Build an isolated Apache Guacamole gateway with Ubuntu 24.04, LXD, Docker Compose, PostgreSQL, TOTP, and controlled application networks.
Publish Apache Guacamole through Nginx with TLS, WebSocket proxying, real-client addressing, and a backend restricted to the reverse proxy.
Connect a private Windows VM through a controlled guacd network, endpoint firewall allowlist, NLA, and a dedicated non-administrator RDP account.