Install, secure, and operate Skydrix.

Getting started

1. Quick Start

Install the Skydrix binary, create its writable directories, and start it with the default configuration.

sudo cp skydrix /usr/local/bin/
sudo chmod 0755 /usr/local/bin/skydrix
sudo mkdir -p /etc/skydrix /var/log/skydrix

# Default: port 8080, config /etc/skydrix/config.json
skydrix

# Custom port and config
skydrix -port 9090 -config /etc/skydrix/config.json

# Import Astra configuration and exit
skydrix -config /etc/skydrix/config.json \
  -importastra /path/to/astra/config Telekarta-80E

Open http://<server-ip>:8080, or use the HTTPS Nginx frontend described below.

Run as a systemd service

The service account normally needs membership in the video group to access DVB adapters.

sudo useradd --system \
  --home-dir /var/lib/skydrix \
  --create-home \
  --shell /usr/sbin/nologin \
  --groups video \
  skydrix

sudo install -d -o skydrix -g skydrix \
  /etc/skydrix /var/log/skydrix /var/lib/skydrix
sudo chown -R skydrix:skydrix \
  /etc/skydrix /var/log/skydrix /var/lib/skydrix
sudo install -m 0600 -o root -g root /dev/null /etc/default/skydrix

Create /etc/systemd/system/skydrix.service:

[Unit]
Description=Skydrix DVB streaming server
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=skydrix
Group=skydrix
SupplementaryGroups=video
WorkingDirectory=/var/lib/skydrix
EnvironmentFile=-/etc/default/skydrix
ExecStart=/usr/local/bin/skydrix -config /etc/skydrix/config.json -port 8080
Restart=on-failure
RestartSec=5s
TimeoutStopSec=30s
KillSignal=SIGTERM
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
UMask=0027

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now skydrix
sudo systemctl status skydrix
sudo journalctl -u skydrix -f

Astra configuration import

• Run Skydrix transponder discovery before importing.
• Stop the running Skydrix service during the offline import.
• Pass the exact satellite source label displayed by Skydrix.
• The importer replaces IDs, names, adapters, channels, outputs, and Softcam assignments for the selected satellite source.
• The previous configuration is preserved as a timestamped config.json.astra-backup-* file.

Secure access

2. Nginx as SSL Front-End

Skydrix listens on plain HTTP by default. Put Nginx in front to terminate TLS and optionally require HTTP Basic Authentication.

sudo apt install nginx apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd-skydrix operator
sudo chown root:www-data /etc/nginx/.htpasswd-skydrix
sudo chmod 640 /etc/nginx/.htpasswd-skydrix

Create /etc/nginx/sites-available/skydrix:

server {
    listen 80;
    server_name skydrix.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name skydrix.example.com;

    ssl_certificate     /etc/letsencrypt/live/skydrix.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/skydrix.example.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    # Trusted management addresses bypass the password.
    # All other clients must pass HTTP Basic Authentication.
    satisfy any;
    allow 127.0.0.1;
    allow ::1;
    allow 192.168.1.0/24;
    allow 203.0.113.10;
    deny all;

    auth_basic           "Skydrix";
    auth_basic_user_file /etc/nginx/.htpasswd-skydrix;

    location / {
        proxy_pass         http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_buffering    off;
        proxy_read_timeout 120s;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }

    location ~* \.m3u8$ {
        proxy_pass         http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_buffering    off;
        add_header         Cache-Control "no-cache, no-store";
        proxy_set_header   Host $host;
    }

    location ~* \.ts$ {
        proxy_pass         http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_buffering    off;
        proxy_set_header   Host $host;
    }
}

sudo ln -s /etc/nginx/sites-available/skydrix \
  /etc/nginx/sites-enabled/skydrix
sudo nginx -t
sudo systemctl reload nginx

A request is admitted when its IP matches an allow rule or it supplies valid Basic Auth credentials. Replace all example IPs. If another proxy is in front of Nginx, configure the real-IP module before relying on the allowlist.

Core platform

3. Key Features

Virtual playout

4. Custom Channels

Skydrix supports three custom channel types that do not require a DVB adapter. They use the embedded FileCaster engine and do not launch VLC, FFmpeg, or another external media process.

