RDP Web module

[bpmct]

A discussion dedicated to the RDP Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
11 / 17	16 / 20	0 / 20	7 / 10	51 / 100

Drilldown

Track: Utility (remote desktop access tool — not an AI coding agent or code editor/IDE; scored on Universal criteria only, normalized per rubric note round(raw/75*100))

Presentation & Onboarding — 11 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows "With AWS" and "With Google Cloud" examples that are byte-for-byte identical (no real provider-specific config shown), and only prose (not a code example) covers the enable_native_rdp = false web-only mode. The native-RDP mode and custom-gateway-version mode do get dedicated code blocks. Partial/redundant coverage caps this at half.
Visual preview	5	5	README embeds a video thumbnail image (./video-thumbnails/video-thumbnail.png, verified present) linking to a demo video of the module in action.

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	admin_password is sensitive = true. No README example sets admin_password inline with a literal value — all examples rely on the (non-exposed) default, so no inline secret appears in documentation.
Non-hardcoded auth path	4	0	No alternative to raw username/password credentials (e.g. IAM, OAuth, SSO) is documented; the module only offers admin_username/admin_password variables.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	Devolutions Gateway is installed via Install-Module from PSGallery/NuGet inside powershell-installation-script.tftpl. No variable overrides the PSGallery/NuGet source URL — only devolutions_gateway_version (a version pin, not a URL override) exists.
Bring-your-own binary	10	0	No variable or documented flag to skip Install-DevolutionsGateway when the gateway is already baked into the image; the script unconditionally installs it.
Egress transparency	3	0	No dedicated README section lists contacted endpoints (PSGallery, NuGet, Devolutions distribution); nothing is documented about restricted/air-gapped operation at all.
Runs without sudo	2	0	The PowerShell script mutates HKLM registry keys, manages local Windows accounts, and installs the Devolutions module system-wide — these require Administrator privileges for core functionality, with no documented non-elevated fallback.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	Most variables have descriptions and sensible defaults, and share/agent_name have validation blocks. However admin_username and admin_password — arguably the most important inputs — lack description fields entirely.
Test coverage	4	4	windows-rdp.tftest.hcl covers business logic (native RDP enable/disable, agent_name validation, URL construction with URL-encoding). main.test.ts covers end-to-end script generation, credential injection, and special-character escaping. Solid dual coverage.

Overall — 51 / 100

Raw 34 / 67 → round(34 / 67 × 100) = 51

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.