Remote access
Put the media server behind a trusted HTTPS proxy.
Use the supported HTTPS setup
This guide exposes your media server. Use your own subdomain, such as media.example.com. The public Lumina website is a separate container.
- Point your media hostname at the server. Allow inbound TCP 80 and 443 for the bundled Caddy example.
- Download the matching release proxy configuration:
shell
curl -fsSLO https://github.com/shiftedx/lumina/releases/download/v0.4.0/docker-compose.https.example.yml
mkdir -p docker
curl -fsSL https://github.com/shiftedx/lumina/raw/v0.4.0/docker/Caddyfile.example -o docker/Caddyfile.exampleAdd LUMINA_HOSTNAME=media.example.com to .env, then start:
shell
docker compose -f docker-compose.yml -f docker-compose.https.example.yml up -d --no-buildOpen https://media.example.com. Keep the Caddy data and config volumes for certificates.
Bring your own proxy
| Setting | Required value |
|---|---|
LUMINA_APP_PUBLIC_URL | https://media.example.com |
LUMINA_FRONTEND_PUBLIC_URL | Exactly the same origin. |
LUMINA_ALLOWED_ORIGINS | Exactly the same origin; no wildcards. |
LUMINA_SESSION_COOKIE_SECURE | true |
LUMINA_TRUSTED_PROXY_IPS | The single proxy’s fixed private IPv4 address as /32. |
The proxy must overwrite X-Forwarded-Proto, preserve the public host, and be the immediate trusted peer. Follow the full proxy contract; arbitrary proxy chains are unsupported.
Keep media delivery direct
Disable CDN caching and response buffering for authenticated media. Give long streams appropriate timeouts. Check your tunnel provider’s current service terms and streaming limits before routing a media server through it.
Applies to Lumina 0.4.0. Source: operator guide