WabiLink by WabiOne
WabiLink connects you to your own server: move files at full speed, open a terminal, reach services behind its firewall, and use its desktop with sound — from Windows, macOS or Linux.
One app and one encrypted link to every machine you run — at home, for a team, or for the people you help.
A server, a few Raspberry Pis, a NAS, a database: each one a card in the app, with its files, a terminal, its desktop and the services behind it.
wabilink mcpThe database credentials stay on the server. Each person is given a level on each connection — read, write, schema or admin — and the password never reaches their machine.
With the WabiLink server on the machines you look after, see and use their desktop — every monitor, with sound and a shared clipboard — and fix what you find in a terminal or by moving a file.
The client logs in once; files, terminals, tunnels and the desktop all travel over that session, encrypted end to end. Only one port needs to be open.
Files go over several connections at once and are put back together, so a long or lossy link is used to the full. Transfers resume where they stopped.
Browse the server's shares like a local disk. Folders update as they change, and a file opened from the server is saved back to it.
A shell on the server, or a login over SSH, in a tab of the client — with no SSH port reachable from outside.
Reach a database, a web interface or any TCP service near the server through a local port — the administrator decides who may use which.
The server's own desktop, built in: coded on its graphics card where it has one, sharp when still, every monitor, sound in step with the picture, and a clipboard that carries text, images and files.
Your server, your accounts: per-user rights, the server's identity checked by fingerprint, and every byte encrypted. The same app manages it all from your desk.
Three quick choices, and you get the download and the instructions for exactly your machine. Version 1.1.28 released 7 November 2026.
The app you connect with. It comes with everything it needs: no installer, nothing else to set up.
Most PCs are x64; take ARM64 for a Snapdragon laptop or a Surface Pro X.
Right-click the downloaded .zip → Extract All…, and choose where it should
live, for example C:\Users\you\Apps. Then open the wabilink-client folder and run
WabiLink.exe.
Right-click WabiLink.exe → Pin to Start to find it again.
Click New profile and fill in the server's address (port 8009), your account and
password. The first time, WabiLink shows the server's fingerprint: compare it with what the server's
administrator got from wabilink-server identity, and accept it.
A server you administer: Server settings, on its card, opens its users, shares and settings,
through its admin port (8010). On a PC that runs the server itself, This PC's server,
at the top, opens its settings on the spot.
The server's desktop is decoded on your graphics card with Windows' own decoders. For HEVC install Microsoft's HEVC Video Extensions, and on Windows 10 the free AV1 Video Extension, from the Microsoft Store. Without them, WabiLink picks a codec you do have.
The folder also has wabilink-cli.exe: what the app does, from PowerShell or a script - files, a
terminal on the server, tunnels, and the server's desktop (it opens the app's viewer). It uses the app's saved accounts.
To type wabilink-cli anywhere, add the folder to your PATH once (the folder you unpacked to):
[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "User") + ";$HOME\Apps\wabilink-client", "User")Then, in a new window:
wabilink-cli profile add work --host server.example.com --user you
wabilink-cli terminal -p work # a shell on the server; Enter then ~. leaves one that hangs
wabilink-cli get -p work -r /Files/project .
wabilink-cli helpClose WabiLink, unpack the new .zip over the old folder, and start it again. Your profiles are kept.
Delete the folder. Profiles and settings are in %LOCALAPPDATA%\WabiLink.
Installs the WabiLink server on this PC, so others can reach it, and the WabiLink app to manage it. It walks you through setting the server up, and then keeps it up to date by itself. Run it on the PC that will be the server.
The same file works on every Windows 10 and 11 PC, x64 or ARM. While it installs, it downloads the rest (about 110 MB) for this PC, so the PC needs internet.
Open the downloaded file. Two things may come first:
Setup opens, and says what it will install. Click Next.
Not sure? Keep the first one.
Click Install. Setup installs the server, opens the firewall for it, and adds the WabiLink app to the Start menu. This takes a minute or two.
Setup then asks how people get access. Pick one; you can switch later.
Or click Skip, and do it later in the WabiLink app, under This PC's server, or by running setup again.
Install the WabiLink app on the computer you connect from (it is there for macOS and Linux too), then:
8009, and your account and password. The first time, compare the fingerprint the app shows with the
one you noted. To connect from outside your network, forward TCP 8009 on your router to this PC. Never
forward 8010.Nothing to do: it installs a newer version by itself, at night between 03:00 and 05:00 (how). To update at once, run setup again and click Update.
Settings → Apps → WabiLink Server → Uninstall. Its users, settings and identity are kept, for when it is installed again, unless you tick the box to delete them too.
Windows Server Core has no desktop for setup: install the server by hand, in PowerShell. A PC with no internet: on another computer, download the server's zip and the app's for that PC (x64 or ARM64), and put them in the same folder as setup before you open it. For IT: setup with no window.
Runs as a Windows service: it starts with Windows, restarts if it stops, and shows this PC's own desktop to the people you allow.
Or install it by hand, in PowerShell
For Windows Server Core, which has no desktop for setup's window, or to see each step. Used WabiLink Setup? Skip to Optional: this PC's desktop below.
The service runs from this folder, so put it somewhere permanent. Open PowerShell as administrator (Win+X → Terminal (Admin)) and run:
$arch = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { 'arm64' } else { 'x64' }
$dl = "C:\Program Files\WabiLink\.download"
New-Item -ItemType Directory -Force $dl | Out-Null
curl.exe -fLo "$dl\wabilink-server.zip" "https://link.wabione.com/files/wabilink-server-1.1.28-windows-$arch.zip"
curl.exe -fLo "$dl\SHA256SUMS" "https://link.wabione.com/files/SHA256SUMS"
$listed = (Select-String -Path "$dl\SHA256SUMS" -Pattern "^([0-9a-f]{64}) [ *]wabilink-server-1.1.28-windows-$arch\.zip$").Matches[0].Groups[1].Value
if ((Get-FileHash "$dl\wabilink-server.zip" -Algorithm SHA256).Hash -ne $listed) { throw "The download is not the file SHA256SUMS lists: do not unpack it." } else { Expand-Archive "$dl\wabilink-server.zip" -DestinationPath "C:\Program Files\WabiLink" }
Remove-Item -Recurse -Force $dl
cd "C:\Program Files\WabiLink\wabilink-server"It takes the x64 or ARM64 build, as this PC is, and unpacks it only if it is the file the site's
SHA256SUMS lists. Both are downloaded into the program's own folder, which only administrators can
change, not into TEMP, where a program of yours could swap the zip between its check and its unpacking. That list is signed with WabiLink's release key (SHA256SUMS.asc); with
gpg installed, gpg --verify SHA256SUMS.asc SHA256SUMS checks it too, against key
2C9F 6909 A29F C1FE 2F95 7F7F ACBA 8605 5D3E BAD2. WabiLink Setup checks both by itself. With no internet on
the PC, download it here instead, check it the same way (Get-FileHash against the line for it in
SHA256SUMS), right-click it → Properties → Unblock, and unpack it to
C:\Program Files\WabiLink:
.\wabilink-service install --startIt runs as LocalSystem; its data and logs are in C:\ProgramData\WabiLink\Server.
