services: overlord-server: image: ${DOCKER_IMAGE:-ghcr.io/vxaboveground/overlord:latest} build: context: . dockerfile: Dockerfile cache_from: - type=local,src=.docker-cache/buildx cache_to: - type=local,dest=.docker-cache/buildx,mode=max container_name: overlord-server ports: - "${PORT:-5173}:5173" environment: PORT: 5173 HOST: 0.0.0.0 # Optional: set an explicit initial admin account. If OVERLORD_PASS is empty, # the server generates one-time bootstrap secrets and stores them in /app/data/save.json. OVERLORD_USER: ${OVERLORD_USER:-admin} OVERLORD_PASS: ${OVERLORD_PASS:-} # Optional overrides. If empty, generated and persisted to /app/data/save.json. JWT_SECRET: ${JWT_SECRET:-} OVERLORD_AGENT_TOKEN: ${OVERLORD_AGENT_TOKEN:-} NODE_ENV: ${NODE_ENV:-production} OVERLORD_TLS_CERT: ${OVERLORD_TLS_CERT:-/app/certs/server.crt} OVERLORD_TLS_KEY: ${OVERLORD_TLS_KEY:-/app/certs/server.key} OVERLORD_TLS_CA: ${OVERLORD_TLS_CA:-} # Set true only behind a trusted reverse proxy that terminates TLS (for example Render). # Default false keeps current behavior: Overlord terminates TLS in-process. OVERLORD_TLS_OFFLOAD: ${OVERLORD_TLS_OFFLOAD:-false} # Trust X-Forwarded-For / X-Real-IP / CF-Connecting-IP from an upstream proxy when # resolving the agent's source IP shown in the dashboard, audit log, and IP bans. # Set true only when a trusted reverse proxy (nginx, Caddy, Cloudflare, etc.) sits # in front of Overlord — otherwise agents can spoof their IP. Auto-enabled when # OVERLORD_TLS_OFFLOAD=true. OVERLORD_TRUST_PROXY: ${OVERLORD_TRUST_PROXY:-false} # Cookie security mode: auto (default), true, or false. # auto: Secure cookie on HTTPS requests / X-Forwarded-Proto=https. OVERLORD_AUTH_COOKIE_SECURE: ${OVERLORD_AUTH_COOKIE_SECURE:-auto} # Optional certbot integration (used only when NODE_ENV=production) OVERLORD_TLS_CERTBOT_ENABLED: ${OVERLORD_TLS_CERTBOT_ENABLED:-false} OVERLORD_TLS_CERTBOT_LIVE_PATH: ${OVERLORD_TLS_CERTBOT_LIVE_PATH:-/etc/letsencrypt/live} OVERLORD_TLS_CERTBOT_DOMAIN: ${OVERLORD_TLS_CERTBOT_DOMAIN:-} OVERLORD_TLS_CERTBOT_CERT_FILE: ${OVERLORD_TLS_CERTBOT_CERT_FILE:-fullchain.pem} OVERLORD_TLS_CERTBOT_KEY_FILE: ${OVERLORD_TLS_CERTBOT_KEY_FILE:-privkey.pem} OVERLORD_TLS_CERTBOT_CA_FILE: ${OVERLORD_TLS_CERTBOT_CA_FILE:-chain.pem} OVERLORD_CLIENT_BUILD_CACHE_DIR: ${OVERLORD_CLIENT_BUILD_CACHE_DIR:-/app/client-build-cache} OVERLORD_FILE_UPLOAD_INTENT_TTL_MS: ${OVERLORD_FILE_UPLOAD_INTENT_TTL_MS:-1800000} OVERLORD_FILE_UPLOAD_PULL_TTL_MS: ${OVERLORD_FILE_UPLOAD_PULL_TTL_MS:-1800000} # WebRTC: Bun reaches MediaMTX via the docker service name on bridge net. OVERLORD_MEDIAMTX_URL: ${OVERLORD_MEDIAMTX_URL:-http://mediamtx:8889} OVERLORD_TURN_HOST: ${OVERLORD_TURN_HOST:-127.0.0.1} OVERLORD_TURN_PORT: ${OVERLORD_TURN_PORT:-3478} OVERLORD_TURN_REALM: ${OVERLORD_TURN_REALM:-overlord} OVERLORD_TURN_SECRET_FILE: /run/overlord-turn/secret OVERLORD_TURN_CREDENTIAL_TTL_SECONDS: ${OVERLORD_TURN_CREDENTIAL_TTL_SECONDS:-3600} depends_on: mediamtx: condition: service_started turn-secret-init: condition: service_completed_successfully volumes: - overlord-data:/app/data - overlord-certs:/app/certs - overlord-client-build-cache:/app/client-build-cache - overlord-plugins:/app/plugins - overlord-turn-secret:/run/overlord-turn:ro # Uncomment to mount host certbot certs read-only # - /etc/letsencrypt:/etc/letsencrypt:ro # Uncomment to use a static config file instead of env vars # - ./Overlord-Server/config.json:/app/config.json:ro restart: unless-stopped init: true security_opt: - no-new-privileges:true healthcheck: # Use http:// when OVERLORD_TLS_OFFLOAD=true. test: ["CMD-SHELL", "wget -qO- --no-check-certificate ${OVERLORD_HEALTHCHECK_URL:-https://localhost:5173/health} >/dev/null 2>&1 || exit 1"] interval: 30s timeout: 10s retries: 3 start_period: 40s turn-secret-init: image: alpine:3.22 command: ["/bin/sh", "-ec", "umask 077; if [ ! -s /run/overlord-turn/secret ]; then head -c 32 /dev/urandom | base64 > /run/overlord-turn/secret; fi; IFS= read -r turn_secret < /run/overlord-turn/secret; printf 'webrtcICEServers2:\n - url: \"stun:%s:%s\"\n - url: \"turn:%s:%s?transport=udp\"\n username: AUTH_SECRET\n password: \"%s\"\n clientOnly: true\n - url: \"turn:%s:%s?transport=tcp\"\n username: AUTH_SECRET\n password: \"%s\"\n clientOnly: true\n' \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$$turn_secret\" \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$$turn_secret\" > /run/overlord-turn/mediamtx.yml; chmod 0444 /run/overlord-turn/secret /run/overlord-turn/mediamtx.yml"] environment: OVERLORD_TURN_HOST: ${OVERLORD_TURN_HOST:-127.0.0.1} OVERLORD_TURN_PORT: ${OVERLORD_TURN_PORT:-3478} volumes: - overlord-turn-secret:/run/overlord-turn restart: "no" coturn: image: coturn/coturn:4.14.0-r0-alpine container_name: overlord-coturn ports: - "3478:3478/udp" - "3478:3478/tcp" - "49160-49200:49160-49200/udp" entrypoint: ["/bin/sh", "-ec"] command: - | secret="$$(cat /run/overlord-turn/secret)" external="" if [ -n "$${OVERLORD_TURN_EXTERNAL_IP:-}" ]; then external="--external-ip=$${OVERLORD_TURN_EXTERNAL_IP}"; fi exec turnserver --fingerprint --use-auth-secret --static-auth-secret="$$secret" --realm="$${OVERLORD_TURN_REALM:-overlord}" --listening-port=3478 --min-port=49160 --max-port=49200 --no-tls --no-dtls --no-multicast-peers --log-file=stdout $$external environment: OVERLORD_TURN_REALM: ${OVERLORD_TURN_REALM:-overlord} OVERLORD_TURN_EXTERNAL_IP: ${OVERLORD_TURN_EXTERNAL_IP:-127.0.0.1} volumes: - overlord-turn-secret:/run/overlord-turn:ro depends_on: turn-secret-init: condition: service_completed_successfully restart: unless-stopped security_opt: - no-new-privileges:true mediamtx: image: bluenviron/mediamtx:latest container_name: overlord-mediamtx restart: unless-stopped command: ["/run/overlord-turn/mediamtx.yml"] ports: # WHIP/WHEP signaling only reached by the Bun container internally, # so we don't publish 8889. ICE UDP/TCP must be reachable from the # outside world (browser + agent), so publish 8189. - "8189:8189/udp" - "8189:8189/tcp" environment: # Disable every protocol except WebRTC. The Overlord server proxies all # WHIP/WHEP signaling and enforces auth itself. MTX_RTSP: "no" MTX_RTMP: "no" MTX_HLS: "no" MTX_SRT: "no" # Fixed ICE ports (matched by the port-publish above). MTX_WEBRTCLOCALUDPADDRESS: ":8189" MTX_WEBRTCLOCALTCPADDRESS: ":8189" # Advertise 127.0.0.1 as an ICE candidate so browsers on the docker # host can reach MediaMTX through the published port. For viewers on # a different machine, override with the host's LAN/public IP, e.g.: # OVERLORD_WEBRTC_ADDITIONAL_HOSTS=127.0.0.1,192.168.1.42 MTX_WEBRTCADDITIONALHOSTS: ${OVERLORD_WEBRTC_ADDITIONAL_HOSTS:-127.0.0.1} volumes: - overlord-turn-secret:/run/overlord-turn:ro depends_on: turn-secret-init: condition: service_completed_successfully volumes: overlord-data: overlord-certs: overlord-client-build-cache: overlord-plugins: overlord-turn-secret: