MoQtail
MoQtail is available in the NetActuate Marketplace as a one-click, open-source appliance you can deploy into any NetActuate PoP. Standards-track Media over QUIC (IETF draft-16) relay for low-latency live media. It is grouped under the Media & Streaming category.
What It Does
MoQtail is a standards-track Media over QUIC (MoQ) relay. It implements the IETF moq-transport draft-16 (advertising the moqt-16 and h3 ALPNs) and moves live media between publishers and subscribers over QUIC and WebTransport with low latency. If you want to run the emerging MoQ transport on infrastructure you control, MoQtail is the standards-track relay option.
Key features
- Media over QUIC relay implementing the IETF moq-transport draft-16
- QUIC + WebTransport transport (single UDP port), with raw-QUIC and browser clients
- Low-latency fan-out of live media between publishers and subscribers
- Ships the official, unmodified upstream MoQtail relay (Apache-2.0)
- Self-signs a TLS certificate at first boot so the relay runs immediately
- Fail-closed first-boot self-check: reports healthy only once the relay is actually running and its UDP port is bound
Use cases
- Experiment with and deploy the emerging Media over QUIC transport
- Low-latency live media distribution over QUIC/WebTransport at the edge
- A standards-track MoQ relay to pair with the MoQtail demo player and clients
Why run it on the NetActuate edge MoQ rides on QUIC/UDP, so placing the relay in a PoP close to your publishers and viewers shortens the network path and cuts latency for live media, on infrastructure you control. This is a headless transport appliance: it binds a single UDP port for QUIC (default 4433) and a co-located landing page on the management port documents the relay endpoint, the UDP/cert requirement, and the relay self-check. There is no web console and no login. The appliance boots with a self-signed certificate so the relay starts; real browser playback with the demo player needs a customer domain and a trusted TLS certificate (or a WebTransport certificate-hash pin).
Vendor and Project
MoQtail is an open-source project, offered here under the Open Source listing with best-effort community support.
- Project home: github.com
NetActuate supports the underlying infrastructure. Application-level support follows the listing SLA class (open-source, best effort).
Sizing
| vCPU | RAM | Disk | |
|---|---|---|---|
| Minimum | 1 | 1 GB | 20 GB |
| Recommended | 2 | 2 GB | 20 GB |
No VPU (hardware acceleration) is required for this appliance. Choose a size at deploy based on your expected load.
Configuration Fields
When you deploy, you provide these fields. They are written into the appliance at first boot.
| Field | Required | Default | Notes |
|---|---|---|---|
| Landing page port | No | 8080 | Port the static landing/instructions page is served on, published on the instance IP (default 8080). MoQtail is a headless MoQ relay; this page documents the relay endpoint and reports the relay self-check. |
| Relay UDP port | No | 4433 | UDP port the Media over QUIC / WebTransport relay binds (QUIC, default 4433). Open this UDP port to your clients. |
| Announced host | No | none | Optional hostname or IP printed in the client endpoint URLs and placed in the self-signed certificate SAN (e.g. relay.example.com). Defaults to the instance IPv4. Real browser playback needs a customer domain + trusted cert. |
Using the Appliance
Reach the relay in minutes
- Confirm the relay is healthy. Browse to http://YOUR_VM_IP:8080/ . The landing page confirms the appliance is up and reports the relay self-check (it shows moqtail-relay-ok once the relay is running and its UDP port is bound).
- Point clients at the relay endpoint. MoQ / WebTransport clients connect over UDP to https://YOUR_VM_IP:4433 (WebTransport) or moqt://YOUR_VM_IP:4433 (raw QUIC). Make sure UDP port 4433 is open to your clients.
- For browser playback, add a real certificate. The appliance self-signs a certificate so the relay starts, but browsers reject a self-signed WebTransport certificate unless you pin its hash. Set mkt_announced_host to your domain and put a trusted TLS certificate on it (or supply a WebTransport certificate-hash pin) before using the demo player.
Exposure posture: the only TCP/HTTP surface is the read-only landing/instructions page; the relay itself is UDP/QUIC. There is no web console and no login.
FAQ
Is there a software license fee? No. MoQtail is open source and free to run. You pay only for the NetActuate infrastructure and bandwidth.
Which port does the appliance serve on?
The primary service is published on port 8080 by default; see the configuration fields for any adjustable ports.
Who supports it? NetActuate operates the underlying infrastructure. The application itself is community-supported open source (best-effort SLA class).
Version and Changelog
| Version | Status | Released |
|---|---|---|
| 0.14.0 | Current (default) | 2026-07-14 |
Deploy
- Deploy in the portal: Deploy MoQtail
- View the listing: portal.netactuate.com/platform/marketplace/l/moqtail
- Public listing: netactuate.com/marketplace/moqtail
Need Help?
Contact support@netactuate.com or open a support ticket from the portal.