ça part de la page Libretime dans container LXC sans privilèges conjuguée à la sauce 2026 cad installer Libretime via un container Docker (Modernité !)
Tests partiellement réalisés sur Debian 13 et Ubuntu 24.04
Commencer par installer Docker : Doc install Docker https://docs.docker.com/engine/install
Création d'une utilisatrice dédiée
adduser libretimedocker
Changer d'utilisatrice
sudo su - libretimedocker
Installer ensuite Libretime en tant qu'utilisatrice libretimedocker : Doc install Libretime docker
Il faut donc adapter les fichiers config.yml et docker-compose.yml puis …
Ne pas oublier d'initier la base de données depuis le répertoire d'install !
docker compose run --rm api libretime-api migrate
Ensuite pour démarrer le container, toujours à partir du répertoire d'install :
docker compose up -d
check si ça marche :
docker compose ps docker compose logs -f
éteindre et virer les processus orphelins (les pauvres)
docker-compose down --remove-orphans
services:
postgres:
image: postgres:15
# pour assurer un démarrage au boot, ajouter cette ligne pour chaque service :
restart: always
volumes:
- postgres_data:/var/lib/postgresql/data
environment:
POSTGRES_USER: ${POSTGRES_USER:-libretime}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-libretime} # Change me !
healthcheck:
test: pg_isready -U libretime
rabbitmq:
image: rabbitmq:3.13-alpine
restart: always
environment:
RABBITMQ_DEFAULT_VHOST: ${RABBITMQ_DEFAULT_VHOST:-/libretime}
RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-libretime}
RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-libretime} # Change me !
healthcheck:
test: nc -z 127.0.0.1 5672
playout:
image: ghcr.io/libretime/libretime-playout:${LIBRETIME_VERSION:-latest}
restart: always
init: true
ulimits:
nofile: 1024
depends_on:
- rabbitmq
volumes:
- ${LIBRETIME_CONFIG_FILEPATH:-./config.yml}:/etc/libretime/config.yml:ro
- libretime_playout:/app
environment:
LIBRETIME_GENERAL_PUBLIC_URL: http://nginx:8080
liquidsoap:
image: ghcr.io/libretime/libretime-playout:${LIBRETIME_VERSION:-latest}
restart: always
command: /usr/local/bin/libretime-liquidsoap
init: true
ulimits:
nofile: 1024
ports:
# à changer si plusieurs docker Libretime sur le même serveur
- 8001:8001
- 8002:8002
depends_on:
- rabbitmq
volumes:
- ${LIBRETIME_CONFIG_FILEPATH:-./config.yml}:/etc/libretime/config.yml:ro
- libretime_playout:/app
environment:
LIBRETIME_GENERAL_PUBLIC_URL: http://nginx:8080
analyzer:
image: ghcr.io/libretime/libretime-analyzer:${LIBRETIME_VERSION:-latest}
restart: always
init: true
ulimits:
nofile: 1024
depends_on:
- rabbitmq
volumes:
- ${LIBRETIME_CONFIG_FILEPATH:-./config.yml}:/etc/libretime/config.yml:ro
- libretime_storage:/srv/libretime
environment:
LIBRETIME_GENERAL_PUBLIC_URL: http://nginx:8080
worker:
image: ghcr.io/libretime/libretime-worker:${LIBRETIME_VERSION:-latest}
restart: always
init: true
ulimits:
nofile: 1024
depends_on:
- rabbitmq
volumes:
- ${LIBRETIME_CONFIG_FILEPATH:-./config.yml}:/etc/libretime/config.yml:ro
environment:
LIBRETIME_GENERAL_PUBLIC_URL: http://nginx:8080
api:
image: ghcr.io/libretime/libretime-api:${LIBRETIME_VERSION:-latest}
restart: always
init: true
ulimits:
nofile: 1024
depends_on:
- postgres
- rabbitmq
volumes:
- ${LIBRETIME_CONFIG_FILEPATH:-./config.yml}:/etc/libretime/config.yml:ro
- libretime_storage:/srv/libretime
legacy:
image: ghcr.io/libretime/libretime-legacy:${LIBRETIME_VERSION:-latest}
