Exposing publicly

Put Torrin behind HTTPS so you can use it remotely and with Stremio.

The quickstart runs Torrin on plain HTTP, which is fine on your LAN. To use it from outside your network — and to use the Stremio addon, which requires HTTPS — put it behind TLS. The docker-compose.public.yml overlay does this for you, two ways.

Access it locally first (no domain)

Before exposing anything, you can reach the dashboard on the machine itself. The web UI runs in the web container on port 5000, but that port isn’t published to your host by default. Publish it with a docker-compose.override.yml next to your compose files:

services:
  web:
    ports:
      - "127.0.0.1:5000:5000"

Re-run your up -d command, then open http://localhost:5000 to create your account and add your debrid key. Drop the 127.0.0.1: prefix to reach it from other devices on your LAN.

Local access is HTTP only. For remote use and the Stremio addon (which requires HTTPS), use one of the options below.

Option A: Caddy with a domain (automatic TLS)

Point a domain at your server, then let the bundled Caddy fetch and renew a Let’s Encrypt certificate automatically.

1. DNS

   Create an A/AAAA record for your domain (e.g. stream.example.com) pointing at the server’s public IP. Open ports 80 and 443.

2. Configure

   In deploy/.env:

   STREAM_DOMAIN=stream.example.com
   ACME_EMAIL=[e-mail]
   PUBLIC_URL=https://stream.example.com
   
3. Start with the overlay

   docker compose -f docker-compose.yml -f docker-compose.vpn.yml \
     -f docker-compose.public.yml up -d
   

Caddy reverse-proxies the public services (see deploy/Caddyfile) and manages TLS. Adjust the Caddyfile if you want separate subdomains for the api, addon, or WebDAV.

Option B: Cloudflare Tunnel (no open ports)

If you can’t open ports or prefer not to expose your IP, use a Cloudflare Tunnel. Create a tunnel in the Cloudflare dashboard, then:

CLOUDFLARE_TUNNEL_TOKEN=your-tunnel-token

and bring the stack up with the same docker-compose.public.yml overlay. Route the tunnel’s hostnames to the internal services in the Cloudflare dashboard.

PUBLIC_URL must match the HTTPS address you actually serve on — signed stream URLs are minted against it, so a mismatch breaks playback.