NetDesk 1.5.0 — source release

docker/README.md

@@ -0,0 +1,41 @@
+# NetDesk server — Docker
+
+Run a full self-hosted NetDesk (signaling + relay + web viewer/host + accounts +
+portal + audit) with one command, plus an optional coturn TURN sidecar.
+
+```sh
+cd docker
+cp .env.example .env     # then edit .env — at least ND_STATUS_KEY + ND_PORTAL_PASSWORD
+docker compose up -d --build
+```
+
+The server listens on `:8443` (plain HTTP/WS). For the public internet, terminate
+TLS at a reverse proxy (nginx/Caddy/Traefik) in front of it, or set `ND_CERT` /
+`ND_KEY` in `.env` (and mount the certs in `docker-compose.yml`) to run TLS
+in-process.
+
+Quick check once it's up:
+
+```sh
+curl "http://localhost:8443/status?token=$ND_STATUS_KEY"
+```
+
+## Persistence
+
+All state — `accounts.db`, `audit.log`, and uploaded `files/` — lives in the
+named volume `netdesk-data` (mounted at `/data` via `ND_DATA_DIR`), so it
+survives `docker compose down` / image rebuilds. Back it up with
+`docker run --rm -v netdesk-data:/data -v "$PWD":/backup busybox tar czf /backup/netdesk-data.tgz -C /data .`.
+
+## Config
+
+Everything is set through `.env` (see `.env.example` for the full list); the
+entrypoint maps `ND_*` vars to the server's CLI flags. Only non-empty vars are
+passed, so the defaults apply otherwise.
+
+## TURN
+
+The `coturn` sidecar runs with `--use-auth-secret` sharing `ND_TURN_SECRET`; the
+server mints 12-hour HMAC credentials against the same secret. It uses host
+networking because TURN needs the real relay port range. Leave `ND_TURN_HOST` /
+`ND_TURN_SECRET` blank to disable TURN (direct P2P + the WSS relay still work).