In previous posts “Steps to configure Dehydrated for ZeroSSL and Let’s Encrypt” and “Steps to configure Dehydrated for ZeroSSL and Let’s Encrypt for One IP and multiple domains”
We saw how we can create a certificate for our domains.
Now will see step by step how we can create our own radio station using a dynamic domain and the certificates we had created.
I try to be as simple as i can and most work can be done by copy and paste.
First have to create a dynamic domain e.g. on noip.me lets use for this "how to" the foo.ddns.net
we have to open on our router the ports 80 for httpd, 8000 for icecast, 443 for ssl, 8443 secure port for icecast
I have build for salix 64 bit the packages because packages i use for slackel do not run on salix of course.
Download and install icecast package, libigloo and
install rhash
sudo slapt-get -i rhash
Download and install mpd package
Download and install mympd package
Optional install libmpdclient
sudo slapt-get -i libmpdclient
and Download mpc and install it
On slackel we just do this to install the packages
sudo slapt-get -u
sudo slapt-get -i icecast mpd mympd
Replace the /etc/icecast.xml with this
<icecast>
<location>Greece</location>
<admin>admin</admin>
<limits>
<clients>100</clients>
<sources>2</sources>
<queue-size>524288</queue-size>
<client-timeout>30</client-timeout>
<header-timeout>15</header-timeout>
<source-timeout>10</source-timeout>
<burst-size>65535</burst-size>
</limits>
<authentication>
<source-password>hackme</source-password>
<relay-password>hackme</relay-password>
<admin-user>admin</admin-user>
<admin-password>hackme</admin-password>
</authentication>
<yp-directory url="https://dir.xiph.org/cgi-bin/yp-cgi">
<option name="timeout" value="15" />
</yp-directory>
<hostname>foo.ddns.net</hostname> <!-- replace foo.ddns.net with you own domain -->
<fileserve>1</fileserve>
<listen-socket>
<port>8000</port>
<shoutcast-mount>/live</shoutcast-mount>
<charset>UTF-8</charset>
</listen-socket>
<mount type="default">
<mount-name>/live</mount-name>
<charset>UTF-8</charset>
</mount>
<listen-socket>
<port>8443</port>
<shoutcast-mount>/live</shoutcast-mount>
<charset>UTF-8</charset>
<ssl>1</ssl>
</listen-socket>
<http-headers>
<header name="Access-Control-Allow-Origin" value="*" />
<header name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Content-Type, Accept" />
<header name="Access-Control-Allow-Methods" value="GET, OPTIONS" />
</http-headers>
<paths>
<basedir>/usr/share/icecast</basedir>
<logdir>/var/log/icecast</logdir>
<webroot>/usr/share/icecast/web</webroot>
<adminroot>/usr/share/icecast/admin</adminroot>
<alias source="/" dest="/status.xsl"/>
</paths>
<logging>
<accesslog>access.log</accesslog>
<errorlog>error.log</errorlog>
<loglevel>3</loglevel> <!-- 4 Debug, 3 Info, 2 Warn, 1 Error -->
<logsize>10000</logsize>
</logging>
<security>
<chroot>0</chroot>
<changeowner>
<user>nobody</user>
<group>nogroup</group>
</changeowner>
<tls-context>
<!-- The certificate file containng public and optionally private key.
Must be PEM encoded. -->
<tls-certificate>/etc/icecast2/bundle.pem</tls-certificate>
<!-- The private key if not contained in <tls-certificate>.
Must be PEM encoded. -->
<!-- <tls-key>/etc/icecast2/privkey.pem</tls-key> -->
</tls-context>
</security>
</icecast>
you can change the /live with /whatever_mount_you like
Create the certification key for icecast secure connection.The fullchain.pem and privkey.pem we have created on
previous posts “Steps to configure Dehydrated for ZeroSSL and Let’s Encrypt for One IP and multiple domains”
or “Steps to configure Dehydrated for ZeroSSL and Let’s Encrypt”
for foo.ddns.net, have to be copied in bundle.pem (we use it in icecast.xml above in line /etc/icecast2/bundle.pem
mkdir -p /etc/icecast2
cat /etc/dehydrated/certs-letsencrypt/foo.ddns.net/fullchain.pem /etc/dehydrated/certs-letsencrypt/foo.ddns.net/privkey.pem > /etc/icecast2/bundle.pem
chown nobody:nogroup /etc/icecast2/*
chmod 600 /etc/icecast2/*
Set up mpd client.
