Technical · Self-hosting
Self-hosted remote desktop, explained without the sales pitch.
“Self-hosted” gets used loosely. Here it means precisely this: two small services run on a machine you control, your computers talk to those instead of to anybody else's, and the encryption keys never leave the two computers in the session. This page is what that involves, including the parts that are work.
What you are running
Two services, and a key.
That really is the whole server side. Both run comfortably in Docker on a machine smaller than a laptop.
The introducer
Sometimes called the ID or rendezvous server. Every computer running the client checks in with it and is given a nine-digit number. When you type a number, this is what tells the two machines how to reach each other. It handles a trickle of traffic, even with hundreds of machines.
The relay
A fallback. Most sessions connect directly between the two computers, but some networks refuse to allow that. Those sessions pass through the relay instead. It carries the encrypted traffic without being able to read it — but it does use your bandwidth, so a busy day of relayed sessions shows up on your bill.
The key pair
Generated once, on your server. The public half is compiled into the clients you hand out; the private half stays put. It is what stops a client being pointed at somebody else's server, and it is the one file on the box worth backing up carefully. Lose it and every client you have distributed must be replaced.
What it needs
A very small machine.
One core, 1 GB of memory and a few gigabytes of disk will serve a few hundred computers. The introducer is doing almost nothing most of the time. Pick the machine for its network allowance rather than its processor, because relayed sessions are the only thing that will ever stretch it.
You also need a name pointed at it — desk.yourfirm.co.uk or
similar — rather than a bare address. Use the name everywhere. If you build
clients against a raw IP address and the address later changes, every client you
have given out stops working.
TCP 21115 introducer, direct
TCP 21116 introducer
UDP 21116 introducer, discovery
TCP 21117 relay
TCP 21118 introducer, over websocket
TCP 21119 relay, over websocket
Security
What your server can and cannot see.
Worth being precise about, because this is the reason most people self-host, and because a client's security questionnaire will eventually ask.
It can see
Which nine-digit number connected to which, and at what time. The addresses those computers came from. How long the session lasted. If the session was relayed, the volume of scrambled traffic that went through.
It cannot see
The screen. The keystrokes. The files transferred. The chat. The two computers agree their key directly with each other and your server is never given it, so even with full access to the machine there is nothing there to read.
Self-hosting protects the contents of your sessions and keeps the record of who connected to whom in your hands. It does not make the machine at the far end secure, and it does not protect you if somebody gets into your server and swaps the software for a modified one. Two-factor sign-in, a locked-down server and keeping it patched still matter.
Getting there
The order to do it in.
Machine and name
Rent a small Linux server. Point a name at it. Get a certificate. Open the six ports and nothing else, and put the SSH door on a port that is not 22.
Run the two services
Start them under Docker. The key pair is generated on first run. Copy the public half somewhere safe before you do anything else, and back up the private half.
Build your clients
Compile the client with your server name and public key inside it, so the person installing it types nothing at all. Then set yourself a reminder to apply updates.
The address built into a client is only a default. It applies when the machine has no settings file yet. If that computer has ever had this kind of software on it before, the old settings win and it will quietly keep using the old server with no error shown at all.
On Windows the file is %APPDATA%\RustDesk\config\RustDesk2.toml. Either
rename it before installing, or clear the network boxes in the client's settings.
Leave them blank rather than typing your server in — blank
means “use what is built in”.
Or don't
What it costs to hand the job over.
Self-hosting is free and always will be. These exist because for a lot of people an hour a month of server work is worth more than the money.
- The software, under AGPL-3.0
- Every feature, nothing held back
- You pay only for the machine
- Updates and backups are yours
- Set up on your own server
- Clients built with your name inside
- Handed over and documented
- Optional cover afterwards, £588 a year
- Runs on our UK server
- Updates, backups and monitoring done
- Your own name on the clients
- Nothing for you to look after
Just want logins on a server that already exists and is looked after? That is the £4.95 per technician a month plan.
Questions
Straight answers.
What size of server do I need?
One processor core and 1 GB of memory handles a few hundred machines comfortably, because the server mostly just introduces computers to each other. What matters more is the network allowance: if sessions have to be relayed, that traffic passes through your server and counts against your monthly transfer.
Which ports have to be open?
TCP 21114 to 21119, and UDP 21116. Nothing needs opening at the customer's end, because their computer makes an outbound connection to you.
Can my server see what happens in a session?
No. The two computers agree an encryption key directly with each other, and your server never holds it. It knows which two machines connected and when, and if the session has to be relayed it passes the scrambled bytes along without being able to read them.
What happens if my server goes down?
Sessions already running on a direct connection carry on. New connections cannot be set up until it is back, because the server is what lets two computers find each other. This is the main argument for either paying someone to watch it or using our hosted plan.
Do I need to keep it updated?
Yes, and this is the part people underestimate. It is a service on the public internet. Security updates, certificate renewal and backups are yours to do. Budget an hour a month, and more the first time something breaks.
Is self-hosting really free?
The software is, permanently, under the AGPL-3.0 licence. You pay for the machine it runs on - a small virtual server is a few pounds a month - and for your own time. There is no licence fee to us and no feature held back.
Keep reading
Related
Try it before you decide anything.
The client is free and the source is public. Download it, connect two of your own machines, and see whether it does what you need. Nothing to sign up for.