# Kasm Workspaces on Your Own Subdomain: Email Login, Uses and Costs

Give staff a disposable browser or Linux desktop behind email login. Compare Kasm on Kimsufi and a VPS with hosted desktops, including licenses and labor.

Author: J.A. Watte
Published: October 30, 2026
Source: https://jwatte.com/blog/kasm-workspaces-subdomain-cloudflare-access/

---

**Kasm Workspaces can give your staff a disposable browser, a Linux desktop or a single application running in a container on your server, opened through a supported web browser after an approved email login. Nobody needs to install a remote desktop client on their device.**

That can be useful when a seasonal bookkeeper needs a client portal, a maintenance vendor needs one work order application, or a volunteer needs a familiar desktop for an afternoon. Put Kasm at its own address, such as `desktops.example.com`. Cloudflare Access checks the visitor's approved email before showing Kasm's login page. Kasm then checks its own account and workspace permissions.

Skip this design for heavy Windows only business software unless you also have a Windows server and licensing plan. A Linux container does not supply Windows. Skip GPU work on a machine without a suitable GPU. Keep regulated records out until someone has checked the applicable rules, contracts and recovery requirements.

This builds on our [Kimsufi and Cloudflare Tunnel guide](/blog/kimsufi-vps-cloudflare-tunnel-access/). That article covers the shared tunnel and email login steps. Here we deal with what changes when the application behind that gate is a streamed desktop.

We read the primary sources on October 29, 2026. We have not installed or load tested this system for the article. The session counts below are planning assumptions, and the cost comparisons include paid business licensing.

## The free edition is not a free business license

Kasm's [licensing documentation](https://docs.kasm.com/docs/latest/reference/license) allows Community Edition for testing, nonprofit and eligible noncommercial use, with a limit of five concurrent sessions and community support. Its [license agreement](https://kasm.com/eula) is more direct: Community Edition “may not be used for revenue-generating business activities.” A five person company does not become eligible merely because it fits beneath the session limit.

The open source workspace images and KasmVNC rendering technology have their own licenses. Their availability does not turn the complete Kasm Workspaces platform into an unrestricted commercial product. Read the platform license and the licenses for applications you put inside it.

Here is what Kasm's [edition comparison](https://kasm.com/community-edition) and [purchase configurator](https://kasm.com/server-checkout) showed when checked:

| Edition or model | Published charge | What you are buying |
|---|---:|---|
| Community Edition | $0 | Eligible use, up to five simultaneous sessions, community support |
| Starter, named users | $10 per user monthly equivalent, billed annually | Licenses for registered users; five cost $600 a year |
| Starter, concurrent sessions | $20 per session monthly equivalent, billed annually | Shared simultaneous capacity; two cost $480 a year |
| Enterprise | Request a quote | Commercial deployment with additional features and support options |

Named users and concurrent sessions measure different things. Five people who use the system throughout the day may suit named licensing. A larger group whose work rarely overlaps may suit concurrent licensing. Buying two sessions means you must handle the moment a third person wants to work. Buying licenses also does not create more server memory.

Starter is self supported; its purchase page excludes support services. The small team page uses both “fewer than 25” and “up to 25,” while its comparison table divides licenses at less than and greater than 25. Confirm the exact boundary with Kasm if you are near it. Our example uses two concurrent licenses and stays well below that ambiguity.

Kasm also sells [Cloud Personal](https://kasm.com/cloud-personal): Cloud Browser at $10 a month with 100 hours, Cloud Desktop at $20 with 200 hours, and Cloud OSINT at $40 with 300 hours. Their published timeouts are 20, 30 and 60 minutes respectively. These are individual services with disposable sessions, no built in file persistence and no software installation. They are not the same purchase as a company managed installation on your own hostname. [Business Cloud and Enterprise deployments require a quote](https://kasm.com/quote).