.\wabilink-service status says whether it is running.
Clients connect on 8009; Server settings, in the app, on 8010, which this opens to your local network only:
New-NetFirewallRule -DisplayName "WabiLink" -Direction Inbound -Protocol TCP -LocalPort 8009 -Action Allow
New-NetFirewallRule -DisplayName "WabiLink Admin" -Direction Inbound -Protocol TCP -LocalPort 8010 -RemoteAddress LocalSubnet -Action AllowSet it up
Decide who may use the server, and what they get. Pick one of the two ways; you can switch later, and unregistering from WabiOne brings back the settings the server had before.
Pick one to see its steps.
Sign in to WabiOne's console at app.wabione.com (no account yet? Create one: it makes your organization). Then Servers → Add server, a name if you like (otherwise this PC's name), and Get code. The code works once, for 15 minutes. From a script or a CI pipeline, with no code to copy, an API token that may register servers registers it instead.
In the same PowerShell, in the server's folder, with the code from the console:
.\wabilink-service register K7M2-QX9P-4HRTThe console says Registered, and within seconds the server is online there.
.\wabilink-service home shows the organization and the connection.
On the server's page: People → Add person for each person of your organization who may use it, with their shares; Terminals and desktop, Tunnels and Databases for the rest. Changes reach the server within seconds.
In the WabiLink app, Sign in at the top right, with your WabiOne account: your organization's servers appear, ready to connect. There is no address, password or fingerprint to type: WabiOne vouches for the server.
From outside this PC's network, nothing needs forwarding on the router: WabiOne's rendezvous introduces the app to
the server. A few networks (some mobile and carrier networks) don't let that through; from those, forward TCP
8009 to this PC.
.\wabilink-service unregister
takes it back, with the server's own settings as they were..\wabilink-service user add $env:USERNAME --admin # asks for a password, twice
.\wabilink-service share add $env:USERNAME Files C:\Users\Public
.\wabilink-service identity # the fingerprint clients will be shownYour WabiLink account is named as your Windows account, with a password of its own; Files is the PC's Public folder. Write down the fingerprint: you will compare it the first time you connect.
In the WabiLink app, New profile: this PC's address (ipconfig shows it), port
8009, your account and password. Compare the fingerprint it shows the first time with the one above,
and accept it.
To reach it from outside your network, forward TCP 8009 on your router to this PC. Never forward 8010.
More people and their rights, groups, tunnels, databases and every setting: with .\wabilink-service here,
or from your desk with Server settings, in the app (port 8010, your account).
Optional: this PC's desktop
Let people see and use this PC's screen from WabiLink, in their session. In PowerShell as administrator, in the
server's folder (cd "C:\Program Files\WabiLink\Server" if WabiLink Setup installed it), with the name of each
WabiLink account that may use it:
.\wabilink-service config set desktop-enabled yes
.\wabilink-service user desktop $env:USERNAME yesWith WabiOne, turn it on in the console instead: Terminals and desktop, and the desktop for each person under People. The rest is the same either way.
That is all it takes on Windows. Viewers see this PC's own screen, UAC prompts included. With nobody signed in - after a restart, or a server with no one at it - it is the login screen, and you sign in from the viewer as at the machine: the viewer's Ctrl+Alt+Del button (the keyboard icon), then a Windows account's password. Where the lock screen asks for no Ctrl+Alt+Del - Windows 11 and 10 by default - press Space or click, as at the PC.
A session the viewer found at the login or lock screen and signed in to is locked again when the last viewer has
gone, so it is not left open on the PC's monitor; one that was already open - someone at the PC, being helped - is
left as it was. To leave it open instead: .\wabilink-service config set desktop-lock-on-leave no (with
WabiOne, in the console). Signing in to an account with a disconnected session brings that session to the screen; the
viewer follows it.
For the Ctrl+Alt+Del button, WabiLink lets services send Ctrl+Alt+Del (the SoftwareSASGeneration
policy), as remote-support tools do; turning the desktop on sets it, and says so. With a graphics card (NVIDIA, AMD,
Intel), the screen is coded on it, at 60 frames a second and more.
This is the PC's own screen, not a Remote Desktop session: someone connected by Remote Desktop is not seen (the screen shows the login screen meanwhile), and signing in as them from the viewer takes their session over and ends their Remote Desktop connection. For a separate session, give yourself a WabiLink tunnel to the PC's Remote Desktop and connect a Remote Desktop app of your own through it.
In the server's folder:
.\wabilink-service statusIts log is in C:\ProgramData\WabiLink\Server\logs; warnings and errors also go to the Application event log, as
WabiLink.
Installed with WabiLink Setup: nothing to do, it updates itself at night (how). Installed by hand, in the server's folder:
$arch = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { 'arm64' } else { 'x64' }
$dl = "C:\Program Files\WabiLink\.download"
New-Item -ItemType Directory -Force $dl | Out-Null
curl.exe -fLo "$dl\wabilink-server.zip" "https://link.wabione.com/files/wabilink-server-1.1.28-windows-$arch.zip"
curl.exe -fLo "$dl\SHA256SUMS" "https://link.wabione.com/files/SHA256SUMS"
$listed = (Select-String -Path "$dl\SHA256SUMS" -Pattern "^([0-9a-f]{64}) [ *]wabilink-server-1.1.28-windows-$arch\.zip$").Matches[0].Groups[1].Value
if ((Get-FileHash "$dl\wabilink-server.zip" -Algorithm SHA256).Hash -ne $listed) { throw "The download is not the file SHA256SUMS lists: do not unpack it." } else { .\wabilink-service stop; Expand-Archive "$dl\wabilink-server.zip" -DestinationPath "C:\Program Files\WabiLink" -Force; .\wabilink-service start }
Remove-Item -Recurse -Force $dlInstalled with WabiLink Setup: Settings → Apps → WabiLink Server → Uninstall. Installed by hand:
.\wabilink-service uninstallEither way the data in C:\ProgramData\WabiLink\Server is kept, unless you delete it too.