Copy this to /etc/mpd.conf
music_directory "~/music"
playlist_directory "~/.mpd/playlists"
db_file "~/.mpd/database"
log_file "~/.mpd/log"
pid_file "~/.mpd/pid"
state_file "~/.mpd/state"
sticker_file "~/.mpd/sticker.sql"
## Replace myuser with yours mpd has to run as current user and no root
user "myuser"
# For network
bind_to_address "localhost"
port "6600"
restore_paused "no"
metadata_to_use "artist,album,title"
auto_update "yes"
default_permissions "read,add,control,admin"
audio_output {
type "shout"
encoder "vorbis"
name "My Radio"
host "localhost"
port "8000"
mount "/live"
password "hackme"
bitrate "128"
format "44100:16:2"
description "Greek - Rock" # optional
genre "Greek GREEK greek Greece greece"
public "yes"
mixer_type "software"
}
filesystem_charset "UTF-8"
replace in the line user “myuser” the “myuser” with your “username” you log in.
name “My Radio”
description “Greek – Rock” # optional
genre “Greek GREEK greek Greece greece ” with whatever you like
Set up mympd web UI client for mpd. I have created a script which automatically set up mympd with your radio domain.
sudo RADIO="https://foo.ddns.net" sh /usr/src/mympd/config-helper.sh
Set apache
Edit /etc/httpd/httpd.conf
Be sure the lines to be uncommented
Listen 80
LoadModule proxy_module lib64/httpd/modules/mod_proxy.so
LoadModule proxy_http_module lib64/httpd/modules/mod_proxy_http.so
LoadModule proxy_wstunnel_module lib64/httpd/modules/mod_proxy_wstunnel.so
LoadModule rewrite_module lib64/httpd/modules/mod_rewrite.so
LoadModule ssl_module lib64/httpd/modules/mod_ssl.so
Include /etc/httpd/extra/httpd-vhosts.conf
Include /etc/httpd/mod_php.conf
And this line to be commented
#Include /etc/httpd/extra/httpd-ssl.conf
Also look for these lines to be as bellow.
<IfModule dir_module>
DirectoryIndex index.html index.php
</IfModule>
Edit /etc/httpd/extra/httpd-vhosts.conf and replace all with these lines
# Virtual Hosts
#
# Required modules: mod_log_config
# If you want to maintain multiple domains/hostnames on your
# machine you can setup VirtualHost containers for them. Most configurations
# use only name-based virtual hosts so the server doesn't need to worry about
# IP addresses. This is indicated by the asterisks in the directives below.
Listen 443
SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
SSLHonorCipherOrder on
SSLProtocol all -SSLv3
SSLProxyProtocol all -SSLv3
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/var/run/ssl_scache(512000)"
SSLSessionCacheTimeout 300
####
<VirtualHost *:80>
ServerAdmin webmaster@foo.ddns.net
DocumentRoot "/srv/httpd/htdocs"
ServerName foo.ddns.net
ErrorLog "/var/log/httpd/foo.ddns.net-error_log"
CustomLog "/var/log/httpd/foo.ddns.net-access_log" common
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
#RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</VirtualHost>
<VirtualHost *:443>
DocumentRoot "/srv/httpd/htdocs/"
ServerName foo.ddns.net:443
ErrorLog "/var/log/httpd/foo.ddns.net-error_log"
CustomLog "/var/log/httpd/foo.ddns.net-access_log" common
SSLEngine on
SSLCertificateFile /etc/dehydrated/certs-letsencrypt/foo.ddns.net/cert.pem
SSLCertificateKeyFile /etc/dehydrated/certs-letsencrypt/foo.ddns.net/privkey.pem
SSLCertificateChainFile /etc/dehydrated/certs-letsencrypt/foo.ddns.net/chain.pem
RewriteEngine On
## --- myMPD Configuration ---
## Automatically add slash if user writes /mympd, then redirect to /mympd/
## The [R=301,L] makes a permanent redirect and stops processing here
RewriteRule ^/mympd$ /mympd/ [R=301,L]
## 1. myMPD Interface
<Location /mympd>
# We want a password for user admin, to not let anyone to log in to mympd UI
# Password set with "sudo htpasswd -c /etc/httpd/.htpasswd admin"
AuthType Basic
AuthName "myMPD Control"
AuthUserFile /etc/httpd/.htpasswd
Require valid-user
ProxyPass http://127.0.0.1:8081
ProxyPassReverse http://127.0.0.1:8081
</Location>
# 2. myMPD WebSockets (Necessary for UI)
<Location /mympd/ws>
ProxyPass ws://127.0.0.1:8081/ws
ProxyPassReverse ws://127.0.0.1:8081/ws
</Location>
# 3. static files (Required for page rendering)
<Location /mympd/static>
ProxyPass http://127.0.0.1:8081
