Deployment: Debian

This is the path the maintainers run in production (Debian 13 trixie). The reference version with all the exhaustive options lives in docs/deployment-guide.md. This page is the wiki-style "what you actually do" version.

Get the .deb

Pre-built .debs are attached to every GitHub release. Both amd64 and arm64.

wget https://github.com/sol1/rustguac/releases/latest/download/rustguac_amd64.deb
sudo apt install ./rustguac_amd64.deb

The package installs to /opt/rustguac, creates the rustguac system user (with a real home directory at /home/rustguac, which Chromium needs), drops a systemd unit, and pulls in all runtime dependencies.

First-run

# Edit the config (config.toml is created on install with sensible defaults)
sudo $EDITOR /opt/rustguac/config.toml

# Initialise the SQLite DB and create an initial admin
sudo /opt/rustguac/bin/rustguac --config /opt/rustguac/config.toml add-admin --email you@example.com

# Start the service
sudo systemctl enable --now rustguac

The admin command on a fresh install also fixes ownership on the SQLite DB (and its -wal / -shm sidecars) so the service user can write to it.

Reverse proxy

Don't expose port 8089 to the internet. Put a reverse proxy in front of it. The reference setup is HAProxy + optional Knocknoc; see Knocknoc integration. For nginx / Caddy / Apache / Traefik, see the in-repo docs/reverse-proxies.md, particularly the %2F-decoding gotcha that affects nested folder paths.

Upgrades

Same drill, install the new .deb on top:

wget https://github.com/sol1/rustguac/releases/latest/download/rustguac_amd64.deb
sudo dpkg -i --force-confold rustguac_amd64.deb
sudo systemctl restart rustguac

--force-confold keeps your existing config.toml. The service restart is the only downtime; sessions are killed (rustguac doesn't currently support process-restart-without-session-loss).

What's where

Path	Purpose
`/opt/rustguac/bin/rustguac`	Binary
`/opt/rustguac/sbin/guacd`	Bundled guacd
`/opt/rustguac/config.toml`	Configuration
`/opt/rustguac/static/`	Static assets (most pages; `client.html` is embedded in the binary)
`/opt/rustguac/data/`	SQLite admin DB and OIDC session store
`/opt/rustguac/recordings/`	Session recordings (if enabled)
`/opt/rustguac/drives/`	LUKS-encrypted per-session drive storage
`/opt/rustguac/vdi-homes/`	Per-user VDI container homes
`/opt/rustguac/tls/`	TLS cert/key for the rustguac listener
`/etc/systemd/system/rustguac.service`	Systemd unit

Logs

sudo journalctl -u rustguac -f

RUST_LOG defaults to info. Bump to rustguac=debug in the systemd unit (or EnvironmentFile=) for more.

VDI on Debian

Install Docker (the upstream docker.io package or Docker's own repo, your call), add the rustguac user to the docker group:

sudo usermod -aG docker rustguac
sudo systemctl restart rustguac

Then enable the [vdi] section in config.toml. See docs/vdi.md for the per-image requirements (xrdp on 3389, accept VDI_USERNAME / VDI_PASSWORD env vars).