Install and first login

See it first

Install

Packages come from a signed apt repository. The first download cannot be verified by the repository itself, so compare its key with the fingerprint printed on the home page before you trust it.

$ curl -fsSLO https://waydesk.dev/apt/waydesk-repo.deb
$ sudo apt install ./waydesk-repo.deb
$ gpg --show-keys --with-fingerprint /usr/share/keyrings/waydesk-archive-keyring.gpg
$ sudo apt update
$ sudo apt install waydesk

waydesk is the server and the desktop (the shell, the dock, a file manager and a terminal). On a server that should only run the RDP part, waydesk-server alone is enough. The RDP port is closed to the network until you open it.

On Arch Linux

Arch (x86_64 and Arch Linux ARM) has its own signed repository, with the same key. It installs the server and its sessions (plain Sway, or the desktop you set for an account); the Waydesk shell, launcher and dock are Debian and Ubuntu packages.

$ curl -fsSL https://waydesk.dev/arch/waydesk.gpg | sudo pacman-key --add -
$ sudo pacman-key --lsign-key C64672B25ECD4773196C39589D8E8874E67617F4
$ printf '[waydesk]\nSigLevel = Required DatabaseRequired\nServer = https://waydesk.dev/arch/$arch\n' | sudo tee -a /etc/pacman.conf
$ sudo pacman -Syu waydesk-server
$ sudo systemctl enable --now waydesk-helper.service waydesk.service

Then make the first administrator as below. What was tested on Arch, and what was not: Other desktops.

The first administrator

There is no default account or password. waydesk-setup-admin makes the first administrator, the account that connects over RDP and manages the others:

$ sudo waydesk-setup-admin

It asks for an account name (lower case letters, digits, - and _), a password of at least ten characters (this is the RDP password), and then how you will connect:

1. From this machine, or through an SSH tunnel (the default: the port stays closed to the network).
2. From computers on this server's local network (the port opens to that network only).
3. Over a WireGuard VPN, made now (the port opens to the VPN only).

It also prints the fingerprint of the server's RDP certificate. Write it down: your client shows it on the first connection, and a client that does not compare can be fooled by a man in the middle. For scripts, --name NAME --password-stdin --access local|lan|vpn does the same without questions.

Connect

The default needs one command on your own computer. It forwards a local port to the server's closed one:

$ ssh -N -L 3389:127.0.0.1:3389 you@your-server  # keep this running

Then point the RDP client at localhost and log in as the account you made. If your computer already uses port 3389, forward 13389 instead and connect to localhost:13389. The Connect page has the other ways (a local network, a VPN, certificates you can verify).

Clients that were tried: the Windows App on macOS, mstsc on Windows 11 (ARM, in a VM) and FreeRDP (Debian 13's sdl-freerdp, version 3.15). Ubuntu's own xfreerdp3 3.32 cannot decode the H.264 stream; use Remmina or Debian's client there.

See what it does

$ sudo waydesk-admin status
Memory    62.6 GB in all, 54.6 GB available
Swap      none
Load      1.00 1.41 1.45 (8 cores)
System    Omarchy, kernel 7.2.11-arch1-1
GPU       Intel Kaby Lake-S GT2 [HD Graphics 630] (i915, renderD128): 2 % busy
            sessions and inference; 4 sessions: alice, bob, carol, dave
          new sessions use: auto
AI        127.0.0.1:11434: answering, no model loaded; 0 connections open
Desktop   sway for new sessions (WAYDESK_COMPOSITOR: sway, or hyprland, which needs a GPU)
Sessions  4 running; a new one would be accepted (needs 9.4 GB available)

ACCOUNT            DESKTOP   SESSION     MEMORY    SWAP    CPU    LIMIT RENDER     ENCODER                      AI   PROGRAMS (resident)
alice              sway      running     230 MB       -     4%  31.3 GB renderD128 vaapi@renderD128 q18 2fps    -    sway 273 MB, waydesk-server 172 MB, foot 32 MB
bob                plasma    running     660 MB       -     3%  31.3 GB renderD128 vaapi@renderD128             -    Xwayland 506 MB, plasmashell 473 MB, kwin_wayland 409 MB
carol              cosmic    running     920 MB       -     3%  31.3 GB renderD128 vaapi@renderD128             -    Xwayland 508 MB, cosmic-app-libr 313 MB, cosmic-launcher 313 MB
dave               hyprland  running     866 MB       -     6%  31.3 GB renderD128 vaapi@renderD128             -    quickshell 567 MB, Hyprland 363 MB, Xwayland 253 MB

Real output from the Intel test server (an i7-7700 with an HD 630, running Arch): four accounts, one on each desktop, all drawn on the GPU and encoded by VAAPI. The DESKTOP column says which desktop each account runs. The systems and clients tried so far are on Limits and status.

What you get

• A desktop of your own for every account, with a shell, a dock, a file manager and your applications. Reconnect and the windows are where you left them: closing the RDP window does not end the session.
• The size follows the client. A Retina Mac or a laptop at 200 % scaling gets a sharp picture, and the window resizes live.
• Chromium is installed with the desktop (from Flathub on Ubuntu). waydesk-setup, run as your own account, offers browsers, office, developer and creative applications.
• Windows are floating: drag a title bar, use the three dots for minimise, maximise and close. Super+Up maximises, Super+Down minimises, Super+Shift+Up brings every window entirely back on the screen.

Add more people

Administrators make the other accounts:

$ sudo waydesk-admin users add alice
made alice (uid 1000), groups: waydesk-users
temporary password (shown once): ************
The account should change it at once: Change password, in the desktop's power menu.
$ sudo waydesk-admin users limit alice --memory 4G
$ waydesk-admin status

A new session is refused when the machine would run out of memory, so one account cannot take everyone else down. The command line page shows every command with its real output, and the GPU page what changes on a machine with a graphics card.