bitinggoatsoft/rallytone-server repository overview

⁠RallyTone Server — Docker Image

RallyTone⁠ is a LAN-first game party voice and text chat app by BitingGoat Software⁠. This image runs one standalone RallyTone party on an always-on Linux host or NAS.

It uses the same authoritative session and certificate-pinned TLS 1.3 QUIC transport as the RallyTone desktop host. Active party state, messages, and voice are ephemeral; the Docker volume keeps the server identity stable. Voice is relayed without being decoded, recorded, or persisted.

An optional token-protected management page shows live status and persists settings. Management-page values override environment variables one field at a time, and each override can be reset to reveal its environment or default value.

⁠Quick start

⁠Docker Compose (recommended)

Download docker-compose.server.yml⁠, then run:

docker compose -f docker-compose.server.yml pull
docker compose -f docker-compose.server.yml up -d
docker compose -f docker-compose.server.yml logs -f

Compose creates a named /config volume for page overrides and the stable server identity. The management page remains disabled until an administrator token is supplied.

Back up /config/identity.json as a secret. Recreating the container with the same volume preserves the identity code; losing that file makes clients report an identity change on the next connection.

⁠One-liner

docker volume create rallytone-server-config
docker run -d \
  --name rallytone-server \
  --network host \
  --restart unless-stopped \
  --read-only \
  --cap-drop ALL \
  --security-opt no-new-privileges:true \
  --mount source=rallytone-server-config,target=/config \
  -e RALLYTONE_PARTY_NAME="RallyTone Server" \
  -e RALLYTONE_CAPACITY=12 \
  bitinggoatsoft/rallytone-server:latest

⁠Optional management page

Set an administrator token of 16–256 bytes and bind the management listener to a trusted LAN interface:

-e RALLYTONE_ADMIN_BIND=0.0.0.0:15382
-e RALLYTONE_ADMIN_TOKEN_FILE=/run/secrets/rallytone_admin_token
-v /private/path/rallytone-admin-token:/run/secrets/rallytone_admin_token:ro

Open http://<server-LAN-address>:15382/. Keep TCP 15382 restricted to the trusted LAN and never forward it from a router. The built-in endpoint is plain HTTP; use the default loopback binding or a restricted HTTPS reverse proxy when possible.

Party details, access, join lock, LAN visibility, and member permissions update without disconnecting participants. Party and management listener addresses and LAN discovery startup require a restart. A password set on the page is stored in the private /config/server.json file but is never returned by the management API.

⁠Network

⁠Host network is required for LAN discovery

RallyTone discovery uses multicast that does not cross normal Docker bridge/NAT networking. Use --network host, network_mode: host, or Host network mode in QNAP Container Station and Synology Container Manager.

Bridge networking is only appropriate when both LAN discovery settings are disabled and UDP 15381:15381 is published. If the host is behind a router, forward UDP 15381 to it. In the desktop app, choose Connect by IP, enter the address, and compare the displayed identity code with the server's certificate fingerprint before confirming. Use a strong party password and never forward the management TCP port.

⁠Environment variables

Boolean values accept 1/0, true/false, on/off, and yes/no. Inline and file variants for the same password/token are mutually exclusive. The complete configuration and security contract is in the RallyTone server documentation⁠. When member rename is enabled, compatible desktop clients commit the new nickname through the profile control; the server validates its length and uniqueness before publishing it to the party.

⁠Tags and architecture

• latest — most recently published server release
• v<version> — versioned release tag
• Platforms: linux/amd64, linux/arm64
• Runtime: scratch image, numeric non-root user 65532:65532, no shell