Kaburu Wiki

# RustDesk Self-Hosted Relay Server

Self-hosted RustDesk relay server running on kabururd (Hetzner CX23, 46.224.187.74 — moved 2026-08-05 from kaburusvr for blast-radius isolation). Provides private relay infrastructure for remote desktop access across all managed clients, avoiding reliance on RustDesk public servers.

—

## What it does

RustDesk requires two server components:

- hbbs - ID/rendezvous server. Clients register here and discover each other. - hbbr - Relay server. Proxies traffic when direct peer-to-peer is not possible.

Both run as Docker containers on kaburusvr.uk using host networking.

—

## Location and files

—

## Docker setup

Image: rustdesk/rustdesk-server:latest (version 1.1.16 as of 2026-08-05) Network mode: host - containers share the server network stack directly. Restart policy: unless-stopped

The -r kaburu.cc argument on hbbs tells it which relay host to advertise to clients. Both containers share the same ./data volume.

—

## Ports used (host network)

21118/21119 are web-client only (browser-based access). Steve uses the desktop app, so they're closed at UFW to cut attack surface. Reopen with `ufw allow 21118/tcp && ufw allow 21119/tcp` if browser access is ever needed.

No fail2ban jail for hbbs/hbbr — their logs contain no failure signatures (all INFO: registration, relay pairing), so there's nothing to ban on. Rate-limited UDP 21116 instead.

—

## Client configuration

In the RustDesk client under Settings > Network > ID/Relay Server:

- ID Server: kaburu.cc - Relay Server: kaburu.cc - Key: contents of /opt/rustdesk/data/id_ed25519.pub

—

## History / move-back consideration (2026-08-05)

RustDesk originally lived on a DigitalOcean droplet (~$6/mo); moved to kaburusvr in May 2026 to save ~$5/mo. Moved back to a dedicated Hetzner CX23 (kabururd, 46.224.187.74, €5.49/mo + €0.50 IPv4) on 2026-08-05 — full blast-radius isolation from the production box (25 sites + mail + DNS). Same key, same hostname (kaburu.cc A record repointed), zero client reconfiguration. Old relay on kaburusvr kept running for 48h overlap, then decommissioned. See log 2026-08-05.

## kabururd (new home, since 2026-08-05)

- Hetzner CX23, Ubuntu 26.04 LTS, Nuremberg (same DC as kaburusvr) - Tailscale: 100.122.46.3, tag `server-hetzner` (matches kaburusvr ACL rules) - SSH: Tailscale-only (100.64.0.0/10) — same doctrine as kaburusvr - UFW: 21115/21116/21117 public, 21116/udp LIMIT, 21118/21119 blocked - Data at /opt/rustdesk/data (key + DB copied from kaburusvr — same id_ed25519) - ⚠️ Backup NOT yet wired to TrueNAS — next item

—

## Management commands

Check status:

cd /opt/rustdesk && docker compose ps

View logs:

docker logs rustdesk-hbbs --tail 50
docker logs rustdesk-hbbr --tail 50

Restart:

cd /opt/rustdesk && docker compose restart

Stop and start:

cd /opt/rustdesk && docker compose down
cd /opt/rustdesk && docker compose up -d

Update image:

cd /opt/rustdesk && docker compose pull && docker compose up -d

—

## Key backup

The id_ed25519 private key in /opt/rustdesk/data/ is critical. If lost, all clients need reconfiguring with a new key. Include this directory in server backups. Do not store the key value in this wiki - reference by path only.

—

## Notes

- Both containers use the same image; role is set by command (hbbs vs hbbr). - Host networking avoids Docker NAT issues with UDP on port 21116. - Set up 2026-05-05. Running stably as of 2026-05-12.

—

## Clients

### kaburu-a05m (DECOMMISSIONED 2026-07-04 — screen flicker hardware defect)

Replaced by: kaburu-laptop — Dell Precision 17“, Mint.