Installation Guide

# Update package index
sudo apt update

# Install prerequisites
sudo apt install -y apt-transport-https ca-certificates curl software-properties-common

# Add Docker's official GPG key
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

# Add Docker repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

# Add your user to docker group
sudo usermod -aG docker $USER

# Log out and back in for group changes to take effect

docker --version
docker compose version

mkdir -p ~/theiacast
cd ~/theiacast
mkdir -p ssl-certs  # For optional SSL certificates

services:
  postgres:
    image: postgres:15-alpine
    container_name: theiacast-postgres
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: theiacast
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d theiacast"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s
    restart: unless-stopped

  backend:
    image: ghcr.io/jimmyeao/theiacast-backend:latest
    container_name: theiacast-backend
    environment:
      - ConnectionStrings__Default=Host=postgres;Port=5432;Database=theiacast;Username=postgres;Password=${POSTGRES_PASSWORD:-postgres}
      - ASPNETCORE_ENVIRONMENT=Production
      - Jwt__Secret=${JWT_SECRET:-dev-secret-key}
      - BASE_URL=http://backend:8080
      # Optional: set your own initial admin password instead of the logged one-time one - see Step 9
      - Setup__InitialAdminPassword=${INITIAL_ADMIN_PASSWORD:-}
      # Teams Relay: the public RTMP endpoint shown to admins for handing to meeting organizers
      - TeamsRelay__PublicRtmpHost=${TEAMS_RELAY_PUBLIC_HOST:-localhost}
      - TeamsRelay__PublicRtmpPort=1935
      - TeamsRelay__MediaMtxApiBaseUrl=http://mediamtx:9997
    ports:
      - "5001:8080"
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - theiacast_media:/app/wwwroot
      - theiacast_dataprotection_keys:/app/dataprotection-keys
      - ${SSL_CERT_PATH:-./ssl-certs}:/app/ssl-certs
    restart: unless-stopped

  frontend:
    image: ghcr.io/jimmyeao/theiacast-frontend:latest
    container_name: theiacast-frontend
    ports:
      - "${HTTP_PORT:-80}:80"
      - "${HTTPS_PORT:-443}:443"
    volumes:
      - ${SSL_CERT_PATH:-./ssl-certs}:/etc/nginx/ssl:ro
    depends_on:
      - backend
    restart: unless-stopped

  # Teams Relay (Microsoft Teams RTMP -> screens). Publishes only RTMP ingest on 1935;
  # devices reach the HLS output through the frontend's /hls/ proxy, so no other port is
  # needed on the host. Requires the mediamtx.yml config file below (Step 5) at this
  # relative path.
  mediamtx:
    image: bluenviron/mediamtx:1.9.3
    container_name: theiacast-mediamtx
    volumes:
      - ./docker/mediamtx/mediamtx.yml:/mediamtx.yml:ro
    ports:
      - "1935:1935"
    depends_on:
      - backend
    restart: unless-stopped

volumes:
  postgres_data:
  theiacast_media:
  theiacast_dataprotection_keys:

mkdir -p docker/mediamtx

logLevel: info

###############################################
# RTMP - Teams' Custom Streaming app publishes here as rtmp://<host>:1935/live/<streamKey>

rtmp: yes
rtmpAddress: :1935
rtmpEncryption: "no" # Teams RTMP-Out does not use RTMPS

###############################################
# HLS output for device playback

hls: yes
hlsAddress: :8888
# mpegts (classic TS-segmented HLS), not the default lowLatency/fmp4 - the fmp4/CMAF path
# needs broader MSE support than webOS/Android WebView's firmware-dependent Chromium builds
# can be assumed to have. A few extra seconds of glass-to-glass latency is an acceptable
# trade for playback actually working on every device client.
hlsVariant: mpegts
# Don't remux until a device actually requests the stream - no point generating HLS segments
# while a session is only WaitingForPublish or nobody has tuned in yet.
hlsAlwaysRemux: false

###############################################
# Control API - polled by the backend for live/idle state and used to force-disconnect an
# orphaned publish. Never published to the host - see the compose file above.

api: yes
apiAddress: :9997

###############################################
# Publish authentication - the actual security boundary for Teams Relay. Every publish
# attempt (i.e. every RTMP connection reaching the port forwarded from the internet) is
# checked against an active session's stream key by the backend before MediaMTX accepts it.
# Reads (device HLS pulls) are excluded - they stay on the LAN/internal network.

authMethod: http
authHTTPAddress: http://backend:8080/teams-relay/mediamtx-auth
authHTTPExclude:
  - action: read
  - action: playback
  - action: api
  - action: metrics

###############################################
# Paths - Teams Relay stream keys are opaque per-session tokens, so paths are created
# dynamically per publish rather than pre-registered; this single "all_others" block applies
# to every one of them.

paths:
  all_others:

# PostgreSQL password
POSTGRES_PASSWORD=YourSecurePassword123!

# JWT secret (minimum 32 characters)
JWT_SECRET=your-very-long-and-secure-secret-key-here-32-chars-minimum

# Optional: set the 'admin' account's password on first boot (min 8 chars). If you leave this
# unset, a one-time random password is generated and logged once instead - see Step 9.
INITIAL_ADMIN_PASSWORD=

# Optional: Custom ports
# HTTP_PORT=80
# HTTPS_PORT=443

# Teams Relay: the public hostname/IP meeting organizers publish RTMP to (your public IP or
# DDNS hostname - the admin UI shows it to them as the streaming server)
TEAMS_RELAY_PUBLIC_HOST=change_me_to_your_public_ip_or_ddns_hostname

# Optional: Custom SSL certificate path
# SSL_CERT_PATH=./ssl-certs

# View all logs
sudo docker compose logs

# Follow backend logs
sudo docker compose logs -f backend

# Follow frontend logs
sudo docker compose logs -f frontend

sudo apt update
sudo apt upgrade -y

sudo curl -sSL https://gist.githubusercontent.com/jimmyeao/9a6922cdf1c69da92f1be9c7e3463052/raw/install-theiacast-client.sh | sudo bash

# Check status
sudo systemctl status theiacast-client

# View recent logs
sudo journalctl -u theiacast-client -n 50

# Follow live logs
sudo journalctl -u theiacast-client -f

# Restart the client app
sudo systemctl restart theiacast-client

# Stop the client
sudo systemctl stop theiacast-client

sudo curl -sSL https://gist.githubusercontent.com/jimmyeao/9a6922cdf1c69da92f1be9c7e3463052/raw/install-theiacast-client.sh | sudo bash