SRS Simple Realtime Server on AWS

SRS (Simple Realtime Server) is a free, open source, high efficiency live streaming and real time media server. Publishers such as OBS Studio, ffmpeg, hardware encoders and mobile apps push a live feed over RTMP, SRT or WebRTC, and SRS delivers the same stream in real time as RTMP, HLS, HTTP-FLV and WebRTC for low latency playback in browsers and native players. This cloudimg image ships SRS fully installed and running behind an nginx reverse proxy, with a bundled web console and test player, so a working streaming server is serving within minutes of launch.

• Application: SRS 6.0-r0 (ossrs/srs, MIT), run as the official pinned Docker image
• Served on: port 80 (nginx, HTTP Basic auth) -> SRS console/player/output on loopback 127.0.0.1:8080, SRS HTTP API at /api/
• Ingest: RTMP on port 1935, WebRTC media on UDP port 8000 (direct, host networking)
• Admin user: admin, with a per-instance password generated on first boot
• Data disk: the live HLS/media output lives on a dedicated EBS volume at /var/lib/srs

Architecture

publisher --:1935 RTMP  ------------------------------>  SRS (ingest)
browser   --:8000/udp WebRTC media  ------------------>  SRS (ingest/play)
browser   --:80 nginx (Basic auth) --> /        -> 127.0.0.1:8080  console, player, HLS, HTTP-FLV
                                       /api/     -> 127.0.0.1:1985  SRS HTTP API
                                       /healthz  -> 200 (unauthenticated health check)

SRS runs as a Docker container under systemd with host networking, so the RTMP and WebRTC media ports bind directly for correct low latency delivery. nginx serves the console, player and stream output on port 80 and reverse-proxies the SRS HTTP API, protected by HTTP Basic authentication with a per-instance password. The RTMP ingest port (1935) and WebRTC media port (8000/udp) are exposed directly. The live HLS/media output is stored under /var/lib/srs, a dedicated, independently resizable EBS volume, separate from the operating system disk. An unauthenticated health endpoint is served at /healthz for load-balancer and uptime checks.

Connecting to your instance

Connect over SSH on port 22 as the default login user for your operating system variant, using the EC2 key pair you selected at launch:

The instance security group opens ports 22 (SSH), 80 (HTTP), 443 (reserved for HTTPS), 1935 (RTMP ingest) and 8000/udp (WebRTC media).

Step 1 - Retrieve the generated admin password

On first boot a one-shot service generates an admin password unique to your instance and records it in a root-only file. Read it over SSH:

sudo cat /root/srs-credentials.txt

# SRS - generated on first boot by srs-firstboot.service
# These credentials are unique to this VM. Store them somewhere safe.

SRS_URL=http://<instance-public-ip>/
SRS_ADMIN_USER=admin
SRS_ADMIN_PASSWORD=<generated-password>
SRS_RTMP_URL=rtmp://<instance-public-ip>:1935/live/<stream-key>
SRS_WEBRTC_CANDIDATE=<instance-public-ip>

Confirm the streaming server is up:

sudo docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
systemctl is-active docker srs nginx
curl -s http://127.0.0.1/healthz

NAMES   IMAGE                 STATUS
srs     ossrs/srs:v6.0-r0     Up 2 minutes
active
active
active
ok

Step 2 - Open the SRS console

Open http://<instance-public-ip>/ in your browser and sign in as admin with the password from the credentials file. The home page confirms the server is running and shows the exact RTMP server address and stream key to publish to.

Click SRS console (or open http://<instance-public-ip>/console/en_index.html) for the management console. The Overview tab shows the server version, uptime, CPU, memory, network and connection summary in real time.

