InfoHub
PDF

SDE gateway settings reference

By Paul Flanders · · Intermediate

This article provides a comprehensive reference for configuring the SDE gateway settings, covering aspects such as Guacamole connection, gateway address, and native RDP behaviour. It's aimed at engineers managing SDE sites.

Every setting the SDE gateway reads (rdpgw and the broker, in the sde-gateway unit), with its default, and the version list sde-install works from.

Applies to: the sde-gateway unit (sde-remote-gateway) · Audience: engineers configuring or supporting an SDE site · Time: reference

1. The settings file

The gateway's settings are environment variables in one file on the GLServer host:

/var/glitch-units/sde-gateway/glitch/config/enviroment
  • One NAME=value per line. A line starting with ; is a comment. Quote values with spaces: SDE_LDAP_BASE_DN="DC=lab,DC=local".
  • The file holds secrets. Keep it mode 600 (Check reports anything else).
  • On/off settings are on when set to true, yes or 1. Anything else, or unset, is off (except where a default of on is shown).
  • Durations are written like 20s, 5m, 1h or 9600h.
  • The gateway reads its settings when the container is created. After a change, recreate it: 
    gl -d sde-gateway && docker rm -f sde-gateway && gl -s sde-gateway
docker exec sde-gateway /opt/rdpgw/sde-selftest.sh

In the Notes column, sde-install sets it means the installer writes the value (see Installing an SDE site). A value you've set yourself is kept unless the note says otherwise.

2. Guacamole connection

Setting What it does Default Notes
SDE_GUAC_URL Where the broker reaches Guacamole's REST API, internally. None: required The address with /api directly under it. sde-install sets http://guacamole:8080. A Guacamole served under /guacamole needs that path included.
SDE_GUAC_ADMIN_USER The Guacamole service account the broker uses to read a connection's real host and settings. None: required sde-install sets gua_srv. Needs ADMINISTER. Hidden from the usage report.
SDE_GUAC_ADMIN_PASS That account's password. None Secret. sde-install sets it.

3. Gateway address and keys

Setting What it does Default Notes
SDE_GATEWAY_HOST The public address the app's native RDP connects to (through nginx). Also the name on rdpgw's own self-signed certificate. None: required (the container won't start without it) The site FQDN, never a container name. sde-install sets it only if it's empty.
SDE_GATEWAY_PORT The port clients reach the gateway on. 443 sde-install sets 443.
SDE_LISTEN Where the broker listens inside the container. :8095 Leave as it is: nginx expects 8095.
SDE_TOKEN_SIGNING_KEY Signs the short-lived (5-minute) tokens the broker gives the app for rdpgw, and the streaming host tokens. A new random key on each start Must be exactly 32 characters, unquoted (for example openssl rand -hex 16): rdpgw replaces any other length with a random key and every native RDP launch fails. Pin it if streaming host tokens must survive a restart. sde-install sets a 32-character value.
TZ The container's time zone (log times). As the template: Europe/London  

4. Native RDP behaviour

Setting What it does Default Notes
SDE_NATIVE_CREDENTIALS Set to app to make native RDP always sign in with the user's own SDE Remote sign-in. Unset: follow the connection Unset, native RDP signs in the way the browser does, from the Guacamole connection's Username: ${GUAC_USERNAME} = the user's own sign-in; blank = the RDP client asks; a stored name = prefilled, and the client asks for its password (a stored password is never handed out).
SDE_RDS_HOSTS An RDS farm: the Connection Broker and every session host, as host:port, comma-separated. When a connection's host is in the list, the token covers the whole list, so the client can follow the Connection Broker's redirect. Unset Entries must match exactly what RDS redirects to (see the FreeRDP log's TargetFQDN). The Guacamole connection also needs its load-balancing cookie set.
SDE_DISABLE_SERVER_PROBE Turns off the check that asks each target what kind of RDP server it is. Off (the probe runs) The probe is one RDP negotiation request, no sign-in, with a 1.5-second limit; the answer is kept for an hour (2 minutes if the host didn't answer). When a target is xrdp, the app's Auto quality uses RemoteFX instead of H.264. With the probe off, apps keep their own default.

