Download Cinarox

Ubuntu 24.04 or newer, Debian 12 and 13, amd64

1. 1

   Add the Cinarox APT repository

   Downloads the signing key and adds the source. apt checks every package against this key.

   bashCopy

   sudo apt update && sudo apt install -y curl gpg ca-certificates
   sudo install -d -m 0755 /etc/apt/keyrings
   curl -fsSL https://downloads.cinarox.com/apt/cinarox.asc \
     | sudo gpg --dearmor --yes -o /etc/apt/keyrings/cinarox.gpg
   sudo tee /etc/apt/sources.list.d/cinarox.sources > /dev/null <<'EOF'
   Types: deb
   URIs: https://downloads.cinarox.com/apt
   Suites: prod
   Components: main
   Architectures: amd64
   Signed-By: /etc/apt/keyrings/cinarox.gpg
   EOF
   sudo apt update

2. 2

   Install Cinarox

   One command installs the server, PostgreSQL and an own Redis instance and sets everything up.

   bashCopy

   sudo apt install cinarox

   The complete package cinarox needs the package source from step 1; it pulls cinarox-server and cinarox-redis along. For a cluster node or your own database see Server only below.

3. 3

   What the package sets up

   PostgreSQL: user and database cinarox with a random password. Redis: an own instance cinarox-redis on 127.0.0.1:6380 with a random password; the Redis of your distribution stays as it is. Both are entered in /etc/cinarox/config.yaml and Cinarox starts right away. On a machine that already has a database configured, nothing is changed.

4. 4

   Show the passwords

   The installation never prints a password, because apt keeps its whole output in a log file. The passwords are stored in /etc/cinarox/config.yaml; this command shows the database and Redis access:

   bashCopy

   sudo cinarox-credentials

5. 5

   Access to your media

   Your film and show folders are chosen later in the setup wizard. The service runs as user cinarox and needs read access to them:

   bashCopy

   sudo -u cinarox ls /srv/media/Movies    # must list your files
   sudo usermod -aG <group-of-your-media> cinarox  # if it says permission denied

6. 6

   Open the firewall

   Only the two Cinarox ports, for the devices that should reach the server. Example with ufw:

   bashCopy

   sudo ufw allow 8977/tcp    # HTTP: web app and the native apps
   sudo ufw allow 9977/tcp    # HTTPS, self-signed certificate
   # PostgreSQL (5432) and Redis (6380) stay closed: they only listen on 127.0.0.1

7. 7

   Run the setup wizard

   Open http://<server>:8977. The wizard creates the admin account, asks for your libraries and the TMDB key.

8. 8

   Logs

   In the journal and in /var/log/cinarox/cinarox.log (rotated daily). The admin area shows the same under Server → Logs.

   bashCopy

   sudo journalctl -u cinarox -f
   sudo tail -f /var/log/cinarox/cinarox.log

9. 9

   Updates

   New releases come with the normal system updates. Database migrations run automatically when the service starts.

   bashCopy

   sudo apt update && sudo apt upgrade

Docker Engine with Compose v2, linux/amd64

1. 1

   Create a folder

   Everything for the stack lives in one folder: docker-compose.yaml, .env and config.yaml.

   bashCopy

   mkdir cinarox && cd cinarox

2. 2

   Save docker-compose.yaml

   Cinarox, PostgreSQL 18 and Redis 7.4 with pinned versions, health checks, log rotation and volumes. Database and Redis get no host port.

   docker-compose.yamlCopy

   # docker-compose.yaml: Cinarox + PostgreSQL + Redis
   # Needs .env and config.yaml in the same folder.
   name: cinarox
   
   x-logging: &logging
     driver: json-file
     options:
       max-size: "10m"
       max-file: "3"
   
   services:
     # One-shot helper: makes config.yaml readable for the non-root
     # cinarox user (uid 100) in the image, then exits.
     config-perms:
       image: amslertec/cinarox:${CINAROX_VERSION:?set CINAROX_VERSION in .env}
       user: "0:0"
       entrypoint: ["sh", "-c", "chown 100:100 /cfg/config.yaml && chmod 0640 /cfg/config.yaml"]
       volumes:
         - ./config.yaml:/cfg/config.yaml
       restart: "no"
       logging: *logging
   
     cinarox:
       image: amslertec/cinarox:${CINAROX_VERSION:?set CINAROX_VERSION in .env}
       container_name: cinarox
       restart: unless-stopped
       ports:
         - "8977:8977"   # HTTP: web app and the native apps
         - "9977:9977"   # HTTPS: self-signed, created on first start
       environment:
         TZ: ${TZ:-Europe/Zurich}
       volumes:
         - ./config.yaml:/etc/cinarox/config.yaml:ro
         - cinarox-data:/var/lib/cinarox      # caches, images, TLS cert, master key
         - cinarox-logs:/var/log/cinarox
         - ${MEDIA_DIR:-/srv/media}:/media:ro # your films and shows, read-only
       # Hardware transcoding (VAAPI / Intel QSV) when the host has /dev/dri:
       # devices:
       #   - /dev/dri:/dev/dri
       depends_on:
         config-perms:
           condition: service_completed_successfully
         postgres:
           condition: service_healthy
         redis:
           condition: service_healthy
       logging: *logging
   
