The whole studio, on your own metal.

# FOSSStudio. Save as docker-compose.yml, then: docker compose up -d
#
# Nothing to fill in. Open your domain and choose a password: the first
# person to open a studio nobody owns yet claims it. Do it as soon as it
# is up - until you have, whoever reaches the address first could claim
# it instead. https://fossstudio.org/install.html#code
#
# HTTPS is compulsory - browsers give no camera without it - and the
# Caddy block below is one way to get it. What every line here means,
# and what to do if you already run nginx or use Tailscale:
# https://fossstudio.org/install.html

services:
  app:
    image: ghcr.io/lightmorphic/fossstudio:latest
    restart: unless-stopped
    environment:
      BIND_HOST: "0.0.0.0"
    # Host and container ports must match: the media engine tells guests
    # which port to send to.
    ports:
      - "3000:3000"
      - "40000-40003:40000-40003/udp"
      - "40000-40003:40000-40003/tcp"
    volumes:
      - fossstudio_data:/data
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 5s

  # HTTPS. Delete the "# " from this block, from the two caddy volumes
  # and from the whole configs: block, and change "3000:3000" above to
  # "127.0.0.1:3000:3000". Already running your own proxy? Leave it all
  # alone and point yours at 127.0.0.1:3000.
  # caddy:
  #   image: caddy:2-alpine
  #   restart: unless-stopped
  #   ports:
  #     - "80:80"
  #     - "443:443"
  #     - "443:443/udp"
  #   configs:
  #     - source: caddyfile
  #       target: /etc/caddy/Caddyfile
  #   volumes:
  #     - caddy_data:/data
  #     - caddy_config:/config

  # The relay, for guests behind a strict firewall. The studio writes its
  # settings into the data volume on every start, so nothing is set here.
  coturn:
    image: coturn/coturn:4-alpine
    restart: unless-stopped
    depends_on:
      app:
        condition: service_healthy
    ports:
      - "3478:3478/tcp"
      - "3478:3478/udp"
      - "49160-49189:49160-49189/udp"
    volumes:
      # Mounted whole and read-only rather than reaching for the turn/
      # folder inside it: picking a subfolder out of a volume is a recent
      # Compose feature, and some panels refuse a file that uses it.
      - type: volume
        source: fossstudio_data
        target: /studio
        read_only: true
    command: ["-c", "/studio/turn/turnserver.conf"]

volumes:
  fossstudio_data:
  # caddy_data:
  # caddy_config:

# configs:
#   caddyfile:
#     content: |
#       {
#         on_demand_tls {
#           ask http://app:3000/tls-allowed
#         }
#       }
#       https:// {
#         tls {
#           on_demand
#         }
#         encode zstd gzip
#         header Strict-Transport-Security "max-age=31536000"
#         reverse_proxy app:3000
#       }