The app you connect with. One command downloads the right version for your Mac and puts it in Applications.
Press ⌘+Space, type Terminal and press Return.
curl -fsSLO https://link.wabione.com/install-macos.sh
bash install-macos.sh clientThe first downloads the install script, the second runs it. It finds out whether your Mac has Apple silicon or Intel, downloads the newest WabiLink for it, checks it, and puts WabiLink in Applications. It says when it is done.
Open Applications in Finder (or Launchpad) and double-click WabiLink.
Click New profile: the server's address (port 8009), your account and password. The first
time, WabiLink shows the server's fingerprint: compare it with what the server's administrator got from
wabilink-server identity, and accept it.
A server you administer: Server settings, on its card, opens its users, shares and settings,
through its admin port (8010).
H.264 and HEVC are decoded by macOS itself. For AV1, the best codec for a slow link, install dav1d with Homebrew:
brew install dav1dWabiLink brings its command-line client along: what the app does, from Terminal or a script - files, a terminal on
the server, tunnels, and the server's desktop (it opens the app's viewer), with the app's saved accounts. The install
command makes it wabilink where it can; otherwise it prints the one command that does:
sudo mkdir -p /usr/local/bin && sudo ln -sf /Applications/WabiLink.app/Contents/MacOS/wabilink-cli /usr/local/bin/wabilinkwabilink profile add work --host server.example.com --user you
wabilink terminal -p work # a shell on the server; Enter then ~. leaves one that hangs
wabilink helpApple silicon (M1 and later) or Intel: Apple menu → About This Mac.
Open the .zip (Safari may already have) and drag WabiLink into Applications. The first time,
Control-click it → Open → Open; on macOS 15 and later, open it, then System Settings
→ Privacy & Security → Open Anyway.
Quit WabiLink and paste the same commands again. Your profiles are kept.
curl -fsSLO https://link.wabione.com/install-macos.sh
bash install-macos.sh clientDrag WabiLink from Applications to the Bin. Settings are in ~/Library/Application Support/WabiLink.
Runs as a service: it starts when the Mac starts, before anyone logs in, and restarts if it stops. Copy each box into Terminal as it is - nothing in them needs changing.
sudo asks for its password. Nothing shows as you type it - type it
and press Return;Install it
Press ⌘+Space, type Terminal and press Return.
curl -fsSLO https://link.wabione.com/install-macos.sh
sudo bash install-macos.shThe first command downloads the install script; read it if you like (less install-macos.sh) before the
second runs it. It downloads the newest server for your Mac, checks it, installs it in /usr/local/wabilink-server, and starts it
as a service. It ends with "… is installed, running, and starts at every boot." From then on it updates itself
at night (updates).
Only if the Mac's firewall is on (System Settings → Network → Firewall):
Options… → +, ⌘+Shift+G,
paste /usr/local/wabilink-server/wabilink-server, and set it to Allow incoming connections.
On a Mac your organisation manages, its firewall may be theirs to set: ask them to allow the server.
Set it up
Who may use it, and what they get. Pick one way; you can move to the other later: registered with WabiOne, the server starts from what it already had, and unregistered, it gets that back.
Pick one to see its steps.
Sign in to WabiOne's console at app.wabione.com (no account yet? Create one: it makes your organization). Then Servers → Add server, a name if you like (otherwise the Mac's name), and Get code. The code works once, for 15 minutes. From a script or a CI pipeline, with no code to copy, an API token that may register servers registers it instead.
In Terminal, with the code from the console:
sudo wabilink-server register K7M2-QX9P-4HRTThe console says Registered, and within seconds the server is online there.
sudo wabilink-server home shows the organization and the connection.
On the server's page: People → Add person for each person of your organization who may use it, with their shares; Terminals and desktop, Tunnels and Databases for the rest. Changes reach the server within seconds.
A share is a folder of this Mac. macOS protects Documents, Desktop and Downloads: for a share in one of them, give the
server Full Disk Access (System Settings → Privacy & Security →
Full Disk Access → +, ⌘+Shift+G,
paste /usr/local/wabilink-server/wabilink-server, and turn it on).
In the WabiLink app, Sign in at the top right, with your WabiOne account: your organization's servers appear, ready to connect. There is no address, password or fingerprint to type: WabiOne vouches for the server.
From outside the Mac's network, nothing needs forwarding on the router: WabiOne's rendezvous introduces the app to
the server. A few networks (some mobile and carrier networks) don't let that through; from those, forward TCP
8009 to the Mac.
sudo wabilink-server unregister takes it back, with the server's own settings as they were.Your WabiLink account, named as your Mac account, and an administrator. It asks for a password for it, twice - one for WabiLink, which may be different from the Mac's:
sudo wabilink-server user add "$USER" --adminThe Mac's shared folder, as Files:
sudo wabilink-server share add "$USER" Files /Users/SharedmacOS protects those folders: the server may read them only once allowed. System Settings →
Privacy & Security → Full Disk Access → +, press
⌘+Shift+G, paste
/usr/local/wabilink-server/wabilink-server, and turn it on. Then, for example:
sudo wabilink-server share add "$USER" Documents "$HOME/Documents"sudo wabilink-server identityThe app shows it the first time it connects: it should be the same.
In the WabiLink app, New profile: this Mac's address, port 8009, your account and
password; compare the fingerprint, and accept it. The address:
ipconfig getifaddr en0 || ipconfig getifaddr en1To reach it from outside your network, forward TCP 8009 on your router to the Mac. Never forward 8010.
More people and their rights, groups, tunnels, databases and every setting: with sudo wabilink-server
here, or from your desk with Server settings, in the app (port 8010, your account).
Optional: this Mac's desktop
sudo wabilink-server config set desktop-enabled yes
sudo wabilink-server user desktop "$USER" yesWith WabiOne, turn it on in the console instead: Terminals and desktop, and the desktop for each person under People. The rest is the same either way.
Then allow it twice, once, in System Settings → Privacy & Security - in each, +,
⌘+Shift+G, paste
/usr/local/wabilink-server/wabilink-server, and turn it on:
macOS may ask by itself the first time someone connects. After an update it may need turning on again.
With nobody logged in, viewers see the login window and sign in from it as at the Mac: the account, then its password.
A session the viewer found at the login window or locked is locked again when the last viewer has gone; one already
open is left as it was. To leave it open instead: sudo wabilink-server config set desktop-lock-on-leave no
(with WabiOne, in the console). With FileVault on, a restarted Mac waits at FileVault's unlock screen before macOS starts:
sign in at the Mac once, or restart it with sudo fdesetup authrestart.