Custom channels are created through the regular Add Channel dialog on a custom/virtual transponder. They use the same output system and channel controls as DVB services.

Remote URL

Remote URL channels receive external MPEG-TS, HLS, SRT, or RTSP sources. One or more input URLs can be configured in priority order, with the second and following URLs acting as failover sources. SRT and RTSP require ffmpeg on the Skydrix host and are remuxed into MPEG-TS.

• The source tester verifies that actual transport-stream media bytes are received.
• Skydrix starts with the first URL and switches to the next source after a failure.
• After all URLs fail, Skydrix waits 60 seconds and retries from the first URL.
• A single failed URL is retried after the same delay.
• Stopping the channel immediately cancels the active read and pending retry.

Media directory

Media directory channels play supported files from an absolute server directory. The available controls are Repeat and Shuffle.

• Supported formats: MP4, M4V, MOV, MKV, TS, and M2TS.
• The directory and its subdirectories are scanned recursively.
• The base playlist is sorted case-insensitively by relative path.
• Shuffle randomizes the order before each playback pass.
• Repeat rescans the directory and starts another pass after the last file.
• Without Repeat, the channel stops after one completed pass.
• Unsupported files are skipped; an empty compatible playlist is not started.

media:///media/promo?repeat=1&shuffle=0

Scheduled broadcast

Scheduled broadcast channels play one daily playlist from a configured directory. The playlist name must use the YYYY-MM-DD.m3u8 format, and the daily start hour is evaluated in the server's local timezone.

Entries may contain absolute local paths or HTTP/HTTPS media URLs supported by FileCaster.

#EXTM3U
#EXTINF:3600.0,Morning show
/media/archive/morning-show.ts
#EXTINF:1800.0,News
/media/archive/news.ts

• Before the daily start time, Skydrix outputs internal colour bars.
• A missing playlist is rechecked hourly.
• An early playlist end is filled with colour bars.
• The next day's window forcefully replaces an over-running playlist.

Outputs

All custom channel types support the same outputs as DVB channels. Outputs are independent, and a channel may publish to several destinations at once.

Several channels can share one HTTP listener when each channel has a unique route:

http://SERVER-IP:9001/ch1/out
http://SERVER-IP:9001/ch1/index.m3u8
http://SERVER-IP:9001/ch2/out
http://SERVER-IP:9001/ch2/index.m3u8

Advanced operations

5. Pro Features

Pro functionality is compiled into the Pro build and additionally gated by the active license edition.

Telegram proxy

6. Configure Telegram Custom URL

Use a VDS in a country where Telegram is not restricted as a controlled HTTPS proxy for Skydrix notifications. Several VDS instances may serve the same domain for redundancy.

Install and prepare Nginx

Install Nginx and configure a TLS certificate for your domain. A self-signed certificate may be used when the corresponding client-side TLS option is enabled.

Add the request mapping to the http block in nginx.conf:

http {
    # Existing directives...
    map $request_uri $new_uri {
        include conf.d/proxy.map;
    }

    rewrite_log on;
    error_log /var/log/nginx/error.log notice;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

Create the virtual host

Create /etc/nginx/sites-enabled/mydomain.com.conf and replace the domain and certificate paths:

server {
    listen 80;
    server_name mydomain.com;

    location /.well-known/acme-challenge {
        root /var/www/html;
        allow all;
    }

    return 301 https://mydomain.com:443$request_uri;
    access_log off;
}

server {
    listen 443 ssl;
    server_name mydomain.com;
    http2 on;

    ssl_certificate         /etc/nginx/ssl/mydomain.com/fullchain.pem;
    ssl_certificate_key     /etc/nginx/ssl/mydomain.com/privkey.pem;
    ssl_trusted_certificate /etc/nginx/ssl/mydomain.com/chain.pem;

    root /var/www/html;
    index index.html;

    client_max_body_size 32M;
    client_body_timeout 300s;
    client_body_buffer_size 512k;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/html;
        allow all;
        default_type "text/plain";
        autoindex off;
        try_files $uri $uri/ =404;
    }

    location = /favicon.ico {
        log_not_found off;
    }

    location / {
        deny all;
    }

    include conf.d/tpm.location;
}

Restrict and proxy Telegram requests

Create /etc/nginx/conf.d/tpm.location. Replace the example addresses with the public IP addresses of servers allowed to send Telegram notifications through this VDS.

