# Unda Media Server: the whole website in one file Every page of https://www.undamedia.com as plain text, in reading order. It is made from the same sources as the pages each time the site is built, so it is never older than they are. - Current version: v0.1.49, released 5 November 2026. The release notes are near the end of this file. - Built on 2026-11-08. - Each page starts with a "Page:" line giving its address; links point at the website. - In the package lists, a line starting "Not included:" is a tool that package does not have. ================================================================ Page: https://www.undamedia.com/ Title: Your own live streaming server Summary: Unda Media Server delivers your live streams to every screen from a server you run yourself, with recording, adaptive quality, restreaming and 24/7 channels. ================================================================ Unda Media Server # Your own live streaming platform, *on your own server* Take in streams from OBS, cameras and broadcast encoders, and deliver them to browsers, phones, smart TVs, YouTube, Facebook and TV equipment. Recording, adaptive quality and 24/7 channels are built in. You run it, so your viewers and your data stay yours. [Talk to us](https://www.undamedia.com/contact) [See what it does](https://www.undamedia.com/media-server) [(Picture: The Unda dashboard: live streams, viewers, bandwidth and what needs attention)](https://www.undamedia.com/guide/dashboard) Tested with OBS Studio VLC ffmpeg YouTube Facebook Live and anything that speaks RTMP, SRT, UDP or RIST Video: How Unda works (3:34), https://www.youtube.com/watch?v=4bIhPADuxlM One server, the whole live workflow ## Everything between the camera and the viewer One program does the work of several: it takes the stream in, makes it fit every screen, keeps a copy, and sends it everywhere it needs to go. ### Take streams in From OBS, vMix, phones and hardware encoders over RTMP or encrypted SRT, and from broadcast equipment over UDP, RTP or RIST. (https://www.undamedia.com/guide/streaming) ### Every quality One stream in, up to eight qualities out, so viewers on mobile data keep watching while fast connections get full HD. (https://www.undamedia.com/features/adaptive-bitrate) ### Your own player A player page for every stream, ready to share or embed on your website. Plays in any browser, on phones and smart TVs. (https://www.undamedia.com/guide/watching) ### Restream everywhere Send the same stream to YouTube, Facebook and other servers at once. One failing destination never affects the others. (https://www.undamedia.com/features/restreaming) ### Record Record any stream with one click, play it back in the dashboard and download it after the event. (https://www.undamedia.com/features/recording) ### 24/7 channels Upload your programmes, plan the day, and stay on air around the clock. Live shows take over and hand back by themselves. (https://www.undamedia.com/features/24-7-channels) ### Stay on air A backup encoder, a pulled link or a playlist takes over within seconds if the main encoder drops, so viewers keep watching. (https://www.undamedia.com/features/backup-encoder) ### TV and IPTV outputs Constant-bitrate transport streams with channel names for multiplexers, modulators and set-top boxes, one channel or many. (https://www.undamedia.com/features/tv-outputs) Built for ## People who stream every week, not once a year Unda is made for organisations that run their own live video, and for the teams that run it for them. ### Churches and events Weekly services, weddings, funerals, conferences: your own player page, every platform at once, and the recording afterwards. (https://www.undamedia.com/solutions/churches) ### Internet TV channels A channel on air all day, with live shows when you have them and a quality for every viewer's connection. (https://www.undamedia.com/solutions/internet-tv) ### Production companies Stream for many clients from one server, each with their own channel, key and account, and their viewer figures for the invoice. (https://www.undamedia.com/solutions/production-companies) ### IPTV and broadcasters Take feeds over SRT, UDP or RTP, and hand them to set-top boxes, partners and TV equipment as standard transport streams. (https://www.undamedia.com/solutions/iptv-operators) Why UndaMedia ## Your server, your viewers, your rules Platforms decide who sees your stream, put their adverts on it and keep the figures. With Unda the whole service runs on a server you choose, in your country or in the cloud. - No limit on viewers in any package: your bandwidth is the only limit - Viewers watch on your website, under your name - Installed with one command, or as a Docker image, with automatic HTTPS - Nothing passes through us: no account with us, no hidden access [(Picture: Multiview: a picture of every channel, with its sound levels)](https://www.undamedia.com/guide/dashboard#multiview) For the whole team ## A dashboard anyone on the team can use Give each presenter, operator and client their own sign-in, with only the streams and buttons their role allows. See problems before your viewers do. - Roles from owner to streamer, with two-factor sign-in - Stream health, alerts and an event log in plain words - Who is watching, from where, for how long, downloadable for reports - Light or dark, on a laptop or a phone [Take a tour of the dashboard](https://www.undamedia.com/guide/dashboard) [(Picture: A stream's page with its preview, health and viewers)](https://www.undamedia.com/guide/dashboard#a-streams-page) Getting started ## On air in three steps ### Install it One command on an Ubuntu or Debian server with a domain name, or the Docker image. It gets its own HTTPS certificate. ### Create a channel Open the dashboard, create your account and a channel. You get a public name to watch by and a secret key to stream with. ### Go live Point OBS or your encoder at the server, share your player page, and add YouTube or Facebook if you like. [Read the install guide](https://www.undamedia.com/guide/install) Packages ## Pay for the size you need Every package is the full server with unlimited viewers. They differ in how many streams can be live at once and how many people can sign in. ### Starter 5 live streams · 5 team members. For a church, a school or one production. See what's included → (https://www.undamedia.com/packages) ### Professional 15 live streams · 15 team members. Adaptive quality, 24/7 channels and a backup encoder. See what's included → (https://www.undamedia.com/packages) ### Broadcast 50 live streams · 50 team members. Everything, including UDP, RTP and TV outputs. See what's included → (https://www.undamedia.com/packages) ## Tell us about your project How many streams, how many viewers, where your server is: we'll suggest a package and a price, or set up a demo for you. [Contact us](https://www.undamedia.com/contact) [Read the docs](https://www.undamedia.com/guide/introduction) ================================================================ Page: https://www.undamedia.com/media-server Title: Unda Media Server Summary: The live streaming and broadcast server you run yourself: RTMP, SRT, UDP and RIST in; HLS, DASH, restreaming and broadcast TV out, with a dashboard. ================================================================ The product # Unda Media Server The live streaming and broadcast server you run yourself. One program on one Linux server takes your streams in, prepares them for every screen, records them and sends them everywhere they need to go, with a dashboard your whole team can use. [Ask for a price](https://www.undamedia.com/contact) [Read the docs](https://www.undamedia.com/guide/introduction) What it does ## The whole live workflow in one place A stream is available on every output the moment it arrives, however it came in: sent over SRT, it plays in the browser, in VLC and on a set-top box with nothing to set up. ### Take in - RTMP and RTMPS from OBS, vMix and encoders - SRT with encryption, for contribution over the internet - MPEG-TS over UDP or RTP, unicast or multicast - RIST with packet recovery - Multi-channel feeds: pick the channels you want - MPEG-2 and AC-3 from broadcast gear, converted ### Prepare - Adaptive bitrate: up to 8 qualities, planned for each source - Portrait, 4:3 and widescreen kept in shape, no black bars - On the CPU, or a GPU encoder (ask us about your card) - Switched on per stream from the dashboard ### Deliver - A player page per stream, to share or embed - HLS for websites, apps and smart TVs; MPEG-DASH - RTMP and SRT for VLC, OBS and vMix - Restreaming to YouTube, Facebook and other servers - UDP, RTP and RIST to set-top boxes and partners ### Record and schedule - One-click recording, split every hour, safe against a crash - Play, download or delete recordings in the browser - 24/7 channels from your uploaded programmes - Live shows take over the schedule and hand back ### Protect - A secret stream key per channel - Signed, expiring playback links for paid or private events - A limit on devices per link - Automatic HTTPS, roles, two-factor sign-in, audit log ### Watch over - Stream health: frame rate, keyframes, bitrate, drift - Alerts and an event log in plain words - Viewer sessions with history and CSV export - Prometheus metrics, webhooks and a REST API Each feature in detail: [see all features](https://www.undamedia.com/features/). Where it's used ## One server, many kinds of live video The same program fits a church streaming on Sundays and an operator feeding set-top boxes, because every part is switched on only when you need it. ### Churches and ministries Weekly services on your own website and on Facebook and YouTube at once, recorded for later. ### Live events Conferences, concerts, weddings and funerals, with a backup encoder and ticketed links when you need them. ### Internet TV A channel on air all day from your own programmes, with live shows and adaptive quality. ### Schools and training Lessons and graduations for students only, with signed links that expire. ### Production companies Many clients on one server, each with their own channel, key and account. ### Companies Town halls and announcements for staff, kept private and off public platforms. ### IPTV operators Channels taken in over UDP, SRT or RTP and sent to set-top boxes, unicast or multicast. ### Broadcasters Constant-bitrate SD and HD transport streams with channel names, for multiplexers and partners. How each one comes together: [see the solutions](https://www.undamedia.com/solutions/). Install it your way ## On your server, in Docker, or run by us ### Your Linux server One command installs it on Ubuntu or Debian, gets an HTTPS certificate and starts it as a service. Re-running it upgrades, with a backup first. Install guide → (https://www.undamedia.com/guide/install) ### Docker A ready image for Intel/AMD and ARM servers, with Compose files to copy, including one with a web server in front. Docker setup → (https://www.undamedia.com/guide/install) ### Managed for you We run the server and keep it updated; your team signs in and streams. Ask us about hosting in your region. Ask about managed hosting → (https://www.undamedia.com/contact) Protocols at a glance ## Standard protocols, in and out Unda is not tied to one encoder or player. See [what works with Unda](https://www.undamedia.com/guide/compatibility) for the equipment we have tested. | Protocol | In | Out | | --- | --- | --- | | RTMP / RTMPS | OBS, vMix, ffmpeg, most encoders and phone apps | Players (VLC, OBS, vMix); YouTube, Facebook and other platforms | | SRT | Contribution over the internet, encrypted | Players that pull over SRT; other servers | | HLS | No | Browsers, apps and smart TVs, with adaptive bitrate | | MPEG-DASH | No | DASH players, with adaptive bitrate | | UDP / RTP | Encoders, receivers and IPTV headends; multicast | Set-top boxes, multiplexers, partners; with FEC on RTP | | RIST | Contribution with packet recovery | Partners and other servers | | MPTS | Multi-channel feeds: choose the channels | Several channels bundled in one transport stream | Capacity ## Light on the server, so your bandwidth is the limit Passing streams through costs very little. What we measured on a test machine: - 10 incoming 720p streams with 25 viewers: about a quarter of one CPU core - 200 viewers of a 1080p stream (about 1 Gb/s): about a quarter of one core - 24 hours unattended on a cloud server, with no restart and flat memory Making extra qualities is the expensive part: plan about one CPU core per stream with adaptive bitrate, or use a GPU. | A typical server | | | --- | --- | | Processor | 4 cores | | Memory | 8 GB | | Upload | 100 Mb/s or more: about 25 viewers at 3 Mb/s | | System | Ubuntu or Debian, or anything that runs Docker | | Name | A domain name pointing at the server, for HTTPS | Technical specifications ## The details ### Live input - RTMP, RTMPS, SRT (caller and listener, AES encryption), UDP and RTP (unicast, multicast), RIST Simple Profile - H.264 video with AAC passed through untouched - MP2 and AC-3 audio converted to AAC; MPEG-2 video converted to H.264 on multi-channel inputs - Packet loss, continuity and TR 101 290 checks on transport streams ### Delivery - HLS with a