Browser (HTTPS) → Nginx → Node.js API (REST + JWT auth) → guacamole-lite (WebSocket tunnel) ↓ guacd daemon (handles RDP/SSH/VNC protocols) ↓ Target machines (RDP:3389 / SSH:22 / VNC:5900) ...