Add tech_docs/RustDesk.md
This commit is contained in:
181
tech_docs/RustDesk.md
Normal file
181
tech_docs/RustDesk.md
Normal file
@@ -0,0 +1,181 @@
|
||||
# **Proper RustDesk Self-Hosted Deployment Guide**
|
||||
|
||||
This guide ensures a **proper, secure, and production-ready** RustDesk deployment using Docker. It includes best practices for security, performance, and reliability.
|
||||
|
||||
---
|
||||
|
||||
## **1. Prerequisites**
|
||||
### **Server Requirements**
|
||||
- **OS**: Ubuntu 22.04/24.04 (recommended) or Debian 12
|
||||
- **CPU**: 2+ cores
|
||||
- **RAM**: 4GB+
|
||||
- **Storage**: 20GB+ (SSD preferred)
|
||||
- **Network**: Public IPv4 address (IPv6 optional)
|
||||
- **Ports**:
|
||||
- **TCP**: `21115`, `21116`, `21117`, `21118`, `21119`
|
||||
- **UDP**: `21116` (for NAT traversal)
|
||||
|
||||
### **Software Requirements**
|
||||
- **Docker** (latest stable)
|
||||
- **Docker Compose** (v2+)
|
||||
- **UFW (firewall)** (recommended)
|
||||
|
||||
---
|
||||
|
||||
## **2. Server Setup**
|
||||
### **1. Create a Dedicated User (Security Best Practice)**
|
||||
```bash
|
||||
sudo adduser --disabled-password --gecos "" rustdesk
|
||||
sudo usermod -aG sudo rustdesk
|
||||
sudo mkdir -p /home/rustdesk/.ssh
|
||||
sudo cp ~/.ssh/authorized_keys /home/rustdesk/.ssh/
|
||||
sudo chown -R rustdesk:rustdesk /home/rustdesk/.ssh
|
||||
sudo chmod 700 /home/rustdesk/.ssh
|
||||
sudo chmod 600 /home/rustkdesk/.ssh/authorized_keys
|
||||
echo "rustdesk ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/rustdesk
|
||||
sudo chmod 440 /etc/sudoers.d/rustdesk
|
||||
```
|
||||
|
||||
### **2. Install Docker & Docker Compose**
|
||||
```bash
|
||||
# Install Docker
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
sudo usermod -aG docker rustdesk
|
||||
|
||||
# Install Docker Compose
|
||||
sudo curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
|
||||
sudo chmod +x /usr/local/bin/docker-compose
|
||||
```
|
||||
|
||||
### **3. Configure Firewall (UFW)**
|
||||
```bash
|
||||
sudo apt install ufw -y
|
||||
sudo ufw allow ssh
|
||||
sudo ufw allow 21115/tcp # NAT type test
|
||||
sudo ufw allow 21116/tcp # ID server (TCP)
|
||||
sudo ufw allow 21116/udp # ID server (UDP, critical for NAT traversal)
|
||||
sudo ufw allow 21117/tcp # Relay server
|
||||
sudo ufw allow 21118/tcp # Web client (optional)
|
||||
sudo ufw allow 21119/tcp # Web client (optional)
|
||||
sudo ufw enable
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **3. Deploy RustDesk with Docker Compose**
|
||||
### **1. Create Project Directory**
|
||||
```bash
|
||||
sudo mkdir -p /opt/rustdesk && cd /opt/rustdesk
|
||||
```
|
||||
|
||||
### **2. Create `docker-compose.yml`**
|
||||
```yaml
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
hbbs:
|
||||
container_name: hbbs
|
||||
image: rustdesk/rustdesk-server:latest
|
||||
command: hbbs -r your_server_ip:21117 # Replace with your public IP
|
||||
volumes:
|
||||
- ./data:/root
|
||||
network_mode: host
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- RELAY_SERVERS=your_server_ip:21117
|
||||
- ENCRYPTED_ONLY=Y # Force encrypted connections (security)
|
||||
|
||||
hbbr:
|
||||
container_name: hbbr
|
||||
image: rustdesk/rustdesk-server:latest
|
||||
command: hbbr
|
||||
volumes:
|
||||
- ./data:/root
|
||||
network_mode: host
|
||||
restart: unless-stopped
|
||||
```
|
||||
|
||||
### **3. Start RustDesk Services**
|
||||
```bash
|
||||
sudo docker-compose up -d
|
||||
```
|
||||
|
||||
### **4. Verify Deployment**
|
||||
```bash
|
||||
sudo docker ps # Should show hbbs & hbbr running
|
||||
sudo docker logs hbbs # Check for errors
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **4. Post-Installation Steps**
