RDP Web module

[bpmct]

A discussion dedicated to the RDP Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
21 / 25	10 / 20	0 / 20	7 / 10	51 / 100

Drilldown

Presentation & Onboarding — 21 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for AWS, Google Cloud, and custom Devolutions Gateway version configuration. Each example shows sensible defaults and different configuration modes.
Coder-context framing	8	4	README mentions "Enable Remote Desktop + a web based client on Windows workspaces" and names Devolutions Gateway, but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Minimal context framing.
Visual preview	5	5	README includes a video thumbnail image with link to video demonstration.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The admin_password variable is marked sensitive = true in main.tf. However, README examples do not show any credential handling, and the default value "coderRDP!" is hardcoded in the variable definition itself, which is a form of inline secret in the module code. This caps the score at half.
Non-hardcoded auth path	4	2	The module uses basic username/password authentication for RDP. While credentials can be parameterized via variables, there is no documented path to avoid pasting credentials (e.g., no integration with Windows credential managers, no OAuth, no external auth). The approach is fundamentally credential-based. Partial credit for allowing variable-based credentials rather than requiring hardcoded values in templates.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The module installs DevolutionsGateway from PSGallery. There is no module input variable to override the PSGallery source URL or redirect the Install-Module command to an internal repository. The devolutions_gateway_version variable only controls version selection, not the source.
Bring-your-own binary	5	0	No documented way to skip the Install-Module step when Devolutions Gateway is already installed. The installation script always runs Install-Module.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The script contacts PSGallery (powershellgallery.com) and NuGet repositories, but these are not documented in a network/offline/air-gapped section. Endpoints are only inferable from code.
Runs without sudo	2	0	The PowerShell script performs system-wide installation (Install-Module for all users), modifies HKLM registry keys, configures Windows services, and modifies files in C:\Program Files. These operations require administrator privileges on Windows. No documented non-admin path exists.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions (e.g., agent_id, display_name, devolutions_gateway_version). The share variable includes validation. Defaults are sensible (e.g., display_name = "Web RDP", devolutions_gateway_version = "latest").
Test coverage	4	1	TypeScript tests in main.test.ts cover end-to-end behavior (verifying PowerShell script installation commands and credential injection into JS patch). However, no .tftest.hcl file exists for Terraform-level business logic testing. Partial credit for TypeScript coverage only.

Overall — 51 / 100

Raw 38 / 75 → round(38 / 75 × 100) = 51

Note: This is a Utility module (provides RDP access tooling, not an IDE or AI agent). Scored on Universal criteria only (75 pts denominator), then normalized. Final score: 51 / 100.

Correction to Overall calculation: 21 + 10 + 0 + 7 = 38 raw points out of 75 possible. Normalized: round(38/75 × 100) = round(50.67) = 51.

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.