Nothing to do: it updates itself at night (how). To update at once, the same commands again; the accounts and shares are kept.
curl -fsSLO https://link.wabione.com/install-macos.sh
sudo bash install-macos.shsudo launchctl print system/com.wabilink.server | grep state
tail -n 20 /Library/Logs/WabiLink/server.logsudo wabilink-server uninstall-launchd
sudo rm -rf /usr/local/wabilink-server /usr/local/bin/wabilink-serverThe accounts and settings stay in /Library/Application Support/WabiLink; delete that too to remove everything.
The app you connect with. It brings its own runtime; the system provides fonts, the display and, optionally, video decoders and sound.
sudo dnf install fontconfig libICE libSM libicu libdav1d libavcodec-free pulseaudio-utils 'libssl.so.3()(64bit)'The last one is OpenSSL 3, which the app needs. Fedora 44 and older already have it; from Fedora 45 it is
openssl3-libs, next to OpenSSL 4.
The video decoders come from EPEL:
sudo dnf install epel-release
sudo dnf install fontconfig libICE libSM libicu libdav1d pulseaudio-utilssudo apt update
sudo apt install libfontconfig1 libice6 libsm6 pulseaudio-utils libavcodec-extra
sudo apt install libicu76 || sudo apt install libicu74 || sudo apt install libicu72
sudo apt install libdav1d7 || sudo apt install libdav1d6sudo pacman -S --needed fontconfig libice libsm icu dav1d ffmpeg libpulsesudo zypper install fontconfig libICE6 libSM6 'libicu??' libdav1d7 pulseaudio-utilsFontconfig, libICE, libSM and ICU (libicu, which .NET needs), and for the remote desktop's video dav1d
(libdav1d.so.7) and FFmpeg's libavcodec; for its sound pacat or aplay.
dav1d and libavcodec decode the remote desktop's video; without them it is sent as lossless tiles, which needs a faster link.
openSUSE's own FFmpeg decodes no H.264 or HEVC; dav1d decodes AV1. For all three, FFmpeg from the Packman repository (see the server's instructions).
For a Raspberry Pi 3, 4 or 5 with the 64-bit Raspberry Pi OS take ARM64; the 32-bit system has no WabiLink app.
Most PCs are x86_64; ARM boards and laptops take ARM64. uname -m says which.
mkdir -p ~/.local/opt ~/.local/bin ~/.local/share/applications
tar -xzf ~/Downloads/wabilink-client-1.1.28-linux-*.tar.gz -C ~/.local/opt
ln -sf ~/.local/opt/wabilink-client/wabilink-client ~/.local/bin/wabilink-client
ln -sf ~/.local/opt/wabilink-client/wabilink-cli ~/.local/bin/wabilink
cat > ~/.local/share/applications/wabilink.desktop <<EOF
[Desktop Entry]
Type=Application
Name=WabiLink
Comment=Files, terminals, tunnels and desktop of your server
Exec=$HOME/.local/opt/wabilink-client/wabilink-client
Terminal=false
Categories=Network;FileTransfer;RemoteAccess;
EOFWabiLink is now in your applications menu, and wabilink-client starts it from a terminal;
wabilink is its command-line client.
Click New profile: the server's address (port 8009), your account and password. Compare
the fingerprint shown the first time with the server's wabilink-server identity.
A server you administer: Server settings, on its card, opens its users, shares and settings,
through its admin port (8010).
wabilink does what the app does, from a terminal or a script - files, a terminal on the server, tunnels,
and the server's desktop (it opens the app's viewer) - with the app's saved accounts. If wabilink is not
found, log in again: ~/.local/bin is on the PATH from the next login.
wabilink profile add work --host server.example.com --user you
wabilink terminal -p work # a shell on the server; Enter then ~. leaves one that hangs
wabilink tunnel -p work db --local-port 5432
wabilink helpClose WabiLink and unpack the new version over the old one:
tar -xzf ~/Downloads/wabilink-client-1.1.28-linux-*.tar.gz -C ~/.local/optrm -rf ~/.local/opt/wabilink-client ~/.local/bin/wabilink-client ~/.local/bin/wabilink ~/.local/share/applications/wabilink.desktopInstalled from WabiLink's signed package repository, so it
updates with the rest of the system. It runs as a systemd service under its own wabilink account.
There are no packages for this distribution yet: the server comes as a
self-contained archive, which the install script puts in /opt/wabilink and runs as a systemd service under its
own wabilink account. The same command updates it.
Install it
curl -fsSLO https://link.wabione.com/install.sh
sudo sh install.shThe first command downloads the install script; read it if you like (less install.sh) before the second
runs it. It adds the repository and its signing key, then installs wabilink-server with what its optional parts
use: ssh for login terminals, the libraries of the remote desktop, and SVT-AV1 for AV1 video where the system has it.
It does not start the server yet.
It picks the 64-bit or 32-bit package by itself (Raspberry Pi 2 and later).
sudo curl -fsSLo /etc/pki/rpm-gpg/RPM-GPG-KEY-wabilink https://link.wabione.com/wabilink.asc
gpg --show-keys /etc/pki/rpm-gpg/RPM-GPG-KEY-wabilink
sudo curl -fsSLo /etc/yum.repos.d/wabilink.repo https://link.wabione.com/wabilink.repo
sudo dnf install wabilink-serverThe second command shows what is in the key file: go on only if it shows one key (one pub line), and its
fingerprint is 2C9F6909A29FC1FE2F957F7FACBA86055D3EBAD2. A file with another key in it, or a second one, is not WabiLink's alone.
The repository then checks every package against that file, never a key fetched again later; and the server's own
updates check against the key it carries, whatever the file holds.
sudo install -d -m 0755 /etc/apt/keyrings
sudo curl -fsSLo /etc/apt/keyrings/wabilink.asc https://link.wabione.com/wabilink.asc
gpg --show-keys /etc/apt/keyrings/wabilink.asc
echo "deb [signed-by=/etc/apt/keyrings/wabilink.asc] https://link.wabione.com/deb stable main" | sudo tee /etc/apt/sources.list.d/wabilink.list
sudo apt update && sudo apt install wabilink-serverThe third command shows what is in the key file: go on only if it shows one key (one pub line), and its
fingerprint is 2C9F6909A29FC1FE2F957F7FACBA86055D3EBAD2. apt then checks WabiLink's packages against that file alone; and the
server's own updates write the key it carries over it.
