;
};
`RustDesk` · `Docker` · `Cloudflare Tunnel` · `Self-Hosted` · `Remote Desktop`
## Overview
This project builds a self-hosted remote desktop infrastructure using the community image `lejianwen/rustdesk-server-s6`. The image uses s6-overlay to bundle hbbs (signal server), hbbr (relay server), and a Go-based Web API management console into a single container. A second cloudflared container shares the same network namespace, exposing the Web console through a Cloudflare Zero Trust Tunnel. RustDesk clients connect directly to the host on ports 21115-21117. There is no device-count limit, and the image is MIT-licensed.
## Core features
* Single container bundles hbbs + hbbr + Web API (no three-container coordination needed)
* Web console exposed via Cloudflare Tunnel; no inbound port opened on the host for the console
* RustDesk clients connect directly on 21115-21117, bypassing the Tunnel for lowest latency
* User management, device management, address book/groups, login logs, connection logs, OIDC/LDAP login, Web Client, forced login (`MUST_LOGIN=Y`)
* No device-count limit, MIT licence
## Configuration options
## Architecture
The two containers (rustdesk-s6 and cloudflared) share a network namespace via `network_mode: service:rustdesk`, so cloudflared reaches `localhost:21114` directly without any additional exposed ports.
## Quick start
```bash theme={null}
git clone https://github.com/felimet/self-host-rustdesk-server
cd self-host-rustdesk-server
cp .env.example .env
```
Two values are required in `.env`: `CLOUDFLARE_TUNNEL_TOKEN` (obtained when creating a Tunnel in the Cloudflare Zero Trust Dashboard) and `RUSTDESK_API_JWT_KEY` (any random string you choose).
```bash theme={null}
docker compose up -d
```
```bash theme={null}
cat ./data/server/id_ed25519.pub
```
This key goes into the "Key" field of the RustDesk client configuration. It also appears in the container logs.
Open `https://rustdesk-console.example.com` (the hostname you configured in Cloudflare Tunnel). The default username is `admin`; get the initial password from the container logs:
```bash theme={null}
docker logs rustdesk
```
Change the password immediately after first login.
| Field | Value |
| ------------ | ------------------------------------------------------- |
| ID server | `rustdesk-server.example.com` (direct hostname) |
| Relay server | Same as above, or leave blank |
| API server | `https://rustdesk-console.example.com` (full HTTPS URL) |
| Key | Public key from step 3 |
The ID and relay server fields take only the hostname, without `http://` or a port number.
## Notes
The `PROXY_ENABLE` and `TRUST_PROXY` parameters in `docker-compose.yml` and `.env` directly affect brute-force blocking and real attacker IP identification. Do not change these without understanding the security implications (see the architecture and maintenance guide in `docs/`). Keep `.env` out of version control: it contains the Tunnel token and JWT key. `data/server/id_ed25519` is the private key and must never leave the server; `id_ed25519.pub` is the public key distributed to clients.
## In practice
Lab members use this to access lab workstations remotely without relying on a commercial remote desktop service. Connection records stay on the self-managed server. The administrator manages user accounts and devices through the Web console, and `MUST_LOGIN=Y` ensures that unauthenticated clients cannot establish sessions.
## Links
* GitHub: [felimet/self-host-rustdesk-server](https://github.com/felimet/self-host-rustdesk-server)
* lejianwen/rustdesk-server (community server fork): [github.com/lejianwen/rustdesk-server](https://github.com/lejianwen/rustdesk-server)
* lejianwen/rustdesk-api (Web API backend): [github.com/lejianwen/rustdesk-api](https://github.com/lejianwen/rustdesk-api)
* RustDesk official OSS server: [github.com/rustdesk/rustdesk-server](https://github.com/rustdesk/rustdesk-server)