Wizarr 2026.10.1

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened SRS Streaming Media Server & Media Servers AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose Wizarr 2026.10.1 on Ubuntu 24.04, then choose your Region.
• Pick an instance type (m5.large recommended) and your key pair.
• Choose a security group. The listing's default group opens SSH (22), HTTP (80) and HTTPS (443). Restrict SSH to your own IP address. Port 443 must be reachable by the people you invite, because they open their invitation links there.
• Choose your VPC and subnet, leave the metadata defaults (the image already requires IMDSv2), then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the VPC, subnet, key pair and CIDRs with your own:

SG=$(aws ec2 create-security-group --group-name wizarr \
  --description "Wizarr invitations" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 443 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 80 --cidr 0.0.0.0/0
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=wizarr}]'

You do not need --metadata-options, because the AMI already requires IMDSv2. Associate an Elastic IP if you want the address (and the invitation links) to survive a stop and start.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot takes under a minute after the instance starts. It sets the name Wizarr is served as (the instance's public DNS name when it has one). It creates the TLS certificate, the session key, the database and the administrator account, then writes /root/wizarr-credentials.txt (mode 0600, root). The commands below list the entries in that file without showing the password:

sudo grep -E '^(WIZARR_URL|WIZARR_ADMIN_USER)=' /root/wizarr-credentials.txt
sudo grep -oE '^[A-Z_]+=' /root/wizarr-credentials.txt
sudo stat -c '%a %U:%G %n' /root/wizarr-credentials.txt

WIZARR_URL=https://ec2-54-211-154-107.compute-1.amazonaws.com/ WIZARR_ADMIN_USER=admin WIZARR_HOST= WIZARR_URL= WIZARR_ADMIN_USER= WIZARR_ADMIN_PASSWORD= 600 root:root /root/wizarr-credentials.txt

Value What it is for

WIZARR_HOST The name nginx serves Wizarr as

WIZARR_URL The address of this instance's Wizarr

WIZARR_ADMIN_USER The administrator's user name (admin)

WIZARR_ADMIN_PASSWORD Administrator password, generated on this instance

To read the password, run sudo cat /root/wizarr-credentials.txt in your own session. Store the password in your password manager.

Confirm that the first-boot units have finished, that Wizarr and nginx are active, and that only sshd and nginx listen beyond loopback. Wizarr's gunicorn is on 127.0.0.1:5690, and the resolver is on 127.0.0.53:

systemctl is-active wizarr-egress-fence.service wizarr-firstboot.service wizarr.service nginx.service
sudo ss -Htlnp | awk '{print $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort -u head -n 3 /usr/share/doc/wizarr-sac/README.sac

active active active active 0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) 127.0.0.1:5690 users:(("gunicorn"),("gunicorn")) 127.0.0.53%lo:53 users:(("systemd-resolve")) 127.0.0.54:53 users:(("systemd-resolve")) [::]:22 users:(("sshd"),("systemd")) [::]:443 users:(("nginx"),("nginx"),("nginx")) [::]:80 users:(("nginx"),("nginx"),("nginx")) Wizarr 2026.10.1, installed by sac from the UNMODIFIED upstream release https://codeload.github.com/wizarrrr/wizarr/tar.gz/refs/tags/v2026.10.1 sha256 25cadbb243390540a2339467a8b34c2e4071a3e7404397612ceb7e686e8515c4, tag v2026.10.1 = commit 936143363897efd3ca68568fdf6fdd9a0d63f559

These commands show that a signed-out visitor is sent to the sign-in page, and that the setup wizard only redirects. They also show that the API refuses a request without a key, an unknown invitation code reveals nothing, plain HTTP redirects to HTTPS, an unknown Host header gets no answer, and TLS 1.1 is not offered.

The last command is the image's own round-trip check. It proves that anonymous access and a wrong password are refused, and it signs in over HTTPS with this instance's administrator password:

H=$(sudo sed -n 's/^WIZARR_HOST=//p' /root/wizarr-credentials.txt) C=(--connect-to ::127.0.0.1:) curl -sk "${C[@]}" -o /dev/null -w 'admin pages, signed out -> %{http_code}\n' "https://$H/admin" curl -sk "${C[@]}" -o /dev/null -w 'setup wizard -> %{http_code}\n' "https://$H/setup/" curl -sk "${C[@]}" -w ' <- API without a key (%{http_code})\n' "https://$H/api/status" curl -sk "${C[@]}" "https://$H/j/NOTACODE1" | grep -o 'Invalid Invitation' | head -n 1 curl -s "${C[@]}" -o /dev/null -w 'http -> %{http_code}\n' "http://$H/" curl -sk -o /dev/null -w 'unknown Host -> %{http_code}\n' -H 'Host: evil.example' https://127.0.0.1/ || true curl -sk "${C[@]}" -o /dev/null -w 'TLS 1.1 -> %{http_code}\n' --tlsv1.1 --tls-max 1.1 "https://$H/" || true
sudo wizarr-selftest

admin pages, signed out -> 302 setup wizard -> 302 {"error": "Unauthorized"} <- API without a key (401) Invalid Invitation http -> 301 unknown Host -> 000 TLS 1.1 -> 000 OK Wizarr self-test passed (HTTPS, anonymous refused, setup closed, wrong password refused, admin login OK)

The --connect-to ::127.0.0.1: option sends each request to this instance while keeping the real host name in the request, exactly as a browser would send it. A result of 000 means the server closed the connection without an answer.

