guacamole v0.1.0

Networking

Apache Guacamole — a clientless remote-desktop gateway: access RDP, VNC and SSH machines from your browser. This all-in-one image bundles guacd and PostgreSQL. Deployed as a single host-networked Nomad service.

nomad-pack run guacamole --registry nomploy

…or one line (add registry + run)

curl -fsSL https://packs.nomploy.com/install.sh | sh -s -- guacamole

Needs nomad-pack on PATH. The script only adds the nomploy registry and runs this pack.

Source ↗ Project ↗ ★ 1.7k ⚑ Report an issue

1 task http 8080 1 volume image flcontainers/guacamole:latest tracks :latest image bumped today

Variables 9

values.hcl

Save as values.hcl, edit, then run:

nomad-pack run guacamole -f values.hcl --registry nomploy

# The name of the Nomad job.
job_name = "guacamole"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The Apache Guacamole container image. Pin a tag in production.
image = "flcontainers/guacamole:latest"

# Host port for the Apache Guacamole web UI. Fixed at 8080 inside the image.
port = 8080

# Named volume mounted at /config — the bundled PostgreSQL database and configuration.
data_volume = "guacamole_data"

# Container timezone (TZ), e.g. Europe/Bratislava.
tz = "UTC"

# Placement constraints. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# The task resources.
resources = {
    cpu    = 300
    memory = 256
  }

Name	Type	Default	Description
job_name	string	"guacamole"	The name of the Nomad job.
namespace	string	"default"	The Nomad namespace to deploy into.
datacenters	list	["*"]	The datacenters to deploy to.
image	string	"flcontainers/guacamole:latest"	The Apache Guacamole container image. Pin a tag in production.
port	number	8080	Host port for the Apache Guacamole web UI. Fixed at 8080 inside the image.
data_volume	string	"guacamole_data"	Named volume mounted at /config — the bundled PostgreSQL database and configuration.
tz	string	"UTC"	Container timezone (TZ), e.g. Europe/Bratislava.
constraints	list	[]	Placement constraints. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources	object	{ cpu = 300 memory = 256 }	The task resources.

Back up this pack

This pack stores data in one Docker named volume: guacamole_data

restic

# Run on the node hosting this pack. Point restic at your repo first:
#   export RESTIC_REPOSITORY="s3:https://<account>.r2.cloudflarestorage.com/<bucket>"
#   export RESTIC_PASSWORD="<repo-password>"
#   export AWS_ACCESS_KEY_ID=<key>  AWS_SECRET_ACCESS_KEY=<secret>
restic backup \
  /var/lib/docker/volumes/guacamole_data/_data

rclone (sync to S3/R2)

rclone sync /var/lib/docker/volumes/guacamole_data/_data backup:<bucket>/guacamole_data

Paths assume the default Docker volume location (/var/lib/docker/volumes). Restore by stopping the job, restoring files into the same volume, and re-running the pack.

Readme

guacamole

Apache Guacamole — a clientless remote-desktop gateway. Access RDP, VNC and SSH machines straight from your browser — no plugins or client software. This pack uses an all-in-one image that bundles the Guacamole web app, the guacd proxy daemon and PostgreSQL, so it runs as a single container.

Single host-networked Nomad service with one persistent data volume.

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run guacamole --registry=nomploy

Configure

Variable	Default	Description
`port`	`8080`	Web UI port. Fixed at `8080` inside the image.
`image`	`flcontainers/guacamole:latest`	All-in-one container image. Pin a tag in production.
`data_volume`	`guacamole_data`	`/config` — the bundled PostgreSQL database and config.
`tz`	`UTC`	Container timezone (`TZ`).
`resources`	`{ cpu = 300, memory = 256 }`	Task resources.

First login: guacadmin / guacadmin — change it immediately. Then add your RDP/VNC/SSH connections in the admin settings. Because Postgres lives in the data volume, pin the job to the node holding it with constraints, and put Guacamole behind an authenticating reverse proxy over TLS before exposing it.