Wizarr

Search the Azure Marketplace for Wizarr on Ubuntu 24.04 and choose your VM size. Attach a network security group that allows TCP 22 (SSH) from your management network, and TCP 80 and 443 (the web app) from the networks that need them.

In production, front port 80 with TLS (see Step 12).

RG="wizarr-prod"; LOCATION="eastus"; VM_NAME="wizarr-01" IMAGE_URN="sac1647283583153:wizarr-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name wz-vnet --address-prefix 10.90.0.0/16 --subnet-name wz-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name wz-nsg az network nsg rule create -g "$RG" --nsg-name wz-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name wz-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:wizarr-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name wz-vnet --subnet wz-subnet --nsg wz-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Wizarr listens on loopback only, and nginx fronts the web app on port 80. Run these checks:

sudo systemctl is-active wizarr nginx ss -tln | grep -E ':80 |127.0.0.1:5690' curl -s -o /dev/null -w 'GET /setup/ -> HTTP %{http_code}\n' http://127.0.0.1/setup/

Both services report active. The gunicorn app is bound to 127.0.0.1:5690, nginx is bound to :80, and the setup wizard returns HTTP 200 through nginx.

Nothing sensitive ships in the image. While no administrator exists, the app redirects every request to the create-admin wizard, so / returns a redirect and the admin dashboard is never reachable without authentication.

The per-VM credentials note in /root is readable by root only. The Flask SECRET_KEY is generated on first boot, and the command below masks it.

curl -s -o /dev/null -w 'GET / -> HTTP %{http_code} (redirect to /setup/)\n' http://127.0.0.1/
sudo stat -c '%n perms=%a owner=%U:%G' /root/wizarr-credentials.txt
sudo sed -E 's/^SECRET_KEY=.*/SECRET_KEY=**** (per-VM, generated at first boot)/' /root/wizarr-credentials.txt | grep -E '^WIZARR_URL|^SETUP_WIZARD|^SECRET_KEY|^NOTE'
curl -s -o /dev/null -w 'GET /admin (no auth) -> HTTP %{http_code} (redirect, protected)\n' http://127.0.0.1/admin

The homepage redirects to the setup wizard, and the credentials note is 600 root:root. The session secret is unique to this VM, and the admin dashboard is refused without authentication.

Open http://<vm-ip>/ in your browser. Because no administrator ships, Wizarr shows the create admin page.

Choose your own admin username and password (at least 8 characters), then submit.

After you create your admin account, open Settings. Use the Servers and Connections tabs to connect your media server (Jellyfin, Plex, Emby, Audiobookshelf, Komga, Kavita and more) with its URL and an API key.

Wizarr uses this connection to provision accounts for the users you invite.

Wizarr requires authentication for the admin area. Sign in at /login with the admin username and password that you created during setup.

You land on the admin dashboard. From there, create invitation links, scope each one to specific libraries and permissions, set expiry and usage limits, and track who has joined.

New users redeem an invitation through a guided, multi-step onboarding experience that provisions their media server account.

Print the version of each component:

/opt/wizarr/.venv/bin/python --version uv --version node -v nginx -v grep -m1 '^version = ' /opt/wizarr/pyproject.toml

A uv-managed Python 3.13 runs the Flask app under gunicorn. Node.js 22 LTS built the front-end assets, nginx fronts the app, and the pinned Wizarr release is 2026.7.1.

All Wizarr data lives in the embedded SQLite database at /data/database/database.db, which is captured into the image and carried onto every instance. The first-boot service applies migrations and generates the per-VM secret, then disables itself.

sudo ls -la /data/database/database.db systemctl is-enabled wizarr-firstboot.service apt-mark showhold

The database is present, the first-boot service has run and disabled itself for this instance, and there are no held packages, so the OS security baseline is intact.

nginx already fronts Wizarr on port 80 and is ready for TLS. Point a DNS record at your VM, then obtain a certificate with certbot.

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot installs the certificate, rewrites the nginx server block for TLS, and sets up automatic renewal. Your onboarding portal is then served over HTTPS.