Why host your own remote desktop server
With a commercial solution like TeamViewer, every session passes through the vendor's servers — your data no longer fully belongs to you. Self-hosted RustDesk reverses that: traffic is end-to-end encrypted with Ed25519 and ChaCha20, and never leaves your infrastructure. For agencies, internal IT teams, or service providers accessing sensitive machines, this is as much a compliance requirement as a cost decision. A ServOrbit VPS starting at 99 DH/month/month is enough to host the signaling server.
What self-hosted RustDesk gives you
- Data sovereignty — your sessions only pass through your own server; no third party can intercept or record them
- Guaranteed end-to-end encryption — Ed25519 for key exchange, ChaCha20 for the stream: cryptographic verification is structural, not just a claim
- Cross-platform without friction — clients available on Windows, macOS, Linux, Android, iOS and web browser, all pointing to a single central server
- Built-in terminal access — in addition to graphical remote control, RustDesk exposes a direct terminal on the remote machine, useful for server maintenance
- Zero SaaS subscription — once the server is deployed, your only ongoing cost is the VPS; no per-seat license, no annual renewal
VPS requirements
A VPS with 1 GB of RAM is enough to run both RustDesk server binaries: hbbs (ID server) and hbbr (relay server). You will need Docker and Docker Compose installed, a dedicated public IP — included with all ServOrbit VPS plans — and TCP ports 21115, 21116, 21117 plus UDP port 21116 open in your instance's firewall rules.
Deploy RustDesk Server in four steps
Create the docker-compose.yml file
Create a dedicated directory, for example /opt/rustdesk, then place a docker-compose.yml file inside it with two services: hbbs (image rustdesk/rustdesk-server, command hbbs, ports 21115-21117 TCP and 21116 UDP) and hbbr (same image, command hbbr, port 21117 TCP). Mount a shared /data volume so both services use the same key pair generated on first startup.
Open ports in the VPS firewall
From the ServOrbit panel or using ufw, allow inbound TCP ports 21115, 21116, 21117 and UDP port 21116. If your VPS sits behind a cloud security group, apply the same rules at the network level. Confirm with ss -tlnup that both processes are listening on the correct ports after the containers start.
Retrieve the server public key
On first launch, hbbs generates an Ed25519 key pair. Retrieve the public key from the container logs: docker logs <hbbs_container_name> and look for the line starting with Key:. This key is required for clients to verify your server's authenticity — store it in a secrets manager or a secure file before inviting your first users.
Configure the RustDesk client
On each client machine, open RustDesk's network settings and enter your VPS public IP address in both the 'ID Server' and 'Relay Server' fields. Paste the public key retrieved in the previous step into the 'Key' field. The client will refuse the connection if the key does not match — this is the protection against unauthorized servers. Once configured, every session stays entirely on your infrastructure.
To retrieve the public key after first startup, run docker logs <hbbs_container_name> and look for the Key: ... line in the early output. Without this key, RustDesk clients will refuse to connect — this is the mechanism that ensures your users are connecting to your server and not an intermediary. Record it immediately after deployment and store it in a secure location before inviting your first users.
