Docker Installation

docker-compose.yml

Create a docker-compose.yml file with the following content:

services:
  play:
    image: ghcr.io/itsweber-official/itsweber-play:main
    container_name: itsweber-play
    restart: unless-stopped
    ports:
      - "3000:3000"
    volumes:
      - play-data:/data
    environment:
      PUBLIC_URL: "https://play.example.com"
      NEXT_PUBLIC_SITE_URL: "https://play.example.com"
      AUTH_SECRET: "<openssl rand -hex 32>"
      POSTGRES_PASSWORD: "<openssl rand -hex 24>"
      DATABASE_URL: "postgresql://play:<POSTGRES_PASSWORD>@127.0.0.1:5432/itsweber_play"
      MINIO_ROOT_USER: "play-admin"
      MINIO_ROOT_PASSWORD: "<openssl rand -hex 24>"
      S3_ACCESS_KEY: "play-admin"
      S3_SECRET_KEY: "<same value as MINIO_ROOT_PASSWORD>"
      INITIAL_ADMIN_EMAIL: "admin@example.com"

volumes:
  play-data:

Replace PUBLIC_URL and NEXT_PUBLIC_SITE_URL with your actual public URL, fill the placeholders with values you generate yourself and set INITIAL_ADMIN_EMAIL to your real email address. INITIAL_ADMIN_EMAIL is optional and pre-fills the admin field in the first-run wizard. SMTP is not set via environment variables but in the wizard or under /admin/settings. See Configuration for more variables.

Start

docker compose up -d

The container starts all internal services via s6-overlay. Allow up to about 90 seconds on the first run while Postgres initializes and Prisma migrations run.

Logs

docker compose logs -f play

The logs of all internal services are collected in docker compose logs. s6-svstat shows the state of a single service.

docker compose exec play s6-svstat /run/service/api

Stop / Remove

docker compose down


docker compose down -v

Reverse Proxy Configs

HTTPS is required for production use. Run ITSWEBER Play on port 3000 and terminate TLS at the reverse proxy.

Nginx

server {
    listen 443 ssl;
    server_name play.example.com;

    ssl_certificate     /etc/letsencrypt/live/play.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/play.example.com/privkey.pem;

    client_max_body_size 0;  # Allow large video uploads

    location / {
        proxy_pass         http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
    }
}

Traefik

Add these labels to the play service in your compose file:

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.play.rule=Host(`play.example.com`)"
  - "traefik.http.routers.play.entrypoints=websecure"
  - "traefik.http.routers.play.tls.certresolver=letsencrypt"
  - "traefik.http.services.play.loadbalancer.server.port=3000"

Remove the ports mapping from the compose file when Traefik manages routing.

Caddy

play.example.com {
    reverse_proxy localhost:3000 {
        header_up X-Forwarded-Proto {scheme}
    }
}

Caddy handles HTTPS automatically via Let's Encrypt.

HTTPS

HTTPS is strongly recommended for any production deployment:

• Without HTTPS, video uploads and session cookies travel unencrypted.
• Session cookies with SameSite=Lax behave correctly only over HTTPS.
• PUBLIC_URL is the allowed origin for CORS and Better Auth, so it should start with https://.

Set PUBLIC_URL and NEXT_PUBLIC_SITE_URL to your https:// URL and restart the container after configuring TLS at the reverse proxy.

Updates

docker compose pull
docker compose up -d

The container runs Prisma migrations automatically on startup. No manual database steps are required between versions.