42 lines
1.5 KiB
Markdown
42 lines
1.5 KiB
Markdown
# NetDesk server — Docker
|
|
|
|
Run a full self-hosted NetDesk (signaling + relay + web viewer/host + accounts +
|
|
portal + audit) with one command, plus an optional coturn TURN sidecar.
|
|
|
|
```sh
|
|
cd docker
|
|
cp .env.example .env # then edit .env — at least ND_STATUS_KEY + ND_PORTAL_PASSWORD
|
|
docker compose up -d --build
|
|
```
|
|
|
|
The server listens on `:8443` (plain HTTP/WS). For the public internet, terminate
|
|
TLS at a reverse proxy (nginx/Caddy/Traefik) in front of it, or set `ND_CERT` /
|
|
`ND_KEY` in `.env` (and mount the certs in `docker-compose.yml`) to run TLS
|
|
in-process.
|
|
|
|
Quick check once it's up:
|
|
|
|
```sh
|
|
curl "http://localhost:8443/status?token=$ND_STATUS_KEY"
|
|
```
|
|
|
|
## Persistence
|
|
|
|
All state — `accounts.db`, `audit.log`, and uploaded `files/` — lives in the
|
|
named volume `netdesk-data` (mounted at `/data` via `ND_DATA_DIR`), so it
|
|
survives `docker compose down` / image rebuilds. Back it up with
|
|
`docker run --rm -v netdesk-data:/data -v "$PWD":/backup busybox tar czf /backup/netdesk-data.tgz -C /data .`.
|
|
|
|
## Config
|
|
|
|
Everything is set through `.env` (see `.env.example` for the full list); the
|
|
entrypoint maps `ND_*` vars to the server's CLI flags. Only non-empty vars are
|
|
passed, so the defaults apply otherwise.
|
|
|
|
## TURN
|
|
|
|
The `coturn` sidecar runs with `--use-auth-secret` sharing `ND_TURN_SECRET`; the
|
|
server mints 12-hour HMAC credentials against the same secret. It uses host
|
|
networking because TURN needs the real relay port range. Leave `ND_TURN_HOST` /
|
|
`ND_TURN_SECRET` blank to disable TURN (direct P2P + the WSS relay still work).
|