CortenDesk

Self-hosted · AGPL-3.0

The RustDesk console the open-source server never had — and the server too.

One container runs the ID server, the relay and a full web UI: your fleet, who can reach what, the policies pushed to each machine, a record of every session, and a client that connects from the browser. Already running hbbs/hbbr? Point CortenDesk at them instead.

Get started with Docker View on GitHub
$docker pull ghcr.io/marcpope/cortendesk

No paid tierNo patched clientYour data, your server

https://console.example.com
The CortenDesk dashboard: stat tiles for total devices, devices online, users, active sessions, connections today and recent alarms, above a 14-day connections chart and a device platform breakdown

What it is

The whole deployment in one container

Since 1.5 the image ships hbbs and hbbr alongside the console — a drop-in replacement for the open-source RustDesk server, with fixes it lacks (signed-in clients can actually connect). Sessions still go peer-to-peer; the console handles everything around them. Prefer your own servers? One environment variable turns the embedded pair off.

No patched client. CortenDesk implements the HTTP API that stock RustDesk clients already speak. You set the API Server field in a normal client — there is no fork to maintain and no custom build to distribute.

The essentials

What you get

Your fleet

Live presence, aliases, folders, ownership, pre-registration and a recycle bin — every machine pointed at the console.

Scoped access

People see only their own devices plus the groups granted to them. Enforced in the console and in the client API alike.

Device policies

Push client settings over the heartbeat — permissions, security, capture. Optionally re-applied, so local changes revert.

Audit trail

Connections, file transfers, sign-ins and security alarms, filterable and exportable, with retention you control.

See everything it does →

Fleet

Every machine, and who owns it

Devices register themselves on their first heartbeat. Group them into folders per site or customer, assign an owner, and access follows from there.

  • Online presence within one heartbeat
  • Pre-register a machine before it is imaged
  • Optional approval gate for unknown devices
  • Soft delete, so a removed device cannot reappear
The Devices screen listing machines with their online status, device group, owner, client version and time last seen

Policy

Settings you set once

A strategy is a set of client options pushed to devices on their next heartbeat. Assign it to a device, a user or a whole folder — the most specific assignment wins.

  • Permissions, security rules, capture behaviour
  • Leave an option unmanaged and the device keeps what it has
  • Enforce it, and a change made on the device is undone
The Strategies screen listing two device policies with their option counts, assignments and enabled state

Not an afterthought

The parts you only notice when they are missing

Single sign-on

OpenID Connect for the console and for RustDesk clients. Keycloak, Authentik, Entra ID, Okta, Google Workspace or any compliant provider.

Two-factor

TOTP with single-use recovery codes, optionally required for everyone or for administrators only.

Delegated admin

Roles with a permission matrix per console area, so someone can run the users screen without running everything.

Automation API

Scoped bearer tokens over a REST API, plus the client's --assign flag for unattended rollout.

Address books

Shared books with per-book sharing rules and coloured tags. Both the modern and legacy client APIs.

Runs on a phone

Every screen works at 390 px. Wide tables become card lists. Dark and light themes.

Run it in about a minute

One container, or Compose with MySQL. Set APP_URL and everything else — server key, relay address, client settings — is derived from it.

Installation guide Read the docs