ProxyPassReverse http://127.0.0.1:8081
</Location>
</VirtualHost>
Create a password for user admin so only admin (you) can log in to mympd web UI
sudo htpasswd -c /etc/httpd/.htpasswd admin
Start httpd (apache)
sudo killall httpd
sudo service start httpd
check if httpd is running
ps ax |grep httpd
4759 pts/2 S+ 0:00 grep httpd
12079 ? Ss 0:03 /usr/sbin/httpd -k start
12080 ? Sl 0:03 /usr/sbin/httpd -k start
12082 ? Sl 0:03 /usr/sbin/httpd -k start
12136 ? Sl 0:02 /usr/sbin/httpd -k start
12304 ? Sl 0:04 /usr/sbin/httpd -k start
Start icecast
sudo service start icecast
start mpd
sudo service start mpd
start mympd
sudo service start mympd
check if icecast is running
ps ax |grep icecast
1610 ? Sl 0:23 /usr/bin/icecast -c /etc/icecast.xml -b
we see icecast is running using /etc/icecast.xml config
check if mpd, mympd are running
ps ax |grep mpd
1714 ? Ssl 14:40 /usr/bin/mpd /etc/mpd.conf
1791 ? S 0:00 su -s /bin/sh -c /usr/bin/mympd -w /var/lib/mympd -a /var/lib/mympd/cache mympd
1793 ? Ssl 0:00 /usr/bin/mympd -w /var/lib/mympd -a /var/lib/mympd/cache
we see mpd is running using /etc/mpd.conf config file and mympd is running also as user mympd which created from config-helper.sh script above.
check in which ports icecast, mpd, mympd are listening (I got these from my icecast, mpd, mympd used for my radio station to show the output of commands)
sudo netstat -anpt | grep 'icecast'
we see icecast is listening on 8000, 8443 from outside 127.0.0.1:8000 is our inside port
tcp6 0 0 :::8000 :::* LISTEN 1610/icecast
tcp6 0 0 :::8001 :::* LISTEN 1610/icecast
tcp6 0 0 :::8444 :::* LISTEN 1610/icecast
tcp6 0 0 :::8443 :::* LISTEN 1610/icecast
tcp6 0 0 192.168.1.210:8443 85.75.211.110:43202 ESTABLISHED 1610/icecast
tcp6 0 0 127.0.0.1:8000 127.0.0.1:39658 ESTABLISHED 1610/icecast
192.168.1.210:8443 is my local ip to secure port 8443 and 85.75.211.110 is my dynamic ip i get from my host provider this is the ip of my meraklis.ddns.net domain so when user type on firefox https://meraklis.ddns.net as we see bellow they are listening to my “Meraklis Radio”
or typing https://meraklis.ddns.net:8443/live on vlc or smplayer or exaile they llisten to “My Radio” station. Same for http://meraklis.ddns.net:8000/live unsecured connection used by https://dir.xiph.org/ radios directory
sudo netstat -anpt |grep mpd
tcp 0 0 127.0.0.1:6600 0.0.0.0:* LISTEN 1714/mpd
tcp 0 0 127.0.0.1:6600 127.0.0.1:50884 ESTABLISHED 1714/mpd
tcp 0 0 127.0.0.1:39658 127.0.0.1:8000 ESTABLISHED 1714/mpd
we see that mpd is listening in its default port 6600. And port 8000 send to icecast media server the streaming to go outside to internet
sudo netstat -anpt |grep mympd
tcp 0 0 127.0.0.1:8081 0.0.0.0:* LISTEN 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:34994 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:52924 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:56132 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:33188 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:50882 127.0.0.1:6600 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:50884 127.0.0.1:6600 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:38972 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:35334 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:56130 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:41094 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:35022 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:38970 ESTABLISHED 1793/mympd
tcp 0 0 127.0.0.1:8081 127.0.0.1:34992 ESTABLISHED 1793/mympd
we see mympd is listening to internal port 8081 we do not need this port to be opened
If you have created your playlists then typing on Firefox
https://foo.ddns.net/mympd
you will see mympd interface from where can add playlists or songs to play in random or single mode etc
Your stream url is https://foo.ddns.net:8443/live or insecure http://foo.ddns.net:8000
https://foo.ddns.net:8443 goes to icecast web interface where can log in as administrator using username:admin and pass:hackme
typing https://foo.ddns.net/mympd on you mobile phone can control your radio from where you are.
