45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
# NetDesk self-hosted stack: the signaling/relay/web server + a coturn TURN
|
|
# sidecar. One command to stand up a full self-hosted NetDesk:
|
|
#
|
|
# cd docker && cp .env.example .env # then edit .env (secrets)
|
|
# docker compose up -d --build
|
|
#
|
|
# Terminate TLS at your reverse proxy (nginx/Caddy/Traefik) in front of :8443,
|
|
# or set ND_CERT/ND_KEY + mount the certs to run TLS in-process.
|
|
services:
|
|
netdesk:
|
|
build:
|
|
context: .. # repo root, so the image can COPY server/
|
|
dockerfile: docker/Dockerfile
|
|
image: netdesk-server:latest
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${ND_PORT:-8443}:8443" # HTTP/WS (put a TLS proxy in front for the internet)
|
|
env_file: .env
|
|
volumes:
|
|
- netdesk-data:/data # accounts.db, audit.log, files/ (ND_DATA_DIR)
|
|
# If you enable in-process TLS, also mount your certs and set ND_CERT/ND_KEY:
|
|
# - ./certs:/certs:ro
|
|
|
|
# Self-hosted TURN (use-auth-secret): the server mints 12h HMAC creds against
|
|
# ND_TURN_SECRET, and peers relay through here when direct P2P can't punch NAT.
|
|
# Set ND_TURN_HOST + ND_TURN_SECRET in .env (and TURN_REALM) to activate it.
|
|
coturn:
|
|
image: coturn/coturn:4.6.2
|
|
restart: unless-stopped
|
|
network_mode: host # TURN needs the real host ports / relay range
|
|
command:
|
|
- -n
|
|
- --use-auth-secret
|
|
- --static-auth-secret=${ND_TURN_SECRET:-changeme}
|
|
- --realm=${TURN_REALM:-netdesk.local}
|
|
- --listening-port=3478
|
|
- --tls-listening-port=5349
|
|
- --min-port=49152
|
|
- --max-port=65535
|
|
- --no-cli
|
|
- --fingerprint
|
|
|
|
volumes:
|
|
netdesk-data:
|