Skip to content

Commit 39cf5b5

Browse files
ZaarrgZaarrg
committed
Nginx Basic Auth for web,server and addons
- Added some possible solutions one might use to secure stremio server, stremio web and addons with a basic auth
1 parent 4bc1190 commit 39cf5b5

File tree

4 files changed

+254
-211
lines changed

4 files changed

+254
-211
lines changed

‎README.md

Lines changed: 55 additions & 211 deletions
Original file line numberDiff line numberDiff line change
@@ -4,241 +4,85 @@
44
- This is a fork of the original [stremio-docker rep](https://github.com/tsaridas/stremio-docker)
55
- This fork modifes the server.js and adds the ability to define a prefix
66
- This Prefix can be added with the env URL_PREFIX
7+
- This solution will probably not work.
8+
- Recommended is trying [nginx conf](https://github.com/Zaarrg/stremio-docker-prefix#nginx-setup) first.
79

810
| Env | Default | Example | Description |
911
| - | - |-------------------|----------------------------------|
1012
| `URL_PREFIX` | - | `/stremio-server` | Sets a url prefix for the server |
1113

1214

13-
## Introduction
15+
## Nginx Setup
16+
17+
There are two ways to setup nginx. Everything here was setup using the [stremio-docker](https://github.com/tsaridas/stremio-docker) image.
1418

15-
[Stremio](https://www.stremio.com/) is a free application which lets you stream your favorite shows and movies.
1619

17-
The Docker images in this repository bundle stremio-server, ffmpeg and web player for you, ready to use in a small Alpine image.
20+
#### 1. Using a prefix
1821

