Deployment guide

Jellyfin

Overview

Jellyfin is a free-software, self-hosted media server (GPL-2.0) and an open alternative to Plex and Emby. It organises your movies, TV, music and photos and streams them to any device through a polished web UI and native apps, with no tracking, no subscriptions and no premium tier.

This SecureAnyCloud image installs a stable Jellyfin 10.x from the official Jellyfin APT repository. Jellyfin runs as a systemd service bound to loopback, behind an nginx reverse proxy on port 80. All Jellyfin state lives on a dedicated Azure data disk, and a small demo library means the UI shows content immediately. A unique administrator account is seeded on the first boot of every VM.

What you get:

Jellyfin (stable 10.x) installed from the official repo.jellyfin.org APT repository, running as jellyfin.service
nginx on :80 as a reverse proxy to the loopback Jellyfin backend (127.0.0.1:8096), with WebSocket upgrade headers
A per-VM admin administrator account (username admin) seeded on first boot and recorded in a root-only file
A dedicated 60 GiB Azure data disk at /var/lib/jellyfin holding config, metadata, cache, transcodes and the media library
A ready-to-play demo movie, so the library is populated out of the box
jellyfin.service and nginx.service as enabled, active systemd units
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size. Step up to a size with more vCPUs if you expect concurrent transcoding.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp. Jellyfin serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Jellyfin by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:jellyfin-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name jellyfin \
  --image sac1647283583153:jellyfin-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name jellyfin --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active jellyfin.service nginx.service

Both units report active. On first boot, Jellyfin runs its startup wizard automatically and seeds a per-VM administrator.

Step 5 - Retrieve your admin password

The admin account password is generated uniquely on the first boot of your VM and written to a root-only file. Read it with sudo:

sudo cat /root/jellyfin-credentials.txt

The file contains JELLYFIN_URL, JELLYFIN_ADMIN_USER (admin) and JELLYFIN_ADMIN_PASSWORD. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

Jellyfin exposes an unauthenticated health endpoint, proxied by nginx on :80, for load balancers and probes:

curl -s http://localhost/health; echo

The endpoint returns Healthy. You can also read the public server info, which reports the installed version:

curl -s http://localhost:8096/System/Info/Public

Step 7 - Sign in to the web UI

Browse to http://<vm-public-ip>/ and sign in as user admin with the password from Step 5.

After you sign in, the home screen opens. The bundled Demo Movies library appears under My Media, and the demo clip appears under Recently Added.

Open the Demo Movies library to browse its contents. The preloaded clip confirms that media playback works end to end.

Step 8 - Explore the administration dashboard

From the user menu, choose Administration -> Dashboard. The dashboard shows the server name and version, your libraries, connected devices and a live activity log.

Step 9 - Verify authentication from the command line (optional)

Jellyfin's authentication endpoint rejects a wrong password with HTTP 401. It accepts the per-VM admin password with HTTP 200 and returns an AccessToken.

Use the JELLYFIN_ADMIN_PASSWORD from Step 5 and substitute your own password for <JELLYFIN_ADMIN_PASSWORD>:

curl -s -X POST -H 'Content-Type: application/json' \
  -H 'Authorization: MediaBrowser Client="sac", Device="cli", DeviceId="cli", Version="1.0.0"' \
  -d '{"Username":"admin","Pw":"<JELLYFIN_ADMIN_PASSWORD>"}' \
  http://localhost:8096/Users/AuthenticateByName

A correct password returns a JSON body containing "AccessToken". A wrong password returns HTTP 401.

Step 10 - Confirm data lives on the dedicated disk

All Jellyfin state is stored on the dedicated Azure data disk: configuration, metadata, cache, transcodes and the media library. The state therefore survives OS changes, and you can resize the disk independently. Confirm the mount:

findmnt /var/lib/jellyfin

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM. Your media lives under /var/lib/jellyfin/media.

Adding your own media

Copy your files onto the data disk under /var/lib/jellyfin/media, for example into /var/lib/jellyfin/media/movies and /var/lib/jellyfin/media/shows. Follow Jellyfin's movie and show naming conventions.

Then open Administration -> Dashboard -> Libraries and add a library, or scan an existing one, that points at that folder. Jellyfin fetches artwork and metadata automatically and streams to the web player, mobile apps and TV apps.

Maintenance

Admin users: add or manage users from Administration -> Dashboard -> Users.
Libraries: manage and scan libraries from Administration -> Dashboard -> Libraries. Media lives under /var/lib/jellyfin/media.
Data: configuration, metadata, cache, transcodes and media all live under /var/lib/jellyfin on the dedicated data disk. Snapshot the disk to back Jellyfin up.
TLS: Jellyfin serves plain HTTP on port 80. Before you run it in production, front it with TLS (for example with certbot) and your own domain.
Upgrades: sudo apt-get update && sudo apt-get install --only-upgrade jellyfin pulls newer Jellyfin releases from the official repository.
Security patches: unattended-upgrades remains enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com for help with your deployment.