The server brings its own runtime. From the system it needs OpenSSL 3, and for its optional parts: ssh for login
terminals, the X11 and PipeWire libraries for this machine's desktop, pacat for its sound, and FFmpeg and
SVT-AV1 for video. The packages for other distributions bring these by themselves; here, install them once:
sudo pacman -S --needed openssl openssh libx11 libxext libxtst libxfixes libxrandr pipewire libpulsesudo zypper install libopenssl3 openssh-clients libX11-6 libXext6 libXtst6 libXfixes3 libXrandr2 libpipewire-0_3-0 pulseaudio-utils libavcodec62glibc, OpenSSL 3 (libssl.so.3) and systemd; for the optional parts ssh,
libX11, libXext, libXtst, libXfixes, libXrandr,
libpipewire-0.3, pacat, FFmpeg's libavcodec.so.59 to .62, and
SVT-AV1 2.0 to 3.x (libSvtAv1Enc.so.2 or .3).
sudo zypper ar -cfp 90 https://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Tumbleweed/ packman
sudo zypper dup --from packman --allow-vendor-changeopenSUSE_Leap_15.6 in place of openSUSE_Tumbleweed.curl -fsSLO https://link.wabione.com/install.sh
sudo sh install.shThe first command downloads the install script; read it if you like (less install.sh) before the second
runs it. It downloads the newest server for this machine's processor (x86_64, ARM64 or 32-bit ARM), checks it against the
published checksums, and puts it in /opt/wabilink. It creates the wabilink account and
/var/lib/wabilink, the systemd service, and the agent for this machine's desktop. It does not start the
server yet. wabilink-server version says which version is installed.
uname -m says which: x86_64, aarch64 (ARM64) or armv7l (32-bit ARM).
Check it first: the list of checksums, signed with WabiLink's release key, and the archive against it.
cd ~/Downloads
curl -fsSLO https://link.wabione.com/files/SHA256SUMS
curl -fsSLO https://link.wabione.com/files/SHA256SUMS.asc
curl -fsSL https://link.wabione.com/wabilink.asc | gpg --import
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMSgpg should say Good signature, from key 2C9F 6909 A29F C1FE 2F95 7F7F ACBA 8605 5D3E BAD2,
and sha256sum OK for the archive. Anything else: do not install it.
sudo mkdir -p /opt/wabilink
sudo tar --no-same-owner -xzf ~/Downloads/wabilink-server-1.1.28-linux-$(uname -m).tar.gz -C /opt/wabilink --strip-components=1
sudo /opt/wabilink/wabilink-server install-systemd
sudo ln -sf /opt/wabilink/wabilink-server /usr/local/bin/wabilink-serverThis starts the service now and at every boot. --no-same-owner makes the files root's: without it,
tar run as root keeps whatever account the archive names, and that account could change the server. Set up
the desktop agent by hand too (this machine's desktop, below). To update, run the install script: it takes over an
install made by hand.
sudo systemctl enable --now wabilinkIt starts now and at every boot, and updates itself at night (updates).
systemctl status wabilink shows it running; journalctl -u wabilink -f follows its log.
Clients connect on 8009. Server settings, in the app, use 8010: open that only to where you administer
from - below, the local network 192.168.1.0/24; put in yours (ip -4 addr shows it).
sudo firewall-cmd --permanent --add-port=8009/tcp
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8010" protocol="tcp" accept'
sudo firewall-cmd --reloadIf ufw is on (sudo ufw status):
sudo ufw allow 8009/tcp
sudo ufw allow from 192.168.1.0/24 to any port 8010 proto tcpThere is no firewall on by default. If you set one up with nftables or iptables, allow TCP 8009,
and 8010 from your own network only.
If a firewall is on (firewalld, ufw, nftables), allow TCP 8009, and 8010 from your own
network only; the firewalld and ufw commands are as on Fedora and Ubuntu.
Set it up
Who may use it, and what they get. Pick one way; you can move to the other later: registered with WabiOne, the server starts from what it already had, and unregistered, it gets that back.
Pick one to see its steps.
Sign in to WabiOne's console at app.wabione.com (no account yet? Create one: it makes your organization). Then Servers → Add server, a name if you like (otherwise the machine's host name), and Get code. The code works once, for 15 minutes. From a script or a CI pipeline, with no code to copy, an API token that may register servers registers it instead.
With the code from the console:
sudo wabilink-server register K7M2-QX9P-4HRTThe console says Registered, and within seconds the server is online there.
sudo wabilink-server home shows the organization and the connection.
On the server's page: People → Add person for each person of your organization who may use it, with their shares; Terminals and desktop, Tunnels and Databases for the rest. Changes reach the server within seconds.
A share is a folder of this machine, and the server runs as wabilink: it needs to read each share's
folder, and write where people upload. For a folder of your own,
sudo setfacl -R -m u:wabilink:rwX,d:u:wabilink:rwX /path; sudo wabilink-server share check
says which shares' folders it cannot use.
In the WabiLink app, Sign in at the top right, with your WabiOne account: your organization's servers appear, ready to connect. There is no address, password or fingerprint to type: WabiOne vouches for the server.
From outside this machine's network, nothing needs forwarding on the router: WabiOne's rendezvous introduces the app
to the server. A few networks (some mobile and carrier networks) don't let that through; from those, forward TCP
8009 to this machine.
sudo wabilink-server unregister takes it back, with the server's own settings as they were.sudo wabilink-server user add "$USER" --admin # asks for a password, twice
sudo mkdir -p /srv/files && sudo chown wabilink: /srv/files
sudo wabilink-server share add "$USER" Files /srv/files
sudo wabilink-server identity # the fingerprint clients will be shownThe service runs as wabilink: it needs to read each share's folder, and write where people upload. For a
folder of your own, sudo setfacl -R -m u:wabilink:rwX,d:u:wabilink:rwX /path gives it access.
In the WabiLink app, New profile: this machine's address (hostname -I shows it), port
8009, your account and password. Compare the fingerprint it shows the first time with the one above,
and accept it.
To reach it from outside your network, forward TCP 8009 on your router to this machine. Never forward 8010.
More people and their rights, groups, tunnels, databases and every setting: with sudo wabilink-server
here, or from your desk with Server settings, in the app (port 8010, your account).
Optional: this machine's desktop
Lets the people you choose see and use this machine's screen from WabiLink (Server Desktop), inside their encrypted WabiLink session: no other port is opened. Turn it on, and give it to each account that may use it:
sudo wabilink-server config set desktop-enabled yes
sudo wabilink-server user desktop "$USER" yesWith WabiOne, turn it on in the console instead: Terminals and desktop, and the desktop for each person under People. What this machine needs for it, below, is the same either way.
