[server]

Server connection settings.

Key	Type	Default	Description
listen_addr	string	"[::]:3389"	IP:PORT to bind. `"[::]:3389"` is dual-stack (IPv4 + IPv6); use `"0.0.0.0:3389"` to force IPv4-only
max_connections	integer	10	Maximum concurrent connections (0 = unlimited)
session_timeout	integer	0	Session timeout in seconds (0 = none)
use_portals	boolean	true	Use XDG Desktop Portal capture/input where available

[server]
# IP:PORT. Use "[::]:3389" for dual-stack (IPv4 + IPv6); "0.0.0.0:3389" is IPv4-only.
listen_addr = "[::]:3389"
max_connections = 10 # 0 = unlimited
session_timeout = 0 # seconds, 0 = none
use_portals = true
# view_only = false

Unified transport: `[server.transports]` (optional)

A single accept layer takes TCP, Unix socket, AF_VSOCK, and WebSocket connections. AF_VSOCK enables Hyper-V Enhanced Session Mode (vsock Cargo feature); WebSocket and RDCleanPath serve browser and WASM clients (websocket feature, experimental in 1.4.4). When this table is absent, the server binds TCP on server.listen_addr.

[security]

Security and authentication settings.

Key	Type	Default	Description
cert_path	string	"/etc/lamco-rdp-server/cert.pem"	TLS certificate path. Self-heals: regenerated at startup if absent
key_path	string	"/etc/lamco-rdp-server/key.pem"	TLS private key path
enable_nla	boolean	false	Network Level Authentication. Requires `auth_method = "pam"`
auth_method	string	"none"	`"none"` = no auth (trusted networks or Flatpak); `"pam"` = system accounts (native installs only)
require_tls_13	boolean	false	Reject clients that cannot negotiate TLS 1.3

[security]
cert_path = "/etc/lamco-rdp-server/cert.pem" # self-heals if absent
key_path = "/etc/lamco-rdp-server/key.pem"
enable_nla = false # NLA requires auth_method = "pam"
# "none" = no auth (trusted networks / Flatpak); "pam" = system accounts (native only)
auth_method = "none"
require_tls_13 = false

No IP allowlist setting. There is no allowed_ips or CIDR filtering in the server. Restrict access by source IP at the host firewall instead.

[video]

Video encoding settings.

Key	Type	Default	Description
codec	string	"avc420"	Video codec (avc420, avc444)
encoder	string	"auto"	Encoder (auto, software, vaapi, nvenc)
quality	integer	80	Quality 1-100
max_fps	integer	60	Maximum frame rate

[audio]

Audio streaming settings (v1.2.0+).

Key	Type	Default	Description
enabled	boolean	true	Enable audio streaming
codec	string	"opus"	Audio codec
sample_rate	integer	48000	Sample rate in Hz
frame_ms	integer	20	Frame size (milliseconds)
opus_bitrate	integer	64000	Opus bitrate in bits per second

[audio]
enabled = true
codec = "auto" # auto | opus | pcm | adpcm
sample_rate = 48000
channels = 2
frame_ms = 20
opus_bitrate = 64000

[egfx]

Extended Graphics Framework (EGFX) pipeline settings for RDP 8+ clients.

Key	Type	Default	Description
enabled	boolean	true	Enable EGFX pipeline
codec	string	"auto"	EGFX codec (auto, avc420, avc444)
aux_omission	boolean	true	Omit auxiliary data for bandwidth savings

[egfx]
enabled = true
codec = "auto"
aux_omission = true

[capture]

New in 1.4.4. Settings for the portal-generic (direct Wayland) capture strategy.

Key	Type	Default	Description
protocol	string	"auto"	`auto`, `ext`, or `wlr`
allow_fallback	boolean	true	Fall back to `wlr-screencopy` if the preferred protocol does not complete
handshake_timeout_ms	integer	5000	How long to wait for a capture protocol handshake before falling back

Some compositors advertise ext-image-copy-capture-v1 but never complete the handshake (Hyprland 0.54 and later). The server waits handshake_timeout_ms, then falls back to wlr-screencopy.

[monitoring]

New in 1.4.4. Optional Prometheus /metrics and JSON /health HTTP endpoints. Active only when the server is built with the metrics-server Cargo feature.

Key	Type	Default	Description
enabled	boolean	false	Enable the HTTP metrics server
snapshot_interval_secs	integer	5	How often health sensors are snapshotted
metrics_bind	string	"127.0.0.1:9100"	Bind address for `/metrics` and `/health`

[performance]

Performance tuning and frame delivery settings. Also see [performance.adaptive_fps] and [performance.latency], and [hardware_encoding] for VA-API, NVENC, and the Vulkan Video backend.

Key	Type	Default	Description
latency_mode	string	"balanced"	Latency governor mode (low, balanced, quality)
min_fps	integer	5	Minimum frame rate floor
max_fps	integer	60	Maximum frame rate ceiling
damage_tracking	boolean	true	Only encode changed screen regions

[performance]
latency_mode = "balanced"
min_fps = 5
max_fps = 60
damage_tracking = true

[input]

Keyboard, mouse, and touch input settings.

Key	Type	Default	Description
keyboard_layout	string	"auto"	Keyboard layout (auto, us, de, fr, etc.)
mouse_acceleration	boolean	false	Enable mouse acceleration
touch_enabled	boolean	true	Enable touch input support

[input]
keyboard_layout = "auto"
mouse_acceleration = false
touch_enabled = true

[clipboard]

Clipboard sharing settings between RDP client and server.

Key	Type	Default	Description
enabled	boolean	true	Enable clipboard sharing
protocol	string	"auto"	`auto`, `ext` (ext-data-control-v1), or `wlr` (wlr-data-control-v1)
file_transfer_mode	string	"auto"	`auto`, `fuse`, `staging`, or `portal`

[advanced]

Advanced settings for PipeWire integration and GPU buffer management. Change only if you understand the implications.

Key	Type	Default	Description
pipewire_buffer_count	integer	4	Number of PipeWire buffers for frame capture
dmabuf_enabled	boolean	true	Enable DMA-BUF for zero-copy GPU buffer sharing
explicit_sync	boolean	true	Enable explicit GPU synchronization (requires kernel 6.8+)

[advanced]
pipewire_buffer_count = 4
dmabuf_enabled = true
explicit_sync = true

[logging]

Log output settings for diagnostics and debugging.

Key	Type	Default	Description
level	string	"info"	Log level (error, warn, info, debug, trace)
file	string	""	Log file path (empty = stderr only)

[logging]
level = "info"
file = "" # Log to stderr; set a path to also write to file

Configuration Reference