Self-Hosted Encrypted Remote Desktop on Windows 11: RustDesk + Tailscale + WSL2
TLDR: Replace expensive, privacy-risking remote desktop tools with a free, encrypted, self-hosted stack. Zero public ports. No port forwarding. Dockerized RustDesk server running on WSL2, accessible only through your private Tailscale tailnet.
The Problem
TeamViewer and Anydesk want your money and/or data. Chrome Remote Desktop phones home to Google. And both ask you to trust their servers with your screen data. NO THANKS!
I wanted free, open-source, encrypted end-to-end, and no public attack surface.
This setup replaced my paid remote desktop subscription and it's:
- ✅ Free forever
- ✅ Encrypted end-to-end
- ✅ No vendor lock-in
- ✅ Open-source code
Here's how I built it!
The Stack
has everything you need:
- Full
docker-compose.ymlwith S6-overlay (hbbs + hbbr in one container) - Complete prerequisite checklist
- Client configuration for every platform
- Verification commands and troubleshooting
- Maintenance & upgrade procedures
📋 Check out the full guide on Github!
⭐ Star it if it saves you a subscription fee.
Quick Wins You'll Appreciate
| Before | After |
|---|---|
| Dynamic DNS services | myhost.tailnet-name.ts.net — set and forget |
| Let's Encrypt cert anxiety | Not needed — private names, private trust |
| Firewall port juggling | Zero inbound rules |
| "Did I leave that port open?" | Impossible by design |
Feedback Welcome
This is the stack I run daily. If you hit edge cases, spot improvements, or want to see additional integrations (Ansible? Terraform? Proxmox?), report an issue or open a PR.
SOCIAL SHARE CARD GENERATOR