wrdp accepts RDP connections on one listener and gives each authenticated local user an isolated, managed Wayland desktop. It owns those sessions; it does not expose an existing GNOME or KDE login.
IronRDP handles the wire protocol, capability negotiation and dynamic channels. WRDP connects it to authentication, per-user session lifecycle, the managed compositor, capture, encoding, input, audio and clipboard services.
The server negotiates TLS and RDP, validates credentials through PAM or configured Argon2id password hashes, then binds the user and negotiated desktop size to a new or healthy existing session. Authentication does not start a compositor; session binding happens only after it succeeds.
A session-manager library inside wrdp starts one modified labwc compositor per user and persists process state for reconnects. The compositor exposes a headless Wayland output, which is resized before capture. Frames use DMA-BUF when possible and SHM otherwise; PipeWire supplies audio.
A single TCP endpoint serves independent per-user desktops. Session reuse preserves process identity and reapplies the connecting client's geometry.
Each user receives a headless compositor with a small terminal and optional Waybar. Sessions run separately from host graphical logins and never fall back to another user's desktop.
Prefers EGFX AVC420 or AVC444, with optional VA-API, software H.264 fallback and bitmap updates when EGFX is unavailable.
Wayland or EIS injects keyboard and pointer input; Advanced Input owns mouse delivery while active to prevent duplicate clicks. Output management and data-control protocols handle resize and clipboard operations.
PipeWire redirects the managed session's audio through RDPSND and remains available to portal-backed capture paths.
wrdp runs the server, wrdp-sesman exposes session management for supervision and manual operations, and wrdpctl inspects or controls persisted session state.
Production connections always use TLS. PAM is the normal authentication mode; static-password deployments require Argon2id hashes. NLA/CredSSP and domain authentication are not included in this release.
The first public release is installed from source and targets dedicated systemd Linux hosts. Distribution packages are not yet published.