## What the server actually needs

The current [Kasm requirements](https://docs.kasm.com/docs/explanations/system-requirements) specify at least two CPU cores, 4 GB RAM and 75 GB SSD storage. Ubuntu 22.04 and 24.04 are supported. Kasm recommends a machine dedicated to this purpose, letting its installer handle compatible Docker components, and having swap available for stability.

Those are installation requirements. Each running workspace consumes more capacity. Kasm's default workspace configuration requests two cores and 2,768 MB RAM. The scheduler can refuse a new session when available resources do not meet its configured allocation, even when you still have unused license capacity.

There is no universal recommended specification for every small business in that requirements table. Kasm's [sizing guide](https://docs.kasm.com/docs/explanations/sizing-operations) directs single server deployments to its agent sizing guidance. It recommends planning around simultaneous sessions, monitoring real consumption, and allowing disk space for the base images plus user activity. Its agent storage guidance starts at 80 GB before user space. Do not mistake its database capacity examples for complete desktop capacity.

Our planning assumptions for ordinary portal work are deliberately modest:

| Host | Our initial target | What limits the target |
|---|---|---|
| Two vCPU, 4 GiB VPS | Zero to one light session until tested | Services and a default workspace must fit together; little spare disk capacity on an 80 GiB plan |
| Four vCPU, 8 GiB VPS | One to two light sessions | CPU reservations, service overhead and heavier browser tabs can reduce capacity |
| KS-5 with four physical cores, eight threads and 32 to 64 GB RAM | Start with two; test two to four if more capacity is needed | CPU and streaming load can become limits well before RAM |

These are our assumptions derived from the documented allocations, not benchmarks. The cost example buys only two concurrent licenses. Reaching a higher target may require more licenses and carefully adjusted workspace allocations or agent settings. Do not increase memory overrides simply to make a warning disappear. A machine that starts more sessions but then runs out of memory has not gained useful capacity.

The KS-5 hardware and starting price come from the [Kimsufi catalog](https://eco.us.ovhcloud.com/kimsufi/) checked for the companion article. Its configurations vary. Confirm SSD storage, actual memory, delivery and the final price before ordering; the starting price alone does not establish the disk technology of your selection. The companion's $5.35 monthly OVHcloud VPS-1 offer, or $4.54 with a 12 month commitment, has a 40 GB disk. That falls below Kasm's documented 75 GB SSD minimum, so we do not use that attractive price as a ready to install Kasm budget.

For the pilot, test the actual work: the largest portal report, a document upload, a video if staff need it, and two people working together. Watch memory, CPU, storage and response time. A successful login only proves that the login works.

## One hostname and two login checks

The path is straightforward:

**Staff browser → Cloudflare Access email check → Cloudflare Tunnel → Kasm account → permitted workspace.**

Create a self hosted Access application for the entire `desktops.example.com` hostname before publishing its tunnel route. Enable One-time PIN and allow specific staff and contractor email addresses. Avoid an unrestricted email rule or a policy that admits everyone. Use the [companion walkthrough](/blog/kimsufi-vps-cloudflare-tunnel-access/) for the shared setup.

[Cloudflare's PIN documentation](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/) says codes expire after ten minutes, work once, and are replaced when a new code is requested. An unapproved visitor sees a generic message but does not receive access. Confirmation proves control of that approved mailbox at login. It does not certify that the person's laptop is clean, managed or even theirs.

The second check belongs to Kasm. Create an individual account for each person, assign a group, and expose only that group's workspaces. An approved maintenance vendor should not receive a staff desktop merely because both can pass Cloudflare. Kasm documents its own [two factor authentication](https://docs.kasm.com/docs/how-to/security/users-groups-mgmt/two-factor), including TOTP and WebAuthn. Enable an appropriate second factor, particularly for administrators, and keep recovery procedures outside the server.

Keep the origin private too. A person who can reach Kasm directly through its public server address can avoid the Cloudflare check. Close unintended public routes and verify this from another network, including IPv6 where enabled. [Docker documents that published ports can bypass UFW](https://docs.docker.com/engine/network/packet-filtering-firewalls/), so a host firewall rule alone is not proof.

