Nixos Gnome RDP Remote Desktop

configuration.nix

{ pkgs, lib, ... }: {
  # from https://gist.github.com/hermannolafs/c1379a090350d2dc369aeabd3c0d8de3

  # minimized for clarity.
  # Some of these might not be needed. After some trial and error
  # I got this working with these configs.
  # I do not have the patience to rn an elimination test.

  services.gnome.gnome-remote-desktop.enable = true;

  # Enable the X11 windowing system.
  services.xserver.enable = true;
  services.xserver.displayManager.gdm.enable = true;
  services.xserver.desktopManager.gnome.enable = true;


  services.xrdp = {
    enable = true;
    defaultWindowManager = "${pkgs.gnome3.gnome-shell}/bin/gnome-session";
    confDir = "/etc/xrdp";

    package = pkgs.xrdp.overrideAttrs (oldAttrs: {
      configureFlags = oldAttrs.configureFlags ++ [ "--enable-vsock" ];

      postInstall = oldAttrs.postInstall + ''
        substituteInPlace $out/etc/xrdp/xrdp.ini \
          --replace "port=3389" "port=tcp://0.0.0.0:3389" \
          --replace "security_layer=negotiate" "security_layer=rdp" \
          --replace "crypt_level=high" "crypt_level=none" \
          --replace "bitmap_compression=true" "bitmap_compression=false" \

        substituteInPlace $out/etc/xrdp/sesman.ini \
          --replace "X11DisplayOffset=10" "X11DisplayOffset=0" \
      '';
    });
  };

  systemd = {
    services.xrdp = {
      serviceConfig = {
        ExecStart = lib.mkForce "${pkgs.xrdp}/bin/xrdp --nodaemon --config /etc/xrdp/xrdp.ini";
        # https://github.com/NixOS/nixpkgs/blob/nixos-23.11/nixos/modules/services/networking/xrdp.nix#L158
        # seems the integer port results in ipv6 only
      };
    };
  };

  environment.systemPackages = with pkgs; [
    gnome3.gnome-session
  ];

  # Open ports in the firewall.
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [ 3389 ];
    allowedUDPPorts = [ 3389 ];
  };
}

I found that without overiding the ExexStart value, it only bound to ipv6. So, i patched the ini to explicitly bind to ipv4 and removed the --port from the service init cmd (as that was overiding the ini value)