location /tpm {
    access_log off;
    limit_req zone=tproxy burst=50;
    satisfy any;
    allow 1.1.1.1;
    allow 2.2.2.2;
    allow 3.3.3.3;
    allow 4.4.4.4;
    deny all;

    if ($new_uri) {
        rewrite ^(.*)$ $new_uri break;
    }

    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass https://api.telegram.org/;
}

Create /etc/nginx/conf.d/limit.conf:

limit_req_zone $binary_remote_addr zone=tproxy:10m rate=20r/s;

Create /etc/nginx/conf.d/proxy.map. Keep the real Telegram bot tokens only on the proxy server:

~/tpm/BotName1/(.*)$  /bot12345678:ABCDEFGHijklmnopqrstUVWzyz/$1;
~/tpm/BotName2/(.*)$  /bot12345678:ABCDEFGHijklmnopqrstUVWzyz/$1;

Validate and reload the configuration:

sudo nginx -t
sudo systemctl reload nginx

Configure Skydrix

In the user's Telegram settings, set Custom URL to mydomain.com and Bot to /tpm/BotName1. Skydrix sends notifications to:

https://mydomain.com/tpm/BotName1/sendMessage

Nginx rewrites the request to the corresponding Telegram Bot API URL and forwards it to https://api.telegram.org. Rewrite diagnostics are available in /var/log/nginx/error.log.

For redundancy, deploy the same configuration on several VDS instances and assign several A records to mydomain.com. Notification requests will then be distributed among those servers.

Pro transcoding

7. Configure Transcoding

Skydrix Pro uses a control-plane/data-plane model. The Skydrix server stores profiles, decides which renditions should run, and talks to one or more skydrix-agent processes over mutual TLS. Agents run FFmpeg and publish HLS rendition playlists and segments on their public stream listener.

Network ports and roles

For a remote agent, expose the control listener only to the Skydrix server address, and expose the stream listener only where HLS clients need access. Do not publish the control listener without firewall restrictions.

Generate local setup files

On a build/admin machine that has the Skydrix repository scripts and OpenSSL, run the helper. For a single-server local agent:

cd /path/to/Skydrix
sudo AGENT_ID=local-1 \
  AGENT_NAME=skydrix-agent.local \
  CONTROL_LISTEN=127.0.0.1:9443 \
  CONTROL_URL=https://127.0.0.1:9443 \
  STREAM_LISTEN=0.0.0.0:9088 \
  PUBLIC_BASE_URL=http://SERVER-IP:9088 \
  bash scripts/agent/local-setup.sh /etc/skydrix-agent

The helper creates:

• /etc/skydrix-agent/agent.json - agent runtime config.
• /etc/skydrix-agent/skydrix-transcoding.json - Skydrix config snippet.
• /etc/skydrix-agent/tls/agent.crt and agent.key - server certificate/key used by the agent control API.
• /etc/skydrix-agent/tls/control-ca.crt - CA file used by the agent to verify Skydrix client certificates.
• /etc/skydrix-agent/tls/ca.crt, control.crt, and control.key - files referenced by Skydrix when it connects to the agent.
• /etc/skydrix-agent/tls/ca.key - CA private key. Keep it protected and do not install it into production service directories unless this is a temporary lab setup.

Remote agent certificates

For a remote agent, set AGENT_NAME to the DNS name that Skydrix will verify in TLS, and set the control/public URLs to the remote host:

AGENT_ID=agent-2 \
AGENT_NAME=transcoder-2.example.com \
CONTROL_LISTEN=0.0.0.0:9443 \
CONTROL_URL=https://transcoder-2.example.com:9443 \
STREAM_LISTEN=0.0.0.0:9088 \
PUBLIC_BASE_URL=http://transcoder-2.example.com:9088 \
bash scripts/agent/local-setup.sh ./agent-2-setup

Install only these files on the agent host:

/etc/skydrix-agent/agent.json
/etc/skydrix-agent/tls/agent.crt
/etc/skydrix-agent/tls/agent.key
/etc/skydrix-agent/tls/control-ca.crt

Install these files on the Skydrix host, for example under /etc/skydrix/transcoding/agent-2/:

ca.crt
control.crt
control.key

Do not copy ca.key to either runtime host after certificate generation. Store it offline if you need to issue replacement certificates later.

