Your Sridu, on your terms

• index.html, css/, js/, locales/ The app itself. That is all you need for playing from the files.
• docker-compose.yml and .env.example Docker at home, and its settings.
• deploy/public/ The hardened setup for your own domain.
• deploy/relay/ A relay for online matches, as a project of its own.
• README.md This guide, for reading offline.

Already playing? In the app, Self-host it below the game selection packs the running app into a ZIP, right in your browser. That copy holds the app files only: enough for playing from the files, not for Docker.

Why not just double-click index.html? The browser then opens it as file://. There it blocks the app’s modules and never hands out cameras. You need a small web server, and that is one command.

1 · Unzip

Unzip the download into a folder, for example sridu in your documents.

2 · Open a terminal in that folder

• Windows: open the folder in Explorer, click into the address bar, type cmd and press Enter.
• macOS: right-click the folder in Finder, then Services → New Terminal at Folder.
• Linux: open a terminal and cd into the folder.

3 · Start a web server

Use whatever is already on your computer. Python comes with macOS and Linux; on Windows get it from python.org.

# Python 3
python3 -m http.server 8080

# or Node.js
npx serve -l 8080

# or PHP
php -S localhost:8080

4 · Play

Open http://localhost:8080 in Chrome or Edge. Allow the cameras, then go to Cameras → Set up automatically. No cameras yet? Start page → Demo plays with three simulated ones.

Stop the server with Ctrl+C. What you play is stored in this browser, not in the folder, so it is still there the next time you start the server on the same port.

Put it on a web space

Because Sridu is only static files, any host works. The one rule: index.html has to sit in the root of the site, and the site has to be served over https.

• Cloudflare Pages or Netlify: create a project and drag the unzipped folder into the upload box. Free, with https.
• GitHub Pages: push the folder to a repository, then Settings → Pages → deploy from the branch.
• Your own web space or NAS web station: copy the folder into the web folder by FTP or file share.
• Plain Docker, nothing extra: one nginx container serves the folder.

docker run -d -p 8080:80 -v "$PWD":/usr/share/nginx/html:ro nginx:alpine

Phones, tablets and a second board

Another device reaches your computer by its IP address, and there the browser refuses cameras and the encryption that sessions need. Only localhost and https:// are allowed. So as soon as more than one device is involved, use a web space with https, or Docker at home, which brings https along.

1 · Get Docker

• Windows and macOS: install Docker Desktop and start it once.
• Linux and Raspberry Pi: Docker Engine with the compose plugin.
• Synology: Container Manager from the Package Center. The commands below run over SSH, or use Container Manager → Project → Create with the folder of the ZIP.

2 · Tell Sridu its address

Unzip the download, open a terminal in the folder and copy the example settings:

cp .env.example .env

# on Windows (cmd):
copy .env.example .env

Open .env in any text editor and put the IP address of this machine into SRIDU_HOSTS, plus a name if it has one. They go into the certificate that every other device needs:

SRIDU_HOSTS=192.168.1.20,darts.local

Do this before the first start. The certificate is made once and then kept, so the browser exception you confirm survives every update. Everything else in the file can wait; it is all explained below.

3 · Start it

docker compose up -d --build

The first start builds the images and takes a minute or two. After that, three small containers run: the app (nginx), the admin service and the broker for online play. A fourth, the relay, only starts if you ask for it.

4 · Open it

• On this machine: http://localhost:8090
• On every other device: https://192.168.1.20:8443. The browser warns once about the self-signed certificate: Advanced → Proceed.
• Admin page: http://<this machine>:8090/admin/, see below.

Want no warning at all? Put a reverse proxy such as Caddy, Traefik or Nginx Proxy Manager in front of port 8090. It gets a certificate browsers trust, and then Sridu can also be installed as an app on every device.

5 · Everyday commands

# what is going on
docker compose logs -f

# stop
docker compose down

# start again, or after an update
docker compose up -d --build

Updating: unzip the new download over the old folder. Keep .env and the data/ folder, then run the last command. With git: git pull && docker compose up -d --build.

