How can I set up a Guacamole proxy to connect multiple branch offices?

Interestingly, you can already achieve this out of the box by installing the guacamole-server component on a different host and then configuring it in the guacamole-client connection on the web interface. Just keep in mind that it lacks built-in authentication, so you might want to wrap it using stunnel for secure access.

You might want to explore Cloudflare tunnels. They can simplify the setup in some cases.

Just a heads-up, this has come up in discussions before. From what I've seen, guacd isn't very secure for direct external use. Setting up a VPN would likely be your safest option.

Typically, if there's no connection between your locations, using VPN tunnels like IPSec is the go-to solution for creating secure links. This way, the central Guacamole instance can interact with devices at your branches as though they're on the same network, thanks to proper firewall and filtering rules.

Have you considered using Tailscale? It's generally simpler to set up compared to something like Headscale.