|
||||
### **1. Retrieve the Public Key (Required for Clients)**
|
||||
```bash
|
||||
cat /opt/rustdesk/data/id_ed25519.pub
|
||||
```
|
||||
**Save this key**—it must be entered in every RustDesk client for secure connections.
|
||||
|
||||
### **2. Enable Auto-Updates (Optional but Recommended)**
|
||||
```bash
|
||||
sudo crontab -e
|
||||
```
|
||||
Add:
|
||||
```bash
|
||||
0 3 * * * cd /opt/rustdesk && docker-compose pull && docker-compose up -d --force-recreate
|
||||
```
|
||||
This updates RustDesk nightly.
|
||||
|
||||
---
|
||||
|
||||
## **5. Client Configuration**
|
||||
### **1. Download RustDesk Client**
|
||||
- [Windows/macOS/Linux](https://rustdesk.com/download)
|
||||
- [Android/iOS](https://rustdesk.com/download.html)
|
||||
|
||||
### **2. Configure Client Settings**
|
||||
1. Open RustDesk → **Settings (⚙️) → Network**
|
||||
2. **Unlock advanced settings** (if prompted)
|
||||
3. Configure:
|
||||
- **ID Server**: `your_server_ip`
|
||||
- **Relay Server**: `your_server_ip`
|
||||
- **Key**: Paste `id_ed25519.pub` from earlier
|
||||
4. **Save & Restart RustDesk**
|
||||
|
||||
---
|
||||
|
||||
## **6. Security Hardening (Optional but Recommended)**
|
||||
### **1. Enable Fail2Ban (Prevent Brute Force Attacks)**
|
||||
```bash
|
||||
sudo apt install fail2ban -y
|
||||
sudo systemctl enable --now fail2ban
|
||||
```
|
||||
|
||||
### **2. Disable Web Console (If Not Needed)**
|
||||
- Remove `21118` and `21119` from `ufw` if you don’t use the web client.
|
||||
|
||||
### **3. Use a Reverse Proxy (HTTPS for Web Client)**
|
||||
If using the web client, set up **Nginx + Let’s Encrypt** for HTTPS.
|
||||
|
||||
---
|
||||
|
||||
## **7. Troubleshooting**
|
||||
| Issue | Solution |
|
||||
|-------|----------|
|
||||
| **Clients can't connect** | Check `ufw status`, verify ports are open |
|
||||
| **High latency** | Ensure `RELAY_SERVERS` is set correctly |
|
||||
| **"Unencrypted connection" warning** | Set `ENCRYPTED_ONLY=Y` in `docker-compose.yml` |
|
||||
| **hbbs/hbbr crashes** | Check logs (`docker logs hbbs`) |
|
||||
|
||||
---
|
||||
|
||||
## **Conclusion**
|
||||
This guide ensures a **proper, secure, and production-ready** RustDesk deployment with:
|
||||
✅ Dedicated non-root user
|
||||
✅ Firewall hardening
|
||||
✅ Encrypted-only connections (optional)
|
||||
✅ Auto-updates
|
||||
✅ Fail2Ban protection (optional)
|
||||
|
||||
For large-scale deployments, consider **multiple relay servers** for better performance.
|
||||
|
||||
**Enjoy your self-hosted RustDesk!** 🚀
|
||||
Reference in New Issue
Block a user