Yamtrack

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Yamtrack by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

RG="yamtrack-prod"; LOCATION="eastus"; VM_NAME="yamtrack-01" IMAGE_URN="sac1647283583153:yamtrack-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name yt-vnet --address-prefix 10.100.0.0/16 --subnet-name yt-subnet --subnet-prefix 10.100.1.0/24 az network nsg create -g "$RG" --name yt-nsg az network nsg rule create -g "$RG" --nsg-name yt-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name yt-nsg --name allow-http --priority 110 \
  --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:yamtrack-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name yt-vnet --subnet yt-subnet --nsg yt-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Yamtrack runs as one all-in-one container under yamtrack.service, alongside a PostgreSQL container and a Redis container. The app's bundled nginx is published on host port 80. PostgreSQL and Redis have no published host ports and are reachable only on the internal Docker network.

Confirm that the services are active and list the containers:

sudo systemctl is-active docker yamtrack-firstboot yamtrack
sudo docker compose -f /var/lib/yamtrack/docker-compose.yml ps

The services report active and the three containers are running. The app container reports healthy and publishes only 0.0.0.0:80->8000/tcp.

Inside the app container, supervisord runs nginx in front of gunicorn (the Django app), a Celery worker and Celery beat. Celery handles the background metadata sync.

First boot generated a unique application secret and database password for this VM, before the app was reachable. Once the app was healthy, it also seeded a per-instance admin account with a random password and wrote the details to a root-only file. Read the file:

sudo cat /root/yamtrack-credentials.txt

The file (mode 0600 root:root) holds the admin username, email and DJANGO_ADMIN_PASSWORD, which together form the account you sign in to the web app with, and the app url.

None of these values ship in the image. Every value is unique to this VM, so no two instances share a credential and there is no default login to change.

The health endpoint is reachable without authentication, but every application page requires a signed-in session, and open self sign-up is disabled.

Run the following checks. They confirm that the health endpoint answers, that the home page redirects an anonymous visitor to the login page, and that an unauthenticated attempt to add an item is rejected. They also confirm that the per-instance admin credential authenticates a real session and reads back the library:

B=http://localhost curl -s -o /dev/null -w 'health (no auth): %{http_code}\n' $B/health/ curl -s -o /dev/null -w 'home / (no auth): %{http_code}\n' $B/ curl -s -o /dev/null -w 'POST /create (no auth): %{http_code}\n' -X POST $B/create
PASS=$(sudo grep '^DJANGO_ADMIN_PASSWORD=' /root/yamtrack-credentials.txt | cut -d= -f2-)
J=$(mktemp)
curl -s -c $J -b $J -o /dev/null $B/accounts/login/
TOK=$(awk '$6=="csrftoken"{print $7}' $J | tail -1)
curl -s -c $J -b $J -o /dev/null -w 'login (admin creds): %{http_code}\n' \
  -H "Referer: $B/accounts/login/" -H "Origin: $B" \
  --data-urlencode "login=admin" --data-urlencode "password=$PASS" \
  --data-urlencode "csrfmiddlewaretoken=$TOK" $B/accounts/login/
curl -s -c $J -b $J -o /dev/null -w 'GET /admin/movie (session): %{http_code}\n' $B/admin/movie rm -f $J

The results are:

• The health endpoint returns 200.
• The home page returns 302, which redirects an anonymous visitor to the login page.
• The unauthenticated add is rejected with a non-success code.
• The login with the per-instance admin returns 302, which indicates success.
• The authenticated library page then returns 200.

This is the security model. Django's login-required middleware gates every page, there is no open registration, and only the per-instance admin can read or write the library.

Browse to http://<vm-ip>/ to reach the Yamtrack web app. Sign in with the username admin and the DJANGO_ADMIN_PASSWORD from Step 5.

Yamtrack fetches rich metadata and artwork for the titles you add. Use the search box at the top to look up a movie, show, game or book. Add it to your library with a status such as Completed, In progress or Planning, a score and your progress.

For a niche item that no catalogue covers, select Create Custom in the sidebar. In the create form, choose the media type and enter the details to add a fully custom entry. A custom entry needs no external metadata provider.

Each media type has its own page in the sidebar: Movies, TV Shows, Anime, Manga, Games, Books and more. Open one to see everything you are tracking of that type as cards that show the title, your score and a status indicator. You can filter or sort by rating, status or title.

This is the heart of Yamtrack: one private, organised library of everything you watch, play and read.

The Home dashboard shows what you have in progress and what you are planning next, grouped by media type. Quick progress controls let you bump an episode or a chapter without opening the item.

