CortenDesk

CortenDesk is a self-hosted replacement for the open-source RustDesk server, packaging the ID/rendezvous server (hbbs), the relay (hbbr), and a Laravel-based management console into a single container. It ships a from-scratch TypeScript web client that speaks the RustDesk wire protocol in the browser, so stock RustDesk clients connect unchanged while operators manage devices, users and audit history from a web console.

What is CortenDesk?

CortenDesk is a web console plus bundled RustDesk server for teams running their own remote-desktop infrastructure. It takes stock RustDesk clients as input — pointed at it via ID Server, Relay Server, Key and API Server fields — and produces a managed device fleet with presence, address books, scoped user access, audit logs and browser-based remote control. It is built on Laravel and Livewire with precompiled assets (no frontend build step), requires PHP 8.3+ and MySQL/MariaDB (SQLite for evaluation), and is distributed under AGPL-3.0-only. It is an independent project, not affiliated with RustDesk / Purslane Ltd.

Key Features

• Bundled hbbs/hbbr — the included servers are CortenDesk Server, an AGPL fork of rustdesk-server that completes the signalling key exchange RustDesk 1.4.1+ clients start, fixing the Failed to secure tcp: deadline has elapsed failure from signed-in clients.
• Native browser client — a TypeScript implementation of the RustDesk wire protocol (rendezvous, relay, NaCl handshake, login) over WebSocket, with WebCodecs hardware video, remote audio, voice calls, chat, clipboard sync, multi-monitor switching and Ctrl+Alt+Del.
• WebRTC support — connections to devices on RustDesk 1.5+ can go direct via WebRTC with relay fallback, and a self-hosted TURN server (coturn) traverses carrier NAT.
• In-session file transfer — a dual-pane remote file manager with progress, resume-aware digests, conflict prompts and drag-and-drop, using the File System Access API on Chromium.
• Remote terminal — an xterm.js terminal for Windows, macOS and Linux devices on RustDesk 1.4.1+, opened inside a session or from the device list.
• Device policies — push client settings (permissions, password rules, capture options, STUN/TURN servers) to a device, user or device group, with the most specific assignment winning and optional enforcement that reverts local changes on next heartbeat.
• SSO and 2FA — OpenID Connect authorization-code flow with PKCE for Keycloak, Authentik, Entra ID, Okta or Google Workspace, plus TOTP two-factor with recovery codes and administrator reset.
• Share links — secret single-device links that open the web client with no account, with configurable concurrency and lifetimes from 15 minutes to 7 days.

What can you do with CortenDesk?

• Small IT teams: run a single Docker container to replace a split hbbs/hbbr deployment, then approve new devices and mark them incoming-only from the console.
• MSPs and support desks: send a share link so an end user's browser connects to a device without installing RustDesk or creating an account.
• Compliance-minded operators: export connection, file-transfer and login audit records to CSV or as JSON lines to the container log for a log shipper, with configurable retention and nightly pruning.
• Administrators migrating consoles: import users (bcrypt passwords intact), devices, address books and audit history from a lejianwen/rustdesk-api database with one artisan command.

How does CortenDesk work?

1. Run the container with APP_URL set to the address clients and browsers reach; it generates the server key pair on first boot and derives the ID server, relay and WebSocket URLs from that value.
2. Read the public key from the Settings screen (or /data/rustdesk/id_ed25519.pub) and enter it, along with the console URL as API Server, in each RustDesk client.
3. Devices register within a heartbeat, roughly 15 seconds, and then appear in the fleet view.

Pros and cons

• Bundled server fixes a signalling bug upstream treats as out of scope.
• No frontend build step: clone, configure, migrate and serve.
• Desktop streaming needs WebCodecs, so Chrome/Edge is the recommended browser; over plain HTTP the client falls back to H.264 via Media Source Extensions with no per-frame statistics.
• SQLite commits one write at a time, so fleets of several hundred devices or more should use MySQL or MariaDB.
• Go-encrypted address-book entry passwords from lejianwen/rustdesk-api cannot be decrypted and must be re-saved by users.

FAQ

Is CortenDesk free?

CortenDesk is licensed under AGPL-3.0-only and the page makes no mention of a paid tier. The bundled CortenDesk Server is likewise AGPL. There is no paid tier mentioned on the page, in contrast to RustDesk's own commercial offering.

Does CortenDesk work with stock RustDesk clients?

Yes. Stock clients connect unchanged — set ID Server, Relay Server, Key and API Server in the client's network settings to the values shown on CortenDesk's Settings screen. CortenDesk implements the RustDesk client HTTP API, so no client patches are needed.

Can I keep my existing RustDesk server?

Yes. Set CORTENDESK_EMBEDDED_SERVER=false along with CORTENDESK_ID_SERVER, CORTENDESK_RELAY_SERVER and CORTENDESK_PUBLIC_KEY. Enforcing approved-only access requires CortenDesk Server 1.1.0+ with a shared CORTENDESK_SERVER_SECRET. Mounting a prior data directory at /data/rustdesk preserves device IDs.

Do I need HTTPS for the web client?

HTTPS is recommended but not required. Over HTTPS the client uses WebCodecs for hardware-accelerated VP8/VP9/H.264/H.265/AV1; over plain HTTP it automatically falls back to H.264 through Media Source Extensions, limited to H.264 and without per-frame statistics.