RustDesk now supports true unattended remote access on Wayland

Re:RustDesk now supports true unattended remote access on Wa... by preisschild on Saturday August 15, 2026 @09:29AM (#49310384)

I just have envoy proxy with the oauth + jwt filter in front of those services. Envoy does the oidc flow with pocket-id so I can use passkeys for authN. Envoy validates the resulting token and does authorization via ACL. Envoy then sends an authorization bearer jwt with the oidc id_token jwt to the backend (for example grafana). Grafana parses and validates the jwt and sets claims as userinfo (username, groups, email).

I think such setups are at least as secure as having tailscale in front of it and they are web standards conform. I dont need a client app like tailscale, I can just use my normal browser and internet conn.

I always make sure envoy/all other apps are on the latest security patcb anyways.

[ Parent | on HN ]

Re:RustDesk now supports true unattended remote access on Wa... by mnahkies on Saturday August 15, 2026 @10:28AM (#49310875)

It's funny you say that, as one of my weekend projects today is setting up https://www.authelia.com/ to achieve the same.

I probably won't allow everything through it (eg: postgres, clickhouse etc can stay on tailscale), but I've been stumbling into use cases where I want to share things with friends or colleagues, and I don't want to put them on my tailnet.

[ Parent | on HN ]

Re:RustDesk now supports true unattended remote access on Wa... by preisschild on Sunday August 16, 2026 @07:01PM (#49324665)

You can use the great oauth2-proxy as a forward auth proxy to archive that if you use nginx btw, i did that before envoy.

[ Parent | on HN ]