A small agent runs in each desktop session and offers its screen to the server. The install script sets it up, as the packages for other distributions do. Installed by hand, set it up once:
sudo tee /etc/systemd/user/wabilink-desktop-agent.service >/dev/null <<'EOF'
[Unit]
Description=WabiLink desktop agent
PartOf=graphical-session.target
After=graphical-session.target
[Service]
ExecStart=/opt/wabilink/wabilink-server desktop-agent
Restart=on-failure
RestartSec=5
[Install]
WantedBy=graphical-session.target
EOF
sudo systemctl --global enable wabilink-desktop-agent.serviceIt starts in every desktop session from the next login on; in the session you are in now, at once with
systemctl --user start wabilink-desktop-agent.
Viewers then see whoever is logged in at the machine - locked or not, as on its monitor - and unlock it from the viewer with that account's password. GNOME shows that the screen is shared while someone looks. If someone is working in that session, they are asked first, in a notification naming who asks and from where: Allow or Deny, and no answer in 30 seconds is a no.
A login screen of your own (GNOME 46 and later: Fedora 40, Ubuntu 24.04, Debian 13, RHEL 10
and newer): give an account desktop-login as well, and a viewer with nobody at the screen - or no screen at all -
gets a login screen of its own. It logs in there as any account of this machine, with that account's password, and may
log out: the next connection gives a new login screen. Each WabiLink account sees only its own.
sudo wabilink-server user desktop-login "$USER" yes
sudo wabilink-server login-probe # whether this machine canAfter a restart, nobody is logged in yet. Two ways to have a desktop there from the start:
sudo wabilink-server desktop-setup "$USER" --login
sudo systemctl rebootdesktop-setup says if not): a separate GNOME session for the
account, started at boot on a 1920×1080 virtual monitor, locked while no one looks and again after each viewer.
Don't use it for an account that also logs in at the machine: GNOME runs one session per account at a time.
sudo wabilink-server desktop-setup "$USER"To undo either: sudo wabilink-server desktop-setup --off. desktop-setup changes the
server's settings too, so with WabiOne, run it before registering.
Which desktops: GNOME on Wayland, and any desktop in an X11 session. KDE Plasma, Sway and other Wayland desktops are not supported yet: log in to their X11 session where they still offer one (the choice on the login screen).
Raspberry Pi OS's own desktop (labwc) is not supported yet: switch it to X11 with
sudo raspi-config → Advanced Options → Wayland → X11. The screen is sent as lossless tiles.
Video from the graphics card: with a graphics card, the screen is coded on it - 60 frames a second and
more. It needs the card's own driver: NVIDIA's driver for NVIDIA cards
(RPM Fusion's akmod-nvidia)
(sudo ubuntu-drivers install), and the VA-API driver for AMD and Intel - for H.264
and HEVC on AMD and Intel, RPM Fusion's mesa-va-drivers-freeworld, since Fedora's own leaves them out.
The viewer's stats panel (the chart button) says what codes the screen, and why.
Nothing to do: it updates itself at night (how). To update at once, with the system's updates:
sudo dnf upgrade --refreshA running server restarts by itself.
Nothing to do: it updates itself at night (how). To update at once, with the system's updates:
sudo apt update && sudo apt upgradeA running server restarts by itself.
Nothing to do: it updates itself at night (how). To update at once:
curl -fsSLO https://link.wabione.com/install.sh
sudo sh install.shThe same commands as installing: the newest version replaces the old one, and a running server restarts. The accounts,
shares and identity in /var/lib/wabilink are kept. It takes over an install made by hand too, its files
made root's. Desktop agents restart as the new version by themselves.
systemctl status wabilink
journalctl -u wabilink -n 50 # its log; -f to follow it
sudo ss -ltnp | grep -E ':(8009|8010)'The last shows the ports it listens on. From another computer, the app connecting is the test that counts.
sudo wabilink-server desktop-setup --off # only if you used desktop-setup
sudo dnf remove wabilink-serverThe accounts, shares and identity in /var/lib/wabilink are kept for a reinstall; to remove everything,
also sudo rm -rf /var/lib/wabilink.
sudo wabilink-server desktop-setup --off # only if you used desktop-setup
sudo apt remove wabilink-serverThe accounts, shares and identity in /var/lib/wabilink are kept for a reinstall; to remove everything,
also sudo rm -rf /var/lib/wabilink.
sudo wabilink-server desktop-setup --off # only if you used desktop-setup
sudo systemctl --global disable wabilink-desktop-agent.service
sudo rm -f /etc/systemd/user/wabilink-desktop-agent.service
sudo wabilink-server uninstall-systemd
sudo rm -rf /opt/wabilink /usr/local/bin/wabilink-serverThe accounts, shares and identity in /var/lib/wabilink are kept for a reinstall; to remove everything,
also sudo rm -rf /var/lib/wabilink and sudo userdel wabilink.
A user data script sets the server up on an EC2 instance when it first boots - nothing to log in to the instance for. Registered with WabiOne by an API token, it needs no code copied from the console: a release script or a CI pipeline adds servers on its own.
The instance's system
How it is set up
Pick both to see the steps.
The commands below are for bash, with the AWS CLI set up with your account
(aws configure) - on your computer, or in your pipeline. Each step also says where it is in the AWS console.
In Git Bash on Windows, run export MSYS_NO_PATHCONV=1 first: otherwise it turns /wabilink/...
into a Windows path, and AWS refuses the parameter's name.
In WabiOne's console at app.wabione.com, as an admin of the organization: API tokens → Create token, with a name that says what it is for (CI builds, say), Register servers ticked, and how long it works: 30, 90, 180 or 365 days, or until revoked. A token can do only what is ticked: this one, nothing but register servers. It is shown once: copy it. Until then it registers any number of servers; the console shows when it was last used and how many servers it registered, and Revoke stops it at once. The servers it registered stay.
Console: Systems Manager → Parameter Store → Create parameter:
name /wabilink/registration-token, type SecureString, the default key, and the token as its
value. Or with the CLI on Linux or macOS - it asks for the token without showing it, and keeps it off the command line:
printf 'WabiOne API token: '; stty -echo; read -r token; stty echo; echo
printf '%s' "$token" | aws ssm put-parameter --name /wabilink/registration-token --type SecureString --value file:///dev/stdin
unset tokenIn a pipeline, from the token kept as one of its secrets (here WABIONE_REGISTRATION_TOKEN):
printf '%s' "$WABIONE_REGISTRATION_TOKEN" | aws ssm put-parameter --name /wabilink/registration-token --type SecureString --value file:///dev/stdin --overwriteThe parameter stays for the next launches; a new token replaces it with --overwrite.
