SRS Streaming Media

Architecture

publisher --:1935 RTMP ------------------------------> SRS (ingest) browser --:8000/udp WebRTC media ------------------> SRS (ingest/play) browser --:80 nginx (Basic auth) --> / -> 127.0.0.1:8080 console, player, HLS, HTTP-FLV /api/ -> 127.0.0.1:1985 SRS HTTP API /healthz -> 200 (unauthenticated health check)

SRS runs as a Docker container under systemd with host networking. The RTMP and WebRTC media ports bind directly, which keeps delivery latency low.

nginx serves the console, player and stream output on port 80 and reverse-proxies the SRS HTTP API. Both are protected by HTTP Basic authentication with a per-instance password. The RTMP ingest port (1935) and WebRTC media port (8000/udp) are exposed directly.

The live HLS/media output is stored under /var/lib/srs, a dedicated, independently resizable EBS volume separate from the operating system disk. An unauthenticated health endpoint at /healthz serves load-balancer and uptime checks.

Connecting to your instance

Connect over SSH on port 22 as the default login user for your operating system variant. Use the EC2 key pair you selected at launch.

OS variant SSH login user Example

Ubuntu 24.04 ubuntu ssh -i your-key.pem ubuntu@<instance-public-ip>

The instance security group opens these ports: 22 (SSH), 80 (HTTP), 443 (reserved for HTTPS), 1935 (RTMP ingest) and 8000/udp (WebRTC media).

Step 1 - Retrieve the generated admin password

On first boot, a one-shot service generates an admin password unique to your instance. It records the password in a root-only file. Read the file over SSH:

sudo cat /root/srs-credentials.txt

# SRS - generated on first boot by srs-firstboot.service
# These credentials are unique to this VM. Store them somewhere safe. SRS_URL=http://<instance-public-ip>/ SRS_ADMIN_USER=admin SRS_ADMIN_PASSWORD=<generated-password> SRS_RTMP_URL=rtmp://<instance-public-ip>:1935/live/<stream-key> SRS_WEBRTC_CANDIDATE=<instance-public-ip>

Confirm that the streaming server is up:

sudo docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' systemctl is-active docker srs nginx curl -s http://127.0.0.1/healthz

NAMES IMAGE STATUS srs ossrs/srs:v6.0-r0 Up 2 minutes active active active ok

Step 2 - Open the SRS console

Open http://<instance-public-ip>/ in your browser. Sign in as admin with the password from the credentials file. The home page confirms that the server is running and shows the RTMP server address and stream key to publish to.

Click SRS console (or open http://<instance-public-ip>/console/en_index.html) to reach the management console. The Overview tab shows the server version, uptime, CPU, memory, network and a connection summary in real time.

Step 3 - Publish a live stream

Point any RTMP encoder at the server. In OBS Studio, set Service to Custom, Server to rtmp://<instance-public-ip>:1935/live and Stream Key to any name (for example livestream).

To publish a synthetic test pattern from the instance itself, SSH in and run the following self-contained check. It publishes a 20-second test stream over RTMP. It then confirms through the authenticated HTTP API and the HLS and HTTP-FLV outputs that ingest, packaging and delivery all work end to end.

PW=$(sudo grep '^SRS_ADMIN_PASSWORD=' /root/srs-credentials.txt | cut -d= -f2-) nohup ffmpeg -re -f lavfi -i testsrc2=size=1280x720:rate=25 -f lavfi -i sine=frequency=500 \
  -t 20 -c:v libx264 -preset ultrafast -tune zerolatency -pix_fmt yuv420p -c:a aac \
  -f flv rtmp://127.0.0.1:1935/live/demo </dev/null >/tmp/srs-demo.log 2>&1 & disown sleep 7 echo "== live streams (SRS HTTP API) ==" curl -s -u "admin:$PW" http://127.0.0.1/api/v1/streams/ | python3 -c 'import json,sys; d=json.load(sys.stdin); print("\n".join(f"{s[\"app\"]}/{s[\"name\"]} {s[\"video\"][\"codec\"]} {s[\"video\"][\"width\"]}x{s[\"video\"][\"height\"]}" for s in d.get("streams",[])))' echo "== HTTP-FLV delivery ==" curl -s -o /dev/null -w 'http://<host>/live/demo.flv -> %{http_code}\n' -u "admin:$PW" http://127.0.0.1/live/demo.flv echo "== HLS delivery (master playlist) ==" curl -s -u "admin:$PW" http://127.0.0.1/live/demo.m3u8