built-in player and quality menu; MPEG-DASH - RTMP and SRT playback; GOP cache for a fast start - Restreaming over RTMP, RTMPS, SRT, UDP, RTP and RIST, each destination independent - Broadcast outputs: 576p, 720p50 or 1080i25, H.264, HEVC or MPEG-2, constant bitrate - Multi-channel transport streams with DVB channel names and now/next guide ### Adaptive bitrate - Up to 8 qualities, 4K down to 144p by default, with aligned keyframes - Planned per source: size, shape, frame rate and bitrate - On the CPU; NVIDIA, Intel and AMD GPU encoders through FFmpeg (ask us about your card) ### Recording and 24/7 channels - Recording to MPEG-TS files, split hourly, safe against a crash, optional clean-up - Media library with resumable uploads - Schedules with fixed and following items, daily repeat, live takeover, as-run log ### Reliability - Backup encoders and other streams as backup sources, with automatic return - A slow viewer or destination never holds up the others - Alerts on the dashboard and by webhook ### Access and security - Accounts with roles: owner, admin, operator, streamer - Two-factor sign-in, invitations, API keys, audit log - Signed playback links with device limits - Automatic HTTPS (Let's Encrypt) or your own certificate ### Management - Web dashboard, light or dark, on desktop and phone - REST API for everything the dashboard does - Prometheus metrics and an hour of history in the dashboard ### Running it - One program for Linux on Intel/AMD and ARM; Docker image - FFmpeg for adaptive bitrate, 24/7 channels and conversions - Database backed up automatically before every upgrade ## Find the package that fits Packages differ in live streams, team members and tools. Every one has unlimited viewers. [See the packages](https://www.undamedia.com/packages) [Ask for a price](https://www.undamedia.com/contact) ================================================================ Page: https://www.undamedia.com/packages Title: Packages Summary: Unda Media Server packages: the full server with unlimited viewers in each, sized by live streams, team members and tools. Starter from $20 a month. ================================================================ Packages # Pay for the size you need, not for every viewer Every package is the full Unda Media Server, with unlimited viewers. Packages differ in how many streams can be live at the same time, how many people can sign in to the dashboard, and which tools are switched on. Starter has a fixed price; the other packages depend on your setup, so we quote them. ### Starter For a church, a school or one production team. **5** live streams **5** team members - Player page and embedding - RTMP and SRT input - Recording - Restreaming to YouTube, Facebook and other social media - Signed playback links - Not included: adaptive bitrate (from Professional) - Not included: 24/7 channels, backup encoder, pull and playlist inputs (from Professional) - Not included: UDP, RTP and RIST, SRT output, TV outputs, relays and the analyser (Broadcast) $20 a month, or $220 a year [Get Starter](https://www.undamedia.com/contact?package=Starter) Recommended ### Professional For internet TV channels and production companies. **15** live streams **15** team members - Everything in Starter - Adaptive bitrate for every connection - 24/7 channels and media library - Channel inputs in your order: live and backup encoder, a pull stream, a playlist - WebRTC: about a second of delay (WHIP in, WHEP out) - Pull inputs: HLS links, RTMP servers, RTSP cameras - Not included: UDP, RTP and RIST, SRT output, TV outputs, relays and the analyser (Broadcast) Price on request [Ask for a price](https://www.undamedia.com/contact?package=Professional) ### Broadcast For IPTV operators, broadcasters and large productions. **50** live streams **50** team members - Everything in Professional - UDP, RTP and RIST input and output - Constant-bitrate SD and HD TV outputs, with ad breaks (SCTE 35) - TV stations get a channel by SRT, or pull it from a link - Multi-channel feeds in and out (MPTS), with an 8-day guide - Relays: a feed passed on untouched - Stream analyser: TR 101 290 checks on any feed Price on request [Ask for a price](https://www.undamedia.com/contact?package=Broadcast) ### Custom More streams, more people, or a server we run for you. **Any** live streams **Any** team size - Any number of streams and team members - The tools you need, and only those - Managed hosting: we run the server - Locked to your domain if you want Price on request [Talk to us](https://www.undamedia.com/contact?package=Custom) Compare ## What each package includes | | Starter | Professional | Broadcast | Custom | | --- | --- | --- | --- | --- | | Live streams at the same time | 5 | 15 | 50 | Your choice | | Team members (besides owners) | 5 | 15 | 50 | Your choice | | Viewers | Unlimited | Unlimited | Unlimited | Unlimited | | Player page, HLS, DASH, RTMP playback | Yes | Yes | Yes | Yes | | Dashboard, roles, two-factor sign-in, API | Yes | Yes | Yes | Yes | | Signed playback links | Yes | Yes | Yes | Yes | | Monitoring, alerts, viewer sessions | Yes | Yes | Yes | Yes | | SRT input and playback | Yes | Yes | Yes | Optional | | WebRTC low latency (WHIP in, WHEP out) | No | Yes | Yes | Optional | | Pull inputs (HLS, HTTP MPEG-TS, RTMP, RTSP cameras) | No | Yes | Yes | Optional | | Recording | Yes | Yes | Yes | Optional | | Restreaming to social media (RTMP, RTMPS) | Yes | Yes | Yes | Optional | | Adaptive bitrate | No | Yes | Yes | Optional | | 24/7 channels, media library, backup encoder | No | Yes | Yes | Optional | | Channel inputs in order (live, backup encoder, pull, playlist), switched by themselves | No | Yes | Yes | Optional | | UDP, RTP and RIST in and out, SRT destinations | No | No | Yes | Optional | | Constant-bitrate SD and HD TV outputs, ad breaks (SCTE 35), a link stations pull | No | No | Yes | Optional | | Multi-channel feeds (MPTS) in and out, 8-day guide (EIT) | No | No | Yes | Optional | | Relays: a feed passed on untouched | No | No | Yes | Optional | | Stream analyser (TR 101 290) | No | No | Yes | Optional | | Support by email, Monday to Friday, 9:00-19:00 GMT | Yes | Yes | Yes | Yes | | Serious problems (a channel off air) handled until 22:00 GMT | No | No | Yes | Yes | | Price | $20 a month or $220 a year | On request | On request | On request | ### Try it free first Without a licence, Unda runs in evaluation mode with every tool switched on: 2 live streams and 2 team members, for 30 days. Install it, test it with your own encoder, and buy when you're ready. Your settings stay when you add a licence. [Install guide →](https://www.undamedia.com/guide/install) ### Self-hosted or managed Run Unda on your own server, in your own building or in the cloud, or let us run the server for you. Either way your team signs in to the same dashboard, and your viewers watch on your website. [Ask about managed hosting →](https://www.undamedia.com/contact) ### Ready to buy? Once you have our quote, sign the licence agreement online, on a computer or a phone, or download it as a PDF and email it back. We sign it and send it to you with your invoice. [Sign online →](https://www.undamedia.com/order)[PDF →](https://www.undamedia.com/unda-licence-agreement.pdf) Questions ## Good to know before you buy **How do I buy?** Starter costs $20 a month or $220 a year (US dollars, before any tax that applies): tell us through the [contact form](https://www.undamedia.com/contact?package=Starter) and we send you a quote with those fees. For the other packages, ask us for a price. With our quote, [sign the licence agreement online](https://www.undamedia.com/order), on a computer or a phone. You can also download it as a [PDF](https://www.undamedia.com/unda-licence-agreement.pdf), fill it in on a computer and email it to [support@undamedia.com](mailto:support@undamedia.com), or print it, sign it and email us a scan. We sign it and send it back with your invoice, and your licence file follows once the first invoice is paid. **When can we reach support?** By email at [support@undamedia.com](mailto:support@undamedia.com), Monday to Friday, 9:00 to 19:00 GMT. On Broadcast and custom packages, a serious problem that needs attention at once, such as a channel off air, is handled until 22:00 GMT on those days. **What counts as a live stream?** Each stream being received at the same moment counts once: a camera, an encoder, or a 24/7 channel. A stream with a backup encoder still counts as one. Streams that are not live don't count, so you can create as many channels as you like. **What counts as a team member?** Anyone with their own sign-in to the dashboard, apart from the owners: admins, operators and streamers. Invitations not yet accepted count too. Support access you give us for a few days does not. **Is there really no limit on viewers?** None in the licence. The limit is your server's upload: a 100 Mb/s connection carries about 25 viewers of a 3 Mb/s stream, a 1 Gb/s port about 250 (leaving some room, as the server's own bandwidth cap does). You can set a cap so the server never promises more than it can send. **Can I change package later?** Yes. We send you a new licence file, the owner installs it under Server → License in the dashboard, and most changes apply at once. A few tools need a restart; the dashboard tells you which. **What happens when a licence ends?** The dashboard warns 30 days before. After the end date there are 14 days of grace. Then new streams can't start, but streams already live carry on, so a licence never cuts a broadcast off in the middle. **Who is responsible for what we stream?** You are. Unda is the software; you choose what is streamed with it, and you hold the rights and any broadcasting licence it needs. We don't see or review your streams. See our [disclaimer](https://www.undamedia.com/disclaimer). **Do you see my streams or my viewers?** No. Unda runs on your server and nothing passes through us. We can only sign in if the owner gives us support access, which ends by itself after the time they choose. ## Not sure which one fits? Tell us what you stream and how many people watch, and we'll suggest a package and send you a price. [Ask for a price](https://www.undamedia.com/contact) [See what Unda does](https://www.undamedia.com/media-server) ================================================================ Page: https://www.undamedia.com/about Title: About us Summary: UndaMedia makes Unda Media Server, live streaming software for organisations that want their own platform. A product of LC Technology. ================================================================ About us # Live video that belongs to the people who make it UndaMedia makes Unda Media Server: streaming software for churches, broadcasters, production companies and anyone who wants their own live video platform instead of renting someone else's. Most organisations that stream live depend on a platform they don't control. The platform decides who sees the stream, puts its adverts on it, and keeps the viewer figures. Running your own streaming server used to mean a team of engineers and several products stitched together. We built Unda so that one program, on one server, does the whole job: takes the stream in, prepares it for every screen, records it, sends it to social platforms and TV equipment, and gives the whole team a dashboard they can understand. Unda is shaped by real streams on real servers: a player that keeps going when the encoder reconnects, a backup encoder that takes over by itself, a 24/7 channel that runs while everyone sleeps. [(Picture: The Streams page of the Unda dashboard)](https://www.undamedia.com/guide/dashboard) How we work ## What you can count on ### Your server, your data Unda runs where you choose. Your streams, viewers and recordings never pass through us, and there is no hidden way in: we can sign in only when your owner gives us support access, for as long as they choose. ### Plain about what's tested Our documentation says what we have tested, equipment by equipment, so you can plan with real information. ### Built to keep going A slow viewer or a failing destination never affects the rest. Backups are taken before every upgrade, and a licence never stops a stream that is already live. The company UndaMedia is a product of LC Technology. ## Let's talk about your live video Whether you stream once a week or around the clock, we'd like to hear what you need. [Contact us](https://www.undamedia.com/contact) [See the product](https://www.undamedia.com/media-server) ================================================================ Page: https://www.undamedia.com/contact Title: Contact Summary: Contact UndaMedia for a price, a demo, managed hosting or help with Unda Media Server. ================================================================ Contact # Talk to us Ask for a price, a demo or managed hosting, or tell us about your project. We reply by email. (A form: open the page in a browser to use it.) ### Email support@undamedia.com Monday to Friday, 9:00-19:00 GMT (mailto:support@undamedia.com) ### Licence agreement Ready to buy? Sign the agreement online with your quote, on a computer or a phone, or download it as a PDF. (https://www.undamedia.com/order) ### YouTube Guides and demos: @undamediaserver (https://www.youtube.com/@undamediaserver) ### Already a customer? Email us with your licence name. If we need to look at your server, the owner can give us time-limited support access from the License page. (https://www.undamedia.com/guide/license#support-access-for-your-vendor) ================================================================ Page: https://www.undamedia.com/guide/introduction Title: What is Unda Media Server? Summary: Unda Media Server is a live streaming server you run yourself: RTMP, SRT, UDP and WebRTC in; HLS, DASH, RTMP and restreaming out. What it does and needs. ================================================================ # What is Unda? Unda Media Server is a live streaming server you run yourself. Encoders such as OBS, vMix, hardware encoders, broadcast encoders and satellite receivers send it a stream (see [What works with Unda](https://www.undamedia.com/guide/compatibility)); Unda passes that stream on to viewers in a browser, to players such as VLC, to production software such as OBS and vMix, and to other platforms such as YouTube. It is one program. It runs on one Linux server (or in Docker), keeps its data in a single file, and gets its own HTTPS certificate. ## What it does | | | |---|---| | **Takes streams in** | RTMP / RTMPS (OBS, vMix, ffmpeg), SRT (contribution over the internet), WebRTC with WHIP (OBS, a browser), MPEG-TS over UDP or RTP, unicast or multicast, and RIST (hardware encoders, IPTV), multi-channel feeds (MPTS) | | **Fetches streams** | HLS links, MPEG-TS over HTTP, other RTMP servers and RTSP cameras, published like any other stream | | **Gives them out** | A browser player page, HLS for websites and apps, MPEG-DASH, WebRTC with WHEP (about a second of delay), RTMP and SRT for VLC / OBS / vMix, MPEG-TS over HTTP for IPTV apps, UDP, RTP or RIST for set-top boxes | | **Adaptive bitrate** | Several qualities of one stream (4K down to 144p) so every viewer gets one their connection can carry. On the CPU or a GPU; optional; needs FFmpeg | | **Restreaming** | The same stream to YouTube, Facebook, Twitch or other servers at once, over RTMP, RTMPS or SRT | | **Broadcast TV and IPTV** | SD (576p25) and HD (720p50, 1080i25) in H.264, HEVC or MPEG-2 (SD only), at a constant bitrate with DVB channel names, network and time tables and a programme guide, for multiplexers and modulators; several streams bundled as the channels of one transport stream (MPTS); a feed passed on untouched with a relay | | **Recording** | Record any live stream to files, split every hour, with optional automatic clean-up | | **Dashboard** | Streams, multiview, viewers, health, alerts and events live; channels, users, API keys and settings | | **Monitoring** | Stream health, packet loss on UDP inputs, TR 101 290 checks on transport streams in and out, a stream analyser, Prometheus metrics and webhook alerts | [A tour of the dashboard](https://www.undamedia.com/guide/dashboard) shows what running it looks like. ## How it fits together 1. An admin creates a **channel**. A channel has a public **name** (for example `main-show`) and a secret **stream key** (`sk_…`). 2. The encoder publishes with the key: `rtmp://your-server/live/sk_…`. 3. Viewers watch by the name: `https://your-server/watch/main-show`. Only the key can publish; knowing the name only lets you watch. Every stream is available on every output as soon as it arrives, whichever way it came in: a stream sent over SRT plays in the browser, in VLC over RTMP and on a set-top box over UDP, with nothing to configure. ## What you need - A Linux server. **4 CPU cores and 8 GB of memory** are enough to pass streams through. Converting needs more: about 1 to 2 cores per 1080p stream with adaptive bitrate. - Upload bandwidth for your viewers: every viewer needs the stream's bitrate, so **100 Mbit/s carries about 25 viewers at 3 Mb/s**, 1 Gbit/s about 250 (see [How far one server goes](https://www.undamedia.com/guide/compatibility#how-far-one-server-goes)). - A domain name pointing at the server, for HTTPS on the internet. On your own network, the Docker install works without one: it makes its own certificate. - A license file from your vendor. Without one Unda runs in evaluation mode for 30 days: everything works, for up to 2 live streams and 2 accounts besides the owner. ## How big a server The number of viewers is set by the server's upload bandwidth, not its CPU: 100 Mbit/s carries about 25 viewers at 3 Mb/s, 1 Gbit/s about 250, whatever the machine. The CPU (or a GPU) matters for converting: adaptive bitrate, MPEG-2 feeds and 24/7 channels. [How far one server goes](https://www.undamedia.com/guide/compatibility#how-far-one-server-goes) explains both. Next: [install Unda](https://www.undamedia.com/guide/install). ================================================================ Page: https://www.undamedia.com/guide/dashboard Title: A tour of the Unda dashboard Summary: Pictures of every page of the Unda dashboard: streams, Multiview, viewers and events, channels and people, recordings, 24/7 channels and server settings. ================================================================ # A tour of the dashboard Everything in Unda is run from the dashboard at `https://your-server/dashboard`: streams, viewers, recordings, 24/7 channels, people and settings. These pictures come from a demo server with a few live streams, a 24/7 channel and simulated viewers. Select a picture to see it full size. People see only what their role allows. A streamer sees their own channels and streams; operators and admins see more (see [Accounts and channels](https://www.undamedia.com/guide/accounts#roles)). Explanations sit behind a small **i** beside a setting or title: point at it, tap it, or Tab to it and press Enter. What you need to see at once (status, warnings, errors) stays on the page. ## Overview [![The Overview page: live streams, viewers, ingest and egress for the last hour, and what needs attention](https://www.undamedia.com/screens/overview.webp)](/screens/overview.webp) The first page after signing in. Live streams, viewers, incoming and outgoing bandwidth (with a bandwidth cap set, how many more viewers the server has room for), and charts of the last hour. **Needs attention** lists open alerts, worst first: here, a camera whose keyframes are too far apart. **Clear** calms one you have seen, for everyone, until it gets worse or happens again ([Clearing an alert](https://www.undamedia.com/guide/monitoring#clearing-an-alert)). The dot at the bottom of the sidebar shows the live connection to the server; if it drops, the page greys out and says so. ## Streams [![The Streams list: status, protocol, resolution, bitrate, viewers, uptime and health of every live stream](https://www.undamedia.com/screens/streams.webp)](/screens/streams.webp) Every live stream with its protocol, picture size, measured frame rate, bitrate, viewers and health. Tags show what is happening to each one: recording, adaptive bitrate, restreaming, backup sources. Streams with a problem always sort to the top. Open a row to see who is pulling the stream and whether any of them is falling behind. ## A stream's page [![A stream's page with a live preview, its sound meter and player choice, its input, health figures and viewers](https://www.undamedia.com/screens/stream.webp)](/screens/stream.webp) A live preview with a sound meter, what the encoder is sending, and its health: frame rate, keyframe interval, audio/video drift, bitrate against its usual level and reconnects. From here you record, stop the stream, or open the player. Under the preview, choose how it plays: **HLS** (the stream as it arrives, a few seconds behind live), **Adaptive** (the qualities of a transcoded stream) or **Low latency** (WebRTC, under a second behind, when the server has it). This browser remembers the choice. The preview starts muted and plays only while the browser tab is in front. The meter beside the picture shows the sound reaching the server, also while the preview is muted; with HLS it moves a few seconds ahead of the picture, with Low latency in step with it. On a stream that keeps a [rewind window](https://www.undamedia.com/guide/watching#rewind), a bar over the picture lets you go back in it, and **Go live** brings you back. Beside the choice are the stream's size, frame rate and bitrate, and under it how fast your connection loads the preview. **Link** copies the watch page's address and **Embed** the code that puts the watch page in your own web page. When your connection is too slow for the stream, a note under the preview says so: **Show a picture instead** shows its latest picture every few seconds rather than a video that keeps stopping (and holds up the rest of the page), and this browser remembers it until you click **Play video**; **Keep playing** leaves the video on. The tabs hold the stream's other settings: - **Input**: the channel's [inputs in order](https://www.undamedia.com/guide/channel-inputs): its live encoder (and a backup encoder), a pull stream and a playlist; the first one with pictures is on air. - **Restream**: [destinations](https://www.undamedia.com/guide/restreaming) such as YouTube and Facebook. - **EPG**: a live channel's [programme guide](https://www.undamedia.com/guide/playout#live-channels-a-typed-in-guide). - **Output**: every address to watch it by, who can watch ([signed links](https://www.undamedia.com/guide/protect-playback)), how far back viewers can go ([rewind](https://www.undamedia.com/guide/watching#rewind)) and [adaptive bitrate](https://www.undamedia.com/guide/transcoding). ## Multiview [![Multiview: a picture of every channel with its sound levels; a silent camera is marked No sound](https://www.undamedia.com/screens/multiview.webp)](/screens/multiview.webp) Every channel on air at a glance. A bar at the top sums them up: how many are on air, how many have an alarm or a warning, how many people are watching, and (for staff) what the server is sending and its CPU. Choose **Wall** or **List** at the top right; this browser remembers the choice, the sort and the tile size. **Wall.** A picture of every channel, refreshed every few seconds. The pictures are stills, so the wall costs the server little, however many channels there are. Point at a picture to see how old it is. Under each picture is the channel's name, a tag for what feeds it (**ENCODER**, **24/7** or **PULL**), and one line with its bitrate, picture size, viewers and a small graph of its bitrate, or, when it needs attention, what is wrong. Click a picture to see the channel's details on the right: a larger picture, its figures, viewers over the last 30 minutes, its sound, what a 24/7 channel is playing, its recent events, and buttons to its stream page, its watch page and its viewer figures. On screens narrower than about 1100 pixels there is no room for the details, and a picture opens the channel's stream page instead. **Full screen** fills the screen with Multiview, for a wall monitor. An alert you have seen can be cleared with the ✓ beside its tile's line (or **Clear** in the list and the details): the tile calms down for everyone, with a small grey **1 cleared** mark, until the alert gets worse or happens again ([Clearing an alert](https://www.undamedia.com/guide/monitoring#clearing-an-alert)). **List.** One line per channel, grouped into encoders, 24/7 channels and pulled streams: its picture, status, bitrate and graph, sound, viewers, what is on air (or how long it has been up), what needs attention, and **Open**. **Colours.** A red frame means the channel's viewers are losing it: nothing coming in, no sound, a 24/7 channel off air or out of pictures, a pull that has been off the air for minutes, or heavy packet loss. Everything else that needs a look is orange: a failing restream, keyframes too far apart, an encoder reconnecting, a low bitrate. A channel on a [backup source](https://www.undamedia.com/guide/backup-encoder) is never red: viewers still get it, so it is orange and says it is on its backup, even when the backup is silent. Above the wall or list, type in **Filter channels** to find one by name, show only **Encoders**, **24/7** channels, **Pull** streams or those that **Need attention**, and sort: needs attention first, by name (either way), most or fewest viewers, highest or lowest bitrate, longest or shortest on air, by type (encoders, then 24/7, then pull), largest picture, or quietest sound first. In the list, click a column heading (Channel, Bitrate, Sound, Viewers, On air, Problem) to sort by it, and again to turn the order round. A channel with [inputs](https://www.undamedia.com/guide/channel-inputs) has one tile: what its viewers see, its tag saying what is on air (**ENCODER**, **BACKUP**, **PULL**, **PLAYLIST** or **SLATE**). Pictures of its inputs are on the channel's Input tab. The Overview and the Streams count in the menu count such a channel once, as the licence does. Each picture has two sound meters at its right edge, for the left and right channel: green, yellow above -18 dBFS, red above -6 dBFS, with a line marking the last peak (in the list they lie across the Sound column). A channel that has been silent for 10 seconds shows **NO SOUND** with how long; a stream that carries no sound at all shows **No sound track**, in orange. The same alarm appears in **Needs attention** and in Events, whether or not anyone has Multiview open (see [No sound](https://www.undamedia.com/guide/monitoring#no-sound)). ## Viewers and events [![Sessions: every player watching now, with its address, player, start time and traffic](https://www.undamedia.com/screens/sessions.webp)](/screens/sessions.webp) **Sessions** lists every player watching now, over HLS, DASH, RTMP or SRT, with its address, player, how long it has watched and how much it received. The other tabs keep the history (downloadable as CSV) and add it up by stream and by viewer. [![Events: what happened on the server, newest first](https://www.undamedia.com/screens/events.webp)](/screens/events.webp) **Events** is what happened, newest first: streams starting and stopping, reconnects, switches to a backup encoder, recordings, restream destinations connecting or failing, alerts opening and resolving. A line that repeats is shown once with a count. ## Channels and people [![Channels: every channel with whether it is live, its owner, viewers and time on air, and its Inputs and Encoder settings buttons](https://www.undamedia.com/screens/channels.webp)](/screens/channels.webp) A **channel** is a public name for viewers and a secret key for the encoder. Each row shows whether it is live (and, for a channel with [inputs](https://www.undamedia.com/guide/channel-inputs), which one is on air), its owner, viewers and time on air; an offline channel shows when it was last live. Search and the owner filter help when there are many. A channel streaming with settings that will make viewers buffer gets a warning with the fix. - **Inputs** sets what the channel plays: its encoder, a pull stream or a playlist. - **Encoder settings** has what to put in OBS or vMix: the server address and the stream key (RTMP, or SRT and WHIP when the server has them), the backup key when backup sources are on, the watch link and the recommended encoder settings. Keys stay hidden until you choose the eye; **Copy** copies a key without showing it, which is safe while you share your screen. - The **⋯** menu holds the rest: **Copy stream key**, **New stream key**, **New backup key**, **Change owner** (admins), **Pause channel** and **Delete channel**. - **Pause channel** takes a channel off air without deleting it: a live encoder is disconnected, and its stream key (and backup key) is refused until you choose **Resume** on its row or its page. Its pull stream and playlist stop too. Its settings, keys, watch links, guide and recordings are kept, it stays paused after a restart, and a paused channel doesn't count toward your licence. **New channel** (top right) asks for the name, shows the watch link as you type it, and opens the new channel's encoder settings. (Picture: Encoder settings: the server address, the stream and backup keys hidden behind dots with Show and Copy buttons, the watch link and the recommended encoder settings) [![Users: inviting people and setting their roles](https://www.undamedia.com/screens/users.webp)](/screens/users.webp) People join by invitation, with a role: owner, admin, operator or streamer. Two-factor sign-in can be required per role. **Server → API keys** and the **Audit log** sit next to it in the sidebar. ## Recordings [![Recordings: files per stream with their length and size, to play, download or delete](https://www.undamedia.com/screens/recordings.webp)](/screens/recordings.webp) Every recording with its length and size. Play it in the browser, download it, or delete it. See [Recording](https://www.undamedia.com/guide/recording). ## 24/7 channels [![A 24/7 channel on air, with what plays next](https://www.undamedia.com/screens/playout.webp)](/screens/playout.webp) A [24/7 channel](https://www.undamedia.com/guide/playout) plays your files to a schedule and can hand over to a live stream. Its page shows what is on air and what comes next; the playlist is edited on the same page. **Pause** takes it off air until you choose **Resume**, which carries on where it stopped (see [Pausing a channel](https://www.undamedia.com/guide/playout#pausing-a-channel)). A channel's own videos are uploaded with **Add videos** on its playlist; the **Media** page holds every file, shared ones included. The **Guide** page shows every channel's programmes for the coming days, with the XMLTV link for IPTV apps (see [Programme guide](https://www.undamedia.com/guide/playout#programme-guide)). A live channel's guide is typed in on its **EPG** tab (Streams → the channel). [![The Guide page: what each channel is showing now, and the day's programmes on a timeline](https://www.undamedia.com/screens/guide.webp)](/screens/guide.webp) ## Broadcast TV and IPTV delivery, for operators and above, from what comes in to what goes out: **UDP inputs** (hardware encoders and IPTV headends), **Pull inputs** (streams the server fetches), **MPTS inputs** and **MPTS outputs** ([multi-channel bundles](https://www.undamedia.com/guide/mpts)), **Relays** ([a transport stream passed on untouched](/guide/relays)) and **Analyse** ([the stream analyser](/guide/analyser)). ## Server settings [![The Server page: bandwidth, CPU and memory now and over the last hour](https://www.undamedia.com/screens/server.webp)](/screens/server.webp) How the server is doing (bandwidth, CPU, memory over the last hour, refused requests), with tabs for its **History** over days and months, **Capacity**, **Encoders** (the addresses and keys to give OBS, vMix or an encoder), **HTTPS** certificates, **Transcoding**, **Playback** (signed links and rewind), the programme **Guide** links, **API keys** (admins), the **License** and your **Account**. Clients don't see this page: their **Account** is in the menu. **Database backups** (Status tab, admins and owners) shows the newest daily copy, how many days are kept and when the next one is made. An owner can also **download a locked backup** to their own computer: a copy of the database locked with a passphrase they choose, after typing their password again. The dialog lists what is inside and what is left out (the licence file, who is signed in, pending invitations and viewer history). Restoring is one command on the server; see [Backups and upgrades](https://www.undamedia.com/guide/install#8-backups-and-upgrades). (Picture: Download a locked backup: what is inside and left out, a passphrase typed twice, and your password) ## License **Server → License** (operators and above). [![Server → License: who the license is for, its expiry, limits and features](https://www.undamedia.com/screens/license.webp)](/screens/license.webp) Who the license is for, when it ends, how much of it is in use, and which features it includes. The owner installs a new license here, and can give the vendor time-limited support access. See [License](https://www.undamedia.com/guide/license). ## Light or dark The dashboard is light by default. The moon button at the bottom of the sidebar switches to dark, and **Server → Account → Appearance** (clients: **Account → Appearance**) can follow your computer's setting instead. [![The Overview page in the dark theme](https://www.undamedia.com/screens/overview-dark.webp)](/screens/overview-dark.webp) ================================================================ Page: https://www.undamedia.com/guide/earning Title: Ways to earn with your own streaming server Summary: How customers earn with Unda Media Server: streaming events for clients, ticketed and pay-per-view events, their own TV channel, and hosting for others. ================================================================ # Ways to earn with Unda Unda does not charge your viewers itself: it has no payment page and inserts no ads. You earn by selling a service built on it. These are the ways customers use it today, with the parts of Unda each one relies on. ## Streaming events for clients Churches, weddings, funerals, graduations, conferences, concerts: many organisations want their event online and have no one to do it. A production team or a freelance streamer charges per event, or a monthly fee for a weekly service. What Unda gives you to sell: - **The client's own player page** (`/watch/`), to share or embed on their website, not only a Facebook or YouTube link ([Watching and embedding](https://www.undamedia.com/guide/watching)). - **Every platform at once**: the same stream to YouTube, Facebook and others ([Restreaming](https://www.undamedia.com/guide/restreaming)). - **The recording**, ready to hand over after the event ([Recording](https://www.undamedia.com/guide/recording)). - **A backup encoder**, so the stream stays on air if the main one drops ([Backup encoder](https://www.undamedia.com/guide/backup-encoder)), or a pull of the client's own link and a playlist of their videos behind it ([Channel inputs](https://www.undamedia.com/guide/channel-inputs)). - **Viewer figures** to report back: how many watched, from where and for how long ([Viewer sessions](https://www.undamedia.com/guide/monitoring#viewer-sessions)). One server serves many clients: give each a channel with its own key ([Accounts and channels](https://www.undamedia.com/guide/accounts#channels)). ## Ticketed and pay-per-view events Sell tickets to a concert, a match, a conference or a paid course, and let only buyers watch. Unda provides the lock: with [signed playback links](https://www.undamedia.com/guide/protect-playback), a stream plays only with a link you make. Each link has a deadline for starting to watch and a limit on how many devices can use it at once, so a link passed around stops being useful. Your website provides the till: it takes the payment (Paystack, Flutterwave, Stripe or any other), then makes a link for that buyer and shows or emails it. [Make links on your own website](https://www.undamedia.com/guide/protect-playback#make-links-on-your-own-website) has the code, a few lines in PHP, Node.js or Python, for your web developer. ## Your own internet TV channel Run a channel that is on air all day: your programmes play to a schedule, live shows take over when they start, and the schedule picks up again when they end ([24/7 channels](https://www.undamedia.com/guide/playout)). Viewers on mobile data get a quality their connection can carry ([Adaptive bitrate](https://www.undamedia.com/guide/transcoding)). The income comes from sponsors and advertisers (with their spots edited into your programmes), from paid subscriptions using signed links as above, or from carrying the channel on other platforms through restreaming. Unda does not insert ad breaks by itself. ## Hosting streams for other organisations Run one Unda server and rent streaming to smaller organisations (churches, schools, radio stations, community groups) for a monthly fee. They stream from their own OBS or vMix; you run the server. - **An account for each client** with the streamer role: they see their own channels and nothing else, in the dashboard or the API ([Roles](https://www.undamedia.com/guide/accounts#roles)). - **A channel limit per client**, set when you invite them. - **Usage per client for billing**: the **Sessions** page adds up watch time, viewers and traffic per stream for the last day, week or month, and its **History** tab downloads every session as a CSV file ([Viewer sessions](https://www.undamedia.com/guide/monitoring#viewer-sessions)). **Warning: Check your license first** Hosting streams for other organisations is not the same as running Unda for your own. Before you sell this, ask your vendor whether your license allows it and how many live streams it covers. ## What Unda does not do So that you can plan for it: - **No payments.** Tickets, subscriptions and invoices are handled by your own website or billing system. - **No ad insertion of its own.** Adverts are part of the programme you play. For an ad inserter at a head-end or TV operator, Unda can announce your ad breaks with SCTE 35 cues ([Ad breaks](https://www.undamedia.com/guide/restreaming#ad-breaks-scte-35)). - **No public catch-up library.