datarhei-dragonfork-core/deploy/truenas
Zac Gaetano 7621f88fea
Some checks are pending
ci / vet + build (push) Waiting to run
ci / race tests (push) Blocked by required conditions
ci / WebRTC smoke (5-viewer fanout) (push) Blocked by required conditions
ci / WebRTC latency p95 gate (push) Blocked by required conditions
feat(ui): Wild Dragon reskin overlay on the Restreamer UI
Layers Wild Dragon branding on top of upstream restreamer-ui v1.14.0
without forking the whole repo — keeps upstream UI updates flowing in
when we bump RESTREAMER_UI_REF.

Overlay (deploy/truenas/core/ui-overlay/):
  public/index.html       Wild Dragon title, theme color #0d0e12
  public/manifest.json    PWA name/short_name/colors
  public/favicon.ico      multi-res ICO (16/32/64) generated from
                          a 'WD' monogram in orange #ff6633 on dark
  public/logo192.png      Apple touch icon
  public/logo512.png      PWA install icon
  src/misc/Logo/images/   rs-logo.svg (square mark, used in the
                          Header) and logo.svg (wordmark, used in
                          the Footer) — both Wild-Dragon-themed
  src/misc/Logo/{index,rsLogo}.js
                          link the logos to forge.wilddragon.net
                          instead of datarhei.com

apply-overlay.sh runs in the Docker ui-builder stage just after the
upstream git clone and just before yarn install. Two phases:
  1. rsync the overlay's public/ and src/ on top of the cloned
     upstream tree
  2. Targeted in-place patches for one-line UI strings (header
     title, two welcome captions). Each patch is anchored to a
     unique surrounding context and the script fails loudly if the
     anchor isn't present — so a future upstream rename surfaces
     immediately rather than silently shipping un-rebranded UI.

Image size: ~+50KB (the overlay assets), no measurable build-time
delta. PWA installs and OS bookmarks now show Wild Dragon. The
remaining 'Restreamer'/'datarhei' references in views/Welcome.js,
views/Login.js, views/Settings.js, etc. are deeper-page strings
that aren't worth a one-off overlay; they'll go away when we fork
the UI repo properly for the WebRTC tab milestone.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-03 13:14:41 +00:00
..
core feat(ui): Wild Dragon reskin overlay on the Restreamer UI 2026-05-03 13:14:41 +00:00
docker-compose.yml feat(webrtc): add -rtp-host flag + TrueNAS Docker deploy 2026-04-17 09:05:37 -04:00
README.md feat(webrtc): add -rtp-host flag + TrueNAS Docker deploy 2026-04-17 09:05:37 -04:00

TrueNAS deploy — WebRTC PoC (M1)

Host-networked Docker stack that runs cmd/webrtc-poc on TrueNAS for manual end-to-end testing. Not wired into the Core binary.

Prereqs

  • Docker on the TrueNAS host (TrueNAS SCALE includes it)
  • LAN or public IP that clients can reach
  • One free TCP port (WHEP) and one free UDP port (RTP ingest)

One-time setup

# On TrueNAS:
sudo mkdir -p /mnt/NVME/Docker/dragonfork-webrtc-poc
cd /mnt/NVME/Docker/dragonfork-webrtc-poc

# Copy the repo's deploy/truenas/docker-compose.yml in here, and the
# whole repo (or just cmd/ + core/ + go.mod + vendor/) somewhere the
# Dockerfile build context can see. Simplest: clone the repo adjacent
# and symlink docker-compose.yml, or point `context:` at the clone.

cat > .env <<EOF
WHEP_PORT=45121
RTP_PORT=49248
STREAM_ID=test
PUBLIC_IP=10.0.0.25
EOF

Run

docker compose up -d --build
docker compose logs -f

You should see:

listening for RTP on 127.0.0.1:49248   # or 0.0.0.0:49248 on real deploy
WHEP listening on :45121 — POST /whep/test to subscribe

Verify from another host on the LAN

curl -i -X GET http://10.0.0.25:45121/whep/test   # → 405 (POST only)
curl -i -X POST http://10.0.0.25:45121/whep/nope  # → 404 (stream not found)

For a real end-to-end check, point the repo's test/publish.sh at 10.0.0.25 49248 and the whep-client at http://10.0.0.25:45121/whep/test.

Teardown

docker compose down

Security notes

  • WHEP is served plain HTTP. Put nginx-proxy-manager or Caddy in front for TLS — but note that WHEP itself is fine over HTTPS; the real media is DTLS-SRTP-encrypted regardless.
  • No auth in M1. Anyone who can reach the port can subscribe. M3 adds a token check.
  • The binary runs as PID 1 in scratch — no shell, no package manager, no privilege escalation path. Exit codes only.