     postgres:
       image: postgres:18.6-alpine
       container_name: cinarox-postgres
       restart: unless-stopped
       environment:
         POSTGRES_USER: ${POSTGRES_USER:-cinarox}
         POSTGRES_DB: ${POSTGRES_DB:-cinarox}
         POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
         POSTGRES_INITDB_ARGS: "--auth-host=scram-sha-256 --data-checksums"
         TZ: ${TZ:-Europe/Zurich}
       volumes:
         - cinarox-postgres:/var/lib/postgresql
       healthcheck:
         test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
         interval: 10s
         timeout: 5s
         retries: 10
         start_period: 20s
       logging: *logging
       # no host port: only reachable inside the compose network
   
     redis:
       image: redis:7.4.11-alpine
       container_name: cinarox-redis
       restart: unless-stopped
       command: ["sh", "-c", "exec redis-server --requirepass \"$$REDIS_PASSWORD\" --appendonly yes"]
       environment:
         REDIS_PASSWORD: ${REDIS_PASSWORD:?set REDIS_PASSWORD in .env}
         REDISCLI_AUTH: ${REDIS_PASSWORD}
       volumes:
         - cinarox-redis:/data
       healthcheck:
         test: ["CMD", "redis-cli", "ping"]
         interval: 10s
         timeout: 5s
         retries: 10
       logging: *logging
   
   volumes:
     cinarox-data:
     cinarox-logs:
     cinarox-postgres:
     cinarox-redis:

3. 3

   Generate passwords, .env and config.yaml

   This block creates two random passwords and writes them into both files. The containers read .env, Cinarox reads only config.yaml, so the values must match.

   bashCopy

   PG_PASSWORD=$(openssl rand -hex 24)
   REDIS_PASSWORD=$(openssl rand -hex 24)
   cat > .env <<EOF
   CINAROX_VERSION=0.1.49
   TZ=Europe/Zurich
   MEDIA_DIR=/srv/media
   POSTGRES_USER=cinarox
   POSTGRES_DB=cinarox
   POSTGRES_PASSWORD=$PG_PASSWORD
   REDIS_PASSWORD=$REDIS_PASSWORD
   EOF
   cat > config.yaml <<EOF
   http:
     listen_addr: "0.0.0.0:8977"
     tls_listen_addr: "0.0.0.0:9977"
     public_url: "http://$(hostname -I | awk '{print $1}'):8977"
   database:
     dsn: "postgres://cinarox:$PG_PASSWORD@postgres:5432/cinarox?sslmode=disable"
   redis:
     addr: "redis:6379"
     password: "$REDIS_PASSWORD"
     db: 0
   auth:
     jwt_secret: ""
   media:
     transcode_dir: /var/lib/cinarox/transcode
     cache_dir: /var/lib/cinarox/cache
   cluster:
     node_name: "primary"
   EOF
   chmod 600 .env config.yaml

   The resulting .env looks like this. Set MEDIA_DIR to the folder with your films and shows; in the wizard it appears as /media.

   .envCopy

   # .env: read by docker compose, never by Cinarox itself
   CINAROX_VERSION=0.1.49
   TZ=Europe/Zurich
   MEDIA_DIR=/srv/media
   POSTGRES_USER=cinarox
   POSTGRES_DB=cinarox
   POSTGRES_PASSWORD=<48 hex characters from openssl rand -hex 24>
   REDIS_PASSWORD=<48 hex characters from openssl rand -hex 24>

4. 4

   Start the stack

   Cinarox waits until PostgreSQL and Redis report healthy.

   bashCopy

   nano docker-compose.yaml        # paste the file from above
   docker compose pull
   docker compose up -d
   docker compose ps                # all three "healthy" / "running"
   docker compose logs -f cinarox   # wait for "http server listening"

5. 5

   Run the setup wizard

   Open http://<server>:8977 and allow ports 8977 and 9977 in the host firewall.

6. 6

   Update

   Set the new release in .env, pull and recreate. Migrations run on start.

   bashCopy

   sed -i 's/^CINAROX_VERSION=.*/CINAROX_VERSION=<new version>/' .env
   docker compose pull && docker compose up -d

7. 7

   Back up

   The database dump and the data volume with master.key. Keep both off the server.

   bashCopy

   # database dump (custom format, restore with pg_restore)
   docker compose exec -T postgres pg_dump -U cinarox -Fc cinarox > cinarox-$(date +%F).dump
   # master key, TLS certificate and caches: without master.key encrypted settings are lost
   docker run --rm -v cinarox_cinarox-data:/data:ro -v "$PWD":/backup alpine \
     tar czf /backup/cinarox-data-$(date +%F).tgz -C /data .
   # restore the database into an empty stack
   docker compose exec -T postgres pg_restore -U cinarox -d cinarox --clean < cinarox-<date>.dump