Step 3 - Publish a live stream

Point any RTMP encoder at the server. In OBS Studio, set Service to Custom, Server to rtmp://<instance-public-ip>:1935/live and Stream Key to any name (for example livestream). To publish a synthetic test pattern straight from the instance, SSH in and run this self-contained check - it publishes a 20 second test stream over RTMP and then confirms, through the authenticated HTTP API and the HLS and HTTP-FLV outputs, that ingest, packaging and delivery all work end to end:

PW=$(sudo grep '^SRS_ADMIN_PASSWORD=' /root/srs-credentials.txt | cut -d= -f2-)
nohup ffmpeg -re -f lavfi -i testsrc2=size=1280x720:rate=25 -f lavfi -i sine=frequency=500 \
  -t 20 -c:v libx264 -preset ultrafast -tune zerolatency -pix_fmt yuv420p -c:a aac \
  -f flv rtmp://127.0.0.1:1935/live/demo </dev/null >/tmp/srs-demo.log 2>&1 & disown
sleep 7
echo "== live streams (SRS HTTP API) =="
curl -s -u "admin:$PW" http://127.0.0.1/api/v1/streams/ | python3 -c 'import json,sys; d=json.load(sys.stdin); print("\n".join(f"{s[\"app\"]}/{s[\"name\"]}  {s[\"video\"][\"codec\"]} {s[\"video\"][\"width\"]}x{s[\"video\"][\"height\"]}" for s in d.get("streams",[])))'
echo "== HTTP-FLV delivery =="
curl -s -o /dev/null -w 'http://<host>/live/demo.flv -> %{http_code}\n' -u "admin:$PW" http://127.0.0.1/live/demo.flv
echo "== HLS delivery (master playlist) =="
curl -s -u "admin:$PW" http://127.0.0.1/live/demo.m3u8

== live streams (SRS HTTP API) ==
live/demo  H264 1280x720
== HTTP-FLV delivery ==
http://<host>/live/demo.flv -> 200
== HLS delivery (master playlist) ==
#EXTM3U
#EXT-X-STREAM-INF:BANDWIDTH=1,AVERAGE-BANDWIDTH=1
/live/demo.m3u8?hls_ctx=...

In the console, the Streams tab lists every live stream with its status, client count, inbound and outbound bitrate, and video and audio codecs.

Step 4 - Play the stream back

Open the bundled player at http://<instance-public-ip>/players/srs_player.html, set the URL to your stream (for example http://<instance-public-ip>/live/livestream.flv for HTTP-FLV, or the .m3u8 URL for HLS) and click Play. The player also has WHEP and WebRTC tabs for sub-second latency playback.

The same stream is available simultaneously in multiple protocols:

Step 5 - Query the HTTP API

The SRS HTTP API reports server, stream, client and version information as JSON, protected by the same per-instance password. For example, check the server version and list clients:

PW=$(sudo grep '^SRS_ADMIN_PASSWORD=' /root/srs-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" http://127.0.0.1/api/v1/versions
echo
curl -s -o /dev/null -w 'clients endpoint -> %{http_code}\n' -u "admin:$PW" http://127.0.0.1/api/v1/clients/

{"code":0,"server":"...","data":{"major":6,"minor":0,"revision":0,"version":"6.0.0"}}
clients endpoint -> 200

Where things live

WebRTC and public IP

WebRTC media requires the instance to advertise a reachable public IP as its ICE candidate. First boot resolves the instance public IP automatically and writes it into the SRS configuration. AWS assigns a new public IP when an instance is stopped and started, so for a production WebRTC deployment attach an Elastic IP so the address is stable. If the public IP ever changes, re-run first boot to re-template it:

sudo rm -f /var/lib/cloudimg/srs-firstboot.done
sudo systemctl start srs-firstboot.service

Enabling HTTPS (recommended for production)

The image serves plain HTTP on port 80. For production, put the instance behind TLS - either terminate HTTPS at an AWS Application Load Balancer with an ACM certificate, or install a certificate directly in nginx for your domain. Port 443 is already open in the security group. Restrict inbound access to the RTMP (1935) and HTTP (80) ports to trusted networks or publishers.

Support

24/7 technical support is available from cloudimg by email and chat. We can help with deployment, reverse-proxy and HTTPS configuration, RTMP, SRT and WebRTC publishing, HLS and low latency tuning, recording and storage, and upgrade planning.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.