N3X
PLEN
Self-hosted10 min readUpdated:

Self-hosted remote support with Docker: architecture and security

A web panel on port 443 is not the whole platform. Reliable remote support needs signaling, TURN, agent control and explicit access policy.

A self-hosted support platform keeps the control plane, inventory and audit under your control, but the web layer and session transport must be considered separately. A reverse proxy on port 443 does not replace TURN for restrictive NATs.

Platform layers

A typical stack contains a Control Center, API and WebSocket signaling, a private device database, endpoint agents and TURN. Desktop media can flow peer to peer or fall back to a TURN relay.

  • The reverse proxy terminates HTTPS and forwards WebSocket upgrades.
  • The database should not expose a public port.
  • TURN needs explicit TCP/UDP and relay-range firewall rules.
  • Agents initiate outbound connections, simplifying endpoint firewalls.

Attended and unattended access

One-time support should show the recipient who is requesting access and which permissions are requested. Unattended access requires prior enrolment, device policy and an immediate revocation path.

Beyond the desktop

A mature agent can provide an audited terminal, files, hardware inventory and bounded package operations without opening the desktop. Each capability needs a separate permission, reason and outcome record.

  • Do not retain terminal contents without a clear policy.
  • File transfer must confirm overwrites.
  • Install and uninstall actions need bounded execution and audit.
  • Revoking a device and remotely uninstalling its agent are separate decisions.

Before publishing the server

  • Enable HTTPS, WebSocket and operator MFA.
  • Test both P2P and TURN from an external network.
  • Restrict database and application ports.
  • Test agent install, update and revocation.
  • Review terminal, file and package audit events.

Put it into practice

Configure N3XRemote Server

Generate a Compose stack for your infrastructure and manage agents from the browser.

Configure N3XRemote Server

Frequently asked questions

Can everything use port 443?

The panel and signaling can. Typical TURN still requires direct UDP/TCP and relay ports. TURN over TLS on 443 is possible but needs deliberate design and port sharing is not always straightforward.

Does a public Docker image expose source code?

It exposes analysable runtime artefacts but does not have to contain the source repository. A container is never a safe place for embedded secrets.

What should revoke do?

At minimum, invalidate access immediately. A separate explicitly confirmed action may instruct an online agent to uninstall itself safely.