19-
My motivation for doing this is having it running on my RPi5 and couldn't find something that has both player and server but also the official image seemed too big but also lacks the Web Player and doesn't work out of the box if no HTTPS is configured.
22+
```nginx configuration
23+
# Stremio-specific route
24+
location /stremio-server/ {
25+
# Strip stremio-server
26+
rewrite ^/stremio-server/(.*) /$1 break;
2027
21-
## Features
22-
Idea here is to have both Stremio web player and server run on the same container and if IPADDRESS env variable is setup generate a certificate and use it for both.
23-
24-
The Web player runs on port 8080 and server runs on both ports 11470 ( plain http ) and 12470 (https).
25-
26-
-----
27-
28-
1) If you exposed the ports 8080, 11470 for HTTP just point your streaming server (http://{LAN IP}:8080/) in settings to the lan ip address and set the server to be http://{LAN IP}:11470/ and enjoy. Make sure you set NO_CORS=1 with this option.
29-
30-
This is the easy option since there is **no need to setup dns or have an external ip. Do not set the IPADDRESS env variable** if you just want HTTP. You do not need to expose port 12470 with this option but you will only be able to use the webplayer with HTTP.
31-
32-
-----
33-
34-
2) If you set your public IP address for the `IPADDRESS` environment variable, then the Stremio server should automatically set the certificate to the wildcard `*.519b6502d940.stremio.rocks` and should generate an A record for your public IP address. You should then expose ports 8080 and 12470 to your servers and then setup port forwarding to your router to point these two ports to your server. Once this is done you can point the WebPlayer to your streaming server on port 12470.
35-
36-
To find the FQDN that the certificate is pointing to, look at the folder you mounted for a file with a `.pem` extension. The filename is the domain you need to add your your hosts in case of local ip address.
37-
38-
-----
39-
40-
3) If you set IPADDRESS to your private ip address then the server should still set the certificate to the wildcard *.519b6502d940.stremio.rocks and have the subdomain set as 192-168-1-10 assuming your private is 192.168.1.10. Full domain should look like 192-168-1-10.519b6502d940.stremio.rocks. You can then setup your /etc/hosts in Linux or c:\Windows\System32\Drivers\etc\hosts in windows to point that host to your lan address like :
41-
42-
```bash
43-
192.168.1.10 192-168-1-10.519b6502d940.stremio.rocks # this is an example. set your own ip and fqnd here.
28+
proxy_pass http://stremio-container:11470;
29+
}
4430
```
31+
- The **Streaming Server URL** would be https://stremio.mydomain.com/stremio-server/
32+
- If this does not work and videos for example dont play then you can try by explicitly allowing all routes the server might call.
33+
- You can also find all routes in [server-routes.md](https://github.com/Zaarrg/stremio-docker-prefix/blob/main/server-routes.md)
34+
- You can find a example.conf [here](https://github.com/Zaarrg/stremio-docker-prefix/blob/main/nginx-prefix.conf)
4535

46-
Then you can point your browser to https://192-168-1-10.519b6502d940.stremio.rocks:8080 and setup Streaming server to https://192-168-1-10.519b6502d940.stremio.rocks:12470 .
36+
#### 2. Explicitly allowing (Recommended)
4737

38+
```nginx configuration
39+
# Stremio-specific routes
40+
location ~ ^/(hlsv2|casting|local-addon|proxy|rar|zip|settings|create|removeAll|samples|probe|subtitlesTracks|opensubHash|subtitles|network-info|device-info|get-https|hwaccel-profiler|status|exec|stream) {
41+
proxy_pass http://stremio-container:11470;
42+
}
4843
49-
To find the FQDN that the certificate is pointing to, look at the folder you mounted for a file with a `.pem` extension. The filename is the domain you need to add your your hosts in case of local ip address.
44+
location ~ ^/([^/]+)/(stats\.json|create|remove|destroy) {
45+
proxy_pass http://stremio-container:11470;
46+
}
5047
51-
-----
48+
location ~ ^/([^/]+)/([^/]+)/(stats\.json|hls\.m3u8|master\.m3u8|stream\.m3u8|dlna|thumb\.jpg) {
49+
proxy_pass http://stremio-container:11470;
50+
}
5251
53-
## Thoughts
52+
location ~ ^/([^/]+)/([^/]+)/(stream-q-[^/]+\.m3u8|stream-[^/]+\.m3u8|subs-[^/]+\.m3u8) {
53+
proxy_pass http://stremio-container:11470;
54+
}
5455
55-
You don't need to have both Stremio Server and Web Player running. One could use the Stremio web player ([https://app.strem.io/#/](https://app.strem.io/#/)). Stremio's web player should also work for options 2 and 3 above because the web player requires that the server's URL is in HTTPS.
56+
location ~ ^/([^/]+)/([^/]+)/(stream-q-[^/]+|stream-[^/]+)/[^/]+\.(ts|mp4) {
57+
proxy_pass http://stremio-container:11470;
58+
}
5659
57-
You can also use the native clients for options 2-3 since they use https but those clients also run a server so there is no point doing this.
60+
location ~ ^/yt/([^/]+)(\.json)? {
61+
proxy_pass http://stremio-container:11470;
62+
}
5863
59-
Another option is to use an External Media player like VLC or any other supported by stremio to avoid transcoding on the docker container. This would help if you don't have GPU transcoding or some other good CPU.
60-
61-
## Shell
62-
63-
I added stremio shell html files under http(s)://{Your stremio url}:{port}/shell/ . One should be able to get the old online stremio version of the files that are in app.stremio.io. Defaults to the normal webplayer on the root "/". I have had issues playing youtube videos with these files though and I assume so will you.
64-
65-
## Requirements
66-
67-
* A host with Docker installed.
68-
69-
## Installation
70-
71-
### 1. Install Docker
72-
73-
If you haven't installed Docker yet, install it by running:
74-
75-
```bash
76-
$ curl -sSL https://get.docker.com | sh
77-
$ sudo usermod -aG docker $(whoami)
78-
$ exit
64+
location = /(thumb\.jpg|stats\.json) {
65+
proxy_pass http://stremio-container:11470;
66+
}
7967
```
68+
- The **Streaming Server URL** would be https://stremio.mydomain.com/
69+
- This solution should always work.
70+
- You can find a example.conf [here](https://github.com/Zaarrg/stremio-docker-prefix/blob/main/nginx-example.conf)
71+
- This also allows for the **Stremio Web URL** and **Streaming Server URL** to be the same:
72+
- **Stremio Web URL** accessible at: https://stremio.mydomain.com/
73+
- **Streaming Server URL**: https://stremio.mydomain.com/
8074