This command prints the Python runtime Wizarr uses, the five raised packages as Wizarr's own environment resolves them, and the size of the installed set. It reads the packages as the wizarr user, exactly as the running service sees them:

/opt/wizarr/python/bin/python3 --version sudo -u wizarr /opt/wizarr/.venv/bin/python -c 'import importlib.metadata as m for d in ("brotli", "certifi", "oauthlib", "pyasn1", "setuptools", "flask", "gunicorn"): print(d, m.version(d))' wc -l < /usr/share/doc/wizarr-sac/python-packages.txt

Python 3.13.18 brotli 1.2.1 certifi 2026.10.18 oauthlib 4.0.1 pyasn1 0.6.5 setuptools 84.1.0 flask 3.1.3 gunicorn 26.2.0 75

Browse to WIZARR_URL (https://<public-dns-name>/). The certificate is self-signed, so your browser warns once. Accept it for this host, or install your own certificate (Step 10). Sign in with WIZARR_ADMIN_USER and WIZARR_ADMIN_PASSWORD.

After you sign in, you land on the dashboard. Once a server is connected, it shows your media servers, accepted invitations and recent activity.

Open Settings and add your media server under Media Servers. Choose the server type, enter the address Wizarr should use to reach it (for example https://jellyfin.example.com or http://10.0.1.25:8096) and the server's API key or token. Then let Wizarr load its libraries.

• A media server on a public address works straight away.
• A media server on a private address (in this VPC, a peered VPC or over a VPN) is blocked by the egress fence until you allow its address. Allow only the server itself, as a /32. The change takes effect at once and survives reboots:

sudo wizarr-egress-allow add 10.0.1.25/32
sudo wizarr-egress-allow list
sudo wizarr-egress-allow remove 10.0.1.25/32

Plex sign-in for invited users goes through plex.tv, which is public, so it needs no allow entry.

Choose Invitations to create a link. Pick the server and the libraries the guest gets, how long the link is valid, how many times it can be used and how long the resulting account lasts. Wizarr shows the link (https://<your-name>/j/<code>) for you to copy and send.

The guest opens the link, creates an account on your media server through Wizarr's onboarding pages, and is shown which apps to install. A wrong or expired code shows only an error page, without any detail about your server.

Users lists everyone who joined, with the invitation they used, and lets you remove their access.

These commands confirm the following. Wizarr and nginx carry IPAddressDeny for the metadata addresses. Wizarr runs sandboxed as wizarr. The egress fence is loaded with nothing allowed. The wizarr account cannot reach the metadata service on either address family. SSH runs with the SecureAnyCloud pins.

systemctl show -p IPAddressDeny wizarr.service nginx.service
systemctl show -p User -p ProtectSystem -p ProtectHome -p NoNewPrivileges wizarr.service
sudo wizarr-egress-fence check && echo 'egress fence loaded'
sudo wizarr-egress-allow list
sudo -u wizarr curl -s -m 5 -o /dev/null -w 'metadata (IPv4) as wizarr -> %{http_code}\n' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token || true
sudo -u wizarr curl -s -g -m 5 -o /dev/null -w 'metadata (IPv6) as wizarr -> %{http_code}\n' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' 'http://[fd00:ec2::254]/latest/api/token' || true
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|x11forwarding) '

IPAddressDeny=168.63.129.16/32 fd00:ec2::254/128 169.254.169.254/32 IPAddressDeny=168.63.129.16/32 fd00:ec2::254/128 169.254.169.254/32 User=wizarr ProtectHome=yes ProtectSystem=strict NoNewPrivileges=yes egress fence loaded (no ranges allowed: the fence is complete) metadata (IPv4) as wizarr -> 000 metadata (IPv6) as wizarr -> 000 permitrootlogin no passwordauthentication no x11forwarding no

Invitation links carry the name Wizarr is served as, so set your own name before you send them. Point a DNS record (for example wizarr.example.com) at the instance's public or Elastic IP address, then tell the image to serve that name. The command creates a new self-signed certificate for the name and pins nginx to it. It also updates WIZARR_HOST and WIZARR_URL in the credentials file and keeps the name across reboots:

sudo wizarr-set-hostname wizarr.example.com

For a trusted certificate, obtain one for that name, for example with certbot's certonly mode using its own temporary web server, or from your organization's CA. Copy the certificate chain and key over /etc/ssl/wizarr/wizarr.crt and /etc/ssl/wizarr/wizarr.key (key mode 0600, root), then run sudo systemctl reload nginx.