Caddy in front

These are the ready-made files for running Unda behind Caddy with Docker, as described in the install guide's HTTPS options. Caddy gets the certificate and Unda listens only for Caddy. The same files are in the caddy/ folder of each release.

docker-compose.yml

# Unda behind Caddy (Docker). An alternative to Unda's built-in Let's Encrypt:
# Caddy obtains and renews the certificate and forwards to Unda over the
# private Docker network. Copy this folder, set your domain in the Caddyfile,
# then:  docker compose up -d
services:
  unda:
    image: ghcr.io/localhostdeveloper/unda:v0.1.49   # newest version: see the release notes
    restart: unless-stopped
    ports:
      - "1935:1935"         # RTMP (encoders)
      - "6000:6000/udp"     # SRT (encoders, optional)
      # no web port here: only Caddy reaches Unda's dashboard/HLS port
    volumes:
      - unda-data:/data
      - ./unda.yaml:/etc/unda/unda.yaml:ro
    environment:
      TZ: UTC               # your time zone (e.g. Europe/Paris): recording file names and logs
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    ulimits:
      nofile: 65536
    logging:                # Docker keeps logs forever otherwise
      options: { max-size: "10m", max-file: "5" }
    networks: [web]

  caddy:
    image: caddy:2
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data      # Caddy's certificates: keep this volume
    logging:                # Docker keeps logs forever otherwise
      options: { max-size: "10m", max-file: "5" }
    networks: [web]

networks:
  web:
    ipam:
      config:
        - subnet: 172.30.0.0/24   # fixed, so unda.yaml can trust Caddy by address

volumes:
  unda-data:
  caddy-data:

Caddyfile

# Replace tv.example.com with your domain (its DNS must point at this server).
# Caddy gets a Let's Encrypt certificate for it and renews it on its own, and
# sends Unda the X-Forwarded-* headers it needs; live dashboard updates
# (server-sent events) are streamed through without buffering.
tv.example.com {
	reverse_proxy unda:8080
}

unda.yaml

# Unda's config when Caddy terminates HTTPS in front of it (see Caddyfile).
server:
  rtmp_addr: ":1935"
  http_addr: ":8080"                   # reached only by Caddy, over the Docker network
  # Caddy's network (docker-compose.yml): its X-Forwarded-Proto/For are
  # believed, so sign-in knows the browser used HTTPS and the audit log shows
  # real client addresses. No server.tls here: Caddy holds the certificate.
  trusted_proxies: ["172.30.0.0/24"]
log:
  level: info
paths:
  recordings_dir: /data/recordings
  hls_dir: /data/hls
  data_dir: /data/state                # accounts, channels, license: back this up
  media_dir: /data/media               # files uploaded for playout channels
srt:
  addr: ":6000"