It is the at-a-glance view of your active backlog.

Open self sign-up is disabled on this image (REGISTRATION=False), so the instance is not world open and nobody who reaches the URL can create an account. To let people register their own accounts, edit the environment file, set REGISTRATION=True, and restart the app:

sudo sed -i 's/^REGISTRATION=.*/REGISTRATION=True/' /var/lib/yamtrack/.env
sudo systemctl restart yamtrack.service

Alternatively, keep registration closed and add users yourself from the Django admin at http://<vm-ip>/admin/. The admin backend is enabled on this image. Sign in as the admin user.

The stack is pinned to a fixed Yamtrack release and fixed PostgreSQL and Redis images, so your instance never upgrades silently. Confirm the image tags:

sudo docker compose -f /var/lib/yamtrack/docker-compose.yml images

Yamtrack works out of the box with shared default metadata keys. For heavy use, or to add games and books reliably, add your own provider keys to /var/lib/yamtrack/.env and restart the app. Common keys are TMDB_API (movies and TV), MAL_API (anime and manga), and IGDB_ID plus IGDB_SECRET (games):

sudo tee -a /var/lib/yamtrack/.env >/dev/null <<'EOF' TMDB_API=<your-token> MAL_API=<your-token> EOF
sudo systemctl restart yamtrack.service

Custom entries created with Create Custom never need a provider key, so you can track anything even when no keys are set.

• Application: Yamtrack 0.25.3 all-in-one container (nginx, gunicorn Django, Celery worker and Celery beat under supervisord), pinned
• Front door: the container's nginx on :8000, published on host :80
• Application database: PostgreSQL 16 (postgres:16-alpine), internal Docker network only
• Cache and task broker: Redis 8 (redis:8-alpine), maxmemory capped at 256mb, internal Docker network only
• Orchestration: Docker Compose under yamtrack.service
• Application secret: per instance, generated on first boot into /var/lib/yamtrack/.env
• Admin account: per-instance random password, seeded on first boot into /root/yamtrack-credentials.txt
• Registration: open self sign-up disabled (REGISTRATION=False)
• Operating system: Ubuntu 24.04 LTS (patched at build)
• License: AGPL-3.0 (Yamtrack)

sudo systemctl status yamtrack --no-pager | head -12 sudo docker compose -f /var/lib/yamtrack/docker-compose.yml logs --tail 40 yamtrack

Restart the app with sudo systemctl restart yamtrack.service. Follow the logs live with sudo docker compose -f /var/lib/yamtrack/docker-compose.yml logs -f yamtrack. View the configuration in /var/lib/yamtrack/.env.

After you change the environment file, restart the service to apply the change.

The image serves the web app over plain HTTP on port 80, which is convenient behind a load balancer or private network. For production, terminate TLS in front of the VM so that credentials travel encrypted:

• Front the VM with Azure Application Gateway, a load balancer with a managed certificate, or a CDN, and forward to the app on port 80.
• If you serve the app from a custom domain, add that origin to CSRF in /var/lib/yamtrack/.env (for example CSRF=https://<your-domain>) so that login and forms work from that address. Then restart the app. The app reads its reachable address at first boot, so use a stable public IP or set the address before first boot.

• Restrict the NSG. Allow TCP 80 (and 22 for admin) only from the networks that use the app.
• Terminate TLS in front of the app (Step 16) so that the admin password and session cookies are encrypted in transit.
• Rotate the seeded admin password. Sign in and change it, or set a new password from the Django admin.
• Keep registration closed. Open self sign-up is disabled by default. Leave it that way and add members yourself, unless you specifically want open registration.
• Keep the datastores private. PostgreSQL and Redis are bound to the internal Docker network only. Never publish their ports.
• Keep the OS patched. Unattended security upgrades remain enabled on the running VM.

Yamtrack is distributed under the GNU Affero General Public License v3.0 (AGPL-3.0). This SecureAnyCloud image bundles the unmodified official open source release.

SecureAnyCloud provides the packaging, the PostgreSQL and Redis backing services, the per-instance secret, database password and admin generation, the paired deploy guide, and 24/7 support with a guaranteed 24-hour response SLA.

Yamtrack is an independent open source project. This image is not affiliated with or endorsed by it.

Deploy on Azure

Launch Yamtrack on Ubuntu 24.04 LTS by SecureAnyCloud from the Azure Marketplace and follow this guide to a working personal media tracker for movies, TV, anime, manga, games and books in minutes.