81-
And log in again.
82-
83-
### 2. Run Stremio Web + Server
84-
85-
To automatically run stremio web player and server in http, simply run:
8675

87-
<pre>
88-
$ docker run -d \
89-
--name=stremio-docker \
90-
-e NO_CORS=1 \
91-
-v ~/.stremio-server:/root/.stremio-server \
92-
-p 8080:8080/tcp \
93-
-p 11470:11470/tcp \
94-
--restart unless-stopped \
95-
tsaridas/stremio-docker:latest
96-
</pre>
76+
## Basic Auth
77+
- With those solutions basic auth is as easy as adding it for the base domain https://stremio.mydomain.com/
78+
- Stremio Web, Stremio Server and any addons are on the same base url and will be therefor protected!
79+
- With basic auth simply visit Stremio Web login with basic auth and you are good to go!
9780

9881

99-
The Web UI will now be available on `http://`YOUR_SERVER_IP`:8080`. Set streaming server to `http://`YOUR_SERVER_IP`:11470` add your add ons and start watching your favourite movie.
100-
101-
> 💡 Your configuration files and cache will be saved in `~/.stremio-server`
102-
103-
## Options
104-
105-
These options can be configured by setting environment variables using `-e KEY="VALUE"` in the `docker run` command.
106-
107-
| Env | Default | Example | Description |
108-
| - | - | - | - |
109-
| `IPADDRESS` | - | `192.168.1.10` | Set this to enable https |
110-
| `NO_CORS` | - | `1` | Set to disable server's cors |
111-
| `CASTING_DISABLED` | - | `1` | Set to disable casting |
112-
| `WEBUI_LOCATION` | - | `http://192.168.1.10:8080` | Sets the redirect page for web player and automatically sets up streaming server for you when one tries to access server at port 11470 or 12470. Default is https://app.strem.io/shell-v4.4/ |
113-
| `FFMPEG_BIN` | - | `/usr/bin/` | Set for custom ffmpeg bin path |
114-
| `FFPROBE_BIN` | - | `/usr/bin/` | Set for custom ffprobe bin path |
115-
| `APP_PATH` | - | `/srv/stremio-path/` | Set for custom path for stremio server. Server will always save cache to /root/.stremio-server though so its only for its config files. |
116-
117-
118-
There are multiple other options defined but probably best not settings any.
119-
120-
## Updating
121-
122-
To update to the latest version, simply run:
123-
124-
```bash
125-
docker stop stremio-docker
126-
docker rm stremio-docker
127-
docker pull tsaridas/stremio-docker:latest
128-
```
129-
130-
And then run the `docker run -d \ ...` command above again.
131-
132-
## FFMPEG
133-
134-
We build our own ffmpeg from jellyfin repo with version 4.4.1-4 This plays well and its what stremio officially supports.
135-
136-
### FFMPEG add configure options
137-
You could build your own image with extra ffmpeg configure options. Your new option will probably require that you have the -dev libraries installed for alpine.
138-
139-
If you cannot find the -dev libraries in the alpine repo then you might need to compile them as well.
140-
141-
```bash
142-
xvidcore-dev \
143-
fdk-aac-dev \
144-
libva-dev \
145-
git \
146-
x264 `ADD-DEV-PACKAGE-HERE` && \
147-
```
148-
149-
Add your extra options at the end line before the && :
150-
151-
```bash
152-
--prefix=/usr/lib/jellyfin-ffmpeg --extra-version=Jellyfin --disable-doc --disable-ffplay --disable-shared --disable-libxcb --disable-sdl2 --disable-xlib --enable-lto --enable-gpl --enable-version3 --enable-gmp --enable-gnutls --enable-libdrm --enable-libass --enable-libfreetype --enable-libfribidi --enable-libfontconfig --enable-libbluray --enable-libmp3lame --enable-libopus --enable-libtheora --enable-libvorbis --enable-libdav1d --enable-libwebp --enable-libvpx --enable-libx264 --enable-libx265 --enable-libzimg --enable-small --enable-nonfree --enable-libxvid --enable-libaom --enable-libfdk_aac --enable-vaapi --enable-hwaccel=h264_vaapi --toolchain=hardened `ADD-OPTION-HERE` &&