also for listen from you phone type https://foo.ddns.net:8443/live
or for icecast web type https://foo.ddns.net:8443 or http://foo.ddns.net:8000
These https://foo.ddns.net:8443/live or http://foo.ddns.net:8000/live can be used on vlc or smplayer or exaile to listen to your radio from outside on internet.
To have users to listen to your radio without to type https://foo.ddns.net:8443/live just https://foo.ddns.net
copy these to /var/www/htdocs/index.html
####### index.html ############
<!-- Created by Dimitris Tzemos - Mar 2026 -->
<!DOCTYPE html>
<html lang="en">
<head>
<!-- Primary Meta Tags -->
<title>My Radio - Live Rock, folk | foo.ddns.net</title>
<link rel="shortcut icon" href="/favicon.ico" />
<link rel="canonical" href="https://foo.ddns.net">
<meta name="title" content="My Radio - Live Rock">
<style>
body {
background-color: #006400; /* The dark green you chose */
color: #ffffff; /* White letters to be read everywhere */
margin: 0;
padding: 40px; /* A little more space to "breathe" the page */
font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
min-height: 100vh;
text-align: center; /* Centering to make the radio look nice */
}
h2 {
font-size: 1.8em;
color: #ffffff; /* I changed #333 to white to make it visible */
margin-bottom: 10px;
}
p {
font-size: 1.1em;
opacity: 0.9; /* Slightly softer white for the text */
}
/* Style for the player container */
#muses-container {
margin-top: 30px;
display: inline-block; /* To center correctly */
</style>
<style>
.music-widget {
background: rgba(255, 255, 255, 0.1);
backdrop-filter: blur(10px); /* Blur effect */
border: 1px solid rgba(255, 255, 255, 0.2);
border-radius: 15px;
padding: 20px;
display: inline-block;
font-family: 'Segoe UI', Roboto, sans-serif;
color: #333;
box-shadow: 0 8px 32px 0 rgba(31, 38, 135, 0.15);
text-align: center;
min-width: 300px;
}
.widget-header {
font-size: 1.8rem;
text-transform: uppercase;
letter-spacing: 2px;
color: #888;
margin-bottom: 8px;
}
.widget-info {
font-size: 1.1rem;
text-transform: uppercase;
letter-spacing: 2px;
color: #888;
margin-bottom: 8px;
}
.radiostation-title {
font-size: 1.1rem;
font-weight: 700;
text-transform: uppercase;
background: linear-gradient(45deg, #2c3e50, #000000);
-webkit-background-clip: text;
-webkit-text-fill-color: transparent;
text-shadow: 2px 2px 4px rgba(0,0,0,0.1);
}
.info-title {
font-size: 0.85rem;
font-weight: 700;
text-transform: uppercase;
background: linear-gradient(45deg, #2c3e50, #000000);
-webkit-background-clip: text;
-webkit-text-fill-color: transparent;
text-shadow: 2px 2px 4px rgba(0,0,0,0.1);
}
#stream-info {
font-size: 1.0rem;
font-weight: 700;
text-transform: uppercase;
background: linear-gradient(45deg, #2c3e50, #000000);
-webkit-background-clip: text;
-webkit-text-fill-color: transparent;
text-shadow: 2px 2px 4px rgba(0,0,0,0.1);
}
#radio-title {
font-size: 1.0rem;
font-weight: 700;
text-transform: uppercase;
background: linear-gradient(45deg, #2c3e50, #000000);
-webkit-background-clip: text;
-webkit-text-fill-color: transparent;
text-shadow: 2px 2px 4px rgba(0,0,0,0.1);
}
#title {
font-size: 1.0rem;
font-weight: 700;
text-transform: uppercase;
background: linear-gradient(45deg, #2c3e50, #000000);
-webkit-background-clip: text;
-webkit-text-fill-color: transparent;
text-shadow: 2px 2px 4px rgba(0,0,0,0.1);
}
#artist {
font-size: 1.0rem;
font-weight: 700;
text-transform: uppercase;
background: linear-gradient(45deg, #2c3e50, #000000);
-webkit-background-clip: text;
-webkit-text-fill-color: transparent;
text-shadow: 2px 2px 4px rgba(0,0,0,0.1);
}
</style>
</head>
<body>
<h2 style="font-size: 1.2em; color: #ffffff;">The radio for music lovers</h2>
<p>Welcome to <strong>My Radio</strong>, the station that honors <strong>good singing.</strong></p>
<div id="muses-container">
<!-- BEGINS: AUTO-GENERATED MUSES RADIO PLAYER CODE -->
https://hosted.muses.org/mrp.js
<script type="text/javascript">
MRP.insert({
'url':'https://foo.ddns.net:8443/live', <!-- Replace foo.ddns.net with your own domain -->
'codec': 'mp3',
'volume':65,
'autoplay':true,
'forceHTML5':true,
'jsevents':true,
'buffering':0,
'metadataInterval': 15,
'title':'My Radio',
'welcome':'Welcome to...',
'lang':'en',
'wmode':'transparent',
'skin':'oldradio',
'includeInLayout': true,
'width':205,
'height':132
});
</script>
<!-- ENDS: AUTO-GENERATED MUSES RADIO PLAYER CODE -->
</div>
<!-- ######################## For proxy.php ########################################################
## which shows a transparent rectangle where the title of current playing song appears ## -->
<br>
<div class="music-widget">
<div class="radiostation-title">My Radio</div>
<div class="info-title">Now it's playing...</div>
<div id="stream-info">Loading...</div>
</div>
<script>
const ICECAST_URL = "proxy.php";
const MOUNT_POINT = "/live";
async function updateSong() {
try {
const response = await fetch(ICECAST_URL);
const data = await response.json();
// Finding the source (source)
const sources = data.icestats.source;
let currentSource;
if (Array.isArray(sources)) {
currentSource = sources.find(s => s.mount === MOUNT_POINT);
} else {
currentSource = sources;
}
if (currentSource && currentSource.title) {
document.getElementById('stream-info').innerText = currentSource.title;
}
// Add check if mount point actually exists in the data
if (currentSource && currentSource.title) {
const songTitle = currentSource.title;
// Avoid unnecessary updates to the DOM if the title has not changed
if (document.getElementById('stream-info').innerText !== songTitle) {
document.getElementById('stream-info').innerText = songTitle;
}
} else {
document.getElementById('stream-info').innerText = "On air...";
}
} catch (error) {
console.error("Connection error:", error);
}
}
// Run every 10 seconds
setInterval(updateSong, 10000);
updateSong(); // First run immediately
</script>
</body>
</html>
17.1 copy the lines bellow to /var/www/htdocs/proxy.php
proxy.php shows a transparent rectangle where the title of current playing song appears
<?php
// We allow the browser to read the data (CORS)
header("Access-Control-Allow-Origin: *");
header("Content-Type: application/json; charset=utf-8");
// Τhe full URL of your Icecast statistics
$url = "https://foo.ddns.net:8443/status-json.xsl"; // replace foo.ddns.net with you own domain
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Important for ddns/self-signed SSL
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 10.0; Win64; x64)");
$response = curl_exec($ch);
curl_close($ch);
// If Icecast returns JSON in a callback or has spaces, we clean it up
echo trim($response);
?>
To see how this index.html is looking and also the result of all these above click in this linkMy Radio to listen to “My Radio” we have created.
To see the “My Radio” running on my laptop, i have changed the foo.ddns.net to meraklis.ddns.net and also i discovered that running two instances of icecast, mpd and mympd with different configurations can have two stations to stream different songs under the same dynamic ip.
Furthermore can create some php pages and a mysql database where listeners can send you radio orders to play. If anyone is interesting can tell me to send or post here the php files and details. You can see the admin_radio_orders page in the admin_orders-img2.png admin_orders-img3.png on the screenshots link bellow.
The two radio stations My Radio created for this post and Meraklis Radio are running on my lenovo laptop 8GB RAM and from a 64GB USB stick where slackel is installed (real installation), two years ago, which upgraded to latest updates almost every day because of slackware current tree.
More screenshots
"My Radio" station we created streaming
MyMPD web UI
icecast media server web UI
Top comments (0)