### The settings that differ from a normal website

Kasm listens on HTTPS port 443 by default. Its installer accepts `-L 8443` to use another port. A tunnel does not require that change, but an alternate port can avoid conflicts with another local listener. The public browser address still uses normal HTTPS without an added port number.

Kasm's [Cloudflare guide](https://docs.kasm.com/docs/how-to/networking/cloudflare-tunnels) uses an HTTPS origin and enables **No TLS Verify** and **HTTP2 Connection**. No TLS Verify accommodates the installation's self signed certificate by disabling certificate verification between the connector and Kasm. It does not disable HTTPS in the visitor's browser. Prefer a verified origin certificate where practical, especially if the connector reaches Kasm across a network; [Cloudflare documents the certificate and HTTP/2 settings](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/).

Kasm's [reverse proxy instructions](https://docs.kasm.com/docs/how-to/networking/reverse-proxy) also require Zone changes. For this single server arrangement, set **Upstream Auth Address** to `proxy` and **Proxy Port** to `0`. The latter lets Kasm determine the public port from the browser address. Start a new workspace after changing the Zone; existing sessions retain their old settings. A dedicated subdomain avoids the extra path and cookie configuration required when placing Kasm beneath a URL path.

WebSockets carry the interactive session. Keep them enabled in Cloudflare and preserve their upgrade handling if you add another reverse proxy. Cloudflare [supports WebSockets on every plan](https://developers.cloudflare.com/network/websockets/), but connections can end during network updates or inactivity. Test reconnection and Access expiry during a full length work session. An email login page appearing where a connection expects a stream can look like a broken desktop.

This kit covers browser sessions. Kasm documents an additional client IP restriction caveat for native RDP clients behind Cloudflare. Do not copy the browser design and assume it also provides a native Windows remote desktop service.

## Seven ways a small business might use it

These are illustrations, not customer stories. Each commercial example assumes one or two people working at once and two paid concurrent licenses. That puts a standalone KS-5 installation in the **$4,914 to $10,398 over 36 months** range calculated below, subject to the selected server configuration. The same license can serve different approved people at different times. It cannot serve all of them simultaneously.

### A five person bookkeeping firm

The problem in their words might be: our seasonal contractor needs the client portal, but we do not want downloaded statements on a personal laptop. Give that contractor a Chrome or Firefox workspace, their own portal credentials and an approved email entry in Access. Disable routine downloads and clipboard export unless the work requires them.

On a normal morning the contractor opens the company address, confirms email, signs into Kasm and works in the portal. Ending the disposable session clears that workspace's local state. It does not delete anything saved in the portal. Budget the paid two session case above, plus any portal subscription already required. Before client financial records enter the system, check whether the GLBA Safeguards Rule applies to the firm and whether client contracts permit this access arrangement.

### A property manager with four staff and six regular vendors

Their problem: vendors need today's approved work orders without browsing every tenant file. Publish a browser workspace with the repair portal as its starting page. Allow each vendor's own email through Access and give them a restricted Kasm group and a restricted portal account.

A plumber opens the assigned job, reviews permitted photos and updates its status. The coordinator no longer shares a general office login. A bookmarked URL alone does not lock down a browser; enforce permissions in the portal and any required browsing restrictions separately. This uses the same two session budget if vendors take turns. If four vendors routinely log in together, the license and server plan must change.

### A 24 room motel with twelve employees

The front desk problem: shared browser profiles collect saved passwords and unrelated tabs between shifts. Use a disposable browser workspace for the online travel agency extranet, admitting only the front desk staff who need it. Keep each person's application identity wherever the extranet supports that arrangement.

At shift change the clerk signs out and destroys the workspace. This fits the two session cost case when one clerk and a manager overlap. Before routing payment work through it, check PCI DSS obligations with the processor. Do not place card details in clipboard history or recordings. If a tunnel or server outage would stop check in, keep the approved continuity procedure and consider a managed service.

