Harden and rewrite for release

examples/client.toml

@@ -0,0 +1,25 @@
+# Copy to ~/.config/rex/client.toml on the device.
+# This file contains the connect key and must be readable only by the client
+# service account (chmod 600 ~/.config/rex/client.toml).
+
+device_name = "desk"
+api_key = "REPLACE_WITH_THE_DESK_CONNECT_KEY"
+
+# WSS through an Nginx reverse proxy. No port means the normal HTTPS/WSS port.
+endpoint = "rex.example.net"
+scheme = "wss"
+
+# For a direct server listener instead, use for example:
+# endpoint = "192.0.2.10"
+# scheme = "ws"     # only on a trusted network
+# port = 8010
+
+# Only names are sent to the server. argv remains local and is executed without
+# a shell, so each action must name an executable followed by its arguments.
+[[actions]]
+name = "lock"
+argv = ["/usr/local/bin/lock-screen"]
+
+[[actions]]
+name = "wake-display"
+argv = ["/usr/bin/dpms", "force", "on"]

examples/nginx-rex.conf

@@ -0,0 +1,20 @@
+# /etc/nginx/sites-available/rex.conf
+# Public API and WebSocket only. The management listener remains loopback-only.
+server {
+    listen 443 ssl http2;
+    server_name rex.example.net;
+
+    ssl_certificate     /etc/letsencrypt/live/rex.example.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/rex.example.net/privkey.pem;
+
+    location / {
+        proxy_pass http://127.0.0.1:8010;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}

examples/server.toml

@@ -0,0 +1,42 @@
+# Copy to ~/.config/rex/server.toml on the server, then replace every secret.
+# Rex writes this file with mode 0600 when it creates or updates it.
+
+# Public API listener. Keep 127.0.0.1 when Nginx terminates TLS on this host.
+public_host = "127.0.0.1"
+public_port = 8010
+
+# Internal status API. Do not expose this through a reverse proxy.
+management_host = "127.0.0.1"
+management_port = 8011
+
+# Uncomment both lines only if Rex, rather than a reverse proxy, terminates TLS.
+# tls_certfile = "/etc/letsencrypt/live/rex.example.net/fullchain.pem"
+# tls_keyfile = "/etc/letsencrypt/live/rex.example.net/privkey.pem"
+
+# Per direct peer address, over a rolling 60-second window.
+rate_limit_per_minute = 120
+
+# Individual IP addresses and CIDR networks are accepted.
+blacklist = ["203.0.113.24", "198.51.100.0/24"]
+
+# Only listed names may connect a device WebSocket.
+devices = ["desk"]
+
+# Use a distinct secret for each role. Generate production keys with:
+#   rex server keys create <name> --permission <connect|execute|admin>
+[[keys]]
+name = "desk-client"
+secret = "REPLACE_WITH_A_CONNECT_KEY"
+permissions = ["connect"]
+
+[[keys]]
+name = "automation"
+secret = "REPLACE_WITH_AN_EXECUTE_KEY"
+permissions = ["execute"]
+
+# Optional: this key can access the loopback-only management status API and
+# also has connect and execute rights. Do not use it in a client or automation.
+[[keys]]
+name = "local-admin"
+secret = "REPLACE_WITH_AN_ADMIN_KEY"
+permissions = ["admin"]