Deployment Guide

This guide covers advanced deployment topics, including running MeTube behind a reverse proxy for HTTPS and authentication.

Native HTTPS Support

MeTube has built-in support for serving content over HTTPS. This is useful for simple deployments where a full reverse proxy is not needed.

To enable it, you must provide a certificate and a private key file, and set the HTTPS environment variable to true.

Example docker-compose.yml:

services:
  metube:
    image: ghcr.io/alexta69/metube
    container_name: metube
    restart: unless-stopped
    ports:
      - "8081:8081"
    volumes:
      - /path/to/downloads:/downloads
      # Mount your SSL certificate and key
      - /path/to/your/ssl/cert.pem:/ssl/cert.pem
      - /path/to/your/ssl/key.pem:/ssl/key.pem
    environment:
      - HTTPS=true
      - CERTFILE=/ssl/cert.pem
      - KEYFILE=/ssl/key.pem

Reverse Proxy Configuration

Running MeTube behind a reverse proxy is a common and recommended practice. It allows you to:

• Terminate SSL/TLS (HTTPS) at the proxy.
• Host multiple services on the same server.
• Add authentication (e.g., Basic Auth, OAuth).
• Serve MeTube from a subfolder (e.g., https://example.com/metube/).

When serving from a subfolder, you must set the URL_PREFIX environment variable to match the path. For example, if MeTube is at /metube/, set URL_PREFIX=/metube/.

NGINX

This configuration proxies requests from /metube/ to the MeTube container. The directives for Upgrade and Connection are required for WebSocket support.

location /metube/ {
    proxy_pass http://metube:8081/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
}

Apache

This configuration requires mod_proxy, mod_proxy_http, mod_rewrite, and mod_proxy_wstunnel to be enabled.

# Serves MeTube under a /metube/ subdir (http://yourdomain.com/metube/)
<Location /metube/>
    ProxyPass http://localhost:8081/ retry=0 timeout=30
    ProxyPassReverse http://localhost:8081/
</Location>

<Location /metube/socket.io>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} transport=websocket    [NC]
    RewriteRule /(.*) ws://localhost:8081/socket.io/$1 [P,L]
    ProxyPass http://localhost:8081/socket.io retry=0 timeout=30
    ProxyPassReverse http://localhost:8081/socket.io
</Location>

Caddy

Here is a sample Caddyfile for reverse proxying to MeTube under the /metube path.

example.com {
  route /metube/* {
    uri strip_prefix /metube
    reverse_proxy metube:8081
  }
}

Using SWAG (Secure Web Application Gateway)

The linuxserver/swag Docker image is a popular choice that bundles NGINX, Certbot (for free Let's Encrypt certificates), and Fail2ban. It includes pre-configured proxy configs for many applications, including MeTube. You can find sample configurations for both subfolder and subdomain deployments in its proxy-confs directory.