RDP Web module

[bpmct]

A discussion dedicated to the RDP Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	10 / 20	0 / 20	7 / 10	45 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for AWS and Google Cloud, plus a custom version example. Each shows sensible defaults for the major configuration mode (version pinning).
Coder-context framing	8	0	README does not explain what the module adds on top of Coder or how Coder fits in the RDP flow. It names the target tool (Devolutions Gateway) but lacks context about Coder's role.
Visual preview	5	5	README includes a video thumbnail image with a link to a video demonstration.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The admin_password variable is marked sensitive = true in main.tf. However, README examples show inline default values (admin_password = "coderRDP!"), which counts as inline secrets, capping this at half credit.
Non-hardcoded auth path	4	2	The module accepts username/password as variables, but the README does not document any path that avoids pasting credentials into templates (no ServiceAccount, IAM, OAuth, or similar alternatives shown). Partial credit for variable-based approach.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the download URL for Devolutions Gateway. The module installs from PSGallery via Install-Module with no URL override capability. The devolutions_gateway_version variable only controls version selection, not source location.
Bring-your-own binary	5	0	No documented way to skip the Devolutions Gateway installation when it is already present in the image. The installation script always runs Install-Module and Install-DGatewayPackage.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. The PSGallery and NuGet endpoints are inferable from code but not documented.
Runs without sudo	2	0	The PowerShell script performs system-wide installations (Install-Module for all users, service configuration with Set-Service, registry modifications with New-ItemProperty at HKLM) that require administrator privileges. No non-privileged fallback is documented or implemented.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (display_name, slug, icon, admin credentials, version). The share variable includes validation. The devolutions_gateway_version variable has a helpful description explaining 'latest' vs specific versions.
Test coverage	4	1	TypeScript tests in main.test.ts cover basic functionality (script presence, username/password injection). However, no .tftest.hcl files exist for Terraform-level business logic testing. Tests are minimal and don't cover end-to-end behavior like service startup or web app accessibility.

Overall — 45 / 100

Raw 34 / 75 → round(34 / 75 × 100) = 45

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.