Deployment: Red Hat / Fedora

rustguac doesn't ship pre-built RPMs yet (see issues if you'd like to vote one up), but the repo includes everything needed to build one yourself. This page is the practical "I just want a dnf install rustguac.rpm" guide.

Tested on Rocky 9 and AlmaLinux 9. Should also work on RHEL 9 and Fedora 39+, with the EPEL caveats noted below. EL8 hasn't been tested and probably needs a newer Rust toolchain than the base repos provide.

What you're building

The build produces a single RPM that contains:

/opt/rustguac/bin/rustguac (the Rust binary)
/opt/rustguac/sbin/guacd (built from upstream apache/guacamole-server with the Debian-13-FreeRDP-3.15 patches applied)
guacd's protocol shared libraries under /opt/rustguac/lib/guacamole/
A systemd unit and the rustguac system user
TLS bootstrap material at /opt/rustguac/tls/

Naming convention is rustguac-<version>-1.el9.x86_64.rpm.

Prerequisites

EPEL is required for several runtime dependencies (ffmpeg-libs, libtelnet, libwebsockets, chromium):

sudo dnf install -y epel-release
sudo dnf config-manager --set-enabled crb   # or "powertools" on EL8

Build-time toolchain:

sudo dnf install -y \
  rust cargo rpm-build systemd-rpm-macros \
  autoconf automake libtool make gcc git \
  pkgconfig openssl-devel libpng-devel libjpeg-turbo-devel libwebp-devel \
  cairo-devel pango-devel pulseaudio-libs-devel \
  libssh2-devel libvncserver-devel ffmpeg-devel libtelnet-devel libwebsockets-devel \
  freerdp-devel

If freerdp-devel isn't in your base repos, enable CRB / PowerTools or the corresponding Fedora repo. The repo's documented FreeRDP target is FreeRDP 3.x; on EL9 the package is freerdp (pulled in by the libs) and the headers come from freerdp-devel.

Build

git clone https://github.com/sol1/rustguac
cd rustguac
./build-rpm.sh

The script:

Determines version from Cargo.toml + the git short hash.
Clones upstream apache/guacamole-server into ../guacamole-server if it isn't there yet.
Applies the patches in patches/ (FreeRDP 3.15+ compatibility).
Configures guacd with --with-ssh --with-vnc --with-rdp --without-telnet --without-kubernetes.
Compiles guacd into rpm/staging.
Compiles rustguac with cargo build --release.
Runs rpmbuild -bb against rustguac.spec and drops the result one directory above the repo root.

Output:

../rustguac-1.6.6+gXXXXXXX-1.el9.x86_64.rpm

Install

sudo dnf install -y ./rustguac-1.6.6+gXXXXXXX-1.el9.x86_64.rpm

This pulls in all the runtime dependencies (cairo, libjpeg-turbo, libpng, libwebp, libssh2, openssl-libs, libvncserver, pango, pulseaudio-libs, ffmpeg-libs, libtelnet, libwebsockets, freerdp-libs, ca-certificates), creates the rustguac system user, and installs the systemd unit.

First-run setup

# Edit the config (see docs/configuration.md for everything)
sudo $EDITOR /opt/rustguac/config.toml

# Create the SQLite DB and an initial admin
sudo /opt/rustguac/bin/rustguac --config /opt/rustguac/config.toml add-admin --email you@example.com

# Start the service
sudo systemctl enable --now rustguac

Then put a reverse proxy (nginx / HAProxy / Caddy) in front of port 8089 with TLS and you're up. Same operational shape as the Debian deployment.

SELinux

EL9 ships with SELinux enforcing by default. The default rustguac systemd unit and file paths are designed to work with the targeted policy out of the box (binary lives under /opt, listens on a non-privileged port, doesn't touch system directories). If you customise install locations or run rustguac on port 443 directly, you may need to add SELinux exceptions:

# If you need rustguac to bind 443 directly (not behind a proxy)
sudo semanage port -a -t http_port_t -p tcp 443

If something fails silently, sudo ausearch -m AVC -ts recent is your friend.

firewalld

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Don't open 8089 publicly. rustguac is meant to live behind a reverse proxy on 443.

Differences from the Debian path

Binary location is identical (/opt/rustguac).
Systemd unit is functionally the same. The Debian install.sh and the RPM %post scriptlet do the same useradd -r -m + systemctl daemon-reload dance.
VDI works the same. Install Docker (dnf install docker-ce from the docker.com repo, or podman-docker) and add the rustguac user to the docker group.

Known gaps

We don't currently publish a pre-built RPM as a release artifact. The release pipeline produces .deb for Debian/Ubuntu and Docker images; RPMs are build-it-yourself.
The spec file is targeted at EL9; EL8 builds may need adjustments to the Rust toolchain and to the dependency list.
COPR / official Fedora packaging hasn't been pursued. Patches welcome.