OmegaDesk — Sovereign Self-Hosted Remote Desktop in Pure Rust

Zero-Copy Hardware H.264/AV1 · QUIC TLS 1.3 + Built-in WireGuard/Disco Mesh · Zero-Trust HuJSON Policy & TOTP MFA · QuickSupport & Fleet RMM

🇬🇧 English: OmegaDesk is a sovereign, self-hosted remote desktop, zero-trust mesh access, and fleet RMM platform written from scratch in 100% safe, modular Rust (17 workspace crates). Designed as a full-stack open-source replacement for TeamViewer, AnyDesk, BeyondTrust, and ScreenConnect, OmegaDesk unifies five proven architectural pillars in a single cohesive codebase:

1. Sunshine-Grade Zero-Copy GPU Video Pipeline: Captures frames via DXGI Desktop Duplication (WGC -> GDI fallback) and encodes H.264 directly from GPU resident textures (ID3D11VideoProcessor + MFCreateDXGISurfaceBuffer across Intel Quick Sync, NVIDIA NVENC, and AMD AMF), achieving 60 FPS at 24.5 ms end-to-end latency (11 ms hardware encode).
2. Tailscale-Style Magicsock & DERP Relay Mesh: Nodes enroll with omegadesk-server, resolve peers by human-readable *.omega names (office-pc.omega), punch through NATs via STUN + disco, fall back to omegadesk-relay in 1.5 s, and bind QUIC TLS 1.3 directly to Ed25519/X25519 device identities.
3. Headscale/Tailscale HuJSON Zero-Trust Policy & PAM Gate: Enforces identity-filtered netmaps, per-session TOTP MFA ("action": "check"), .odrec session recording, dynamic video watermarks, clipboard byte quotas, OS posture checks, and JSON Lines security audit logs.
4. TeamViewer-Style 9-Digit QuickSupport & Windows LocalSystem Service: Single-executable omegadesk-quicksupport (123 456 789 + ephemeral password + console consent prompt), plus omegadesk-service for unattended access across Windows Session 0, login screens, UAC prompts, and privacy blanking (WDA_EXCLUDEFROMCAPTURE + IddCx virtual displays).
5. MeshCentral/TacticalRMM-Style Fleet Management & WebCodecs Browser Gateway: Built-in WebCodecs H.264 browser access (--web-listen) and CLI fleet RMM (omegadesk-server admin) with 15-minute hardware/OS/process inventory, automated threshold alerts, and remote PowerShell/sh script scheduling.

🇧🇷 Português (pt-BR): O OmegaDesk é uma plataforma soberana e auto-hospedada (self-hosted) de acesso remoto de baixa latência, rede mesh Zero-Trust e gerenciamento de frota (RMM) escrita do zero em Rust puro (17 crates). Projetado como alternativa aberta e auditável ao TeamViewer e AnyDesk, o OmegaDesk combina captura de tela via hardware (DXGI + codificação GPU zero-copy NVENC/QuickSync/AMF a 60 FPS e 24,5 ms de latência ponta a ponta), transporte QUIC (TLS 1.3) sobre malha STUN/Disco + Relay DERP (*.omega), políticas Zero-Trust em HuJSON com MFA TOTP por sessão e gravação .odrec, executável único QuickSupport de 9 dígitos, serviço Windows LocalSystem (tela de login/UAC e monitor virtual IddCx), cliente nativo + navegador (WebCodecs) e RMM integrado.

What works today:

• Screen capture with DXGI Desktop Duplication on Windows, including hardware cursor compositing and rotated monitor support (90°, 180°, 270°).
• Hardware H.264 encoding through Media Foundation (Intel Quick Sync, NVIDIA NVENC, AMD AMF) with a zero-copy D3D11 GPU texture pipeline (ID3D11VideoProcessor + MFCreateDXGISurfaceBuffer), plus automatic fallback to OpenH264 in software.
• QUIC transport (TLS 1.3) with certificate pinning and a mandatory access password.
• Remote keyboard and mouse using physical scancodes, so any keyboard layout works (ABNT2 included). Multi-monitor aware.
• Native client that shows a live latency breakdown in the title bar.
• Mesh mode: a self-hosted coordinator (omegadesk-server) hands out addresses and names (office-pc.omega), nodes find each other with STUN and disco hole punching, fall back to a DERP-style relay (omegadesk-relay) in 1.5 s and upgrade to a direct path as soon as one validates. TLS is bound to the device identity the coordinator distributes, so there is no fingerprint to copy.
• QuickSupport: the person who needs help runs one executable, reads a nine-digit ID and a temporary password to the technician and accepts a consent prompt; the technician connects with omegadesk-client 123 456 789. The ID lives in the coordinator only while the program runs, and ten wrong passwords rotate the password.
• Clipboard text synchronized in both directions (SHA-256 echo suppression; --no-clipboard to disable).
• File transfer in both directions on dedicated QUIC streams: --send-file, drag a file onto the client window, --receive-dir on either side. Transfers resume from a partial file and are SHA-256 verified before the file gets its final name; nothing is ever overwritten.
• Multi-monitor: the agent lists its monitors; in the client press Ctrl+Alt+Shift + 1..9, N (next) or P (previous) to switch the streamed display.
• Adaptive video quality: the client acknowledges every frame and the agent lowers the bitrate first, then the frame rate, when the path congests (RustDesk video_qos model); --bitrate-mbps and --fps are the ceilings.
• RMM (command line): every mesh agent reports its inventory (OS, CPU, memory, drives, NICs, logged-on user, running processes and services, pending Windows reboot) at enrollment, every 15 minutes and on change; the coordinator evaluates checks (CPU, memory, disk, process, service, script exit code, offline), opens and resolves alerts, runs saved or ad-hoc PowerShell/sh/cmd scripts with a timeout (queued while a device is offline), keeps schedules, issues deployment links and persists it all to a JSON state file. omegadesk-server admin devices|alerts|run|... is the operator interface.