Deploy on Azure

Launch Yamtrack on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Sign in to the AWS Management Console, open AWS Marketplace, and find the Yamtrack listing by SecureAnyCloud. Choose Continue to Subscribe, then Continue to Configuration and Continue to Launch.

Pick your region, instance type (m5.large), VPC subnet and key pair. Choose a security group that allows SSH (22) and HTTP (80), then select Launch.

AMI_ID="ami-xxxxxxxxxxxxxxxxx"
# the Yamtrack AMI id for your region (from the listing)
aws ec2 run-instances \
  --image-id "$AMI_ID" \
  --instance-type m5.large \
  --key-name my-keypair \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --associate-public-ip-address \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeType":"gp3","VolumeSize":16}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=yamtrack-01}]'

ssh ubuntu@<vm-ip>

Yamtrack runs as one all-in-one container under yamtrack.service, alongside a PostgreSQL container and a Redis container. The app's bundled nginx is published on host port 80. PostgreSQL and Redis have no published host ports and are reachable only on the internal Docker network.

Confirm that the services are active and list the containers:

sudo systemctl is-active docker yamtrack-firstboot yamtrack
sudo docker compose -f /var/lib/yamtrack/docker-compose.yml ps

The services report active and the three containers are running. The app container reports healthy and publishes only 0.0.0.0:80->8000/tcp.

Inside the app container, supervisord runs nginx in front of gunicorn (the Django app), a Celery worker and Celery beat. Celery handles the background metadata sync.

First boot generated a unique application secret and database password for this instance, before the app was reachable. Once the app was healthy, it also seeded a per-instance admin account with a random password and wrote the details to a root-only file. Read the file:

sudo cat /root/yamtrack-credentials.txt

The file (mode 0600 root:root) holds the admin username, email and DJANGO_ADMIN_PASSWORD, which together form the account you sign in to the web app with, and the app url.

None of these values ship in the image. Every value is unique to this instance, so no two instances share a credential and there is no default login to change.

The health endpoint is reachable without authentication, but every application page requires a signed-in session, and open self sign-up is disabled.

Run the following checks. They confirm that the health endpoint answers, that the home page redirects an anonymous visitor to the login page, and that an unauthenticated attempt to add an item is rejected. They also confirm that the per-instance admin credential authenticates a real session and reads back the library:

B=http://localhost curl -s -o /dev/null -w 'health (no auth): %{http_code}\n' $B/health/ curl -s -o /dev/null -w 'home / (no auth): %{http_code}\n' $B/ curl -s -o /dev/null -w 'POST /create (no auth): %{http_code}\n' -X POST $B/create
PASS=$(sudo grep '^DJANGO_ADMIN_PASSWORD=' /root/yamtrack-credentials.txt | cut -d= -f2-)
J=$(mktemp)
curl -s -c $J -b $J -o /dev/null $B/accounts/login/
TOK=$(awk '$6=="csrftoken"{print $7}' $J | tail -1)
curl -s -c $J -b $J -o /dev/null -w 'login (admin creds): %{http_code}\n' \
  -H "Referer: $B/accounts/login/" -H "Origin: $B" \
  --data-urlencode "login=admin" --data-urlencode "password=$PASS" \
  --data-urlencode "csrfmiddlewaretoken=$TOK" $B/accounts/login/
curl -s -c $J -b $J -o /dev/null -w 'GET /admin/movie (session): %{http_code}\n' $B/admin/movie rm -f $J

The results are:

• The health endpoint returns 200.
• The home page returns 302, which redirects an anonymous visitor to the login page.
• The unauthenticated add is rejected with a non-success code.
• The login with the per-instance admin returns 302, which indicates success.
• The authenticated library page then returns 200.

This is the security model. Django's login-required middleware gates every page, there is no open registration, and only the per-instance admin can read or write the library.

Browse to http://<vm-ip>/ to reach the Yamtrack web app. Sign in with the username admin and the DJANGO_ADMIN_PASSWORD from Step 5.

Yamtrack fetches rich metadata and artwork for the titles you add. Use the search box at the top to look up a movie, show, game or book, and open its detail page. The detail page shows the poster and description, and the Add to tracker control adds the title to your library with a status such as Completed, In progress or Planning, a score and your progress.

For a niche item that no catalogue covers, select Create Custom in the sidebar to add a fully custom entry. A custom entry needs no external metadata provider.

Each media type has its own page in the sidebar: Movies, TV Shows, Anime, Manga, Games, Books and more. Open one to see everything you are tracking of that type as cards that show the title, your score and a status indicator. You can filter or sort by rating, status or title.