153-
```
154-
155-
You also add the dev libraries to the above line from configure where you see lots of -dev packages installed. Those packages are purged later so you will also need to install the normal library (not the headers) in the end.
156-
157-
```bash
158-
apk add --no-cache libwebp libvorbis x265-libs x264-libs libass opus libgmpxx lame-libs gnutls libvpx libtheora libdrm libbluray zimg libdav1d aom-libs xvidcore fdk-aac curl libva `ADD-NON-DEV-PACKAGE-HERE` && \
159-
```
160-
161-
The lines shown above might have changed so just try to use common sense on where to add your package. If you want hardware acceleration you might need to compile it with the driver for your hardware. The version of ffmpeg that we compile comes with (VA-API)[https://en.wikipedia.org/wiki/Video_Acceleration_API]. You will probably need to expose your hardware device inside the container in order to make it work. Server tries to see if it can use any devices on first start. You can see those log messages to see if it worked for you.
162-
163-
### Add support for Intel CPU Transcoding
164-
If you have an Intel CPU and you are running Linux you can expose the devices :
165-
166-
```
167-
/dev/dri/card0
168-
/dev/dri/renderD128
169-
```
170-
Make sure the drivers are added to the docker image
171-
172-
```
173-
apk add --no-cache intel-media-driver
174-
```
175-
**Releases later than 1.1.9 should have the drivers installed and one just needs to expose the devices mentioned.**
176-
177-
docker compose :
178-
179-
```
180-
devices:
181-
- "/dev/dri/card0:/dev/dri/card0"
182-
- "/dev/dri/renderD128:/dev/dri/renderD128"
183-
```
184-
185-
cli :
186-
187-
```
188-
--device /dev/dri/renderD128:/dev/dri/renderD12 --device /dev/dri/card0:/dev/dri/card0
189-
```
190-
191-
## Builds
192-
193-
Builds are setup to make images for the below archs :
194-
195-
* linux/arm/v6
196-
* linux/amd64
197-
* linux/arm64/v8
198-
* linux/arm/v7
199-
200-
I can add more build archs if you require them and you can ask but I doubt anybody ever will need to install these containers in anything else.
201-
202-
### Build tags
203-
204-
* latest -> Builds automatically when new version of server or WebPlayer is released. Builds WebPlayer only from release tags.
205-
* nightly -> Builds automatically daily from development branch of web player and gets latest version of server.
206-
* release version (example v1.0.0) -> to have old releases available in case there is something wrong with new release.
207-
208-
Images saved in [Docker Hub](https://hub.docker.com/r/tsaridas/stremio-docker)
209-
210-
### Build your own
211-
212-
You can build your own image by running the below command. By default it will build from development branch of web player and latest version of the server. If you want to build from latest release of web please you can add --build-arg BRANCH=release or the branch that you want.
213-
214-
```bash
215-
docker build -t stremio:myserver .
216-
```
217-
218-
## Common Use Cases
219-
220-
* [Using HTTP](https://github.com/tsaridas/stremio-docker/wiki/Using-Stremio-Server-HTTP)
221-
* [Using HTTPS Local IP](https://github.com/tsaridas/stremio-docker/wiki/Using-Stremio-Server-with-Private-IP)
222-
* [Using HTTPS Public IP](https://github.com/tsaridas/stremio-docker/wiki/Using-Stremio-Server-with-Public-IP)
223-
224-
## Useful links
225-
226-
[Stremio addons](https://stremio-addons.netlify.app/)
227-
228-
## Suggestions
229-
230-
I recommend setting up dnsmasq or similar to cache your dns queries since Stremio seems to be spamming with requests to trackers.
231-
232-
The config option you need with dnsmasq is :
233-
234-
```bash
235-
cache-size=10000
236-
```
82+
## Thoughts
23783