== live streams (SRS HTTP API) == live/demo H264 1280x720 == HTTP-FLV delivery == http://<host>/live/demo.flv -> 200 == HLS delivery (master playlist) == #EXTM3U #EXT-X-STREAM-INF:BANDWIDTH=1,AVERAGE-BANDWIDTH=1 /live/demo.m3u8?hls_ctx=...

In the console, the Streams tab lists every live stream with its status, client count, inbound and outbound bitrate, and video and audio codecs.

Step 4 - Play the stream back

Open the bundled player at http://<instance-public-ip>/players/srs_player.html. Set the URL to your stream, for example http://<instance-public-ip>/live/livestream.flv for HTTP-FLV or the .m3u8 URL for HLS, then click Play. The player also has WHEP and WebRTC tabs for sub-second-latency playback.

The same stream is available in several protocols at once:

Protocol Playback URL

HTTP-FLV http://<instance-public-ip>/live/<stream-key>.flv

HLS http://<instance-public-ip>/live/<stream-key>.m3u8

RTMP rtmp://<instance-public-ip>:1935/live/<stream-key>

WebRTC via the console player (WHEP), UDP 8000

Step 5 - Query the HTTP API

The SRS HTTP API reports server, stream, client and version information as JSON. It is protected by the same per-instance password. For example, check the server version and query the clients endpoint:

PW=$(sudo grep '^SRS_ADMIN_PASSWORD=' /root/srs-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" http://127.0.0.1/api/v1/versions echo
curl -s -o /dev/null -w 'clients endpoint -> %{http_code}\n' -u "admin:$PW" http://127.0.0.1/api/v1/clients/

{"code":0,"server":"...","data":{"major":6,"minor":0,"revision":0,"version":"6.0.0"}} clients endpoint -> 200

Where things live

Item Location

SRS container sudo docker ps (name srs)

SRS server config /etc/srs/srs.conf

Reverse proxy systemctl status nginx (port 80)

SRS console/player port 127.0.0.1:8080 (via nginx /)

SRS HTTP API 127.0.0.1:1985 (via nginx /api/)

Live media / HLS output /var/lib/srs (dedicated EBS volume)

Admin credentials /root/srs-credentials.txt (root-only, 0600)

Health endpoint http://<instance-public-ip>/healthz

WebRTC and public IP

WebRTC media requires the instance to advertise a reachable public IP as its ICE candidate. First boot resolves the instance public IP automatically and writes it into the SRS configuration.

AWS assigns a new public IP when an instance is stopped and started. For a production WebRTC deployment, attach an Elastic IP so the address stays stable. If the public IP ever changes, re-run first boot to re-template the configuration:

sudo rm -f /var/lib/sac/data/srs-firstboot.done
sudo systemctl restart srs-firstboot.service

Security notes: enabling HTTPS

The image serves plain HTTP on port 80. For production, put the instance behind TLS. Either terminate HTTPS at an AWS Application Load Balancer with an ACM certificate, or install a certificate for your domain directly in nginx. Port 443 is already open in the security group.

Restrict inbound access to the RTMP (1935) and HTTP (80) ports to trusted networks or publishers.

Support

SecureAnyCloud provides 24/7 technical support by email and chat. We can help with deployment, reverse-proxy and HTTPS configuration, RTMP, SRT and WebRTC publishing, HLS and low-latency tuning, recording and storage, and upgrade planning.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch SRS Simple Realtime Server with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com