Install Guacamole on Docker with Traefik, Postgres and 2FA

21-01-2023 3 min read Article

Note

I finally found how to get Wake on LAN working from Guacamole in docker, check out this guide.

Note

If you want to install Guacamole with mySQL database check out this guide.

Remotely accessing an SSH terminal or graphics session with VNC/RDP can be very useful. Particularly if you have a lot of devices and if you regularly change your workstation. Guacamole is one of the open source solutions on the market. Unfortunately there is not a single docker container to install and it’s not easy to find a complete guide for installation from start to finish.

Below I’ve created a small guide to install Guacamole with a postgres database for user management and integration with Traefik to have an https connection.

Requirements

Working installation of Traefik and related certificates for https (see basic example)
Access with SSH to the machine where docker is installed

Installation procedure

Postgres database

Generate initialization file for postgres database (may need sudo)

docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --postgres > initdb.sql

The generated file must be passed (linked as a volume) to the database to import the structure needed for Guacamole
Launch and create the database container (you may need sudo)

docker-compose up -d guacamole-db

Guacamole

Create the two Guacamole containers by running the following command (you may need sudo). Given the dependencies of the various containers, both will be created.

docker-compose up -d guacamole

Guacamole is up and running and you can connect to the interface at: https://guacamole.example.com First login details are:
- user: guacadmin
- password: guacadmin
I suggest you duplicate the default account and create a new administrator account. Then login with the new account and delete the default one.

2FA for Guacamole

Since version 1.3.0 TOTP is integrated into the docker container (PR 471), unfortunately the documentation has not been updated yet.

When the Guacamole installation is working, it is recommended to enable 2-factor authentication (2FA).
Add the parameter TOTP_ENABLED: 'true' to the guacamole container. At the first login you will be presented with the QR to activate 2FA and asked to enter a code to confirm.

Docker compose

    guacd:
    image: guacamole/guacd
    container_name: guacd
    hostname: guacd
    restart: unless-stopped
    volumes:
      - /volume1/docker/guacamole/guacd/drive:/drive:rw
      - /volume1/docker/guacamole/guacd/record:/record:rw

  guacamole:
    image: guacamole/guacamole
    container_name: guacamole
    hostname: guacamole
    restart: unless-stopped
    depends_on:
      traefik:
        condition: service_started
      guacamole-db:
        condition: service_started
      guacd:
        condition: service_started
    environment:
      GUACD_HOSTNAME: guacd
      POSTGRES_HOSTNAME: guacamole-db
      POSTGRES_DATABASE: guacamole_db
      POSTGRES_USER: guacamole_user
      POSTGRES_PASSWORD: ${GUACAMOLE_PASSWORD}
      #TOTP_ENABLED: 'true'
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.guacamole.rule=Host(`guacamole.${DOMAIN}`)'
      - 'traefik.http.routers.guacamole.entrypoints=web-secure'
      - 'traefik.http.routers.guacamole.tls=true'
      - "traefik.http.routers.guacamole.tls.certresolver=certificato"
      - "traefik.http.routers.guacamole.tls.domains[0].main=*.${DOMAIN}"
      - "traefik.http.routers.guacamole.service=guacamoleService"
      - "traefik.http.routers.guacamole.middlewares=guacamoleMdl"
      - "traefik.http.middlewares.guacamoleMdl.addprefix.prefix=/guacamole"
      - "traefik.http.services.guacamoleService.loadBalancer.server.port=8080"

  guacamole-db:
    container_name: guacamole-db
    image: postgres:12-alpine
    hostname: guacamole-db
    environment:
      POSTGRES_DB: guacamole_db
      POSTGRES_PASSWORD: ${GUACAMOLE_PASSWORD}
      POSTGRES_USER: guacamole_user
      TZ: ${TIME_ZONE_ZUERICH}
      PGDATA: /var/lib/postgresql/data/pgdata
    logging:
      driver: "none"
    restart: unless-stopped
    volumes:
      - ./initdb.sql:/docker-entrypoint-initdb.d/initdb.sql           #DB configuration file
      - /volume1/docker/guacamole/database:/var/lib/postgresql/data/pgdata

Credits Image Steve Buissinne from Pixabay