oehrlis / guacamole

Container based Guacamole setup

Docker based Guacamole Configuration

This repository contains the mock example for setting up a docker-based guacamole server with an nginx reverse proxy and let's encrypt certificates. The purpose of this project is to provide a guacamole server on OCI bastion hosts for Trivadis Training environments. It is based on the following official docker images:

• guacamole/guacamole-server Apache Guacamole is a clientless remote desktop gateway supporting protocols like VNC and RDP..
• guacamole/guacd The native server-side proxy used by Apache Guacamole.
• mysql/mysql-server Optimized MySQL Server Docker images. Created, maintained and supported by the MySQL team at Oracle.
• nginx Official build of Nginx.
• certbot/certbot Official build of EFF's Certbot tool for obtaining TLS/SSL certificates from Let's Encrypt.

Installation

1. Install docker and docker-compose. See Install Docker Compose

2. Clone this repository: git clone https://github.com/oehrlis/guacamole.git.

3. Modify configuration

   • Update the .env or define the corresponding environment variables.
   • Review and update docker-compose.yml
   • Define the following environment variables:
     • EMAIL - Adding a valid address for certificate renewal (default none)
     • HOSTNAME - Define a hostname for the nginx server and certificate name (default: $(hostname))
     • DOMAINNAME - Define a domain name for nginx server and certificate name (default: trivadislabs.com)
     • STAGING_ENABLE - Set STAGING to 1 if you're testing your setup to avoid hitting request limits is certification

4. Run the script prepare_initdb.sh to prepare the database initialisation scripts

   cd guacamole
   ./bin/prepare_initdb.sh

5. Startup the guacamole services. Currently required to make nginx happy.

   docker-compose up -d guacamole mysql guacd

6. Run the script prepare_certs.sh to initiate an initial certification request.

   export EMAIL="[email protected]"
   export STAGING_ENABLE=1
   ./bin/prepare_certs.sh

7. Finally start all container

   docker-compose up -d

Alternatively you can run the script setup_guacamole.sh to execute most of the steps above.

git clone https://github.com/oehrlis/guacamole.git
cd guacamole
export EMAIL="[email protected]"
export STAGING_ENABLE=1
./bin/setup_guacamole.sh

Issues

Please file your bug reports, enhancement requests, questions and other support requests within Github's issue tracker.

• Questions
• Open enhancements
• Open bugs
• Submit new issue

How to Contribute

1. Describe your idea by submitting an issue
2. Fork this respository
3. Create a branch, commit and publish your changes and enhancements
4. Create a pull request

License

Copyright (c) 2019, 2020 Trivadis AG and/or its associates. All rights reserved.

The Trivadis Terraform modules are licensed under the Apache License, Version 2.0. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.

Related Documentation, Blog

• step-by-step guide on how to set up nginx and Let’s Encrypt with Docker
• Terraform OCI Provider Documentation
• Terraform Creating Modules

guacamole's Issues

Guacamole with Keycloak as Open ID connect authentication

Hi there,

I have been working with guacamole from past couple of weeks using quite similar setup you did. Tried to access the guacamole web UI after introducing keycloak to it as Open ID connect authentication server for the more secured login. I was able to get into it but not sure why I was not getting the user with admin privilege after authenticated from keycloak. I was not able to set up the new connection as well. It was just having read only access. I am trying to get the possible solution for it but thought to post here as an issue. Hoping to get input from you.

Enabling Authentication Extensions

How might one go about enabling the authentication extensions that are built into the docker image (eg DUO, TOTP, etc)?