First measurement (Intel Core Ultra 5 135U, 1920×1080, agent and client on the same machine): 60 fps and 24.5 ms end-to-end latency. Host processing takes 15 ms (11 ms of it encoding), plus 0.2 ms network, 6 ms decode and 3 ms draw.

You need Rust 1.90 or newer. On Windows you also need the Visual Studio C++ Build Tools.

On the machine you want to access (Windows for now):

cargo run --release -p omegadesk-agent -- --listen 0.0.0.0:7070

The agent prints a certificate fingerprint and a one-time access password. On the machine you connect from:

cargo run --release -p omegadesk-client -- 192.168.0.10:7070 --fingerprint <fingerprint> --password <password>

Useful flags:

Keyboard shortcuts in the client window: Ctrl+Alt+End or Ctrl+Alt+Delete sends the Secure Attention Sequence to the remote machine; Ctrl+Alt+Shift + 1..9 streams the n-th remote monitor, Ctrl+Alt+Shift+N / P the next or previous one (the title bar shows display 2/3). Letters rather than arrows, because GPU vendor hotkeys (Ctrl+Alt+Arrow on Intel) intercept the arrow combinations before any window sees them.

Run a relay (any machine with a public address; it answers STUN on the same UDP port) and a coordinator. Both need the same 32-byte ticket secret:

cargo run --release -p omegadesk-relay -- --listen 0.0.0.0:8443 --ticket-secret-hex <64 hex>
# prints the relay public key
cargo run --release -p omegadesk-server -- --listen 0.0.0.0:8080 --ticket-secret-hex <64 hex> \
    --relay "relay.example:8443=<relay key>;stun=relay.example:8443"
# prints server_key (128 hex) and bootstrap_preauth_key (odk_...)

Then enroll the agent and connect from the client by name:

cargo run --release -p omegadesk-agent -- --name office-pc --server coord.example:8080 --server-key <128 hex> --preauth-key odk_...
cargo run --release -p omegadesk-client -- office-pc.omega --server coord.example:8080 --server-key <128 hex> --preauth-key odk_... --password <password>

The coordinator can also serve a browser client and proxy it to an agent over the mesh. Build the page once (Node 22 or newer), then start the server with --web-listen:

cd web && npm ci && npm run build && cd ..
cargo run --release -p omegadesk-server -- --listen 0.0.0.0:8080 --ticket-secret-hex <64 hex> \
    --relay "relay.example:8443=<relay key>;stun=relay.example:8443" \
    --web-listen 127.0.0.1:18123

Open http://localhost:18123, type the agent name (office-pc) and its access password. The gateway joins the mesh as web-gateway.omega, sends the agent the same Hello the native client would, and streams H.264 to a WebCodecs decoder in the page; keyboard and mouse go back the same way. WebCodecs requires a secure context, so for anything other than localhost put the gateway behind a TLS-terminating reverse proxy (Caddy, nginx) and pass --web-behind-tls --web-allowed-host desk.example. The browser part is WebSocket-only for now.

On Windows the agent can install itself as a LocalSystem service so remote access keeps working at the login screen, across the UAC secure desktop, the lock screen and session switches, with no one logged in. From an elevated (Administrator) prompt:

# Register the auto-start service (points at this executable).
omegadesk-agent service install
omegadesk-agent service start
# ... later ...
omegadesk-agent service stop
omegadesk-agent service uninstall

The service (SYSTEM) launches a capture/input worker in the active console session using that session's winlogon.exe token, follows the input desktop so it can capture and inject on the secure desktop, and offers a privacy mode that blanks the local screen (a fullscreen WDA_EXCLUDEFROMCAPTURE overlay) while the remote operator keeps working. service run is the Service Control Manager entry point and is invoked by Windows, not manually. On Linux and macOS these subcommands report that the service is Windows-only.