Deploy on Azure

Launch Jellyfin on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Jellyfin is an open source, self-hosted media server. It streams your own movies, TV shows, music and photos to any device through a polished web app and native client apps. It is a free, privacy-respecting alternative to hosted media services, and you deploy it in your own VPC.

This image runs the Jellyfin server behind nginx as a reverse proxy. The datastore is an embedded SQLite database, and the bundled jellyfin-ffmpeg provides hardware-agnostic transcoding. The server listens on 127.0.0.1:8096 and is reached through nginx on port 80 (and 443 once you add TLS).

Jellyfin ships with no account until its first-run setup wizard is completed. On the first boot of every deployed instance, a one-shot service completes the wizard and creates a single administrator account with a per-instance password. It also generates a fresh per-instance server identity. The login is written to /root/jellyfin-credentials.txt with mode 0600.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your viewers use to reach Jellyfin
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Jellyfin. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.medium or larger, because more vCPUs help with on-the-fly transcoding. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your viewers use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a minute or two after the instance state becomes Running and the status checks pass.

Launch the instance from the AWS CLI

Run the following command to launch an instance from the SecureAnyCloud Jellyfin Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=jellyfin-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and retrieve the administrator login

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched. For the Jellyfin 10.11 on Ubuntu 24.04 variant, the login user is ubuntu.

The first-boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you log in for the first time. Read it with sudo:

ssh <login-user>@<public-ip>
sudo cat /root/jellyfin-credentials.txt

The plain-text file contains the Jellyfin URL, the administrator username (admin) and the password.

From the same SSH session, confirm that the deployment is healthy. The public info endpoint is open:

curl -fsS http://127.0.0.1/System/Info/Public

{"LocalAddress":"...","ServerName":"...","Version":"10.11.x","StartupWizardCompleted":true,...}

"StartupWizardCompleted":true confirms that the full stack, nginx and the Jellyfin server, is serving and ready.

Sign in for the first time

Open a web browser and go to http://<public-ip>/. Jellyfin shows its sign-in page. Enter the username admin and the password from /root/jellyfin-credentials.txt, then sign in.

Add your media

Copy your media onto the dedicated media volume, mounted at /srv/media. Organise it into folders by type, for example:

sudo mkdir -p /srv/media/Movies /srv/media/Shows /srv/media/Music
# copy or sync your files into those folders, e.g. with scp, rsync or the AWS CLI
sudo chown -R jellyfin:jellyfin /srv/media

Then open the dashboard and add a library for each folder. The image already ships with Movies, TV Shows and Music libraries that point at the matching /srv/media folders. The home screen lists your libraries under My Media.

Use the administration dashboard

Open the user menu and select Dashboard, or browse to /web/index.html#/dashboard. From the dashboard you manage libraries and scheduled scans, users and access, playback and transcoding, plugins and server logs.

Connect client apps

Install an official Jellyfin client and point it at http://<public-ip>/, or at your HTTPS domain. Clients include web, Android, iOS, Android TV, Fire TV, Roku, Kodi and more. Sign in with a user account.

Create additional users in the dashboard under Users, so each viewer has their own profile and watch state.

Enable HTTPS with Let's Encrypt

For any production deployment, serve Jellyfin over HTTPS so logins and streams cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

These commands assume that a DNS record points your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d media.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

certbot also configures the websocket upgrade headers that Jellyfin uses for real-time updates.

Back up and maintain the server

Jellyfin keeps its configuration, metadata and SQLite database under /var/lib/jellyfin (and /etc/jellyfin). Your media lives on the separate /srv/media volume. Back up the server state regularly:

sudo systemctl stop jellyfin
sudo tar czf <backup-dir>/jellyfin-state-$(date +%F).tgz /var/lib/jellyfin /etc/jellyfin
sudo systemctl start jellyfin

Ship the archive to an Amazon S3 bucket or another object store. The server state and the media library are each on their own EBS volume, so you can also take coordinated EBS snapshots.

To upgrade Jellyfin, run sudo apt-get update && sudo apt-get install --only-upgrade jellyfin and restart. See https://jellyfin.org/docs/.

Scale and operate

Attach a larger or additional EBS volume for /srv/media as your library grows.
For heavy concurrent transcoding, choose a larger instance type or enable hardware acceleration where available.
Put the web tier behind an Application Load Balancer with websocket support if you need high availability.

Each of these is documented in the official Jellyfin documentation at https://jellyfin.org/docs/.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image, with a guaranteed response within 24 hours and a one-hour average for critical issues. Contact sales@secureanycloud.com.

For general Jellyfin questions, consult the documentation at https://jellyfin.org/docs/. Jellyfin is a trademark of its respective owner. Its use here is nominative and does not imply affiliation or endorsement.

Deploy on AWS

Launch Jellyfin on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS