# UniAccess Technical Architecture & LLM Comprehensive Reference
URL: https://uniaccess.net
Platform: UniAccess Remote Technologies
Architecture: Multi-Tenant RustDesk Relay & Management Server

## 1. System Overview
UniAccess is a self-hosted and cloud-enabled enterprise remote desktop management system built around the RustDesk engine (hbbs rendezvous server, hbbr relay server, and a high-performance Python FastAPI administration API). It provides complete multi-tenancy for Managed Service Providers (MSPs), IT departments, and SaaS operators.

## 2. Multi-Tenancy Hierarchy
1. **SaaS Super Administrator (Tier 1)**:
   - Global server settings, cluster node orchestration, billing quotas, payment gateways, fail2ban monitoring, and cryptographic master key generation.
2. **MSP / Reseller Admin (Tier 2)**:
   - Manages multiple child company tenants, custom domain branding, client license seats, and sub-tenant device limits.
3. **Company Admin (Tier 3)**:
   - Manages organizational users, assigned address books, permission policies (file transfer, clipboard, privacy mode), and departmental tags.
4. **End User / Technician**:
   - Accesses designated remote devices, initiates remote control sessions, and uses interactive tools (multi-monitor, remote audio, whiteboard, drag-and-drop file transfer).

## 3. Cryptographic & Security Model
- **Ed25519 Public Key Architecture**: Each Tenant possesses an independent Ed25519 public/private key pair. Remote devices reject connections unless the remote client signs connection payloads with the matching public key.
- **Zero-Knowledge Unattended Passwords**: Client permanent passwords for 24/7 unattended access are stored strictly on the local client using salted cryptographic hashes (`RustDesk.toml`). Passwords are never sent to or stored in the central server database.
- **Fail2Ban Brute-Force Shield**: Monitors authentication endpoints and drops malicious IP addresses across all cluster edge nodes.

## 4. Network Protocols & Firewall Ports
| Port | Protocol | Purpose |
| :--- | :--- | :--- |
| 21115 | TCP | NAT detection, speed test, client update gateway |
| 21116 | TCP & UDP | ID/Rendezvous server, STUN negotiation, UDP Hole Punching |
| 21117 | TCP | Encrypted Relay Tunneling (fallback when direct UDP blocked) |
| 21118 | TCP | Rendezvous WebSocket (WSS on Port 443 via Nginx) |
| 21119 | TCP | Relay WebSocket (WSS on Port 443 via Nginx) |
| 443 | TCP | Secure HTTPS Web Console & WebSocket Gateway |

## 5. Automated Setup & Deployment
UniAccess includes digitally signed polyglot launchers (`UniAccess-RustDesk-Setup.cmd` / `.ps1`) featuring:
- **STA Runspace Multi-Threading**: Asynchronous background installation engine ensuring instantaneous UI responsiveness (`Copy Log`, `🛑 Emergency Stop`, `Exit`).
- **Silent Service Provisioning**: Automatically deploys the official RustDesk v1.4.9+ binaries, configures Windows Service Control Manager recovery actions (`Restart the Service` for 1st, 2nd, and subsequent failures), and sets automatic startup.
- **Multi-Profile TOML Configuration**: Injects server network coordinates (`RustDesk2.toml`) and user session credentials (`RustDesk_local.toml`) across all existing and future Windows user profiles.
- **Defender Firewall Rules**: Automatically provisions TCP and UDP inbound/outbound rules.

## 6. CLI Command Reference (Windows)
- Automated One-Click Installer:
  `curl.exe -L -o "%TEMP%\UniAccess-RustDesk-Setup.cmd" "https://uniaccess.net/api/scripts/UniAccess-RustDesk-Setup.cmd" && "%TEMP%\UniAccess-RustDesk-Setup.cmd"`
- Silent Service Installation:
  `"C:\Program Files\RustDesk\rustdesk.exe" --install-service`
- Set Unattended Password:
  `"C:\Program Files\RustDesk\rustdesk.exe" --password <YourStrongPassword>`
- Apply Server Config:
  `"C:\Program Files\RustDesk\rustdesk.exe" --config "host=uniaccess.net,key=<SERVER_PUB_KEY>,api=https://uniaccess.net"`