### A six person law office

Their concern: someone must inspect an unexpected link without opening it beside ordinary client work. Offer a separate disposable Firefox workspace to the designated reviewer and backup reviewer. Admit their individual emails and avoid mounting client folders or signing into privileged accounts in that session.

The reviewer opens the link inside the isolated browser, records the outcome through the firm's approved process and destroys the session. Treat the two session server budget as a shared office expense, not a separate fee for every suspicious link. Check attorney client confidentiality, applicable state professional conduct rules and the firm's incident procedure before putting client material there. Isolation reduces exposure; it does not make entering a password into a phishing page safe.

### A seven person print shop

The problem: a customer needs help checking artwork, but installing unfamiliar software on the shop's counter computer wastes time. Give the designer and an invited customer separate Ubuntu desktop workspaces with an approved image tool such as GIMP. Allow only the customer's nominated email during the appointment.

The designer demonstrates the review process while the customer works on a sample copy. Store the final approved file in the shop's normal job system before ending the session. Our two session budget covers this occasional appointment alongside other light use. Color accuracy, large artwork and specialist font licensing need their own tests; a streamed desktop is not proof that a file is ready for production.

### A nonprofit with three employees and twelve volunteers

Their problem: every volunteer starts with a different collection of bookmarks and software. Provide individual accounts with the same Ubuntu desktop image and approved bookmarks. Allow only the volunteers scheduled for the task. They receive consistent starting tools without sharing one login.

At the end of a session, volunteers save approved work to the organization's system and close the disposable desktop. For an eligible nonprofit use, Community Edition can remove the $40 monthly license line from our two session example, reducing the 36 month KS-5 total to **$3,474 to $8,958**. Check the license before mixing this with revenue generating activity. Twelve volunteers still do not fit into five concurrent Community sessions at once, and the hardware may support fewer.

### A four person web design shop

Their problem: a client training session begins with forty minutes of local setup. Give the trainer and client an Ubuntu workspace or the listed Visual Studio Code application workspace, with a sample project and no production secrets. Approve the client's email only for the agreed training period.

The client opens the same environment the trainer prepared. Budget the paid two session case plus preparation time for custom images, which our operations allowance excludes. Heavy builds may justify more CPU. Kasm's [image catalog](https://kasm.com/images) and [Cloud Desktop application list](https://kasm.com/cloud-personal) show the application types; confirm the selected image and architecture before promising a particular version.

## The 36 month cost comparison

Kasm and Kimsufi are not competing products. Kasm is the workspace software; Kimsufi is one place to run it. The useful comparison is the whole arrangement against a VPS, hosted desktops, or access to existing computers.

All prices below are US dollars before tax, read October 29, 2026. Our fixed example has five registered people, demand ranging from one to two simultaneous sessions, and two concurrent Starter licenses reserved in both labor cases. Cloudflare Zero Trust Free contributes $0 for this team under 50 users. The companion article verifies its separate Pay-as-you-go price of $7 per user monthly, which we do not need here.

Our server assumptions are 4 to 12 setup hours and 1 to 3 administration hours monthly at **$68.09 an hour**. This is the series' employee compensation estimate from administrator wages and benefits, not an IT provider's quote. An outside provider may bill substantially more.

Backups retain 50 to 200 GB across all copies and versions. At [Backblaze B2's $6.95 per decimal TB monthly](https://www.backblaze.com/cloud-storage/pricing), with the first 10 GB free, that is `(50 − 10) × 0.00695 = $0.278` to `(200 − 10) × 0.00695 = $1.3205` monthly. Transfer beyond the included allowance and other chargeable usage are extra. The worksheet retains these fractions before rounding totals.