5. Lock-downs

Native RDP otherwise takes clipboard, drive, printing and audio from each Guacamole connection's own settings. These force them off for every native RDP session and desktop pool launched from the app, whatever a connection says. Browser (Guacamole) sessions keep following the connection's settings.

Setting What it does Default Notes
SDE_DISABLE_REDIRECTIONS All four below off. Off The master switch.
SDE_DISABLE_CLIPBOARD Clipboard off. Off sde-install asks for these on a new gateway (Turn off for every connection) and writes true or false for each. The broker's AUDIT authorize log line shows the result per session (clipboard=false and so on).
SDE_DISABLE_DRIVE Drive redirection (file transfer) off. Off
SDE_DISABLE_PRINTING Printing off. Off
SDE_DISABLE_AUDIO Audio off. Off

With SDE_LDAP_HOST set, the broker checks passwords with AD before Guacamole and lets users change an expired or must-change password from the app (see Sign-in and passwords). Unset, both features are off and Guacamole alone decides. A wrong AD setting never stops the gateway: AD is first contacted on the first sign-in, and retried on the next if it fails.

Setting What it does Default Notes
SDE_LDAP_HOST The domain controller. Turns the AD features on. Unset (off) Use the DC's FQDN so its certificate validates. sde-install sets it with AD sign-in.
SDE_LDAP_PORT The LDAP port. 636  
SDE_LDAP_TLS ldaps, starttls or plain. ldaps AD refuses password writes over plain LDAP.
SDE_LDAP_SERVERNAME The name to check the DC's certificate against. The host Set it when SDE_LDAP_HOST is an IP address.
SDE_LDAP_BASE_DN Where to search for users. None sde-install sets it from the DC's domain (DC=lab,DC=local).
SDE_LDAP_UPN_SUFFIX Users sign in to AD as user@suffix. None sde-install sets the domain, for example lab.local.
SDE_LDAP_USER_ATTR The attribute that holds the username. sAMAccountName  
SDE_LDAP_BIND_DN The service account that looks users up and does first-use password resets. None Needs Reset Password delegated on the users' OU for must-change and expired passwords. sde-install sets Guacamole's bind account.
SDE_LDAP_BIND_PASSWORD Its password. None Secret. Don't let the account's password expire: an expired bind account shows up as "directory unavailable".
SDE_LDAP_CA_AUTOFETCH Trust the DC's CA automatically: from the LDAPS handshake, or read from AD's directory for a single-tier root CA. Off Recommended: DC certificate renewals need no action. Reading from AD needs the bind account. sde-install sets true.
SDE_LDAP_CA_FILE A PEM file of the CA to trust, inside the container. None Can be used with AUTOFETCH. With neither (and no INSECURE), AD calls fail with "no CA trust configured".
SDE_LDAP_INSECURE Don't check the DC's certificate. Off Test sites only.

7. Guacamole-only accounts

Setting What it does Default Notes
SDE_LOCAL_ACCOUNTS Accounts that exist only in Guacamole, not AD, comma-separated. The AD check is skipped for them, so they can sign in to the app. Desktop pools refuse them unless the pool asks for the desktop sign-in. guacadmin none = no exceptions. Names are matched in any case. Only matters with SDE_LDAP_HOST set for the sign-in check; pools use it either way. The Guacamole step of sde-install adds its admin and gua_srv when AD is on.

8. SyOps agreement

The app fetches these from the gateway (/sde-broker/clientconfig) at sign-in, so they're set once per site.

Setting What it does Default Notes
SDE_SYOPS_URL The SyOps service. Set = the app asks users to accept the SyOps after signing in. Unset (no gate) App only: browser users don't see the gate.
SDE_SYOPS_SUFFIX Added to the username for the SyOps service only, to pick the SDE SyOp. .sde Sign-in, AD and RDP use the real username.
SDE_SYOPS_INSECURE Don't check the SyOps service's certificate. Off Test sites only.