** Recordings are for your team in the dashboard; to publish them, download them and post them where your viewers watch. ================================================================ Page: https://www.undamedia.com/guide/compatibility Title: Compatible encoders, players and equipment Summary: Encoders, players and broadcast equipment that work with Unda Media Server, from OBS, vMix and VLC to hardware encoders, receivers and set-top boxes. ================================================================ # What works with Unda Unda is not tied to OBS or vMix. It speaks the standard protocols of live video (RTMP, SRT, MPEG-TS over UDP and RTP, RIST, HLS, DASH and WebRTC), so anything that sends or receives one of them can work with it: a phone app, a software encoder, a hardware streaming box, a broadcast encoder or satellite receiver on your local network, a DVB multiplexer, or YouTube. This page separates three things: - **Tested:** we ran it and checked the result. - **Should work:** the equipment speaks a protocol and format that is tested with Unda. - **Not supported:** don't plan on it. The measurements behind it (long runs, capacity, delay, lossy networks, broadcast analysis) are on [Test results](https://www.undamedia.com/guide/test-results). ## Sending to Unda | Source | Connects with | Status | |---|---|---| | OBS Studio | RTMP, SRT | Tested (OBS 32) | | OBS Studio 30 and newer | WebRTC (WHIP) | Should work: the same standard as the tested ffmpeg client | | ffmpeg | RTMP, SRT, UDP, RTP, RIST, WebRTC (WHIP) | Tested | | VLC | RIST | Tested | | vMix | RTMP, SRT | Should work | | Wirecast, Streamlabs, Larix Broadcaster (phone) | RTMP, SRT | Should work | | Hardware streaming encoders with RTMP or SRT (Blackmagic ATEM Mini and Web Presenter, Teradek, Magewell, Kiloview, Haivision, AJA and others) | RTMP, SRT | Should work | | Broadcast encoders and satellite/IRD receivers with an IP output (Motorola / ARRIS, Harmonic, Ericsson, Cisco and others) | MPEG-TS over UDP or RTP, one channel or a multi-channel bundle | Should work: the formats they send are tested (see below); [setup](https://www.undamedia.com/guide/broadcast-encoders) | | IP cameras that can push RTMP or SRT | RTMP, SRT | Should work | | IP cameras that only offer RTSP | [Pull input](https://www.undamedia.com/guide/pull-inputs) (Unda fetches RTSP over TCP or UDP) | Should work: RTSP is tested over TCP and UDP, with H.264 video, G.711 audio and a password | | HLS links and MPEG-TS over HTTP (IPTV providers, CDNs, other servers) | [Pull input](https://www.undamedia.com/guide/pull-inputs) | Tested with HLS and HTTP sources, a public HLS stream on the internet and another Unda server | | Another RTMP server | [Pull input](https://www.undamedia.com/guide/pull-inputs) | Tested (pulling from FFmpeg's RTMP server) | | ASI or SDI | — | Not supported; use an ASI-to-IP gateway or an SDI encoder in front | | NDI | — | Not supported | ### Video and audio formats | The source sends | What happens | Cost | |---|---|---| | H.264 video, AAC audio | Passed through as is, over any input | Almost nothing | | H.264 video, MP2 or AC-3 audio, or AAC packed as LATM/LOAS (UDP/RTP) | Audio converted to AAC | Very little | | MPEG-2 video (typical of broadcast encoders and IRDs) | Converted to H.264, interlaced pictures deinterlaced | 1 to 2 CPU cores per HD channel (see [sizing](https://www.undamedia.com/guide/compatibility#converting-the-cpu-or-gpu)) | | HEVC (H.265) video over UDP/RTP | Converted to H.264, like MPEG-2 | A little more than MPEG-2: HEVC is heavier to decode | | HEVC over RTMP or SRT | Not supported: send H.264 | — | Conversion is done by a [Multi-channel input](https://www.undamedia.com/guide/mpts) with `transcode_video: true`, **also when the feed carries only one channel**. The plain [UDP input](https://www.undamedia.com/guide/udp) takes H.264 with AAC only. Also good to know: - **Scrambled channels** (BISS, conditional access) can't be descrambled by Unda. The receiver must send them in the clear. - Each stream keeps **one video and one audio track**, with the closed captions inside the video ([CEA-608/708](https://www.undamedia.com/guide/watching#closed-captions)). Subtitles, teletext and SCTE-35 cue messages are not carried through. ### Example: a broadcast encoder on the same network A Motorola / ARRIS encoder or IRD (or any other make) with an IP output sits on the same subnet as the Unda server and sends an MPEG-2 feed with AC-3 audio. **What we tested:** a 1920×1080 interlaced MPEG-2 feed at 12 Mb/s with AC-3 audio, sent over UDP. Unda converted it to H.264 1080p at 59.94 frames per second with AAC stereo audio, and it played over HLS without a single decoder warning. Plan 1 to 2 CPU cores per HD channel converted like this. 1. On the encoder, set the IP output to the server's address and a port (unicast, the simplest), or to a multicast group. 2. In `unda.yaml` (or the dashboard: Broadcast → MPTS inputs): ```yaml mpts_inputs: - name: motorola source: udp://:5000 # unicast to the server's port 5000 # source: udp://239.1.1.1:5000 # or a multicast group # interface: eth1 # multicast: the network card facing the encoder allow: [192.168.10.20] # only accept packets from the encoder programs: - program: 1 # the channel's number in the feed stream: channel-1 # its name in Unda transcode_video: true # MPEG-2 → H.264 ``` 3. Not sure what the feed carries? Add `discover_only: true` first: Unda lists every channel with its number, name and formats, without publishing anything. 4. Above about 20 Mb/s, raise Linux's receive buffer (see [UDP / MPEG-TS](https://www.undamedia.com/guide/udp)). **Multicast** needs a switch with IGMP snooping and a querier, or the traffic floods every port. Every encoder setting Unda needs (packet size, PCR, keyframes, audio), which input to add for which formats, and sending over the internet: [Broadcast encoders (IP output)](https://www.undamedia.com/guide/broadcast-encoders). ### IP cameras that only speak RTSP Add the camera as a [pull input](https://www.undamedia.com/guide/pull-inputs): Unda fetches its RTSP stream and converts the camera's audio to AAC by itself (H.264 video is passed through). Without the pull feature in your licence, run ffmpeg next to Unda to pull the camera and push it in: ```bash ffmpeg -rtsp_transport tcp -i "rtsp://user:pass@192.168.1.64/stream1" \ -c:v copy -c:a aac -f flv "rtmp://your-server/live/sk_…" ``` ## Getting streams out of Unda | Destination | How | Status | |---|---|---| | Web browsers (the built-in player, your website) | HLS | Tested in Chrome; Safari and Firefox play the same HLS | | Web browsers, low latency (the watch page's Low latency switch, or a WHEP player) | WebRTC (WHEP) | Tested in Chrome; Safari and Firefox support the same standard | | Phones, tablets and smart TVs | HLS | Should work (the same HLS) | | IPTV set-top boxes, IPTV apps and panels | MPEG-TS over HTTP (`/ts/.ts`) or HLS | Should work: the link is tested with FFmpeg as the player | | VLC | RTMP, SRT, HLS | Tested | | OBS as a receiver | SRT (Media Source) | Tested | | vMix as a receiver | UDP | In use by a customer | | PikoTV transcoder (a TV station's receiver) | SRT, Unda calling: an SD TV output (720×576 H.264, AAC, 1.5 Mb/s constant bitrate) | In use by a TV station | | YouTube, Facebook | RTMP, RTMPS | Tested in production | | Twitch and other RTMP platforms | RTMP | Should work | | DASH players | MPEG-DASH, one quality or the adaptive-bitrate ladder | Tested with dash.js and Shaka Player in Chrome, and VLC | | DVB multiplexers, modulators, IRDs and set-top boxes | MPEG-TS over UDP, RTP, SRT or RIST: single channels or multi-channel bundles, constant bitrate, DVB channel names and an 8-day programme guide | Should work: the output is checked by Unda's own TR 101 290 monitor and was analysed with TSDuck with no errors | | Another streaming server | RTMP, SRT, UDP, RIST, MPEG-TS over HTTP | Tested with Unda and VLC at the other end (MPEG-TS over HTTP: another Unda pulling it) | ## How far one server goes Two things decide what a server can do, and they have to be sized separately: its **network connection** decides how many viewers it can serve, and its **CPU (or GPU)** decides how much converting it can do. A more powerful machine does not serve more viewers on the same connection. ### Viewers: the upload bandwidth Every viewer receives their own copy of the stream, so the server's upload must carry the stream's bitrate once per viewer. This is arithmetic, the same on any server however powerful. Leaving 20% headroom: | Server upload | Viewers at 3 Mb/s | Viewers at 5 Mb/s | |---|---|---| | 100 Mbit/s | about 25 | about 15 | | 1 Gbit/s | about 250 | about 150 | | 10 Gbit/s | about 2,500 | about 1,500 | - Restream destinations (YouTube, Facebook…) use the same upload: each one costs as much as one viewer at its bitrate. - Incoming streams use the download side, which is usually separate. - With adaptive bitrate, viewers on slow connections take a smaller quality, so more of them fit. - Set `limits.max_egress_mbps` so that when the uplink is full, new viewers are refused instead of everyone buffering (see [Monitoring](https://www.undamedia.com/guide/monitoring)). Serving viewers needs little CPU: sending streams on is copying, not converting. A modest server can fill a 1 Gbit/s connection. ### Converting: the CPU or GPU Passing streams through (H.264 with AAC in, the same out) costs almost nothing, whatever the number of streams. The work that needs cores: | Work | Rough need | |---|---| | Adaptive bitrate for one 1080p stream (6 qualities), on the CPU | 1 to 2 CPU cores and about 1 GB of memory | | An MPEG-2 HD channel converted to H.264 | 1 to 2 CPU cores and about 0.5 GB | | A 24/7 playout channel at 720p | About 1 CPU core | | Splitting a multi-channel bundle (no conversion) | A small fraction of one core | The lower figure is for a recent CPU, the higher for older server CPUs. A GPU (NVIDIA, Intel or AMD) takes the conversion off the CPU: the **Transcoding** page detects your cards and test-encodes on each before offering it. These are starting points: check the CPU graph on the Server page under your real load before adding more. ### Built-in limits | | Per server | |---|---| | Live streams | Set by your license | | UDP inputs | 32 | | Multi-channel inputs and bundles out | 8 each, up to 32 channels each | | Restream destinations | 16 per stream, 64 in total | ### Delay - **RTMP and SRT:** about 0.1 s through the server (measured for RTMP), plus the encoder's and player's own buffers. - **HLS:** about 7 s with a keyframe every 2 seconds; much more with longer keyframe intervals (29 s with 8 s keyframes). - **WebRTC:** about 0.1 s through the server to the watch page in low-latency mode (measured in Chrome, publisher, server and viewer on one machine; a real network adds its own delay). The picture starts about half a second after the page opens. See [WebRTC](https://www.undamedia.com/guide/webrtc). ## Beyond one server - **More viewers:** put a CDN in front of HLS. Set `hls.disable_session_ids: true` so the CDN can cache segments; viewer numbers then come from the CDN's statistics. Streams protected with signed links need the CDN to check its own links, or no caching ([With a CDN](https://www.undamedia.com/guide/protect-playback#with-a-cdn)). - **One server per installation:** Unda has no clustering, load balancing or automatic failover between servers. [Channel inputs](https://www.undamedia.com/guide/channel-inputs) protect against an encoder or a source failing, not the server. - **Not available yet:** NDI, SDI/ASI, and DRM (Widevine, FairPlay; [signed playback links](https://www.undamedia.com/guide/protect-playback) are available). If your equipment is marked "should work" or isn't listed, tell us what it is: we will test it with you before you go live. ================================================================ Page: https://www.undamedia.com/guide/test-results Title: Test results: capacity, delay and long runs Summary: What has been measured on Unda Media Server: 24-hour runs, viewer capacity, delay, lossy networks, broadcast outputs and adaptive bitrate. ================================================================ # Test results What has been measured, how, and the result. The figures come from recorded runs. Where a line doesn't say otherwise, it was measured on a 10-core development machine over its own network loopback, which shows what the server software can do, not what a given network or server will. The equipment and players that have been tested are listed in [What works with Unda](https://www.undamedia.com/guide/compatibility). *Last updated 29 October 2026, Unda v0.1.48.