The coordinator also prints a quicksupport_preauth_key: a reusable, ephemeral key for the support tenant. The person who needs help runs (the three values can also come from OMEGADESK_SERVER, OMEGADESK_SERVER_KEY and OMEGADESK_PREAUTH_KEY, so they can be baked into a wrapper or installer):

cargo run --release -p omegadesk-quicksupport -- --server coord.example:8080 --server-key <128 hex> --preauth-key odk_<quicksupport key>

It prints Your ID: 123 456 789 and Password: abc123. The technician connects with the ID (digits with or without spaces) and the password; the end user is asked on the console to allow the session (y, n, or a to allow that technician for five minutes without asking again):

cargo run --release -p omegadesk-client -- 123 456 789 --server coord.example:8080 --server-key <128 hex> --preauth-key odk_... --password abc123

Closing QuickSupport ends the session and frees the ID. --view-only lets the technician watch without controlling the mouse and keyboard.

Without a policy every machine of a tenant sees every other one and the access password is the only check. With omegadesk-server --policy policy.hujson each node receives only the peers it may reach (Headscale's model: a peer you may not reach is not in your netmap, so there is no identity to connect to), and every visible peer carries the decision for a remote session towards you, which the agent enforces. The file uses the Tailscale/Headscale policy/v2 format (groups, tagOwners, hosts, acls, ssh) plus a sessions block, and is re-read when it changes on disk:

{
  "groups": { "group:helpdesk": ["alice@example.com"] },
  "tagOwners": { "tag:servers": ["group:helpdesk"] },
  "sessions": [
    {
      "action": "check",            // "accept", or "check" = TOTP step-up on every connection
      "src": ["group:helpdesk", "tag:helpdesk"],
      "dst": ["tag:servers"],
      "record": true,               // the agent writes an .odrec recording
      "clipboard": { "copy": 65536, "paste": 0 },   // bytes per transfer; 0 blocks; omit = unlimited
      "watermark": true,            // "user | client IP | session | time" composed into the video
      "posture": { "minOs": { "windows": "10.0.19045" }, "networks": ["100.64.0.0/10"] }
    }
  ]
}

Machines get their tags from the pre-auth key they enroll with and their owner from --bootstrap-user (or create_preauth_key_for_user). An agent whose sessions require MFA needs --totp-secret (--generate-totp-secret prints one with its otpauth:// URI for the authenticator app; codes are HMAC-SHA256, 6 digits, 30 s); the client passes --totp <code> or types it when asked. Sessions marked record need --recordings-dir; the agent refuses them otherwise. --audit-log on both binaries appends one JSON object per event (enrollments, denials, MFA, DLP, recordings).

The coordinator also prints an admin_token and listens on 127.0.0.1:8081 for the local admin API (--admin-listen, --admin-token, --state-file to persist the RMM state). Every mesh agent reports its inventory automatically; the operator works from the same host as the coordinator:

export OMEGADESK_ADMIN_TOKEN=<admin_token>
omegadesk-server admin devices                       # status, CPU/memory/disk, open alerts
omegadesk-server admin device show office-pc         # full inventory, alerts, recent script results
omegadesk-server admin checks add --id disk-c --kind disk --target 'C:' --max-percent 85 --tenant default --severity critical
omegadesk-server admin scripts add --name "Clean temp" --shell powershell --file clean.ps1
omegadesk-server admin run office-pc --script clean-temp
omegadesk-server admin schedules add --name "Nightly" --tenant default --script clean-temp --interval daily --site hq
omegadesk-server admin results --device office-pc
omegadesk-server admin links create --tenant default --site hq --expires-in 86400
# prints an odl_... token; install the agent with it instead of a pre-auth key:
omegadesk-agent --server coord.example:8080 --server-key <128 hex> --deployment-token odl_...

  omegadesk-agent                                       omegadesk-client
 ┌──────────────────────────────┐    QUIC (TLS 1.3)   ┌───────────────────────────┐
 │ capture → codec → transport  ├─── video stream ───►│ transport → decode → draw │
 │ (DXGI)   (MF / OpenH264)     │                     │             (OpenH264)    │
 │ input ◄──────── control stream: ping, keys, mouse, keyframe requests ──────────┤
 │ (SendInput)                  │                     │ keyboard and mouse (winit)│
 └──────────────────────────────┘                     └───────────────────────────┘

The full design, from the WireGuard mesh to the web client, is in docs/plan.md. docs/language.md explains why we chose Rust.

Contributions are welcome. Every change goes through a pull request and is reviewed by the maintainer. Read CONTRIBUTING.md before you start. It covers the workflow, the commit sign-off (DCO) and the code standards. Please follow our Code of Conduct. See also COMMUNITY.md and PROJECTS.md.

Please do not open public issues for security problems. Report them privately as described in SECURITY.md.

OmegaDesk is licensed under the GNU Affero General Public License v3.0. The license allows code under AGPL-3.0, GPL-3.0, GPL-2.0-or-later, Apache-2.0, MPL-2.0, MIT and similar licenses to be incorporated. Code under GPL-2.0-only or proprietary licenses must not be copied into this repository. deny.toml enforces the dependency policy in CI.