restart: always
init: true
ulimits:
nofile: 1024
depends_on:
- postgres
- rabbitmq
volumes:
- ${LIBRETIME_CONFIG_FILEPATH:-./config.yml}:/etc/libretime/config.yml:ro
- libretime_storage:/srv/libretime
nginx:
image: ghcr.io/libretime/libretime-nginx:${LIBRETIME_VERSION:-latest}
restart: always
ports:
- 127.0.0.1:8080:8080
#pour faire en sorte que le nginx intégré au docker n'écoute qu'en local (possible aussi de changer le 8080:8080 par 8081:8080 pour faire cohabiter plusieurs instances sur le même serveur via différent proxy vhost
depends_on:
- legacy
volumes:
- libretime_storage:/srv/libretime:ro
#pour désactiver le icecast intégré au docker et utiliser un icecast externe, commenter les lignes ci-dessous
# icecast:
# image: ghcr.io/libretime/icecast:2.4.4
# ports:
# - 8000:8000
# environment:
# ICECAST_SOURCE_PASSWORD: ${ICECAST_SOURCE_PASSWORD:-hackme} # Change me !
# ICECAST_ADMIN_PASSWORD: ${ICECAST_ADMIN_PASSWORD:-hackme} # Change me !
# ICECAST_RELAY_PASSWORD: ${ICECAST_RELAY_PASSWORD:-hackme} # Change me !
volumes:
postgres_data: {}
libretime_storage: {}
libretime_playout: {}
# See https://libretime.org/docs/admin-manual/setup/configuration/
general:
# The public url.
# > this field is REQUIRED
public_url: https://****.*******.org
# The internal API authentication key.
# > this field is REQUIRED
api_key: radio.radiocampus.org.APIKEY.clefaleatoireanventer
# The Django API secret key.
# > this field is REQUIRED
secret_key: radio.radiocampus.org.SECRETKEY.clefaleatoireanventer
# List of origins allowed to access resources on the server, the public url
# origin is automatically included.
# > default is []
#allowed_cors_origins: []
allowed_cors_origins: [https://radio.radiocampus.org/, http://radio.radiocampus.org/, http://live.radio-campus.org:8000/, https://live.radio-campus.org:8002/, https://localhost, http://localhost]
# The server timezone, should be a lookup key in the IANA time zone database,
# for example Europe/Berlin.
# > default is UTC
timezone: Europe/Paris
# How many hours ahead Playout should cache scheduled media files.
# > default is 1
cache_ahead_hours: 1
# Authentication adaptor to use for the legacy service, specify a class like
# LibreTime_Auth_Adaptor_FreeIpa to replace the built-in adaptor.
# > default is local
auth: local
storage:
# Path of the storage directory. Make sure to update the Nginx configuration after
# updating the storage path.
# > default is /srv/libretime
path: /srv/libretime
database:
# The hostname of the PostgreSQL server.
# > default is localhost
host: postgres
# The port of the PostgreSQL server.
# > default is 5432
port: 5432
# The name of the PostgreSQL database.
# > default is libretime
name: libretime
# The username of the PostgreSQL user.
# > default is libretime
user: libretime
# The password of the PostgreSQL user.
# > default is libretime
password: passwordgénéréautomatiquelorsdelaprocedured'install
rabbitmq:
# The hostname of the RabbitMQ server.
# > default is localhost
host: rabbitmq
# The port of the RabbitMQ server.
# > default is 5672
port: 5672
# The virtual host of RabbitMQ server.
# > default is /libretime
vhost: /libretime
# The username of the RabbitMQ user.
# > default is libretime
user: libretime
# The password of the RabbitMQ user.
# > default is libretime
password: passwordgénéréautomatiquelorsdelaprocedured'install
email:
# Sender email address to use when sending emails.
# > default is no-reply@libretime.org
from_address: no-reply@libretime.org
# The hostname of the SMTP server.
# > default is localhost
host: localhost
# The port of the SMTP server.
# > default is 25
port: 25
# Whether to use an insecure connection, an SSL/TLS (implicit) connection (generally
# on port 465) or a STARTTLS (explicit) connection (generally on port 587) when
# talking to the SMTP server.
# > must be one of (ssl/tls, starttls)
encryption:
# The username to use for the SMTP server.
# > default is ""
user: ""
# The password to use for the SMTP server.
# > default is ""
password: ""
# Timeout in seconds for blocking operations like the connection attempt.
timeout:
# The path to a PEM-formatted certificate chain file to use for the connection.
cert_file:
# The path to a PEM-formatted private key file to use for the connection.
key_file:
playout:
# Liquidsoap connection host.
# > default is localhost
liquidsoap_host: liquidsoap
# Liquidsoap connection port.
# > default is 1234
liquidsoap_port: 1234
# The format for recordings.
# > must be one of (ogg, mp3)
# > default is ogg
record_file_format: ogg
# The bitrate for recordings.
# > default is 256
record_bitrate: 256
# The samplerate for recordings.
# > default is 44100
record_samplerate: 44100
# The number of channels for recordings.
# > default is 2
record_channels: 2
# The sample size for recordings.
# > default is 16
record_sample_size: 16
liquidsoap:
# Liquidsoap server listen address.
# > default is 127.0.0.1
# à mettre en 0.0.0.0 pour que liquidsoap écoute l'extérieur (master et show source)
server_listen_address: 0.0.0.0
# Liquidsoap server listen port.
# > default is 1234
server_listen_port: 1234
# Input harbor listen address.
# > default is ["0.0.0.0"]
# à mettre en 0.0.0.0 pour que liquidsoap écoute l'extérieur (master et show source)
# à mettre en 127.0.0.1 pour quels les 8001 et 8002 ne soient pas visibles de l'extérieur = désactiver les fonctions show et master
harbor_listen_address: ["127.0.0.1"]
# Input harbor tls certificate path.
harbor_ssl_certificate:
# Input harbor tls certificate private key path.
harbor_ssl_private_key:
# Input harbor tls certificate password.
harbor_ssl_password:
stream:
# Inputs sources.
inputs:
# Main harbor input.
main:
# Harbor input public url. If not defined, the value will be generated from
# the [general.public_url] hostname, the input port and mount.
public_url: https://********.org
# Mount point for the main harbor input.
# > default is main
mount: main
# Listen port for the main harbor input.
# > default is 8001
port: 8001
# Whether the input harbor is secured with the tls certificate.
# > default is false
secure: false
# Show harbor input.
show:
# Harbor input public url. If not defined, the value will be generated from
# the [general.public_url] hostname, the input port and mount.
public_url: https://*****.*****.org
# Mount point for the show harbor input.
# > default is show
mount: show
# Listen port for the show harbor input.
# > default is 8002
port: 8002
# Whether the input harbor is secured with the tls certificate.
# > default is false
secure: false
# Output streams.
outputs:
# Default icecast output
# This can be reused to define multiple outputs without duplicating data
.default_icecast_output: &default_icecast_output
host: *.*******.org
port: 8000
source_password: *************
admin_password: *********************
name: Radio * !
description: Les radios du reseau
website: https://r*******.org/
genre: various
# Icecast output streams.
# > max items is 3
icecast:
# The default Icecast output stream
- <<: *default_icecast_output
enabled: true
public_url: https://****.********.org:8002/radio*****.ogg
mount: radio*****.ogg
audio:
format: ogg
bitrate: 256
# You can define extra outputs by reusing the default output using a yaml anchor
- <<: *default_icecast_output
enabled: true
public_url: https://****.********.org:8002/radio*****.mp3
mount: radio*****.mp3
audio:
format: mp3
bitrate: 320
- # Whether the output is enabled.