* ## Long runs | Test | Result | |---|---| | 24 hours on a production server: 3 live streams, 3 viewers, about 8.3 Mb/s out | No restart, 0 dropped frames, memory flat (146 MB at hour 8, 147 MB at hour 24), memory handed back when a stream stopped | | UDP input at 20 Mb/s for 26 minutes (3.9 GB) | 0 packets lost | | A 12-channel bundle (12 × 720p) received at 60 Mb/s for 10 minutes | 0 packets lost, 0 continuity errors, 0 dropped by the operating system; 6 % of one CPU core listing the channels, 13 % with all 12 published | ## Capacity | Test | Result | |---|---| | 10 incoming 720p streams at 3 Mb/s, with 5 RTMP and 20 HLS viewers, for 3 minutes | Every stream at 30 fps, 0 dropped frames, no alerts; about a quarter of one CPU core, 480 MB of memory | | 200 HLS viewers of a 1080p stream at 5 Mb/s (about 1 Gb/s out) for 3 minutes | 0 freezes of a quarter second or more, 0 errors, 95 % of viewers playing within 2.6 s; about a quarter of one CPU core | | Start-up, to the first answer | 0.05-0.07 s for a new server, 0.2 s with 15 channels | | Installing on a fresh Ubuntu 24.04 server with the one-line installer | Running in under 2 minutes | ## Delay (latency) Measured by stamping the time into the picture at the encoder and reading it back from what the player shows (Chrome). | Path | Delay | |---|---| | RTMP in, RTMP out | 0.1 s | | RTMP in, WebRTC (WHEP) out | 0.11 s; first picture in 0.5 s | | WebRTC (WHIP) in, WebRTC out | 0.14 s | | RTMP in, HLS out, keyframe every 2 s | 6.8 s | | RTMP in, HLS out, keyframe every 8 s | 28.8 s (keep keyframes at 2 s) | | RTMP in, HLS out: the first picture for a viewer who opens it | 0.2 s (3.3 s before v0.1.48) | ## Lossy networks | Test | Result | |---|---| | SRT through 5 % packet loss each way, 80 ms round trip, 500 ms SRT latency | Every frame from the first keyframe on delivered, in order, no gaps (the control run with 60 ms latency lost most frames, as it should) | | RIST from Unda to VLC (librist) through 5 % loss each way | Everything recovered except the stream's very first packet (sent before the receiver knew the stream); 276 packets resent | | RIST from VLC (librist) to Unda through 5 % loss | 1,474 packets recovered, 0 lost | | WebRTC (WHIP) publishing through 3 % loss | 30 pictures a second kept (6 before v0.1.47) | | UDP input loss measurement, against a relay dropping 0.92 % of datagrams | Reported 0.88 % | ## Broadcast outputs | Test | Result | |---|---| | A 3-channel 8 Mb/s bundle (a 24/7 channel with its guide, a live channel, an offline channel showing black) analysed by TSDuck for 12 minutes | 0 sync, transport or continuity errors; all 108,570 clock references (PCR) within one tick of their position; PCR every 23 ms or less; channel list every 100 ms, names every 0.5 s, guide every second | | Single-channel TV outputs, SD (H.264, MPEG-2) | Every second within 0.5 % of the set rate (0.7 % for MPEG-2), PCR every 22 ms or less | | Single-channel TV outputs, HD (720p50, 1080i25; H.264, HEVC) | Every second within 1 % of the set rate, PCR every 40 ms or less | | Network and time tables on all five TV output formats (TSDuck) | Present and correct in every one; clock references exact against their position | | Unda's SD TV output analysed as a receiver sees it (Unda's own analyser, judged as a TV output) | Clean on all three TR 101 290 priorities; rate exactly 1300 kb/s, constant; PCR accuracy 0 errors; network jitter (MDI) 8.8 ms, 0 lost | | The same 2-channel bundle analysed by TSDuck and by Unda's analyser at once | Both: 3,000,000 b/s, the same channels and PIDs, padding within 0.4 %, no errors | | VLC opening a 3-channel bundle | All three channels listed by name; switching between them works | TV outputs are tested with the FFmpeg versions customers' systems carry: 4.4 (Ubuntu 22.04), 6.1 (Ubuntu 24.04), 8.0 (Ubuntu 26.04), 8.1 (the Docker image) and 9. ## Adaptive bitrate and DASH | Test | Result | |---|---| | A 7-quality ladder from a 4K source | Every quality's real bitrate within what the playlist announces; the 4K quality decodes cleanly | | DASH players (dash.js, Shaka) forced through every quality every 6 s | 0 stalls | | A slowed link (HLS in Chrome, Shaka) | Moved down to a smaller quality and back up when the link recovered; Shaka with 0 stalls | | DASH manifests | Valid against MPEG's schema; segment times match the manifest | ## How the software is checked - Every change runs the full test suite with Go's race detector, and `go vet` and a linter. - Every parser that reads data from the network (RTMP, SRT, UDP, RTP, RIST, WebRTC, MPEG-TS, the DVB tables, playlists) is fuzzed with random input on every change. - Test coverage of the core and the protocol packages: 64 % to 100 % (the core: 96 %). - Each release is checked for known vulnerabilities in Go and every library used (govulncheck): none reachable in v0.1.48. See [Releases and support](https://www.undamedia.com/guide/releases) for how releases are made, and the [release notes](https://www.undamedia.com/release-notes) for what each one changed. ================================================================ Page: https://www.undamedia.com/guide/releases Title: Releases, upgrades and support Summary: How often Unda Media Server is released, what version 1.0 will mean, which versions get fixes, how upgrades and licenses work, and how to reach support. ================================================================ # Releases and support How Unda is released, what version 1.0 will mean, how upgrades work, and how to reach support. ## How often - **A feature release each month.** New features are collected and released together, with their [release notes](https://www.undamedia.com/release-notes). - **Fix releases in between, when needed.** They only fix faults; they add nothing new, so they are safe to install straight away. - **Security fixes as soon as they are ready**, whatever the date. Every server checks for new releases and shows a notice to its admins and owners under Overview → Other notices. ## Version 1.0 Unda is at version 0.x. It becomes 1.0 when all three of these are true: 1. A 24/7 channel has run for 72 hours without a break, with memory steady. 2. Unda has run in production at a customer for 30 days with no critical fault. 3. After that, two weeks of fixes only: no new features. We expect 1.0 in December 2026. Features added in the meantime ship in 0.x releases first. ## Which versions get fixes Until 1.0, fixes go into the next release: upgrade to the newest version to get them. A version with a serious fault may be withdrawn from download; its release notes then say so and which version to install instead. After 1.0, a stable line will receive fixes only, for a period announced with 1.0, so you can stay on it while new features arrive in later releases. ## Support By email at [support@undamedia.com](mailto:support@undamedia.com), Monday to Friday, 9:00 to 19:00 GMT. On Broadcast and custom packages, a serious problem that needs attention at once, such as a channel off air, is handled until 22:00 GMT on those days. See [Packages](https://www.undamedia.com/packages). ## Upgrading - **Installed with the installer:** run the install command again. It backs up the database first and keeps your configuration and data. - **Docker:** change the image tag to the new version and pull it. - **Every upgrade starts with a copy of the database,** made by the server itself before anything changes; going back is described in [Backups and upgrades](https://www.undamedia.com/guide/install#8-backups-and-upgrades). - An older version refuses a database that a newer one has changed: to go back, restore the copy made before the upgrade. ## Licences A licence keeps working when you upgrade. Licences issued or renewed from 26 October 2026 need Unda v0.1.46 or later. See [License](https://www.undamedia.com/guide/license). ================================================================ Page: https://www.undamedia.com/guide/install Title: Install Unda Media Server (Linux or Docker) Summary: Install Unda Media Server with one command on Ubuntu or Debian, or with Docker: HTTPS, the owner account, your license, firewall, backups and upgrades. ================================================================ # Installing Unda This guide takes you from a fresh Linux server to your first live stream, with your team signed in. It is written for the person who runs the server. You need: - a Linux server (4 vCPU, 8 GB RAM and 100 Mbit/s+ upload are enough for about ten 720p streams and a few hundred viewers without transcoding); - a DNS name pointing at it, e.g. `tv.example.com` (needed for HTTPS); - the Unda **Docker image** (`ghcr.io/localhostdeveloper/unda`) or **binary** from your vendor, and your **license file** (`something.license.json`). Without a license Unda runs in evaluation mode for 30 days: everything works, up to 2 live streams and 2 accounts besides the owner. Steps: 1. [Install](https://www.undamedia.com/guide/install#1-install): Docker **or** a binary with systemd 2. [HTTPS options](https://www.undamedia.com/guide/install#2-https-options): built in (Let's Encrypt), Caddy, nginx or your own certificate 3. [Create the owner account](https://www.undamedia.com/guide/install#3-create-the-owner-account) 4. [Install the license](https://www.undamedia.com/guide/install#4-install-the-license) 5. [Invite your team](https://www.undamedia.com/guide/install#5-invite-your-team) 6. [First stream](https://www.undamedia.com/guide/install#6-first-stream) 7. [Firewall](https://www.undamedia.com/guide/install#7-firewall) 8. [Backups and upgrades](https://www.undamedia.com/guide/install#8-backups-and-upgrades) 9. [If someone is locked out](https://www.undamedia.com/guide/install#9-if-someone-is-locked-out) 10. [Support access for your vendor](https://www.undamedia.com/guide/install#10-support-access-for-your-vendor) 11. [Troubleshooting](https://www.undamedia.com/guide/install#11-troubleshooting) 12. [Removing Unda](https://www.undamedia.com/guide/install#12-removing-unda) --- ## 1. Install **Quickest (Ubuntu/Debian):** one command downloads, verifies and installs everything, with HTTPS: ```bash curl -fsSL https://get.undamedia.com/install.sh | sudo bash -s -- --domain tv.example.com --email you@example.com ``` It stops before changing anything if a port is taken or a download does not match its checksum. `--help` lists the options (`--staging`, `--with-ffmpeg`, the port options, `--cert-file`). The manual ways follow. **Every release is signed** (from v0.1.49). The installer checks the signature on the release's list of checksums before it installs anything, so a download altered on the way, or on the download site itself, is refused; with `--docker` it pulls the image by the exact digest that list names. The installer carries the public key it checks against; to be sure it is ours, compare it with this one (also in each release as `unda-release.pub`): ```text -----BEGIN PUBLIC KEY----- MCowBQYDK2VwAyEAB1ecJf7qS5QmW0tNgROglMxl5ozWIk4HnHj8b1/EOVs= -----END PUBLIC KEY----- ``` To check a release by hand, in its folder: `openssl base64 -d -A -in SHA256SUMS.sig -out sig.bin && openssl pkeyutl -verify -pubin -inkey unda-release.pub -rawin -in SHA256SUMS -sigfile sig.bin` should print `Signature Verified Successfully`, then `grep -v ' image:' SHA256SUMS | sha256sum -c --ignore-missing` checks the files you downloaded (the line left out is the Docker image's digest). **To check the installer itself before it runs.** The one-line command above runs `install.sh` as it downloads, so it trusts our download site; the installer then checks everything else it fetches. To trust only the key and the version printed on this page, check the installer first, in a new, empty folder (made fresh each time, so no file left from before is used): ```bash cd "$(mktemp -d)" && pwd V=v0.1.49 for f in install.sh SHA256SUMS SHA256SUMS.sig; do curl -fsSLO --proto '=https' "https://get.undamedia.com/$V/$f"; done printf '%s\n' '-----BEGIN PUBLIC KEY-----' 'MCowBQYDK2VwAyEAB1ecJf7qS5QmW0tNgROglMxl5ozWIk4HnHj8b1/EOVs=' '-----END PUBLIC KEY-----' > unda-release.pub openssl base64 -d -A -in SHA256SUMS.sig -out sig.bin openssl pkeyutl -verify -pubin -inkey unda-release.pub -rawin -in SHA256SUMS -sigfile sig.bin grep ' install.sh$' SHA256SUMS | sha256sum -c - grep -q "^DEFAULT_BASE_URL=.* # $V (" install.sh && echo "install.sh is $V" ``` You should see `Signature Verified Successfully`, `install.sh: OK` and `install.sh is` with that version. If any is missing, stop and tell us. `V` is the newest version when this page was published (it is not read from the download site, which could otherwise hand you an older release); if the [release notes](https://www.undamedia.com/release-notes) list a newer one, use that. Then run the checked installer from that folder with the options you need, for example `sudo bash install.sh --domain tv.example.com --email you@example.com` (or `--docker`). It downloads and checks the rest of the release as usual. Upgrades the same way. From v0.1.50 the installer refuses to put an older version over a newer one (see [Backups and upgrades](https://www.undamedia.com/guide/install#8-backups-and-upgrades)). **The same in Docker:** add `--docker`. It installs Docker and its compose plugin from your system's packages if they are missing, writes `/opt/unda/docker-compose.yml` and `/opt/unda/unda.yaml`, pulls the image, starts it and prints the setup link. Running it again with `--docker` upgrades to the new image and keeps your settings and data. - **With `--domain`** (a server the internet reaches): the ports are published as in [A. Docker](https://www.undamedia.com/guide/install#a-docker) below, and HTTPS comes from Let's Encrypt (or `--cert-file`). - **Without `--domain`** (a PC on your own network): Unda uses the machine's network directly, so multicast inputs and outputs work with nothing more to set up, and the dashboard is on `https://:8443` with a certificate made for the machine. Browsers warn about it once: choose Advanced, then continue. ```bash curl -fsSL https://get.undamedia.com/install.sh | sudo bash -s -- --docker ``` An Intel graphics card is given to the container for transcoding (the image carries Intel's driver on 64-bit Intel/AMD machines). AMD and NVIDIA cards are not: install without `--docker` to use one. **Another web server already holds ports 80 and 443** (nginx, Caddy or Apache serving other sites, AzuraCast, Owncast)? Add `--behind-proxy PORT`: that web server keeps 80, 443 and the certificates, and forwards your domain to Unda on `127.0.0.1:PORT`, which only this machine reaches. ```bash curl -fsSL https://get.undamedia.com/install.sh | sudo bash -s -- --domain tv.example.com --behind-proxy 8090 ``` - **With nginx,** the script adds the site for your domain itself. If nginx already has one for it, it only checks that it forwards to Unda. Then it asks certbot for the certificate, when certbot is installed, as for your other sites (`--email` goes to certbot). - **With