# FsRdpServer on Linux

The Linux server is published as a self-contained executable, so the target
machine does not need a system-wide .NET runtime. Raspberry Pi deployments use
64-bit Raspberry Pi OS or Debian and the `linux-arm64` runtime identifier.

## Build

From Windows PowerShell:

```powershell
.\publish-linux.ps1 -RuntimeIdentifier linux-arm64
```

The complete installation bundle is written below `artifacts`.

## Install

Copy the bundle to the Linux machine and run:

```sh
chmod +x FsRdpServer install.sh
sudo ./install.sh
```

The installer creates:

- `/opt/fsrdp-server/FsRdpServer`
- `/opt/fsrdp-server/data`
- `/etc/fsrdp-server/fsrdp-server.env`
- `/etc/systemd/system/fsrdp-server.service`

The binary and unit file are root-owned. Only the dedicated `fsrdp-server`
service account can write persistent data.

## License and certificate

Create and persist the installation ID before issuing a license:

```sh
sudo -u fsrdp-server env FSRDP_DATA_DIR=/opt/fsrdp-server/data \
  /opt/fsrdp-server/FsRdpServer --installation-id
```

Issue a license for this exact ID and the DNS name used by clients. Install the
license and the matching PKCS#12 certificate:

```sh
sudo install -o fsrdp-server -g fsrdp-server -m 0640 \
  license.fsrdp /opt/fsrdp-server/data/license.fsrdp
sudo install -o fsrdp-server -g fsrdp-server -m 0640 \
  cert.pfx /opt/fsrdp-server/data/cert.pfx
```

If the license issuer also provides a `supporter-keys....md` file, keep that
file with the company administrator. It contains the actual client bearer
keys and must never be installed on the server. Only `license.fsrdp`, which
contains signed key hashes, belongs in the server data directory.

Set the PFX password in `/etc/fsrdp-server/fsrdp-server.env` and restrict the
file to root:

```sh
sudo chmod 0600 /etc/fsrdp-server/fsrdp-server.env
```

Validate everything before starting the listener:

```sh
sudo -u fsrdp-server env \
  FSRDP_DATA_DIR=/opt/fsrdp-server/data \
  FSRDP_CERT_PASSWORD='the-password' \
  /opt/fsrdp-server/FsRdpServer --validate-installation
```

## Operate

```sh
sudo systemctl start fsrdp-server
sudo systemctl status fsrdp-server --no-pager
sudo journalctl -u fsrdp-server -n 100 --no-pager
sudo ss -ltnp | grep -E ':(8888|8889)\b'
```

Both TCP ports, 8888 and 8889 by default, must be permitted by the host firewall
and forwarded by the edge router when clients connect over the Internet.

Updating the binary with `install.sh` preserves the certificate, license,
installation ID, room reservations, configuration, and logs.
