Run a full self-hosted NetDesk (signaling + relay + web viewer/host + accounts + portal + audit) with one command, plus an optional coturn TURN sidecar.

cd docker
cp .env.example .env     # then edit .env — at least ND_STATUS_KEY + ND_PORTAL_PASSWORD
docker compose up -d --build

The server listens on :8443 (plain HTTP/WS). For the public internet, terminate TLS at a reverse proxy (nginx/Caddy/Traefik) in front of it, or set ND_CERT / ND_KEY in .env (and mount the certs in docker-compose.yml) to run TLS in-process.

Quick check once it's up:

curl "http://localhost:8443/status?token=$ND_STATUS_KEY"

Persistence

All state — accounts.db, audit.log, and uploaded files/ — lives in the named volume netdesk-data (mounted at /data via ND_DATA_DIR), so it survives docker compose down / image rebuilds. Back it up with docker run --rm -v netdesk-data:/data -v "$PWD":/backup busybox tar czf /backup/netdesk-data.tgz -C /data ..

Config

Everything is set through .env (see .env.example for the full list); the entrypoint maps ND_* vars to the server's CLI flags. Only non-empty vars are passed, so the defaults apply otherwise.

TURN

The coturn sidecar runs with --use-auth-secret sharing ND_TURN_SECRET; the server mints 12-hour HMAC credentials against the same secret. It uses host networking because TURN needs the real relay port range. Leave ND_TURN_HOST / ND_TURN_SECRET blank to disable TURN (direct P2P + the WSS relay still work).