Skip to main content
RustDesk · Docker · Cloudflare Tunnel · Self-Hosted · Remote Desktop

​
Overview

This project builds a self-hosted remote desktop infrastructure using the community image lejianwen/rustdesk-server-s6. The image uses s6-overlay to bundle hbbs (signal server), hbbr (relay server), and a Go-based Web API management console into a single container. A second cloudflared container shares the same network namespace, exposing the Web console through a Cloudflare Zero Trust Tunnel. RustDesk clients connect directly to the host on ports 21115-21117. There is no device-count limit, and the image is MIT-licensed.

​
Core features

  • Single container bundles hbbs + hbbr + Web API (no three-container coordination needed)
  • Web console exposed via Cloudflare Tunnel; no inbound port opened on the host for the console
  • RustDesk clients connect directly on 21115-21117, bypassing the Tunnel for lowest latency
  • User management, device management, address book/groups, login logs, connection logs, OIDC/LDAP login, Web Client, forced login (MUST_LOGIN=Y)
  • No device-count limit, MIT licence

​
Configuration options

​
Architecture

The two containers (rustdesk-s6 and cloudflared) share a network namespace via network_mode: service:rustdesk, so cloudflared reaches localhost:21114 directly without any additional exposed ports.

​
Quick start

1

Clone the repo and configure environment variables

Two values are required in .env: CLOUDFLARE_TUNNEL_TOKEN (obtained when creating a Tunnel in the Cloudflare Zero Trust Dashboard) and RUSTDESK_API_JWT_KEY (any random string you choose).
2

Start services

3

Retrieve the server public key

This key goes into the “Key” field of the RustDesk client configuration. It also appears in the container logs.
4

First login to the Web console

Open https://rustdesk-console.example.com (the hostname you configured in Cloudflare Tunnel). The default username is admin; get the initial password from the container logs:
Change the password immediately after first login.
5

Configure the RustDesk client

The ID and relay server fields take only the hostname, without http:// or a port number.

​
Notes

The PROXY_ENABLE and TRUST_PROXY parameters in docker-compose.yml and .env directly affect brute-force blocking and real attacker IP identification. Do not change these without understanding the security implications (see the architecture and maintenance guide in docs/). Keep .env out of version control: it contains the Tunnel token and JWT key. data/server/id_ed25519 is the private key and must never leave the server; id_ed25519.pub is the public key distributed to clients.

​
In practice

Lab members use this to access lab workstations remotely without relying on a commercial remote desktop service. Connection records stay on the self-managed server. The administrator manages user accounts and devices through the Web console, and MUST_LOGIN=Y ensures that unauthenticated clients cannot establish sessions.