# NetDesk server — Docker

Run a full self-hosted NetDesk (signaling + relay + web viewer/host + accounts +
portal + audit) with one command, plus an optional coturn TURN sidecar.

```sh
cd docker
cp .env.example .env     # then edit .env — at least ND_STATUS_KEY + ND_PORTAL_PASSWORD
docker compose up -d --build
```

The server listens on `:8443` (plain HTTP/WS). For the public internet, terminate
TLS at a reverse proxy (nginx/Caddy/Traefik) in front of it, or set `ND_CERT` /
`ND_KEY` in `.env` (and mount the certs in `docker-compose.yml`) to run TLS
in-process.

Quick check once it's up:

```sh
curl "http://localhost:8443/status?token=$ND_STATUS_KEY"
```

## Persistence

All state — `accounts.db`, `audit.log`, and uploaded `files/` — lives in the
named volume `netdesk-data` (mounted at `/data` via `ND_DATA_DIR`), so it
survives `docker compose down` / image rebuilds. Back it up with
`docker run --rm -v netdesk-data:/data -v "$PWD":/backup busybox tar czf /backup/netdesk-data.tgz -C /data .`.

## Config

Everything is set through `.env` (see `.env.example` for the full list); the
entrypoint maps `ND_*` vars to the server's CLI flags. Only non-empty vars are
passed, so the defaults apply otherwise.

## TURN

The `coturn` sidecar runs with `--use-auth-secret` sharing `ND_TURN_SECRET`; the
server mints 12-hour HMAC credentials against the same secret. It uses host
networking because TURN needs the real relay port range. Leave `ND_TURN_HOST` /
`ND_TURN_SECRET` blank to disable TURN (direct P2P + the WSS relay still work).