For the alternatives, our assumption is 1 to 3 setup hours and 0.25 to 0.75 administration hours monthly, with the same independent business data backup allowance. Hosted services still need account management and recovery planning. Training, migration, custom images, compliance assessments and major incidents are excluded from every row.

| Option | Setup cost | Monthly equivalent including labor | 36 month total |
|---|---:|---:|---:|
| Kasm on KS-5 at listed $20 plus $20 installation | $292 to $837 | $128 to $266 | $4,914 to $10,398 |
| Kasm on DigitalOcean 4 GiB, $24 monthly, minimum pilot only | $272 to $817 | $132 to $270 | $5,038 to $10,522 |
| Kasm on DigitalOcean 8 GiB, $48 monthly | $272 to $817 | $156 to $294 | $5,902 to $11,386 |
| Five AWS Windows Standard desktops at $44 each monthly | $68 to $204 | $237 to $272 | $8,611 to $10,010 |
| Five Splashtop Remote Access Pro licenses at $8.25 each monthly equivalent | $68 to $204 | $59 to $94 | $2,176 to $3,575 |

The [DigitalOcean prices](https://www.digitalocean.com/pricing/droplets) buy two shared vCPUs and 80 GiB disk in the 4 GiB tier, or four shared vCPUs and 160 GiB disk in the 8 GiB tier. The minimum pilot row retains the same license purchase for comparison, but does not promise two usable sessions. Use the 8 GiB row when budgeting a two session VPS pilot.

The [AWS example](https://aws.amazon.com/workspaces/desktop-as-a-service/pricing/) is Windows Standard in Oregon with 175 GB root and 100 GB user storage at $44 per desktop monthly. Five desktops have a subscription total of `5 × 44 × 36 = $7,920` before our labor and backup allowances. Those are five available Windows desktops, while our Kasm arrangement has two shared container sessions. A Windows application requirement can decide this purchase before price does.

[Splashtop Pro](https://www.splashtop.com/pricing) costs $99 per user billed annually. Five licenses are $495 a year, or `5 × 99 × 3 = $1,485` over three years before the allowances. It reaches computers you already have. Computer purchase, power, replacement and host maintenance are outside that row. If those office computers already do the job, buying access to them is substantially cheaper here.

The server formula is **provider installation + setup hours × labor + 36 × (hosting + Kasm license + backups + monthly admin hours × labor)**. For KS-5 low, that is `20 + 4 × 68.09 + 36 × (20 + 40 + 0.278 + 68.09) = $4,913.608`, rounded to $4,914. Annual software bills are counted through their monthly equivalents; the actual $480 Kasm payment is due annually, not in monthly installments.

| Kasm option against five AWS desktops | Low case difference and break even | High case difference and break even |
|---|---|---|
| KS-5 | Saves $3,697; month 3 | Costs $388 more; outside 36 months |
| 4 GiB minimum pilot | Saves $3,573; month 2 | Costs $512 more; outside 36 months |
| 8 GiB VPS | Saves $2,709; month 3 | Costs $1,376 more; never on these inputs |

Break even uses the setup difference divided by the monthly cost saving, rounded up. The KS-5 high case would reach month 94 and the minimum VPS high case month 220 if every input stayed unchanged. Those are arithmetic results far beyond this planning horizon, not forecasts. Annual billing also changes cash timing. Against Splashtop, KS-5 costs $2,738 to $6,823 more over 36 months and never breaks even on these inputs. Neither VPS wins that comparison.

Holding software and labor equal, KS-5 saves only $124 over 36 months against the $24 minimum VPS, recovering its $20 installation fee in month 5. Against the $48 VPS it saves $988, recovering that fee in month 1. Its extra RAM matters when a tested workload can use it. It does not eliminate CPU limits, outages or maintenance.

For one person, Kasm Cloud Personal's subscription totals are $360 for Browser, $720 for Desktop or $1,440 for OSINT over 36 months. These exclude customer labor and backups, and retain the published hour limits. Business Cloud remains quote only, so we cannot honestly place a team price in the table. A hosted option wins when its available features fit and nobody in the business can reliably maintain another server.

If the real goal is reaching existing office computers, also consider [Apache Guacamole](/blog/apache-security-identity-remote-access-small-business/). It is a browser gateway to existing RDP, VNC and SSH systems. The computers and their application licenses still have to exist.