Console: Systems Manager → Parameter Store → Create parameter:
name /wabilink/admin-password, type SecureString, the default key, and the password as its value.
Or with the CLI on Linux or macOS - it asks for the password without showing it, and keeps it off the command line:
printf 'WabiLink admin password: '; stty -echo; read -r pw; stty echo; echo
printf '%s' "$pw" | aws ssm put-parameter --name /wabilink/admin-password --type SecureString --value file:///dev/stdin
unset pwOn Windows, use the console for this step: its CLI cannot read a value from standard input, and a password typed into the command line itself would be kept in the shell's history.
Console: IAM → Roles → Create role for EC2,
with AmazonSSMManagedInstanceCore and an inline policy allowing ssm:GetParameter on the
parameters under /wabilink/. Or:
aws iam create-role --role-name wabilink-server --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
aws iam put-role-policy --role-name wabilink-server --policy-name read-wabilink-parameters --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"ssm:GetParameter","Resource":"arn:aws:ssm:*:*:parameter/wabilink/*"}]}'
aws iam attach-role-policy --role-name wabilink-server --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
aws iam create-instance-profile --instance-profile-name wabilink-server
aws iam add-role-to-instance-profile --instance-profile-name wabilink-server --role-name wabilink-serverAmazonSSMManagedInstanceCore is optional, and recommended: with it, Session Manager gives you a shell on the
instance with no key or open port, and Run Command reads the server's
fingerprint below. With a customer-managed KMS key for the parameter instead of the default, also allow
kms:Decrypt on that key. One role serves every server: launched with it, each reads the same parameter.
A security group allowing TCP 8009 from where your users are (below, anywhere), in the region's default
VPC, and the admin port, 8010 (Server settings, in the app), from your own address
only, and Remote Desktop's 3389 from your own
address only, for the WabiLink app on the instance:
vpc=$(aws ec2 describe-vpcs --filters Name=is-default,Values=true --query 'Vpcs[0].VpcId' --output text); echo "$vpc"
sg=$(aws ec2 create-security-group --group-name wabilink --description "WabiLink server" --vpc-id "$vpc" --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$sg" --protocol tcp --port 8009 --cidr 0.0.0.0/0
echo "$sg"aws ec2 authorize-security-group-ingress --group-id "$sg" --protocol tcp --port 8010 --cidr "$(curl -fsS https://checkip.amazonaws.com)/32"aws ec2 authorize-security-group-ingress --group-id "$sg" --protocol tcp --port 3389 --cidr "$(curl -fsS https://checkip.amazonaws.com)/32"With WabiOne, 8009 is not strictly needed: WabiOne's rendezvous introduces the app to the server. Open, the app connects to it directly, which is faster.
If the first line prints None, the region has no default VPC (accounts set up by an organisation often
don't): set vpc= to a VPC of yours that has a public subnet, and add that subnet to the launch below with
--subnet-id subnet-..., and --associate-public-ip-address where the subnet does not give its
instances a public address itself. The instance needs a public address and a route to the internet - to install the
server, and to be reached.
The script: ec2-user-data.sh. Its first lines hold the settings, to change if you like:
the parameters' names, the WabiOne it registers with, and the server's name there (empty: the instance's Name tag, else
its ID); offline, the administrator's name (admin) and the shared folder (/srv/files, as
Files).
Console: EC2 → Launch instance; under Advanced details, the
IAM instance profile wabilink-server, Allow tags in metadata, and the script
in User data. Or, with Amazon Linux 2023 on Intel or AMD (arm64 and a t4g type
for Graviton):
curl -fsSLO https://link.wabione.com/ec2-user-data.sh
aws ec2 run-instances \
--image-id resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
--instance-type t3.small \
--iam-instance-profile Name=wabilink-server \
--security-group-ids "$sg" \
--metadata-options HttpTokens=required,InstanceMetadataTags=enabled \
--user-data file://ec2-user-data.sh \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=wabilink}]' \
--query 'Instances[0].InstanceId' --output textA small instance is enough for files, terminals and tunnels; the server takes a minute or three to be set up after boot.
The script: ec2-user-data-windows.txt, PowerShell between
<powershell> tags, as EC2 runs it. Its first lines hold the settings, to change if you like: the
parameters' names, the WabiOne it registers with, and the server's name there (empty: the instance's Name tag, else its
ID); offline, the administrator's name (admin) and the shared folder (C:\Files, as
Files). It downloads WabiLink Setup from this site, checks it against the release's list of checksums,
and runs it: Setup installs nothing the release key has not signed.
Console: EC2 → Launch instance, with Microsoft Windows Server 2025 Base;
under Advanced details, the IAM instance profile wabilink-server,
Allow tags in metadata, and the script in User data. Or:
curl -fsSLO https://link.wabione.com/ec2-user-data-windows.txt
aws ec2 run-instances \
--image-id resolve:ssm:/aws/service/ami-windows-latest/Windows_Server-2025-English-Full-Base \
--instance-type t3.medium \
--iam-instance-profile Name=wabilink-server \
--security-group-ids "$sg" \
--metadata-options HttpTokens=required,InstanceMetadataTags=enabled \
--user-data file://ec2-user-data-windows.txt \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=wabilink}]' \
--query 'Instances[0].InstanceId' --output textFor Remote Desktop, add --key-name and one of your key pairs: the console's
Connect → RDP client decrypts the Administrator's password with it.
Windows takes a few minutes to start; the server is set up five to ten minutes after the launch.
The server appears in Servers, online, named by the instance's Name tag - or by its instance ID where the tag is not in its metadata. Instances launched together with one Name tag get one name: leave the tag out, or set the script's server name, to tell them apart.
On the server's page: People → Add person for each person of your organization who may use it, with their shares; Terminals and desktop, Tunnels and Databases for the rest. Changes reach the server within seconds.
In the WabiLink app, Sign in at the top right, with your WabiOne account: the server is in the list, ready to connect. There is no address, password or fingerprint to type: WabiOne vouches for the server.
The script writes it to the instance's system log (console: the instance → Actions → Monitor and troubleshoot → Get system log), with its address:
aws ec2 get-console-output --instance-id i-0123456789abcdef0 --latest --query Output --output text | grep WABILINKIn PowerShell on Windows - where the CLI needs UTF-8 to print the log at all:
$env:PYTHONUTF8 = 1
aws ec2 get-console-output --instance-id i-0123456789abcdef0 --latest --query Output --output text | Select-String -CaseSensitive WABILINKThe server is usually set up a minute after the instance starts; the log can take a few minutes more to show it. Through
Session Manager, sudo wabilink-server identity shows the fingerprint at once.
