How to Install Apache Guacamole (RDP, VNC and SSH to Every Machine from One Browser Tab)

RustDesk (175) is for helping people. Guacamole is for reaching your machines: the Windows PC upstairs by RDP, a Linux desktop by VNC, the servers by SSH, the Proxmox VM consoles — all as tabs in a browser, with nothing installed on the device you're sitting at. Behind HTTPS and TOTP it's the way to get to a home screen from a work laptop that forbids VPN clients and remote-desktop software.

Guacamole needs its schema loaded once:

mkdir -p ~/docker/guacamole/init && cd ~/docker/guacamole
docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --postgresql > init/initdb.sql

nano compose.yaml

services:
guacd:
image: guacamole/guacd:latest
container_name: guacd
restart: unless-stopped

guac-db:
image: postgres:16-alpine
container_name: guac-db
environment:
POSTGRES_DB: guacamole_db
POSTGRES_USER: guacamole
POSTGRES_PASSWORD: ${DB_PASSWORD}
volumes:
- ./db:/var/lib/postgresql/data
- ./init:/docker-entrypoint-initdb.d:ro
restart: unless-stopped

guacamole:
image: guacamole/guacamole:latest
container_name: guacamole
ports:
- "127.0.0.1:8084:8080"
environment:
GUACD_HOSTNAME: guacd
POSTGRESQL_HOSTNAME: guac-db
POSTGRESQL_DATABASE: guacamole_db
POSTGRESQL_USERNAME: guacamole
POSTGRESQL_PASSWORD: ${DB_PASSWORD}
TOTP_ENABLED: "true"
WEBAPP_CONTEXT: ROOT
depends_on: [guacd, guac-db]
restart: unless-stopped

docker compose up -d

WEBAPP_CONTEXT: ROOT serves it at / instead of /guacamole/.

remote.example.com → 127.0.0.1:8084 with the WebSocket lines and proxy_buffering off; (28), HTTPS. Open it, log in guacadmin / guacadmin, enrol the TOTP it asks for, then Settings → Users → guacadmin → change password, and make yourself a second admin user.

Settings → Connections → New Connection:

• Windows PC — Protocol RDP, hostname 192.168.1.20, port 3389, username/password (or leave blank to be prompted), Security: NLA, tick Ignore server certificate. Enable Remote Desktop on the PC (Settings → System → Remote Desktop). Resolution and colour depth under Display; Enable drive under Device Redirection gives a virtual drive for file transfer.
• Linux desktop — VNC to a TigerVNC/x11vnc server on it, or RDP via xrdp (sudo apt install xrdp on the desktop) which is smoother.
• Server SSH — Protocol SSH, hostname, port, username, and paste the private key (or a certificate, 173) under Authentication; SFTP under the same connection for file browsing.
• A Proxmox VM — its VNC console (141), or RDP/SSH inside it.

Connections can be grouped (Home, Work, Servers) and shared with other Guacamole users with per-connection permissions.

Click a connection; the screen fills the tab. Ctrl + Alt + Shift opens the Guacamole menu: clipboard (copy on the remote, paste locally and vice versa), file transfer, input method, zoom. Several connections run as tabs; the recent list is on the home page. Mobile browsers work, with an on-screen keyboard.

It's a door to every screen: HTTPS always; TOTP on; Authelia (95) or VPN-only (33) in front if it isn't strictly needed from the open internet; strong unique passwords for the RDP/VNC targets; Settings → Sessions to see who's connected; and Guacamole's own history page records every session. Consider session recording (a guacd mount and a per-connection setting) for the audit trail.

RDP fails with "security negotiation". Security mode: try nla, then tls, then any; and the Windows account must have a password (blank passwords can't RDP).

Black screen on VNC. The VNC server isn't running, or it's bound to localhost — use an SSH tunnel built into the connection (Guacamole has no tunnel; xrdp avoids it).

Clipboard doesn't work. Not enabled for that connection, or the browser blocked clipboard access — use the Guacamole menu's text box.

"Could not connect to guacd". The guacd container name/port; docker compose logs guacd.

Three containers, the schema initialised once, TOTP on, a proxy entry. Every PC, desktop and server in the house is a tab behind one login — reachable from a browser on a machine that allows nothing else, with the clipboard and files flowing both ways.