## Keeping the desktops disposable and the service recoverable

Give each person a separate account and group permissions. Start without persistent profiles. Enable persistence only when the work requires it, with a named storage location, retention rule and backup owner. A disposable session can still leave records in an external application, uploaded storage, logs or an explicitly persistent profile.

Set session limits and file transfer rules deliberately. Test clipboard access in both directions, uploads, downloads and mapped storage using an ordinary account. Restricting a menu item is not a substitute for testing the data path. A compromised endpoint can still observe the screen or keyboard, and a user can photograph information they can see.

Kasm's [session recording documentation](https://docs.kasm.com/docs/how-to/workspaces-sessions/sessions/session-recording) requires Enterprise licensing. Recording is not included in the Starter budget above. If needed, price the edition and storage, tell people what is recorded, and test retention and access. Recordings can themselves contain sensitive information.

Patch the host, Kasm services and workspace images. Read the [release notes](https://docs.kasm.com/docs/reference/release-notes/1.19.0) and the matching upgrade instructions before each change. Kasm 1.19.0 makes rolling images the default installation choice; its [rolling image guidance](https://docs.kasm.com/docs/how-to/infra-autoscale/rolling-image-management) explains the maintenance model. Static images require a deliberate update process. Do not assume a running desktop has become current merely because a newer image was downloaded.

Review both Access authentication events and Kasm logs. They answer different questions: who passed the outer gate, and what happened inside Kasm. Choose retention to fit the records involved and investigate unexpected administrator access or repeated session failures.

Back up the Kasm database, required configuration and any persistent profiles separately. Test a restore into a separate instance. Kasm's database dump is not a backup of every user file. The kit includes the official backup starting point and identifies recovery details that need version specific review.

Offboarding also has two layers. Remove the person's Access eligibility, revoke existing Access sessions, disable their Kasm account and terminate active Kasm sessions. Then remove portal accounts and shared credentials they could use. Closing only the email gate does not erase an already running workspace or a password copied elsewhere.

Finally, keep access to the hosting control panel independent of Kasm and the tunnel. Kimsufi has no IPMI; its documented recovery route is rescue mode from the OVHcloud Control Panel. A failed update may need a rescue boot while staff wait. The [companion kit](/downloads/kimsufi-vps-cloudflare-tunnel-access-kit.md) covers that procedure. A rescue environment repairs access to the machine; an off site backup recovers lost data.

## Download the setup kit

[Download the Kasm Workspaces setup kit](/downloads/kasm-workspaces-subdomain-cloudflare-access-kit.md). It includes the one page plan, Ubuntu installation and checksum steps, Kasm specific tunnel settings, group policies, tests, offboarding, troubleshooting and the cost worksheet. Run its commands only on the new server you intend to dedicate to Kasm.

## Related reading

- [Kimsufi, a small VPS and Cloudflare email access](/blog/kimsufi-vps-cloudflare-tunnel-access/), including the shared tunnel walkthrough and hosting terms.
- [Apache security, identity and remote access](/blog/apache-security-identity-remote-access-small-business/) for Guacamole and existing office computers.
- [Apache projects for small businesses](/blog/apache-open-source-projects-small-business/) for the broader software and cost framework.
- [Laravel for small business](/blog/laravel-small-business-guide/) when the portal itself needs custom development.
- [A secure workspace on an unfamiliar device](/blog/secure-workspace-on-any-unknown-device/) for broader endpoint tradeoffs. Use this article's current Kasm licensing check when evaluating commercial use.
- [Building a self hosted server](/blog/self-hosted-ai-server-from-scratch/) for the ownership and recovery work behind a server subscription.

*The $100 Network* also considers what is worth operating yourself when your time is limited.