The script writes it, with the instance's address, to C:\Windows\Temp\wabilink-ec2-log-*\wabilink-ec2.log, a folder of its own each run that only SYSTEM and the administrators may read. Run Command reads
it, with no Remote Desktop (console: Systems Manager → Run Command,
AWS-RunPowerShellScript):
id=$(aws ssm send-command --instance-ids i-0123456789abcdef0 --document-name AWS-RunPowerShellScript \
--parameters '{"commands":["(Select-String -CaseSensitive WABILINK C:\\Windows\\Temp\\wabilink-ec2-log-*\\wabilink-ec2.log).Line"]}' \
--query Command.CommandId --output text)
aws ssm get-command-invocation --instance-id i-0123456789abcdef0 --command-id "$id" --query StandardOutputContent --output textAsked straight after the first command, the second may answer InvocationDoesNotExist: ask again a few seconds
later. Through Session Manager or Remote Desktop, this shows it at once:
& "$env:ProgramFiles\WabiLink\Server\wabilink-service.exe" identityIn the app: the instance's public address, port 8009, the administrator and its password; compare the
fingerprint it shows with the one above before accepting it. An Elastic IP keeps the address the same
when the instance is stopped and started.
More users and shares with the WabiLink app (This PC's server), on the instance's Start menu, through Remote Desktop.
Server settings in the app on your own computer cannot reach it: WabiLink Setup opens the admin port, 8010, to the
instance's own network only.
--count 3, or the launch in a loop. Elsewhere than AWS - a machine or VM your
pipeline sets up - a server registers itself the same way, with the token on standard input:
register --token-stdin.The whole run is in /var/log/cloud-init-output.log on the instance (and in the system log). It stops at the
first thing that fails, saying why - a token WabiOne refuses (revoked or expired), or a parameter it cannot read (its
name, or the role's permission) - and the server is not started. With no token to read, it says so, and sets up offline
instead. Fix it, and run the script again on the instance through Session Manager:
sudo bash /var/lib/cloud/instance/scripts/part-001.
The run is in C:\Windows\Temp\wabilink-ec2-log-*\wabilink-ec2.log on the instance, read from an elevated prompt through Session Manager or Remote Desktop,
with where WabiLink Setup's own log is. It stops at the first thing that fails, saying why - a token WabiOne refuses
(revoked or expired), or a parameter it cannot read (its name, or the role's permission). With no token to read, it
says so, and sets up offline instead. Fix it, and launch a new instance: EC2 runs user data at the first boot only.
Updates come with the system's own (sudo dnf upgrade --refresh,
sudo apt update && sudo apt upgrade).
The server updates itself at night, with WabiLink Setup's own task (the server's
auto-update setting turns it off).
When no more servers are to be added, revoke the token in the console and delete the parameter
(aws ssm delete-parameter --name /wabilink/registration-token): the servers it registered stay.
More users and shares from Server settings in the app, or through Session Manager. The parameter can be deleted once the instance is set up; the password lives on in the server.
The usual causes, and what to do. Commands on the server need sudo on Linux and macOS, and an
administrator prompt on Windows (.\wabilink-service in place of wabilink-server).
systemctl status wabilink; macOS:
sudo launchctl print system/com.wabilink.server | grep state; Windows: .\wabilink-service status.8009 open in the server's firewall - and on AWS, its security group; from outside your network,
forwarded on the router?hostname -I (Linux), ipconfig getifaddr en0 (macOS),
ipconfig (Windows).Compare it with wabilink-server identity on the server. If they differ, don't accept it: something between
you and the server is pretending to be it. If the server was reinstalled without its data, it has a new identity - accept
the new one only once the server itself shows it to you.
Set a new one on the server: wabilink-server user passwd NAME. After too many failed tries an account is
locked; wabilink-server user unlock NAME clears that.
On Linux the server runs as the wabilink account, which must be able to read the folder, and write where
people upload: sudo setfacl -R -m u:wabilink:rwX,d:u:wabilink:rwX /path. On macOS, Documents, Desktop and
Downloads need Full Disk Access for /usr/local/wabilink-server/wabilink-server.
It was run without sudo: settings belong to the service. Run it again with sudo (on Windows, from
an administrator prompt). Settings take effect at once; no restart is needed.
It uses port 8010, which the firewall must allow from where you are, and an account made with
--admin (or wabilink-server user admin NAME yes).
The desktop is off, or the account may not use it:
wabilink-server config set desktop-enabled yes and wabilink-server user desktop NAME yes.
The client must be 1.1 or later.
Nobody is logged in at the Linux machine, and GNOME doesn't share its login screen. Lock rather than log out; after a
restart, log in at the machine once, or set up desktop-setup NAME --login (see the Linux server guide).
No desktop agent runs in a session on that Linux machine. In the session on its screen:
systemctl --user status wabilink-desktop-agent, and if it is disabled,
systemctl --user enable --now wabilink-desktop-agent. A server installed from the .tar.gz
needs the agent set up once (the guide's desktop step).
The screen is blanked or locked: press a key or move the mouse in the viewer, and unlock it with that account's password. On a Mac, black or no keys means its permissions are off: Screen & System Audio Recording and Accessibility for the server, which an update can turn off again.
The chart button in the viewer's bar shows the codec, frames a second, and why that codec was picked. Lossless tiles need a fast link; for video, the server needs its graphics card's driver (or SVT-AV1), and the viewer its decoders - see the optional steps in your system's guide.
Linux: journalctl -u wabilink, and the desktop agent's journalctl --user -u wabilink-desktop-agent.
macOS: /Library/Logs/WabiLink/server.log. Windows: C:\ProgramData\WabiLink\Server\logs, and the
Application event log.
Every download is listed with its SHA-256 in SHA256SUMS, signed in SHA256SUMS.asc. That list, the Linux packages and the repositories are signed with wabilink.asc.
To check a download, in the folder it is in:
curl -fsSLO https://link.wabione.com/files/SHA256SUMS -O https://link.wabione.com/files/SHA256SUMS.asc -O https://link.wabione.com/wabilink.asc
gpg --show-keys wabilink.asc
gpg --import wabilink.asc && gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS # macOS: shasum -a 256 --ignore-missing -c SHA256SUMSThe signing key's fingerprint: 2C9F6909A29FC1FE2F957F7FACBA86055D3EBAD2. Go on only if gpg --show-keys
shows that one key and no other, and gpg --verify says Good signature with that fingerprint.