So how do I change the tomcat9 default path, that I don't have to use "vm.domain.com/guacamole" just "vm.domain.com"

Unfortunately, you don't. Not even the Guacamole Docker container does this.

I would configure Nginx to redirect from / to /guacamole/. You could also try reconfiguring Tomcat. Perhaps renaming the guacamole.war to ROOT.war is enough, but I vaguely remember that Tomcat is more tricky than that.

Looks like the Guacamole web frontend doesn't know it is being proxied, and generates some links to translation resources using an absolute path.

Also, a security note: absolutely do not run guacd (the guacamole-server component) as unconfined root or on a publicly accessible port. Guacd has no authentication, and could thus be used as an open proxy by attackers (also to look into your network). Guacd is also written in C, and not in an overly security-conscious manner. It is likely that the code contains quite some vulnerabilities.

The easiest way to harden guacd is to run it in a Docker container and to "bind" it to localhost (not 0.0.0.0). So instead of docker run --rm -p 4822:4822 my-guacd-image you might specify the port as -p 127.0.0.1:4822:4822, which only allows incoming connections from within the server. (But you might not want a separate network namespace at all, especially since this affects the destination IP address for your VNC connections. Then, use --net=host for Docker and set localhost in the guacd config file).

Instead of running in a container, it may be acceptable to use Systemd options for hardening, in particular running as a separate user. Use systemd-analyze security to get suggestions about Systemd features that might be beneficial.

I had a bit of hassle with Guacamole too.

I eventually got it working like this:

location / {
    proxy_pass                             http://guacamole:8080/guacamole/;
    proxy_buffering                        off;
    proxy_http_version                     1.1;
    proxy_cookie_path /guacamole/          /;
    proxy_set_header  X-Forwarded-Host     $host;
    proxy_set_header  X-Forwarded-Server   $host;
    proxy_set_header  X-Forwarded-For      $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto    $scheme;
    proxy_set_header  Host                 $host;
    proxy_set_header  Upgrade              $http_upgrade;
    proxy_set_header  Connection           $http_connection;
}

Happy to send you my docker-compose.yml if you want a copy.

Just want to know, does the copy paste and session recording work for you?

I've tried a couple of docker images, and dinner features are buggy..

• while you have to use the hosted mode the history function to show the actual use details
• ...the recording and copy/paste never seems to work, the option is there but the function first work