Skip to content
KRATOSStreaming Control
Reference

Deployment

Run KRATOS as a service, front it with TLS, and keep it current from the release mirror.

Docker#

The image rebuilds the UI, embeds it in the binary and ships Python 3 + requests for provider scripts. State lives in the /var/lib/kratos volume (kratos.cfg, providers/, logos/, scripts/).

shell
docker build -t kratos .

docker run -d --name kratos -p 18080:18080 \
  -v kratos-data:/var/lib/kratos \
  kratos
# then put your config at /var/lib/kratos/kratos.cfg and restart
A named volume is seeded with the bundled scripts/; a bind mount is not, so copy scripts/ in yourself.

systemd#

The one-line installer already sets up a kratos.service unit. For a source build, install the binary and a hardened unit yourself:

shell
sudo install -m 0755 target/release/kratos /usr/local/bin/kratos
sudo useradd --system --home-dir /var/lib/kratos --shell /usr/sbin/nologin kratos
sudo install -d -o kratos -g kratos /var/lib/kratos /var/lib/kratos/providers
sudo cp -r scripts /var/lib/kratos/ && sudo cp kratos.cfg /var/lib/kratos/
sudo chown -R kratos:kratos /var/lib/kratos
sudo systemctl enable --now kratos

TLS reverse proxy#

Bind KRATOS to 127.0.0.1 (set Rs.Bind to 127.0.0.1:18080) and terminate TLS in front of it. With Caddy and a Cloudflare DNS token, a complete site block is:

Caddyfile
app.example.com {
  tls {
    dns cloudflare {env.CF_API_TOKEN}
  }
  encode gzip
  reverse_proxy 127.0.0.1:18080
}
Only the panel needs to be private. The EPG port (-epgport) and the signed viewer playlist/segment URLs are public by design.