RDP Web module

[bpmct]

A discussion dedicated to the RDP Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	10 / 20	0 / 20	7 / 10	45 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for AWS, Google Cloud, and custom Devolutions Gateway version configuration. Each example shows sensible defaults and the major configuration option (version override).
Coder-context framing	8	0	README does not explain what the module adds on top of Coder or how Coder fits in the RDP flow. It states what it does ("Enable Remote Desktop + a web based client") but lacks context about Coder's role in the architecture.
Visual preview	5	5	README includes an embedded video thumbnail image with a link to the video demonstration.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The admin_password variable is marked sensitive = true in main.tf. However, README examples do not show any password configuration, and the default value "coderRDP!" is visible in the code. No README guidance on avoiding inline secrets, earning half credit.
Non-hardcoded auth path	4	2	The module uses basic username/password authentication with defaults. While these can be overridden via variables, there is no documented path to avoid pasting credentials (e.g., using Windows credential managers, external auth, or other mechanisms). Partial credit for variable-based override capability.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The module installs DevolutionsGateway from PSGallery. There is no module input variable to override the PSGallery source URL or redirect to an internal mirror. The devolutions_gateway_version variable only controls version selection, not the artifact source.
Bring-your-own binary	5	0	No documented or implemented way to skip the Devolutions Gateway installation when it is already present in the image. The installation script always runs Install-Module and Install-DGatewayPackage.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The module contacts PSGallery (powershellgallery.com) and potentially NuGet sources, but these are not documented in a network/offline/air-gapped section.
Runs without sudo	2	0	The PowerShell script performs system-wide module installation (Install-Module for all users), modifies HKLM registry keys, configures Windows services, and modifies system files in "C:\Program Files". These operations require administrator privileges. No non-privileged fallback is documented or implemented.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions (e.g., agent_id, devolutions_gateway_version, admin_username). The share variable includes validation. Sensible defaults are provided for display_name, slug, icon, and admin credentials.
Test coverage	4	1	TypeScript tests in main.test.ts verify that the PowerShell script installs Devolutions Gateway and that username/password are injected into the JS patch file. However, no .tftest.hcl file exists for Terraform-level business logic testing. Partial credit for end-to-end TypeScript coverage only.

Overall — 45 / 100

Raw 34 / 75 → round(34 / 75 × 100) = 45

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.