# > default is false
enabled: false
# Output public url, If not defined, the value will be generated from
# the [general.public_url] hostname, the output port and mount.
public_url:
# Icecast server host.
# > default is localhost
host: localhost
# Icecast server port.
# > default is 8000
port: 8000
# Icecast server mount point.
# > this field is REQUIRED
mount: main
# Icecast source user.
# > default is source
source_user: source
# Icecast source password.
# > this field is REQUIRED
source_password: hackme
# Icecast admin user.
# > default is admin
admin_user: admin
# Icecast admin password. If not defined, statistics will not be collected.
admin_password: hackme
# Icecast output audio.
audio:
# Icecast output audio format.
# > must be one of (aac, mp3, ogg, opus)
# > this field is REQUIRED
format: ogg
# Icecast output audio bitrate.
# > must be one of (32, 48, 64, 96, 128, 160, 192, 224, 256, 320)
# > this field is REQUIRED
bitrate: 256
# format=ogg only field: Embed metadata (track title, artist, and show name)
# in the output stream. Some bugged players will disconnect from the stream
# after every songs when playing ogg streams that have metadata information
# enabled.
# > default is false
enable_metadata: false
# Icecast stream name.
name: LibreTime!
# Icecast stream description.
description: LibreTime Radio!
# Icecast stream website.
website: https://libretime.org
# Icecast stream genre.
genre: various
# Whether the stream should be used for mobile devices.
# > default is false
mobile: false
# Shoutcast output streams.
# > max items is 1
shoutcast:
- # Whether the output is enabled.
# > default is false
enabled: false
# Output public url. If not defined, the value will be generated from
# the [general.public_url] hostname and the output port.
public_url:
# Shoutcast server host.
# > default is localhost
host: localhost
# Shoutcast server port.
# > default is 8000
port: 8000
# Shoutcast source user.
# > default is source
source_user: source
# Shoutcast source password.
# > this field is REQUIRED
source_password: hackme
# Shoutcast admin user.
# > default is admin
admin_user: admin
# Shoutcast admin password. If not defined, statistics will not be collected.
admin_password: hackme
# Shoutcast output audio.
audio:
# Shoutcast output audio format.
# > must be one of (aac, mp3)
# > this field is REQUIRED
format: mp3
# Shoutcast output audio bitrate.
# > must be one of (32, 48, 64, 96, 128, 160, 192, 224, 256, 320)
# > this field is REQUIRED
bitrate: 256
# Shoutcast stream name.
name: LibreTime!
# Shoutcast stream website.
website: https://libretime.org
# Shoutcast stream genre.
genre: various
# Whether the stream should be used for mobile devices.
# > default is false
mobile: false
# System outputs.
# > max items is 1
system:
- # Whether the output is enabled.
# > default is false
enabled: false
# System output kind.
# > must be one of (alsa, ao, oss, portaudio, pulseaudio)
# > default is pulseaudio
kind: pulseaudio
# System output device.
# > only available for kind=(alsa, pulseaudio)
device:
## Libretime - docker-container <VirtualHost *:80> ServerAdmin monmail@riseup.net ServerName ****.***********.org ErrorLog ${APACHE_LOG_DIR}/****.***********.org-error.log CustomLog ${APACHE_LOG_DIR}/****.***********.org-access.log combined ProxyPreserveHost On ProxyRequests Off <Proxy *> Order deny,allow Allow from all </Proxy> RewriteEngine on RewriteCond %{SERVER_NAME} =****.***********.org RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent] </VirtualHost> <file php radio.org-le-ssl.conf > <IfModule mod_ssl.c> <VirtualHost *:443> ServerAdmin **@riseup.net ServerName ****.***********.org ErrorLog ${APACHE_LOG_DIR}/****.***********.org-error.log CustomLog ${APACHE_LOG_DIR}/****.***********.org-access.log combined ProxyPreserveHost On ProxyRequests Off <Location /> ProxyPass http://localhost:8080/ ProxyPassReverse http://localhost:8080/ </Location> <Proxy *> Order deny,allow Allow from all </Proxy> SSLEngine on SSLProxyEngine On SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off SSLCertificateFile /etc/letsencrypt/live/****.***********.org/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/****.***********.org/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf </VirtualHost> </IfModule>