> ## Documentation Index
> Fetch the complete documentation index at: https://docs.torrin.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Exposing publicly

> Put Torrin behind HTTPS so you can use it remotely and with Stremio.

The quickstart runs Torrin on plain HTTP, which is fine on your LAN. To use it
from outside your network — and to use the **Stremio addon**, which requires
HTTPS — put it behind TLS. The `docker-compose.public.yml` overlay does this for
you, two ways.

## Access it locally first (no domain)

Before exposing anything, you can reach the dashboard on the machine itself. The
web UI runs in the `web` container on port `5000`, but that port isn't published
to your host by default. Publish it with a `docker-compose.override.yml` next to
your compose files:

```yaml theme={null}
services:
  web:
    ports:
      - "127.0.0.1:5000:5000"
```

Re-run your `up -d` command, then open **[http://localhost:5000](http://localhost:5000)** to create your
account and add your debrid key. Drop the `127.0.0.1:` prefix to reach it from
other devices on your LAN.

<Note>
  Local access is HTTP only. For remote use and the Stremio addon (which requires
  HTTPS), use one of the options below.
</Note>

## Option A: Caddy with a domain (automatic TLS)

Point a domain at your server, then let the bundled Caddy fetch and renew a
Let's Encrypt certificate automatically.

<Steps>
  <Step title="DNS">
    Create an A/AAAA record for your domain (e.g. `stream.example.com`) pointing
    at the server's public IP. Open ports **80** and **443**.
  </Step>

  <Step title="Configure">
    In `deploy/.env`:

    ```bash theme={null}
    STREAM_DOMAIN=stream.example.com
    ACME_EMAIL=you@example.com
    PUBLIC_URL=https://stream.example.com
    ```
  </Step>

  <Step title="Start with the overlay">
    ```bash theme={null}
    docker compose -f docker-compose.yml -f docker-compose.vpn.yml \
      -f docker-compose.public.yml up -d
    ```
  </Step>
</Steps>

Caddy reverse-proxies the public services (see `deploy/Caddyfile`) and manages
TLS. Adjust the Caddyfile if you want separate subdomains for the api, addon, or
WebDAV.

## Option B: Cloudflare Tunnel (no open ports)

If you can't open ports or prefer not to expose your IP, use a Cloudflare
Tunnel. Create a tunnel in the Cloudflare dashboard, then:

```bash theme={null}
CLOUDFLARE_TUNNEL_TOKEN=your-tunnel-token
```

and bring the stack up with the same `docker-compose.public.yml` overlay. Route
the tunnel's hostnames to the internal services in the Cloudflare dashboard.

<Warning>
  `PUBLIC_URL` must match the HTTPS address you actually serve on — signed stream
  URLs are minted against it, so a mismatch breaks playback.
</Warning>