![\"Mascote](\"\/wp-content\/uploads\/2026\/10\/goguacamole-rdp-ssh-vnc-navegador-go.webp\")
<\/p>\n<\/p>\n
Anyone who has deployed Apache Guacamole<\/a> knows the package: Tomcat, the This post covers version 0.6.2<\/strong> (30 October 2026): what the project does, how it fits into guacd, how to bring it up in one minute with a single image, how to put it behind nginx, how to record and audit sessions, and how to migrate from the Java client. The code is at github.com\/jniltinho\/go-guacamole<\/a>, under the MIT license.<\/p>\n Apache Guacamole has two halves. The guacd<\/strong> daemon is the C daemon that speaks RDP, SSH, and VNC with the servers and translates everything into the Guacamole protocol. The guacamole-client<\/strong> is the Java web application that authenticates the user, stores connections and permissions, and delivers the screen to the browser. GoGuacamole rewrites only the second half:<\/p>\n Users, groups, connection folders, inherited permissions, history, recording, auditing, external login, and MFA come ready to use, without separate extensions. The interface has 16 themes and is available in English and Brazilian Portuguese.<\/p>\n The browser only communicates with goguacamole over HTTPS and WebSocket. goguacamole speaks the Guacamole protocol with guacd, which runs on a private network, and guacd opens the RDP, SSH, or VNC connection to the destination server. The connection's host, username, and password remain on the server, encrypted with AES-256-GCM; the browser never sees them.<\/p>\n Opening a session follows this path:<\/p>\n If the permission is revoked midway, the tunnel is closed immediately. Changes made by another process (the CLI or the importer) are detected within 5 seconds.<\/p>\n As of version 0.6.0, each release publishes to GHCR an image that combines guacd, goguacamole, and Redis in a single container, with SQLite on the volume To pin the version, use the tag Inside the container, supervisord keeps the three processes running as the user This HTTP mode is for local evaluation. For production, see the checklist further below.<\/p>\n To see a real session without touching any server, put GoGuacamole and a disposable OpenSSH on the same Docker network. The guacd from the all-in-one image resolves the target by container name. If the container from the previous section is still running, remove it first ( In the interface, go to Connections \u2192 New connection<\/strong>, choose SSH, host When finished, remove the lab:<\/p>\n For a long-lasting environment, the repository provides a guacamole-client<\/code> in Java, a JDBC extension for the database, another for LDAP, another for TOTP, another for recordings, each with its own configuration file. GoGuacamole<\/strong> is my new project to replace that part with a single Go binary<\/strong>, with the Vue interface 3 built in, keeping the same guacd<\/code> from Apache under the hood. You keep accessing servers via RDP, SSH, and VNC through the browser<\/strong>, but gain session recording, auditing, SSO, and MFA configured directly in the interface, and can import the Guacamole database you already have.<\/p>\nWhat Is GoGuacamole<\/h2>\n
\n
\/api\/v1<\/code>, WebSocket tunnel compatible with the guacamole-common-js<\/code> and the Guacamole protocol implemented directly, including the handshake with guacd (over TCP or TLS).<\/li>\nembed<\/code>, the same technique as the 5 part of the Vue.js + Go with Echo v5 series<\/a>.<\/li>\nguacamole\/guacd<\/code> 1.6 continues doing the heavy lifting for the protocols.<\/li>\n<\/ul>\n![\"Painel](\"\/wp-content\/uploads\/2026\/10\/goguacamole-painel.webp\")
<\/p>\nArchitecture: Who Talks to Whom<\/h2>\n
![\"Diagrama](\"\/wp-content\/uploads\/2026\/10\/goguacamole-arquitetura.webp\")
<\/p>\n\n
POST \/api\/v1\/sessions<\/code> with the connection ID. The server checks the session, the user's restrictions (account validity, access window), and the effective read permission.<\/li>\n\/api\/v1\/tunnel?ticket=\u2026<\/code> sending only screen parameters (width, height, DPI, time zone). The server validates the origin, redeems the ticket, and authorizes again.<\/li>\nBringing It Up in One Minute: The All-in-One Image<\/h2>\n
\/data<\/code>:<\/p>\ndocker run -d --name goguacamole -p 8080:8080 \\\n -v goguacamole-data:\/data ghcr.io\/jniltinho\/go-guacamole:allinone\n\n# a senha gerada do admin aparece uma \u00fanica vez no log\ndocker logs goguacamole 2>&1 | grep 'bootstrap administrator'<\/code><\/pre>\n0.6.2-allinone<\/code> (or 0.6-allinone<\/code>). Open http:\/\/localhost:8080<\/code>, enter with admin<\/code> with the login password and the system prompts for a new password on first access. Readiness can be checked via the API:<\/p>\ncurl -s http:\/\/localhost:8080\/ready\n# {\"db\":\"up\",\"guacd\":\"up\",\"queue\":\"up\"}<\/code><\/pre>\nguacd<\/code> (uid 1000), owner of the files in \/data<\/code>. Therefore, CLI commands run as -u guacd<\/code>:<\/p>\ndocker exec goguacamole supervisorctl status # guacd, redis, goguacamole\ndocker exec -u guacd goguacamole goguacamole user passwd admin\ndocker exec goguacamole goguacamole version<\/code><\/pre>\nTesting with a Lab SSH Server<\/h2>\n
docker rm -f goguacamole<\/code>), because the lab uses the same name and the same port:<\/p>\ndocker network create guac-lab\ndocker run -d --name goguacamole --network guac-lab -p 8080:8080 \\\n -v goguacamole-data:\/data ghcr.io\/jniltinho\/go-guacamole:allinone\ndocker run -d --name ssh-alvo --network guac-lab \\\n -e USER_NAME=demo -e USER_PASSWORD='troque-esta-senha' -e PASSWORD_ACCESS=true \\\n lscr.io\/linuxserver\/openssh-server:latest<\/code><\/pre>\nssh-alvo<\/code>, port 2222<\/code> (the image's port), user demo<\/code> and the password. Before saving, use Test connection<\/strong>: GoGuacamole opens a real connection through guacd using the form values and reports whether the host responded and whether the login worked. In my test, the correct password returned as success in about 200 ms, and the wrong one returned as an authentication failure, without saving anything. Then just save and click Connect<\/strong>: the terminal opens in a browser tab.<\/p>\ndocker rm -f goguacamole ssh-alvo\ndocker volume rm goguacamole-data\ndocker network rm guac-lab<\/code><\/pre>\nDocker Compose with Separate Services<\/h2>\n
docker-compose.yml<\/code> with goguacamole, guacd, and Redis in separate containers, and profiles for MariaDB, PostgreSQL, and test servers:<\/p>\ngit clone https:\/\/github.com\/jniltinho\/go-guacamole.git\ncd go-guacamole\ncp .env.example .env\n# no .env, defina APP_ADMIN_PASSWORD (8+ caracteres); a chave pode ser gerada assim:\nprintf 'APP_SECRET_KEY=%s\\n' \"$(openssl rand -hex 32)\" >> .env\nmake up # app + guacd + Redis, SQLite \u2192 http:\/\/localhost:8080<\/code><\/pre>\n
![\"Player](\"\/wp-content\/uploads\/2026\/10\/goguacamole-player-gravacao.webp\")
<\/p>\n