Remota agent (client)

The Remota agent runs on a Linux machine you want to reach for remote support, and dials out to your self-hosted Remota relay over wss (443). No public IP, no inbound ports — the machine becomes reachable from the Remota app even behind NAT. Self-hosted alternative to remote.it / AnyDesk / RustDesk.

 Remota app  ──wss/443──►  relay.privum.cloud  ◄──wss/443──  this agent  ──►  local sshd / service
 (operator)                (your relay)                       (behind NAT)

Install (on the target machine)

Copy this folder to the machine (or git clone), then:

sudo ./install.sh \
  --relay wss://relay.privum.cloud \
  --token <ENROLLMENT_TOKEN> \
  --name "Cliente X"

• --token is the relay's enrollment secret (ask your Remota admin).
• --name is a human label shown in the app (optional; defaults to the hostname).

The installer sets up a hardened systemd service (remota-agent), running as an unprivileged user, and prints the Device ID — a random, persisted address (AnyDesk-style, e.g. 1994-6028-2938). Give that ID to the operator; they connect from the Remota app.

journalctl -u remota-agent -f      # logs
sudo ./uninstall.sh                # remove (keeps the device id)
sudo ./uninstall.sh --purge        # remove everything

What it is / isn't

• Encryption: the tunnel is TLS (wss) end to the relay; the relay bridges raw bytes to the agent over a second TLS leg. Traffic is encrypted in transit.
• Device ID: a routing address (not the encryption). It's random and persisted in /var/lib/remota-agent/agent-id so it's stable across restarts.
• Authorization today: enrollment token (agent→relay) + a relay-side IP gate on session brokering + single-use per-session tokens. A per-device password / accept-prompt (so knowing the ID isn't enough) is on the roadmap.

Capabilities

--capabilities cli (default) advertises command-line (SSH) access. Screen (VNC) capability is on the roadmap (the agent will tunnel to a local x11vnc).

Build from source

The agent source lives in the Remota monorepo (server/agent). Static musl build:

sudo apt install -y musl-tools
rustup target add x86_64-unknown-linux-musl
CC_x86_64_unknown_linux_musl=musl-gcc \
  cargo build --release --target x86_64-unknown-linux-musl -p remota-agent
# -> server/target/x86_64-unknown-linux-musl/release/remota-agent

License

AGPL-3.0-only. See LICENSE.