Install and start the agent service

Copy the skydrix-agent binary to the agent host and create its service account and writable directories:

sudo cp skydrix-agent /usr/local/bin/
sudo chmod 0755 /usr/local/bin/skydrix-agent
sudo useradd --system --home /var/lib/skydrix-agent \
  --shell /usr/sbin/nologin skydrix-agent
sudo install -d -o skydrix-agent -g skydrix-agent \
  /var/lib/skydrix-agent /var/log/skydrix-agent /etc/skydrix-agent/tls
sudo chown -R skydrix-agent:skydrix-agent /etc/skydrix-agent
sudo chmod 0600 /etc/skydrix-agent/agent.json /etc/skydrix-agent/tls/*.key
sudo chmod 0644 /etc/skydrix-agent/tls/*.crt

Install the example service from scripts/agent/skydrix-agent.service:

sudo install -m 0644 scripts/agent/skydrix-agent.service \
  /etc/systemd/system/skydrix-agent.service
sudo systemctl daemon-reload
sudo systemctl enable --now skydrix-agent
sudo systemctl status skydrix-agent
sudo journalctl -u skydrix-agent -f

The service reads /etc/skydrix-agent/agent.json, starts the mTLS control API, probes FFmpeg capabilities, and serves HLS renditions from the configured stream listener.

Configure Skydrix

Open Settings -> Transcoding in the Skydrix Pro UI. In Agents, add one agent and fill the fields from the generated snippet:

Alternatively, merge the generated skydrix-transcoding.json into config.json while Skydrix is stopped, then start Skydrix and verify the agent appears online in Settings -> Transcoding -> Agent runtime.

Create profiles and enable channel transcoding

1. In Settings -> Transcoding -> Quality profiles, create any desired number of profiles such as 360p, 720p, 1080p.
2. Choose Auto encoder unless the agent has a known working NVENC, QSV, or VAAPI backend.
3. Save the transcoding settings and check that the agent runtime row shows FFmpeg version, encoders, heartbeat, and job capacity.
4. Open a channel settings window, go to Transcoding, enable transcoding, select one or more profiles, and leave Agent as Auto unless you need to pin a specific worker.
5. Save the channel transcoding settings. The channel uses its active input_urls[0] source, and the UI shows only the generated master playlist URL when at least one rendition is ready.

Choose media_transport

media_transport describes only the media-plane protocol used by the agent to pull the source. It does not change the HTTPS/mTLS control API between Skydrix and the agent. In most channel workflows, leave it as auto; Skydrix derives the value from source_url.

If a non-auto value does not match the source_url scheme, Skydrix rejects the job before assigning it to an agent. Source URLs must not contain credentials. For SRT sources, the agent supplies safe live defaults when omitted: mode=caller, transtype=live, and latency=300000.

POST /api/transcoding/jobs
{
  "channel_id": "astra-11550v:501",
  "source_url": "srt://encoder.example.com:9000?mode=caller",
  "media_transport": "srt",
  "profile_ids": ["720p", "1080p"],
  "pinned_agent_id": null
}

Quick diagnostics

# Agent service
sudo systemctl status skydrix-agent
sudo journalctl -u skydrix-agent -n 100

# Agent control API from the Skydrix host
curl --cert /path/to/control.crt \
  --key /path/to/control.key \
  --cacert /path/to/ca.crt \
  https://transcoder-2.example.com:9443/v1/health

# Agent public stream listener
curl http://transcoder-2.example.com:9088/

If the agent is offline in Skydrix, check firewall access to the control URL, certificate paths and permissions, TLS server name, and whether the agent ID in Skydrix matches agent.json. If jobs fail to start, check FFmpeg path, source protocol support, hardware encoder availability, and the agent log.