238-
then you set your dns server to the ip address of your dns caching server and you are set.
84+
As of my knowledge for now these are the best solutions to achive basic auth by having Stremio Web, Stremio Server and any addons on one url.
23985

240-
## Last words
86+
I personally recommend the second nginx setup as this allows for the server url to be the same as the web url and therefor begin a quite smooth solution. Even tho this might have the drawback when the Stremio Server gets updated it might block new endpoints.
24187

242-
I don't intend to spend much time on this and tried to automate as much as I had time to.
243-
PRs and Issues are welcome.
244-
You can also fork and do as you like with the code but if you find some issue please do let me know.
88+
Thank you for reading and have a wonderful time <3

‎nginx-example.conf

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# stremio.mydomain.com
2+
# ------------------------------------------------------------
3+
map $scheme $hsts_header {
4+
https "max-age=63072000; preload";
5+
}
6+
7+
server {
8+
set $forward_scheme http;
9+
set $server "stremio-container";
10+
set $port 8080;
11+
12+
listen 80;
13+
listen [::]:80;
14+
listen 443 ssl;
15+
listen [::]:443 ssl;
16+
17+
server_name stremio.mydomain.com;
18+
19+
# Let's Encrypt SSL
20+
include conf.d/include/letsencrypt-acme-challenge.conf;
21+
include conf.d/include/ssl-ciphers.conf;
22+
ssl_certificate /etc/letsencrypt/live/npm-4/fullchain.pem;
23+
ssl_certificate_key /etc/letsencrypt/live/npm-4/privkey.pem;
24+
25+
access_log /data/logs/proxy-host-11_access.log proxy;
26+
error_log /data/logs/proxy-host-11_error.log warn;
27+
28+
# Common proxy headers
29+
proxy_set_header Host $host;
30+
proxy_set_header X-Forwarded-Scheme $scheme;
31+
proxy_set_header X-Forwarded-Proto $scheme;
32+
proxy_set_header X-Forwarded-For $remote_addr;
33+
proxy_set_header X-Real-IP $remote_addr;
34+
35+
# Stremio-specific routes
36+
location ~ ^/(hlsv2|casting|local-addon|proxy|rar|zip|settings|create|removeAll|samples|probe|subtitlesTracks|opensubHash|subtitles|network-info|device-info|get-https|hwaccel-profiler|status|exec|stream) {
37+
proxy_pass http://stremio-container:11470;
38+
}
39+
40+
location ~ ^/([^/]+)/(stats\.json|create|remove|destroy) {
41+
proxy_pass http://stremio-container:11470;
42+
}
43+
44+
location ~ ^/([^/]+)/([^/]+)/(stats\.json|hls\.m3u8|master\.m3u8|stream\.m3u8|dlna|thumb\.jpg) {
45+
proxy_pass http://stremio-container:11470;
46+
}
47+
48+
location ~ ^/([^/]+)/([^/]+)/(stream-q-[^/]+\.m3u8|stream-[^/]+\.m3u8|subs-[^/]+\.m3u8) {
49+
proxy_pass http://stremio-container:11470;
50+
}
51+
52+
location ~ ^/([^/]+)/([^/]+)/(stream-q-[^/]+|stream-[^/]+)/[^/]+\.(ts|mp4) {
53+
proxy_pass http://stremio-container:11470;
54+
}
55+
56+
location ~ ^/yt/([^/]+)(\.json)? {
57+
proxy_pass http://stremio-container:11470;
58+
}
59+
60+
location = /(thumb\.jpg|stats\.json) {
61+
proxy_pass http://stremio-container:11470;
62+
}
63+
64+
# Self hosted addons, in this case comet. Depends on the plugin if it supports a url prefix
65+
location /comet {
66+
proxy_pass http://stremio-comet:8111;
67+
}
68+
69+
# Stremio web ui
70+
location / {
71+
# Proxy!
72+
include conf.d/include/proxy.conf;
73+
}
74+
75+
# Custom
76+
include /data/nginx/custom/server_proxy[.]conf;
77+
}

0 commit comments

Comments
 (0)