rustguac

A lightweight Rust replacement for the Apache Guacamole Java webapp. Provides browser-based SSH, RDP, VNC, and web browsing sessions through guacd (the Guacamole protocol daemon).

rustguac sits between web browsers and guacd, proxying the Guacamole protocol over WebSockets. It manages session lifecycle, authentication (API keys and OIDC SSO), session recording, and a Vault-backed address book.

Features

SSH sessions — browser-based SSH terminal via guacd, with password, private key, or ephemeral keypair auth
RDP sessions — connect to Windows/RDP hosts with auto-fit display resize, Kerberos NLA, and RemoteApp/RAIL support
VNC sessions — connect to any VNC server (KVM/IPMI consoles, remote desktops, VM displays)
Web browser sessions — headless Chromium on Xvnc, streamed to the browser via VNC, with native autofill and per-entry domain allowlisting
Multi-hop SSH tunnels — chain SSH jump hosts/bastions to reach isolated targets for any session type
OIDC single sign-on — authenticate users via any OpenID Connect provider (Authentik, Google, Okta, etc.)
Role-based access — admin, poweruser, operator, and viewer roles for both API key and OIDC users
Vault-backed address book — connection credentials stored in HashiCorp Vault / OpenBao, never reach the browser
Per-entry clipboard control — disable copy and/or paste per address book entry for data loss prevention
Kerberos NLA — RDP Kerberos authentication via FreeRDP 3.x (no NTLM required)
Session recording — all sessions recorded in Guacamole format with playback UI
Session sharing — share tokens for read-only or collaborative access
Encrypted file transfer — LUKS-encrypted per-session drive storage for RDP, SFTP for SSH
Themeable UI — 8 built-in themes with CSS gradient backgrounds, or configure your own
TLS everywhere — HTTPS for clients, TLS between rustguac and guacd
API key auth — SHA-256 hashed keys with IP allowlists and expiry
SQLite storage — no external database server needed
Single binary — just rustguac + guacd, no Java stack

Architecture

Browser (HTML/JS)
    |
    | WebSocket over HTTPS
    v
rustguac (Rust, axum)
    |
    | TLS (Guacamole protocol)
    v
guacd (C, from guacamole-server)
    |
    +---> SSH server (for SSH sessions)
    +---> RDP server (for RDP sessions)
    +---> VNC server (for VNC sessions)
    +---> Xvnc display (for web browser sessions)
              |
              +---> Chromium (kiosk mode)

Quick start

Debian 13 (.deb) — download from Releases:

sudo apt install ./rustguac_*.deb

Docker:

docker pull sol1/rustguac:latest
docker run -d -p 8089:8089 sol1/rustguac:latest

RPM (Rocky/RHEL 9):

sudo dnf install ./rustguac-*.rpm

After install, create an admin API key to get started:

/opt/rustguac/bin/rustguac --config /opt/rustguac/config.toml add-admin --name admin

API keys are intended for machine access and initial setup. Once you configure OIDC authentication, you can delete the API key — no credentials are stored in the database.

See the Installation guide for full details including bare-metal install, Docker Compose, TLS setup, and development builds.

Documentation

Installation — packages, Docker, bare-metal, development
Configuration — TOML config reference, TLS, allowlists
Security — TLS, rate limiting, headers, credential handling
Roles & Access Control — OIDC, roles, group mappings
Integrations — Vault address book, LUKS drives, HAProxy
API Reference — REST API endpoints, session creation, admin management

Commercial support

Commercial support for rustguac is available from Sol1.

License

Apache License 2.0 — see LICENSE for details.

Rustguac

Install / Use

README