Repository navigation
Home
A complete self-hosted replacement for the open-source RustDesk server — ID server, relay and console in one image, with a native in-browser client.
Since 1.5 the image ships hbbs and hbbr alongside the console, so one container is the whole deployment. It speaks the same HTTP API stock RustDesk clients already use — point clients at it as their API Server, with no patched client. Prefer to run your own servers? Set CORTENDESK_EMBEDDED_SERVER=false and CortenDesk is the console alone.
New here? What CortenDesk is covers what it does, what it needs, and what it deliberately leaves to the RustDesk server.
Work down this list in order. Since 1.5 the ID server and the relay ship inside the CortenDesk image, so a separate RustDesk server is no longer a prerequisite. Already running one? Upgrading to 1.5 moves it in.
-
RustDesk server in Docker — only if you run
hbbs/hbbryourself: every port, the key, and the three things that usually go wrong - Install with Docker — the published image, Compose with MySQL, first boot, sizing for larger fleets
- Upgrading to 1.5 — the release that folded the ID server and relay into the CortenDesk image, and how to move an existing install
- Install on a VM — nginx, php-fpm and MySQL, without Docker
- Reverse proxy and TLS — Caddy, Traefik and nginx, the WebSocket paths, and trusted proxies
- Web client and HTTPS — what the in-browser client gains from TLS, and how to get a certificate on an internal network
- Backups — daily, weekly or monthly archives of the database, settings and server files; off-site copies to FTP or S3; restore
- How to upgrade — Docker and manual installs, and what to back up first
- Releases and changelog
What the console does, and how to set each part up.
| Devices and device groups | Presence, aliases, folders, the device page, pre-registration, approval, deleting and the recycle bin, custom columns, CSV export, bulk actions |
| Users and access scoping | Who sees which devices, how that carries into the client API, and the user page |
| Roles and delegated administration | Grant one screen without handing over the whole console |
| Address books | Shared books, share rules, tags — modern and legacy client APIs |
| Strategies (device policies) | Push client settings to devices over the heartbeat, with an impact preview, revision history and compliance |
| Web client | The in-browser RustDesk client: video, audio, voice calls, clipboard, file transfer, terminal, session controls, remembered settings |
| Server access control | Approved devices only, incoming-only devices, LAN IP |
| Client downloads | Publish your custom builds on a public downloads page |
| Updating clients | What the client's auto-update does, what the console can and cannot do about it |
| Notifications | Fleet and security events to Slack, Telegram and the rest via Apprise, with retries, offline grace and maintenance snoozes |
| Fleet diagnostics | One page for "is everything up?", with a sanitized export |
| Health checks |
/health/live and /health/ready for load balancers and uptime monitors |
| Two-factor authentication | TOTP, recovery codes, enforcement, and the break-glass reset |
| Single sign-on (OIDC) | Console and RustDesk client sign-in through your identity provider |
| Audit logs | Connections, session notes, file transfers, logins, alarms, console actions |
| Email, invitations and password reset | SMTP, inviting users, self-service reset, sign-in codes |
| Automation API | Scoped bearer tokens, the REST API, and --assign for unattended rollout |
| Dashboard and active sessions | Live stats, charts, and ending a session from the console |
- Settings reference — every setting, what it does, and its default
- Command-line reference — the artisan commands, including the break-glass ones
- Importing from lejianwen/rustdesk-api — migrate users, devices, address books and history
- Troubleshooting — devices not appearing, web client failures, sign-in problems, mail