RDP Web module

[bpmct]

A discussion dedicated to the RDP Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
11 / 17	16 / 20	0 / 20	7 / 10	51 / 100

Drilldown

Presentation & Onboarding — 11 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	Two major modes exist (web-only RDP vs. native RDP). The intro mentions enable_native_rdp = false for web-only, but no dedicated example block shows that mode. The "With Native RDP" example is identical to the default (both use enable_native_rdp default true), adding no new information. The AWS and GCP examples are byte-for-byte the same. Partial credit for documenting the modes in prose without a distinct web-only example.
Visual preview	5	5	README embeds  linking to a GitHub-hosted video. File verified present at 93.7 KB.

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	admin_password is declared with sensitive = true in main.tf. No README example inlines a literal or placeholder password; the default "coderRDP!" appears only in the Terraform source, not in any README code block.
Non-hardcoded auth path	4	0	No alternative auth mechanism is documented. The native RDP coder:// URL embeds password=${urlencode(var.admin_password)} directly in the app URL. No mention of a secrets manager, external credential store, or any path that avoids passing the raw Windows admin password through Terraform variables into a URL.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	Devolutions Gateway is installed via Install-Module from PSGallery. No module input variable overrides the PSGallery URL or points to an internal artifact mirror. devolutions_gateway_version pins the version but does not change the source. No such variable exists.
Bring-your-own binary	10	0	The powershell-installation-script.tftpl unconditionally calls Install-DevolutionsGateway and Install-Module. No variable, flag, or documented path allows skipping installation when Devolutions Gateway is pre-baked into the image.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (PSGallery, NuGet, localhost:7171, Coder access URL) or provides guidance for air-gapped/restricted environments. Endpoints are only visible in the PowerShell script source.
Runs without sudo	2	0	The script requires administrator privileges for all core operations: Set-LocalUser, HKLM registry writes, Enable-NetFirewallRule, Install-Module (system-wide), Set-Service/Start-Service, and writing to C:\Program Files\Devolutions\. The script itself states "This requires administrator privileges." No non-admin fallback exists.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	Most variables have clear descriptions, sensible defaults, and validation where appropriate (share enum check, agent_name conditional). However, admin_username and admin_password both lack a description field, which is notable for credential inputs.
Test coverage	4	4	windows-rdp.tftest.hcl covers business logic: native RDP disabled (no app, no data source read), agent_name validation failure, and native RDP enabled (app properties, URL encoding, icon, tooltip). main.test.ts covers end-to-end behavior: required agent_id, PowerShell script content assertions, credential injection into the JS patch (default and custom), and special-character round-tripping. Clear separation between plan-level and script-content tests.

Overall — 51 / 100

Raw 34 / 67 → round(34 / 67 × 100) = 51

Track: Utility (remote desktop access; not an AI agent or IDE)

Grade: Adequate

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.