1. Open ithttp://<this machine>:8090/admin/ from any device at home.
2. Enter the setup codeThe first visit asks for a code. The container prints it to its log: docker compose logs api
3. Choose a passwordAt least 12 characters. Forgot it? docker compose exec api node server.mjs reset prints a new setup code and ends every admin session.

• OnlineStart language, the lobby and where your players meet, relay servers, and whether darts may be corrected in the challenges and mini games.
• LeaderboardOn or off, strict mode, how long results are kept, the players and who is blocked.
• LegalImprint and privacy policy, with templates to start from. As soon as there is text, the app links to them.
• ModerationReports from the lobby, blocked devices and the word filter.
• AccountChange your password.

The admin page keeps its settings, texts and reports in the Docker volume sridu-state, never in the code.

What is different from home

• Only your domain and addresses in your home network get an answer, anything else gets none
• https comes from Cloudflare, and browsers are told to use nothing else (HSTS)
• No player data on the server: it stays in every player’s browser
• Only your own broker for online play, so nothing goes to third parties
• Your own moderated lobby: word filter, blocked devices, reports
• A leaderboard that counts only darts the cameras saw
• Security headers, rate limits, unprivileged read-only containers with memory and CPU limits

Set it up

1. Copy the files to the NASFor example to /volume1/docker/sridu.
2. SettingsIn deploy/public/, copy .env.example to .env and set at least SRIDU_DOMAIN, for example darts-club.org,www.darts-club.org.
3. Startdocker compose up -d --build in deploy/public/. Or Synology Container Manager → Project → Create, with that folder as the path.
4. Cloudflare TunnelZero Trust → Networks → Tunnels → your tunnel → Public hostnames: your domain → HTTP → <NAS-IP>:8090, and the same for www. Or let the project run the tunnel: put its token into CLOUDFLARE_TUNNEL_TOKEN, start with --profile tunnel and use http://web:8080 as the service.
5. Admin page and legal textsFrom home, open http://<NAS-IP>:8090/admin/, choose a password and fill in the imprint and privacy policy under Legal. The templates are a starting point, not legal advice.
6. CheckYour domain opens the app. /admin/ answers 404 from outside. Any other name that points at the tunnel gets no answer.

Recommended Cloudflare settings

• SSL/TLS: Always Use HTTPS on, minimum TLS 1.2.
• Network: WebSockets on (the default). The lobby and online matches need them.
• Security: Bot Fight Mode on, and a rate limit on paths starting with /api/: block above 60 requests per 10 seconds per IP.
• Admin from outside: only with SRIDU_ADMIN_REMOTE=on and a Cloudflare Access application in front of /admin.
• Router and NAS firewall: no port forwarding for the app, and allow SRIDU_PORT only from your local network.

a) Your own relay

Part of both Docker setups. It speaks UDP, so it does not go through Cloudflare Tunnel: this is the one part that needs port forwarding, and players see the IP of your internet connection.

1. SettingsIn .env: SRIDU_TURN_HOST (a name pointing directly at your connection: a DNS-only record or a DDNS name such as yourname.synology.me), SRIDU_TURN_IP (your public IP) and SRIDU_TURN_PASS (letters and digits).
2. RouterForward UDP 3478, UDP 31000–31040 and TCP 3478 to this machine, and allow them in its firewall.
3. Start with the profiledocker compose --profile relay up -d --build
4. CheckFrom a phone on mobile data: Online connection → Test connection should report the relay as working.

Safe by design: the relay login is readable by every visitor, because the browser needs it. So the relay never connects to private addresses, relays UDP only, allows few relays per user and caps the bandwidth. A board in the same network as the relay needs one exception: SRIDU_TURN_ALLOW with its LAN IP.

b) A hosted TURN service

No ports to open: put its addresses into SRIDU_TURN_URLS and its login into SRIDU_TURN_USER and SRIDU_TURN_PASS, and start without the relay profile. Playing from plain files? Enter the relay in the app’s online settings instead.

c) Only the relay

deploy/relay/ runs the relay as a project of its own, for example next to a copy on a web space. Enter it on the admin page with the user and password from that file.