Bring your own streaming server

Your guests' video, on your own machine

Every guest camera in a show travels through a media server. Ours is a DigitalOcean droplet, and yours can be too — same software, your machine, your domain, your bill. A school, a studio, or anyone who wants the room's video to stay on their own hardware, can run the whole thing themselves.

This is the setup we run in production, written out. Below it is a prompt you can hand to an AI — Claude Code or anything like it — so it does the work with you and shows you what it did.

What you need

• A DigitalOcean account (any host with Ubuntu works; the guide names DO because that is what we use)
• A domain you control, and access to its DNS
• About half an hour, most of it waiting for certificates and DNS

The machine

Ubuntu 24.04, 4 vCPU / 8 GB is what ours is. The stack is LiveKit with Redis behind Caddy, brought up by LiveKit's own generate cloud-init, which also gets the TLS certificates. Caddy terminates TLS for both the signalling address and TURN.

The ports

These are the inbound rules on our live firewall, read off the running server:

Those are all it needs. UDP 50000–60000 is where the video actually goes, and TCP 7881 carries it on networks that prefer TCP, which is most corporate wifi.

DNS

Two A records pointing at the droplet: livekit.yourdomain and turn.yourdomain. If your domain already has a wildcard record, make these two specific records so they win over it — that is the one detail worth checking twice.

Hand this to an AI

Paste this into Claude Code (or any coding AI with a terminal). It tells the AI what to build, to work from what is written there, and to prove the thing works before saying it does.

You are setting up a private live-streaming server for me on DigitalOcean.
I run MyStreamRunner and I want my guests' video to go through MY server, not a shared one.

What I have:
- A DigitalOcean account (I can create an API token).
- A domain I control, with access to its DNS.
- A Mac with a terminal. Ask me before anything that costs money or is hard to undo.

What I want, in this order:
1. A droplet: Ubuntu 24.04 LTS, 4 vCPU / 8 GB, in the region closest to my audience.
   Tag it so a firewall can be attached by tag.
2. A firewall with EXACTLY these inbound rules and nothing else:
   TCP 22, TCP 80, TCP 443, TCP 7881, UDP 3478, UDP 50000-60000.
3. LiveKit on it, the official way: the livekit/generate cloud-init, which brings up
   LiveKit + Redis + Caddy with docker compose and gets TLS certificates on its own.
   Use systemd so it comes back after a reboot.
4. DNS: an A record for livekit.MYDOMAIN and one for turn.MYDOMAIN pointing at the
   droplet's IP. Tell me exactly what to add at my registrar and wait until I confirm
   the records resolve before carrying on.
5. Hand me back, in one block I can copy:
   - LIVEKIT_URL (wss://livekit.MYDOMAIN)
   - LIVEKIT_API_KEY
   - LIVEKIT_API_SECRET
   Keep them out of any git repository. Tell me where you stored them on my Mac.
6. Prove it works before you tell me it works: connect a test publisher and a test
   subscriber, show me the output, and show me the firewall rules as the API reports
   them — not as you intended them.

Rules for you:
- Do not invent a number, a port or a price. If you have not read it, say so.
- Show me each command before you run it, and stop at anything destructive.
- When you are done, write me a one-page note: what exists, what it costs per month,
  how to stop and start it, and how to delete the whole thing if I change my mind.

Then point your show at it

1. In the show, open Guests and put your address in Link address for this show. Every guest link, co-host link and QR code is then your address.
2. On the phone app's pairing screen, put the same address in Server URL before you pair.
3. Send yourself the guest link and join from another device. If you can see and hear yourself, it is your server doing it.

Keep the API key and secret off any repository. Ours live in a folder on the Mac that git leaves alone, and yours should too.