RDP Web module

[bpmct]

A discussion dedicated to the RDP Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	10 / 20	0 / 20	8 / 10	52 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for AWS, Google Cloud, and custom Devolutions Gateway version configuration. Each example shows sensible defaults and different configuration modes.
Visual preview	5	5	README includes a video thumbnail image at ./video-thumbnails/video-thumbnail.png (verified to exist, 93.7 KB) with a link to the full video demonstration.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The admin_password variable is marked sensitive = true in main.tf. However, README examples do not show the password variable at all, leaving users to discover the default hardcoded password "coderRDP!" only by reading the source. This is under-documented for credential hygiene, earning half credit.
Non-hardcoded auth path	4	2	The module requires hardcoded credentials (admin_username/admin_password) to configure RDP access. While these can be parameterized via Terraform variables, there is no documented path to avoid pasting credentials into templates (e.g., no integration with Windows credential managers, no OAuth, no external auth). The ability to use Terraform variables instead of inline literals earns half credit.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The module downloads Devolutions Gateway from PSGallery with no variable to override the source URL. The devolutions_gateway_version variable only controls which version is requested from the hardcoded PSGallery source, not where it's downloaded from. No mirror/artifact store override capability exists.
Bring-your-own binary	10	0	No documented or implemented way to skip the Devolutions Gateway installation when it's already present. The installation script always runs Install-Module and Install-DGatewayPackage with no conditional logic or variable to disable this behavior.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The PSGallery dependency is inferable from code but not documented. Endpoints are not listed anywhere in the README.
Runs without sudo	2	0	The PowerShell script performs system-wide module installation (Install-Module for all users), modifies HKLM registry keys, configures Windows services, and writes to C:\Program Files. All of these operations require administrator privileges. No non-privileged path is documented or implemented.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (display_name, slug, icon, share with validation, admin credentials). The share variable includes proper validation. The devolutions_gateway_version variable has a helpful description explaining 'latest' vs specific versions.
Test coverage	4	2	TypeScript tests in main.test.ts cover end-to-end behavior including script generation, credential injection, and special character handling. However, no .tftest.hcl files exist to cover Terraform business logic. Only partial test coverage earns half credit.

Overall — 52 / 100

Raw 35 / 67 → round(35 / 67 × 100) = 52

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.