExecStartPost=/opt/rustdesk-server/generate-rustdesk-exe.sh
+
+Restart=on-failure
+RestartSec=10
+StartLimitIntervalSec=60
+StartLimitBurst=2
+
+User=rustdesk
+Group=rustdesk
+
+# Security
+ProtectSystem=strict
+ReadWritePaths=/opt/rustdesk-server/lib/
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelTunables=true
+ProtectClock=yes
+RestrictSUIDSGID=true
+
+[Install]
+WantedBy=multi-user.target