9. App version notice

Setting What it does Default Notes
SDE_APP_VERSION The SDE Remote app version this site expects. An older app tells its user a new version is out. Unset (no notice) sde-install writes both from versions.conf (APP_VERSION, APP_DOWNLOAD_URL) on every core run, replacing what's there.
SDE_APP_DOWNLOAD_URL Where users get the new version (the release page with the Windows MSI and the Linux packages). Unset

10. Add-on and SDE Network hooks

Each pair turns on when both values are set. With only one, the gateway logs a warning and the feature stays off. The secret is the matching value from the add-on unit.

Setting What it does Default Notes
SDE_VDI_URL Where the gateway reaches sde-vdi, for desktop pools. Unset (pools off) http://sde-vdi:8096 on the sde network. Without it, pool tiles answer "Desktop pools aren't enabled on this gateway."
SDE_VDI_SECRET Shared secret with sde-vdi. Unset = SDE_VDI_SHARED_SECRET in sde-vdi.
SDE_VAPPS_URL Where the gateway reaches sde-vapps, so links can open a page in a web vApp the user already has open. Unset http://sde-vapps:8097. vApps themselves work without it.
SDE_VAPPS_SECRET Shared secret with sde-vapps. Unset = SDE_VAPPS_SHARED_SECRET.
SDE_DEVICES_URL Where the gateway reaches sde-redirector, for SDE Devices. Unset (devices off) http://sde-redirector:8098.
SDE_DEVICES_SECRET Shared secret with sde-redirector. Unset = SDE_REDIRECTOR_SHARED_SECRET.
SDE_DEVICES_PUBLIC_URL The public address the app's device streams use. https://<SDE_GATEWAY_HOST>/sde-redirector  
SDE_NETWORK_URL Where the gateway reads SDE Network's map, for the usage report's network map. Unset sde-install sets http://sde-network:8099.
SDE_NETWORK_SECRET SDE Network's admin secret (read-only use). Unset = SDE_NETWORK_SHARED_SECRET. sde-install sets it.
SDE_GUEST_NETWORKS SDE Network's address block. Addresses in it are never treated as internal (for example, for opening the usage report). Unset sde-install sets it in every SDE unit.

11. Usage report

The report is on by default at /sde-broker/report/. How to use it is in Using the usage report.

Setting What it does Default Notes
SDE_REPORT_DISABLED Turns the report off. Off (report on)  
SDE_REPORT_NETWORKS Addresses and ranges the report may be opened from, comma-separated. 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7 Requests from anywhere else are refused. Addresses in SDE_GUEST_NETWORKS are always refused.
SDE_REPORT_TZ The time zone the report shows times in. Europe/London An invalid name falls back to UTC.
SDE_REPORT_RETENTION How long events are kept. 9600h (400 days)  
SDE_REPORT_EXCLUDE Extra accounts to leave out, comma-separated. None The service account is always left out.
SDE_REPORT_FILE Where events are stored in the container. /opt/rdpgw/data/usage.jsonl Mount a volume on /opt/rdpgw/data (sde-install adds data/report) or native RDP, streaming and pool history is lost when the container is recreated.
SDE_REPORT_POLL How often Guacamole's history is read. 5m  
SDE_REPORT_SESSION_TTL How long a report sign-in lasts. 8h  

12. Streaming

The streaming hub is on by default and does nothing until streaming agents register.