another web server,** it prints what to forward. - **RTMP's port 1935 taken too** (another media server)? Add `--rtmp-port 1936`; encoders then use `rtmp://tv.example.com:1936/live`. - **RTMPS is off:** the certificate is the web server's. - **Graphics cards** work as in any service install. Unlike Docker, an NVIDIA card can be used: install FFmpeg with `--with-ffmpeg`. Only RTMP, SRT and WebRTC need opening in a firewall; never the port after `--behind-proxy`. Another program on 80 and 443 that is not a web server able to forward a name? Give Unda other ports and a certificate file instead: see "Sharing a server" in [section 2](https://www.undamedia.com/guide/install#2-https-options). Pick one: **Docker** (A) or **binary + systemd** (B). Both get HTTPS certificates from Let's Encrypt automatically, with nothing else to install. Replace `tv.example.com` with your domain, and point its DNS (an `A` record) at the server **before** the first start. Let's Encrypt checks the domain by connecting to it on ports 443 and 80. (Prefer a reverse proxy? `--behind-proxy` above does it in one command; [section 2](https://www.undamedia.com/guide/install#2-https-options) has Caddy and nginx by hand.) ### A. Docker Create a directory, e.g. `/opt/unda`, with these two files. `docker-compose.yml`: ```yaml services: unda: image: ghcr.io/localhostdeveloper/unda:v0.1.49 # newest version: see the release notes restart: unless-stopped ports: - "443:8443" # HTTPS: dashboard, watch pages, HLS - "80:8080" # HTTP: redirects to HTTPS, answers Let's Encrypt - "1935:1935" # RTMP (encoders) - "1936:1936" # RTMPS (encoders, encrypted) - "6000:6000/udp" # SRT (encoders, optional) - "8189:8189/udp" # WebRTC media: WHIP encoders, low-latency viewers (optional) volumes: - unda-data:/data - ./unda.yaml:/etc/unda/unda.yaml:ro environment: TZ: UTC # your time zone (e.g. Europe/Paris): recording file names and logs read_only: true tmpfs: [/tmp] cap_drop: [ALL] security_opt: [no-new-privileges:true] ulimits: nofile: 65536 logging: # Docker keeps logs forever otherwise options: { max-size: "10m", max-file: "5" } volumes: unda-data: ``` `unda.yaml`: ```yaml server: rtmp_addr: ":1935" http_addr: ":8443" # published as 443 http_redirect_addr: ":8080" # published as 80 public_https_port: 443 # where that redirect sends browsers tls: letsencrypt: domains: [tv.example.com] email: ops@example.com # optional: expiry notices log: level: info paths: recordings_dir: /data/recordings hls_dir: /data/hls data_dir: /data/state # accounts, channels, license, certificates: back this up media_dir: /data/media # files uploaded for playout channels srt: addr: ":6000" webrtc: # Docker's bridge hides this server's public address from Unda; WebRTC # tells players where to send their media, so give it here. public_ips: [203.0.113.7] # this server's public IPv4 address ``` Start it: ```bash docker compose up -d docker compose logs unda | grep -E 'certificate ready|could not get|setup_link' ``` `certificate ready` means HTTPS works. Keep the `setup_link` line; you need it in step 3. Admin commands (used below) run inside the container: ```bash docker compose exec unda unda admin -config /etc/unda/unda.yaml list-users ``` **UDP, RTP, RIST and multi-channel inputs** listen on ports you choose when you add them. Publish each one under `ports:` as well, e.g. `- "5000:5000/udp"` (RIST uses the port and the one after it, so publish both). Multicast (`udp://239.…`) does not pass Docker's port mapping: to receive or send it, give the service `network_mode: host` and remove its `ports:` list (the container then uses the server's ports directly). Unda then listens on `:8443` and `:8080` itself, and it runs without root rights, so it can't take ports 443 and 80: Let's Encrypt can't reach it, so give it your own certificate, or use `install.sh --docker` without `--domain` for a machine on your own network. ### B. Binary + systemd ```bash # the binary from your vendor sudo install -m 755 unda /usr/local/bin/unda sudo useradd --system --no-create-home --shell /usr/sbin/nologin unda sudo install -d -o unda -g unda -m 750 /var/lib/unda sudo install -d /etc/unda sudo install -m 644 unda.service /etc/systemd/system/unda.service # shipped with the binary sudo touch /etc/unda/unda.env && sudo chmod 640 /etc/unda/unda.env \ && sudo chown root:unda /etc/unda/unda.env # optional secrets; may stay empty ``` `/etc/unda/unda.yaml`: ```yaml server: rtmp_addr: ":1935" http_addr: ":443" http_redirect_addr: ":80" # redirects to HTTPS, answers Let's Encrypt tls: letsencrypt: domains: [tv.example.com] email: ops@example.com # optional: expiry notices log: level: info paths: recordings_dir: /var/lib/unda/recordings hls_dir: /var/lib/unda/hls data_dir: /var/lib/unda/state # accounts, channels, license, certificates: back this up srt: addr: ":6000" ``` The service may bind ports 443 and 80 (`CAP_NET_BIND_SERVICE` in `unda.service`), and nothing more. ```bash sudo systemctl daemon-reload sudo systemctl enable --now unda sudo journalctl -u unda | grep -E 'certificate ready|could not get|setup_link' ``` `certificate ready` means HTTPS works. Keep the `setup_link` line; you need it in step 3. Admin commands always run **as the `unda` user**. As root they can leave files in the data directory that the server can no longer open: ```bash sudo -u unda unda admin -config /etc/unda/unda.yaml list-users ``` Transcoding (adaptive quality for viewers) needs FFmpeg on the server (`sudo apt install ffmpeg`, or `install.sh --with-ffmpeg`); the Docker image already has it. Turn it on in the dashboard under **Server → Transcoding**, which lists the encoders this server has (the CPU, and NVIDIA, Intel or other GPUs), each tested. On an NVIDIA server, install the NVIDIA driver first so `nvidia-smi` works, and use an FFmpeg built with NVENC. When a card in the machine isn't usable, the page says why under the list. Installs made before v0.1.41 hide graphics cards from Unda (`PrivateDevices=true`) and block the local sockets NVIDIA's encoder needs (`AF_UNIX`): run `install.sh` again (it writes the new unit), or ```bash sudo mkdir -p /etc/systemd/system/unda.service.d printf '[Service]\nPrivateDevices=false\nRestrictAddressFamilies=\nRestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX\n' | sudo tee /etc/systemd/system/unda.service.d/gpu.conf sudo systemctl daemon-reload && sudo systemctl restart unda ``` then press **Detect again** on that page. --- ## 2. HTTPS options People sign in with an email and a password, so Unda **refuses a sign-in over plain HTTP from another machine**: anyone on the network could read the password. Section 1 already sets up HTTPS the built-in way. The details, and the alternatives: **Built-in Let's Encrypt (section 1):** - **Getting the certificate:** - on the first start, Unda asks Let's Encrypt for a certificate for each domain in `server.tls.letsencrypt.domains`; - Let's Encrypt checks you control the domain by connecting on port 443 or 80; - the certificate is stored in `/acme`. - **Renewal** happens on its own, well before expiry, with no restart. - **The dashboard's Server page** shows each certificate's expiry. An alert opens if renewal fails for long enough to matter. - **Trying a setup first?** Add `directory_url: staging`. You get Let's Encrypt's test certificates, which browsers warn about, without using up the real rate limits (5 certificates per domain set per week). Remove the line and the `/acme` folder when it works. - **Behind a router or firewall:** forward public ports 443 and 80 to the server. At least one must reach it: 443 to `http_addr`, or 80 to `http_redirect_addr`. - **Wildcard certificates** (`*.example.com`) are not supported. List each name instead. **Caddy in front.** Ready-made files are in [deploy/caddy/](https://www.undamedia.com/reference/caddy) (Docker). Caddy gets the certificate; Unda listens only for Caddy. Leave out `server.tls` and list Caddy in `server.trusted_proxies`; otherwise Unda ignores its headers and treats every browser as plain HTTP. On a systemd install: ```bash sudo apt install caddy printf 'tv.example.com {\n reverse_proxy 127.0.0.1:8080\n}\n' | sudo tee /etc/caddy/Caddyfile sudo systemctl reload caddy ``` Then in `unda.yaml`: ```yaml server: http_addr: "127.0.0.1:8080" trusted_proxies: ["127.0.0.1/32", "::1/128"] ``` **nginx instead of Caddy.** Keep the `Host` header, turn off buffering so the dashboard's live updates flow, and allow 16 MB request bodies (media uploads arrive in 8 MB pieces): ```nginx location / { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_buffering off; proxy_request_buffering off; client_max_body_size 16m; proxy_read_timeout 1h; } ``` **Your own certificate files.** Set `server.tls.cert_file` and `key_file` (e.g. certbot's `fullchain.pem` / `privkey.pem`, readable by the service user) instead of `letsencrypt`. Unda re-reads the files when they are renewed. `install.sh --cert-file F --key-file F` does this for you: it checks the pair (the key matches, the certificate names your domain and has not expired), copies it to `/etc/unda/tls` so the `unda` user can read it, and installs `unda-cert-sync.timer`, which copies it again daily when the source changes. One combined PEM can be given as `--cert-file` alone. **Sharing a server with a program that holds ports 80 and 443.** Unda then runs on other ports (e.g. HTTPS 8443, RTMP 1936) with a certificate file. Where the certificate comes from is up to you, from most to least independent: 1. **Unda's own, through DNS** (recommended): certbot proves the domain with a DNS record instead of a port, so it works whatever holds 80 and 443. Use a name of its own, e.g. `unda.example.com` (an `A` record to this server). With a DNS provider that has a certbot plugin, renewal is automatic, e.g. Cloudflare (an API token with *Zone: DNS: Edit*): ```bash sudo apt install certbot python3-certbot-dns-cloudflare echo "dns_cloudflare_api_token = YOUR_TOKEN" | sudo tee /root/cloudflare.ini sudo chmod 600 /root/cloudflare.ini sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials /root/cloudflare.ini -d unda.example.com ``` Plugins exist for Route 53, DigitalOcean, Google, OVH, Linode and others (`apt search python3-certbot-dns`). Without one, `certbot certonly --manual --preferred-challenges dns` works too, but must be repeated every 90 days. Then: ```bash curl -fsSL https://get.undamedia.com/install.sh | sudo bash -s -- --domain unda.example.com \ --cert-file /etc/letsencrypt/live/unda.example.com/fullchain.pem \ --key-file /etc/letsencrypt/live/unda.example.com/privkey.pem \ --https-port 8443 --rtmp-port 1936 ``` RTMPS then takes port 1937 (1936 is plain RTMP's here): encoders use `rtmps://unda.example.com:1937/live`. Add `--rtmps-port N` for another port, or `--rtmps-port 0` for none. 2. **A certificate you bought**, or one the other program already renews for the same name: the same `--cert-file`/`--key-file` options. Unda then depends on that program keeping it renewed. 3. **Behind that program as a reverse proxy** (Caddy/nginx above), if it is a web server that can forward a name to Unda. With Docker and an nginx that is already on the server, follow [Docker behind nginx on the same server](https://www.undamedia.com/guide/install#docker-behind-nginx-on-the-same-server). Or give Unda a server of its own: nothing to share, and the one-line install needs no options. ### Docker behind nginx on the same server For a server where nginx already holds ports 80 and 443, often next to another media server (Flussonic, Wowza) that holds RTMP's port 1935. nginx keeps 80, 443 and the certificate, and forwards a name of Unda's own (`unda.example.com` below) to it. Unda's web port is reachable only from the server itself. RTMP and SRT go to Unda directly: nginx does not forward them. **1. Check the ports.