Draft: the repository is not published yet, so the commands below do not work yet. Do not install from this page.
For Debian 13 servers
Your server, as a desktop over RDP.
Waydesk gives every account its own Wayland desktop, reached with the Windows App, Microsoft Remote Desktop or FreeRDP. Close the window, come back tomorrow, and your windows are where you left them.
- idle desktop sessionabout 520 MB
- … in the low-memory modeabout 355 MB
- browser users on 4 GB4 (a fifth is refused)
- after a disconnectsame windows
- pictureH.264 over RDP
Install
Four commands and a check
Debian 13 (trixie), arm64 or amd64. Run them as an administrator of the server.
Add the repository
One small package: the signing key, the apt source and a pin so that these packages win over third-party builds of the same names.
curl -fsSLO https://waydesk.stackcare.pt/apt/waydesk-repo.deb sudo apt install ./waydesk-repo.deb
Check the key
This first download cannot be verified by the repository itself, so compare the key you got with the fingerprint published here:
gpg --show-keys --with-fingerprint /usr/share/keyrings/waydesk-archive-keyring.gpg
Install Waydesk
The RDP server, the desktop and what they need.
sudo apt update sudo apt install waydesk
Add the desktop shell and the first administrator
The wizard installs the shell (the bar, launcher and settings). Then make the account that connects over RDP and manages the others: there is no default account and no default password.
sudo waydesk-setup sudo waydesk-setup-admin
Reach it safely
Do not put the RDP port on the internet
The port listens on 127.0.0.1 by default, and the login is an account password sent inside TLS with a self-signed certificate. Reach it through a tunnel.
SSH tunnel
Nothing to set up on the server. From your computer, then connect the RDP client to localhost:13389:
ssh -N -L 13389:127.0.0.1:3389 you@server
WireGuard
For several people and devices: a key per device, RDP bound to the VPN address, only UDP 51820 open. The guide has the configuration, tested on a cloud server.
/usr/share/doc/waydesk-server/WIREGUARD.md
Check the certificate
On the first connection the client shows the server's certificate fingerprint. waydesk-setup-admin prints the one to expect.
What you get
A desktop for each account, kept in check
Own desktop per account
Real Linux accounts with their own password and home. A session survives a disconnect, and a second login from the same account takes it over.
A familiar shell
Bar, launcher, dock, window buttons, four workspaces, a software centre with Flatpak, a file manager on the desktop.
Sharp at any size
The desktop is sized and scaled from what the client asks for, and follows when you resize the window.
Memory protection
A new session is refused when the machine cannot take one more, each account has ceilings, and compressed swap is on. The user is told why with a clear message.
Administration
A Users & Access panel and a waydesk-admin command: accounts, limits, who is logged in.
Signed updates
Packages come from a signed apt repository with a pinned key, and the shell is built from source.
Limits
What to know before you rely on it
- Early software, one author. It has been tested mostly with FreeRDP, and with the Windows App on a Mac before the multi-user work, not since.
- Not independently reviewed. The root helper and the login code have had two internal security passes (written down in the package documentation), no outside review yet.
- Moving screens cost CPU. There is no hardware video encoding. On a 2-core server two busy screens use about 90 % of the CPU, and three drop to a choppy frame rate. Memory allows more users than CPU does when they play video.
- Sizing. About 4 browser users per 4 GB, about 8 with only the desktop open. A low-memory mode saves about 110 MB per session and gives the shell a flat look.
- Debian 13 only. arm64 is the most tested. Ubuntu runs the server but not the shell yet, and there is no Fedora build.
Questions, bugs, help setting it up
Waydesk is made by José Mendonça at StackCare, in Portugal. It is free software, licensed MIT or Apache-2.0 at your option; each package carries the licences of what it includes under /usr/share/doc/.