Setting What it does Default Notes
SDE_STREAM_DISABLED Turns the /stream-* endpoints off. Off (hub on)  
SDE_STREAM_MAX_PER_HOST Most streams at once per host. 4  
SDE_STREAM_AUTOCREATE When an agent registers, create its host's streaming connection in Guacamole, so an admin only has to grant it. On Set false to manage the connections yourself. Needs the service account to have CREATE_CONNECTION.
SDE_STREAM_DS The Guacamole data source to create those connections in. The service account's own mysql on sde-install sites.
SDE_STREAM_SPAWN One-click streaming: when the user has no session, the gateway signs in to the host to start one. Off The host must keep the session after the gateway disconnects.
SDE_STREAM_SPAWN_TIMEOUT How long to wait for the agent after starting a session. 20s  
SDE_SPAWN_RDP_CMD Replaces the built-in sign-in command, with {host}, {user} and {pass} in it. Built-in command  
SDE_TURN_SECRET Turns on the bundled TURN relay, so streaming media goes through 443 instead of directly to the host. Unset (no relay) Secret, shared with the agents.
SDE_TURN_HOST The TURN address clients use. The gateway host Added to the gateway's certificate.
SDE_TURN_TTL How long a player's TURN credential lasts. 1h  
SDE_TURN_TLS_PORT The relay's internal TLS port (nginx passes 443 to it). 5349 Read by the container's start script, only with SDE_TURN_SECRET set.
SDE_TURN_CERT, SDE_TURN_KEY A certificate and key for the relay. The gateway's own self-signed one
SDE_TURN_MIN_PORT, SDE_TURN_MAX_PORT The relay's port range. 49160–49200
SDE_TURN_EXTRA Extra lines for the relay's configuration. None
SDE_TURN_VERBOSE, SDE_TURN_LOG Detailed relay logging, and its log file. Off, /tmp/coturn.log

13. Settings no longer used

Setting What happens
SDE_WEBAPPS Ignored, with a note in the log. Web apps were replaced by web vApps. Remove it. Check warns while it's set.
SDE_REPORT_PIN Ignored, with a note in the log. The report signs in with Guacamole administrator accounts. Remove it.

14. versions.conf

deploy/installer/versions.conf lists the versions that make up one release of SDE. Status compares the running units with it, and the core step takes the app notice from it. The planned sde-install upgrade will bring a site to these versions; it isn't built yet, so today the file doesn't change which image a unit runs.

Setting What it does Default Notes
GATEWAY_VERSION The SDE gateway (sde-remote-gateway). This release's version Bumped when an image is published.
NETWORK_VERSION SDE Network (sde-network). This release's version
VDI_VERSION SDE VDI (sde-vdi). This release's version
VAPPS_VERSION SDE vApps (sde-vapps). This release's version
DEVICES_VERSION SDE Devices (sde-redirector). This release's version
GUACAMOLE_VERSION Guacamole. 1.6.0 The units' own tags are in their unit.conf files.
APP_VERSION The SDE Remote app release (Windows and Linux). This release's version Becomes the gateway's SDE_APP_VERSION.
APP_DOWNLOAD_URL The app's release page. The SDE release page Becomes SDE_APP_DOWNLOAD_URL.

MySQL (mysql:8.4.13) is pinned in the guac-db unit, and sde-nginx isn't versioned yet.

person people found this useful.

Related

Knowledge base 26 Oct 2026

Building a Windows 11 gold template

Learn how to create a Windows 11 gold template in Proxmox for efficient VDI deployment. This guide is aimed at engineers and takes about 2-3 hours, covering setup, configuration, and template updates.
Knowledge base 26 Oct 2026

Building the image in VirtualBox and moving it to Proxmox

Learn how to build an Ubuntu 24.04 desktop in VirtualBox and transfer it to Proxmox as a VDI gold template. This guide is ideal for engineers setting up a VDI environment and provides step-by-step instructions for a seamless transition.
Knowledge base 26 Oct 2026

Building an Ubuntu desktop gold template

Learn how to create an Ubuntu 24.04 LTS desktop template in Proxmox for a VDI environment, using xrdp for remote access. Ideal for engineers, this guide covers installation, configuration, and template management.
Expand 29 Jul 2026

How AI can support pupils with SEND

Explore how AI tools are aiding pupils with special educational needs and disabilities by simplifying text, breaking down tasks, and enhancing accessibility. Learn about the considerations schools should make before implementation.
Expand 29 Jul 2026

AI policy and practice in further education

Further education colleges need distinct AI policies due to their unique mix of vocational courses, diverse age groups, and specific funding and inspection requirements. This guidance highlights the importance of tailored AI approaches in FE settings.