** Nothing should be printed: ```bash sudo ss -tulpn | grep -E ':(1936|6000|8090)\b' ``` If a port is listed, choose another free one and change it everywhere below. Use the **same number on both sides** of `ports:` and in `unda.yaml`: the dashboard shows encoders the ports Unda listens on. **2. DNS:** an `A` record for `unda.example.com` pointing to this server. **3. `/opt/unda/docker-compose.yml`:** ```yaml services: unda: image: ghcr.io/localhostdeveloper/unda:v0.1.49 # newest version: see the release notes restart: unless-stopped ports: - "127.0.0.1:8090:8090" # dashboard, watch pages, HLS: only nginx on this server reaches it - "1936:1936" # RTMP (the other media server keeps 1935) - "6000:6000/udp" # SRT (encoders, optional) - "8189:8189/udp" # WebRTC media (optional; add webrtc.public_ips to unda.yaml) volumes: - unda-data:/data - ./unda.yaml:/etc/unda/unda.yaml:ro environment: TZ: UTC # your time zone (e.g. Europe/Paris): recording file names and logs read_only: true tmpfs: [/tmp] cap_drop: [ALL] security_opt: [no-new-privileges:true] ulimits: nofile: 65536 logging: # Docker keeps logs forever otherwise options: { max-size: "10m", max-file: "5" } networks: [unda] networks: unda: ipam: config: - subnet: 172.30.0.0/24 # fixed, so unda.yaml can trust nginx by address volumes: unda-data: ``` **4. `/opt/unda/unda.yaml`:** ```yaml server: rtmp_addr: ":1936" http_addr: ":8090" # nginx's requests reach the container from the Docker network above, not # from 127.0.0.1. Trusting it lets Unda see that the browser used HTTPS (so # sign-in works) and log visitors' real addresses. Only nginx can come from # there: port 8090 is published on 127.0.0.1 alone. trusted_proxies: ["172.30.0.0/24"] log: level: info paths: recordings_dir: /data/recordings hls_dir: /data/hls data_dir: /data/state # accounts, channels, license: back this up media_dir: /data/media # files uploaded for playout channels srt: addr: ":6000" ``` No `tls:` section: nginx holds the certificate. If your license names domains, add `public_domains: [unda.example.com]` under `server:` (section 4). **5. nginx:** `/etc/nginx/sites-available/unda`: ```nginx server { listen 80; server_name unda.example.com; location / { proxy_pass http://127.0.0.1:8090; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_buffering off; # the dashboard's live updates proxy_request_buffering off; client_max_body_size 16m; # media uploads arrive in 8 MB pieces proxy_read_timeout 1h; } } ``` Enable it and get the certificate (certbot adds the HTTPS part and the redirect to this file, and renews it): ```bash sudo ln -s /etc/nginx/sites-available/unda /etc/nginx/sites-enabled/ sudo nginx -t && sudo systemctl reload nginx sudo certbot --nginx -d unda.example.com ``` **6. Start Unda:** ```bash cd /opt/unda docker compose up -d docker compose logs unda | grep setup_link ``` Open `https://unda.example.com/dashboard#setup/` and continue with [section 3](https://www.undamedia.com/guide/install#3-create-the-owner-account). Encoders use `rtmp://unda.example.com:1936/live` and `srt://unda.example.com:6000?streamid=publish:`; open 1936/tcp and 6000/udp in the firewall (section 7), never 8090. **If something goes wrong:** - *Sign-in says HTTPS is required:* nginx is not sending `X-Forwarded-Proto`, or `trusted_proxies` does not match the network's `subnet`. - *`docker compose up` says the address pool overlaps:* another Docker network already uses 172.30.0.0/24. Pick another private range (e.g. 172.31.0.0/24) and change it in both files. - *nginx answers 502:* Unda is not running or not on 8090 (`docker compose ps`, `docker compose logs unda`). - *The log repeats `open /etc/unda/unda.yaml: no such file or directory`:* see the first row of [section 11](https://www.undamedia.com/guide/install#11-troubleshooting). **A closed studio LAN without HTTPS** can set `auth.allow_insecure_login: true`. The server logs a warning at every start, because passwords then cross the network unencrypted. Without it, plain HTTP from another machine refuses every credential (password, API key, `api.token`, session cookie) with 403 `https_required`, so scripts and Prometheus need `https://` too. On a public server, also firewall the plain HTTP port if nothing needs it. --- ## 3. Create the owner account The first account is the **owner**, who can do everything. On its first start the server logs a one-time link (`setup_link`) and saves the token in `/setup-token`. Open it on your HTTPS address: ``` https://tv.example.com/dashboard#setup/ ``` Enter your email, name and a password of at least 10 characters. The link stops working once the owner exists. **No HTTPS yet, or the link is lost?** Create the owner from the server's shell instead. The password is read from standard input: ```bash # systemd sudo -u unda unda admin -config /etc/unda/unda.yaml create-user you@example.com owner "Your Name" # Docker (-T: the password is piped in) read -rs PW && printf '%s\n' "$PW" | docker compose exec -T unda \ unda admin -config /etc/unda/unda.yaml create-user you@example.com owner "Your Name" ``` Then, under **Server → Account**, turn on **two-factor sign-in** (any authenticator app) and store the recovery codes in your password manager. --- ## 4. Install the license As the owner: **Server → License** → *Install a license* → choose your `.license.json` file → **Install**. Or from the shell: ```bash sudo -u unda unda license -config /etc/unda/unda.yaml install acme.license.json sudo -u unda unda license -config /etc/unda/unda.yaml show ``` Installed from the dashboard, stream and account limits apply at once; from the shell, the running server picks the file up within the hour (restart it to apply at once). Features that start with the server (SRT, UDP inputs, transcoding) follow a new license **after a restart**. What the states mean: | State | What happens | |---|---| | valid | everything in the license | | expiring | a banner shows from 30 days before the end date | | grace | expired less than 14 days ago; everything still works and the banner counts down | | expired | **new** streams are refused; streams already live keep going. Install a renewed license: it takes effect at once | | evaluation | no license file: 2 live streams, 2 accounts besides the first owner, for 30 days | | evaluation_ended | the 30 days are over: new streams are refused until a license is installed | | invalid | the file is damaged or not for this server: evaluation limits until a valid one is installed | A license can be issued for your domain(s). Then it only works on a server whose HTTPS certificate is for those names. Behind Caddy or nginx, where Unda has no certificate of its own, list the name(s) in `/etc/unda/unda.yaml`: ```yaml server: public_domains: [tv.example.com] ``` **Server → License** shows the domains a license is for, and says so when this server's domain is not one of them. The license is checked on the server, offline. Nothing is sent to your vendor. --- ## 5. Invite your team **Users** → *Invite someone*: email, role and, for streamers, how many channels they may create. You get a link valid for 72 hours, usable once. Send it yourself (chat, email); the person opens it and picks a password. | Role | Can | |---|---| | **owner** | everything: license, support access, other owners | | **admin** | users (not owners), security settings, API keys, audit log, and everything an operator can | | **operator** | runs the production: all streams, stop, record, restream, transcoding, UDP inputs, server page | | **streamer** | only their own channels: stream key, status, health, viewers, their restream destinations | Useful settings: - **Users → Security**: require two-factor sign-in for roles (for example owner, admin and operator). People in those roles must set it up at their next sign-in before they can do anything else. - **Server → API keys** (admin): for scripts and Prometheus. Each key has a role, is shown once and can be revoked. Prometheus: `authorization.credentials_file` holding an operator key, scraping `https://tv.example.com/metrics`. - **Audit log** (admin): who did what — sign-ins, failed sign-ins, role changes, stream keys revealed or replaced, licenses, support access. Kept for a year. Sessions last 12 hours without activity and 7 days at most. Five wrong passwords from one address block that address from the account for 15 minutes, doubling each time up to a day; the account keeps working from other addresses. `unda admin unlock` clears every block. Behind a reverse proxy, list it in `server.trusted_proxies`, or every visitor shares the proxy's address and one guesser blocks everyone. --- ## 6. First stream Streams publish to **channels**. A channel has a public **name**, used in the watch link (`/watch/`), and a secret **stream key** (`sk_…`), which is the only thing that lets someone go live on it. 1. **Channels** → *New channel* → e.g. `main-show`. An admin can create it for a streamer; a streamer creates their own. 2. The page shows the encoder settings. In OBS: **Settings → Stream → Service “Custom…”**, then: - Server: `rtmp://tv.example.com:1935/live`, or over the internet `rtmps://tv.example.com:1936/live` (RTMPS: the key and the pictures travel encrypted; OBS, vMix and FFmpeg support it) - Stream key: the `sk_…` key 3. Start streaming. Within a few seconds it appears under **Streams** as `main-show`. 4. Viewers watch at `https://tv.example.com/watch/main-show`. The key is never in that link. If a key leaks, use **New key** on the channel. The old key stops working at once and a live stream using it is disconnected. SRT encoders use `srt://tv.example.com:6000?streamid=publish:` (from **Channels**). OBS 30 and newer can also publish over WebRTC (WHIP), with about a second of delay to viewers who use the watch page's **Low latency** switch: Service **WHIP**, Server `https://tv.example.com/whip/main-show`, Bearer Token the `sk_…` key. WebRTC needs the license's WebRTC feature, HTTPS, and UDP port 8189 open (section 7). --- ## 7. Firewall Open only what is used: ```bash sudo ufw allow 443/tcp # HTTPS: dashboard, watch pages, HLS sudo ufw allow 80/tcp # Let's Encrypt checks and the HTTP → HTTPS redirect sudo ufw allow 1935/tcp # RTMP encoders sudo ufw allow 1936/tcp # RTMPS encoders (RTMP over TLS, encrypted) sudo ufw allow 6000/udp # SRT encoders (if used) sudo ufw allow 8189/udp # WebRTC media: WHIP encoders, low-latency viewers (if used) ``` RTMPS is on by default whenever Unda has HTTPS: same certificate, port 1936 (1937 if plain RTMP was moved to 1936). Plain RTMP sends the stream key and the pictures as they are, so anyone on the path can copy the key: over the internet prefer RTMPS, SRT with a passphrase, or WHIP. `server.rtmps_addr` sets another port, or `off` turns RTMPS off. If its port is taken by another program, Unda starts without RTMPS and says so in its log. WebRTC's signalling goes through HTTPS (443); its audio and video use the one UDP port `webrtc.udp_port` (8189). Behind 1:1 NAT (Docker's bridge, a cloud server with a private address) set `webrtc.public_ips` to the public address. Viewers on networks that block UDP need a TURN relay: see the WebRTC guide. With a proxy in front (section 2), do **not** open Unda's own HTTP port (8080): only the proxy should reach it. **UDP and RTP inputs have no password and no encryption:** anyone who can reach the port can send a stream into it, and anyone on the path can watch it. Keep them on a private network you trust (a studio LAN, a leased line, a VPN), give each input an `allow` list of its senders, and open the port only to those senders: ```bash sudo ufw allow from 192.0.2.20 to any port 5004 proto udp # one sender, one input ``` The same holds for UDP and RTP outputs: whatever they send can be read on the way, so send them only across a network you trust. Over the internet, use SRT (with a passphrase) or RIST instead. --- ## 8. Backups and upgrades Everything that cannot be recreated is in the data directory (`/var/lib/unda/state` or the `/data/state` Docker volume): `unda.db` holds accounts, channels and keys, API keys, settings and the audit log. `license.json` is the license. `acme/` holds the HTTPS certificates (they can be obtained again, but keeping them avoids Let's Encrypt's rate limits). Recordings are separate (`recordings_dir`). **Daily copies are automatic.** While it runs, Unda copies the database once a day to `state/backups/daily-.db` in the data directory (`/var/lib/unda/state/backups`, or `/data/state/backups` in the Docker volume) and keeps the seven newest. Server → Status in the dashboard shows the newest copy; a copy that fails (a copy always leaves 1 GB of the disk free) is an alert there. To keep more, or none (another backup covers the database): ```yaml backups: keep_days: 30 # 0 = 7, at most 365 # disabled: true ``` **Copy them off the server.** Those copies are on the server's own disk, so a lost disk or server takes them with it. Copy the folder and `license.json` to another machine regularly, for example nightly from the server's crontab: ```bash # systemd install (as root) tar czf - -C /var/lib/unda/state backups license.json | \ ssh backup@backup.example.com "cat > unda-$(date +%F).tgz" # Docker docker compose exec -T unda tar czf - -C /data/state backups license.json | \ ssh backup@backup.example.com "cat > unda-$(date +%F).tgz" ``` **Or download a locked backup to your computer.** On Server → Status, an owner can download a copy of the database locked with a passphrase they choose, after typing their password (and 2FA code) again. Without the passphrase the file opens nothing, so it is safe on a laptop or in cloud storage; keep the passphrase somewhere else (a password manager). It holds the accounts, channels and their keys, every setting and the logs; it leaves out the licence file, who is signed in, sign-in lockouts, pending invitations and the viewer history. At most six an hour can be downloaded, and each is in the audit log. To take a copy yourself at any time (before a big change), the backup command is safe while the server runs: ```bash # systemd sudo -u unda unda admin -config /etc/unda/unda.yaml \ backup /var/lib/unda/backup-$(date +%F).db # Docker docker compose exec unda unda admin -config /etc/unda/unda.yaml \ backup /data/backup-$(date +%F).db ``` The backup file must not exist yet (it is never overwritten), hence the date in its name. The database holds stream keys, so keep backups as private as the server. **Restore:** stop Unda, then `unda admin restore` puts a backup back: a locked backup downloaded from the dashboard (it asks for the passphrase) or a plain copy (a daily one, a pre-upgrade one, `unda admin backup`). The database it replaces is kept in `state/backups/pre-restore-