## Fact-check notes and sources

1. [Kasm licensing](https://docs.kasm.com/docs/latest/reference/license), [EULA](https://kasm.com/eula) and [edition comparison](https://kasm.com/community-edition), read October 29, 2026, 22:48 to 22:49 UTC. Community eligibility, five session cap and commercial restrictions; the quoted restriction is from EULA section 2.2.
2. [Starter purchase page](https://kasm.com/server-checkout) and [small team terms](https://kasm.com/quote/deployment-options-small-teams), read October 29, 2026, 22:49 to 22:52 UTC. Configured examples showed $600 annually for five named users and $480 annually for two concurrent sessions. No order was placed. The 25 license boundary needs confirmation.
3. [Cloud Personal](https://kasm.com/cloud-personal), [business quotes](https://kasm.com/quote) and [workspace images](https://kasm.com/images), read October 29, 2026, 22:49 to 22:53 UTC. Personal prices and hour allowances are separate from a team service.
4. [System requirements](https://docs.kasm.com/docs/explanations/system-requirements) and [sizing](https://docs.kasm.com/docs/explanations/sizing-operations), read October 29, 2026, 22:49 UTC. Minimum hardware and default allocations are documented; small server session targets are our assumptions.
5. [Kasm Cloudflare setup](https://docs.kasm.com/docs/how-to/networking/cloudflare-tunnels), [reverse proxy setup](https://docs.kasm.com/docs/how-to/networking/reverse-proxy) and [two factor authentication](https://docs.kasm.com/docs/how-to/security/users-groups-mgmt/two-factor), read October 29, 2026, 22:49 UTC. These document the origin settings, Zone changes and account protection.
6. [Cloudflare application setup](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/), [PIN behavior](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/), [origin parameters](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/) and [WebSockets](https://developers.cloudflare.com/network/websockets/), read October 29, 2026, 22:49 to 22:53 UTC.
7. [Kimsufi KS-5](https://eco.us.ovhcloud.com/kimsufi/ks-5/), [OVHcloud VPS](https://us.ovhcloud.com/vps/) and [Cloudflare Zero Trust prices](https://www.cloudflare.com/plans/zero-trust-services/), checked October 29, 2026 for the companion article. KS-5 was orderable in Hillsboro and Beauharnois; stock, disk selection and checkout terms must be rechecked. The listed starting price is not a verified SSD configuration quote.
8. [DigitalOcean prices](https://www.digitalocean.com/pricing/droplets) and [Backblaze B2](https://www.backblaze.com/cloud-storage/pricing), read October 29, 2026, 21:10 UTC for the shared series inputs. [BLS administrator wages](https://data.bls.gov/oesprofile/?areas=INDUSTRY,STATE,MSA&major_group=150000&measure=01&occupation=151244&year=2025) and [compensation share](https://data.bls.gov/timeseries/CMU2020000000000P), read at 21:12 and 21:17 UTC, give $47.66 ÷ 0.700 = $68.09 per hour after rounding.
9. [AWS WorkSpaces prices](https://aws.amazon.com/workspaces/desktop-as-a-service/pricing/), read October 29, 2026, 22:48 UTC; [Splashtop prices](https://www.splashtop.com/pricing), read at 22:49 UTC. Their product scopes differ from Kasm. Totals and break even months are arithmetic on the stated prices and our labor assumptions.
10. [Kasm recording](https://docs.kasm.com/docs/how-to/workspaces-sessions/sessions/session-recording), [rolling images](https://docs.kasm.com/docs/how-to/infra-autoscale/rolling-image-management) and [release notes](https://docs.kasm.com/docs/reference/release-notes/1.19.0), read October 29, 2026, 22:49 to 22:54 UTC. Recording needs Enterprise; update and recovery procedures must match the installed version.

*Product names identify the services discussed. This site is not affiliated with these providers. Check applicable legal, licensing and data handling requirements with the appropriate adviser before using real client records.*


---

Canonical HTML: https://jwatte.com/blog/kasm-workspaces-subdomain-cloudflare-access/
RSS: https://jwatte.com/feed.xml
JSON Feed: https://jwatte.com/feed.json
Hero image: https://jwatte.com/images/kasm-workspaces-subdomain-cloudflare-access.webp