This is the heart of Yamtrack: one private, organised library of everything you watch, play and read.

The Statistics page summarises your media consumption habits: completed items, average rating, your most active day and current streak, plus an activity history heatmap.

It is the at-a-glance view of everything you have tracked.

Open self sign-up is disabled on this image (REGISTRATION=False), so the instance is not world open and nobody who reaches the URL can create an account. To let people register their own accounts, edit the environment file, set REGISTRATION=True, and restart the app:

sudo sed -i 's/^REGISTRATION=.*/REGISTRATION=True/' /var/lib/yamtrack/.env
sudo systemctl restart yamtrack.service

Alternatively, keep registration closed and add users yourself from the Django admin at http://<vm-ip>/admin/. The admin backend is enabled on this image. Sign in as the admin user.

The stack is pinned to a fixed Yamtrack release and fixed PostgreSQL and Redis images, so your instance never upgrades silently. Confirm the image tags:

sudo docker compose -f /var/lib/yamtrack/docker-compose.yml images

Yamtrack works out of the box with shared default metadata keys. For heavy use, or to add games and books reliably, add your own provider keys to /var/lib/yamtrack/.env and restart the app. Common keys are TMDB_API (movies and TV), MAL_API (anime and manga), and IGDB_ID plus IGDB_SECRET (games):

sudo tee -a /var/lib/yamtrack/.env >/dev/null <<'EOF' TMDB_API=<your-token> MAL_API=<your-token> EOF
sudo systemctl restart yamtrack.service

Custom entries created with Create Custom never need a provider key, so you can track anything even when no keys are set.

• Application: Yamtrack 0.25.3 all-in-one container (nginx, gunicorn Django, Celery worker and Celery beat under supervisord), pinned
• Front door: the container's nginx on :8000, published on host :80
• Application database: PostgreSQL 16 (postgres:16-alpine), internal Docker network only
• Cache and task broker: Redis 8 (redis:8-alpine), maxmemory capped at 256mb, internal Docker network only
• Orchestration: Docker Compose under yamtrack.service, with the data root on a dedicated gp3 volume at /var/lib/docker
• Application secret: per instance, generated on first boot into /var/lib/yamtrack/.env
• Admin account: per-instance random password, seeded on first boot into /root/yamtrack-credentials.txt
• Registration: open self sign-up disabled (REGISTRATION=False)
• Operating system: Ubuntu 24.04 LTS (patched at build)
• License: AGPL-3.0 (Yamtrack)

sudo systemctl status yamtrack --no-pager | head -12 sudo docker compose -f /var/lib/yamtrack/docker-compose.yml logs --tail 40 yamtrack

Restart the app with sudo systemctl restart yamtrack.service. Follow the logs live with sudo docker compose -f /var/lib/yamtrack/docker-compose.yml logs -f yamtrack. View the configuration in /var/lib/yamtrack/.env.

After you change the environment file, restart the service to apply the change.

The image serves the web app over plain HTTP on port 80, which is convenient behind a load balancer or private network. For production, terminate TLS in front of the instance so that credentials travel encrypted:

• Front the instance with an Application Load Balancer with an ACM certificate, or a CloudFront distribution, and forward to the app on port 80.
• If you serve the app from a custom domain, add that origin to CSRF in /var/lib/yamtrack/.env (for example CSRF=https://<your-domain>) so that login and forms work from that address. Then restart the app. The app reads its reachable address at first boot, so use a stable Elastic IP or set the address before first boot.

• Restrict the security group. Allow TCP 80 (and 22 for admin) only from the networks that use the app.
• Terminate TLS in front of the app (Step 16) so that the admin password and session cookies are encrypted in transit.
• Rotate the seeded admin password. Sign in and change it, or set a new password from the Django admin.
• Keep registration closed. Open self sign-up is disabled by default. Leave it that way and add members yourself, unless you specifically want open registration.
• Keep the datastores private. PostgreSQL and Redis are bound to the internal Docker network only. Never publish their ports.
• Keep the OS patched. Unattended security upgrades remain enabled on the running instance.

Yamtrack is distributed under the GNU Affero General Public License v3.0 (AGPL-3.0). This SecureAnyCloud image bundles the unmodified official open source release.

SecureAnyCloud provides the packaging, the PostgreSQL and Redis backing services, the per-instance secret, database password and admin generation, the paired deploy guide, and 24/7 support with a guaranteed 24-hour response SLA.

Yamtrack is an independent open source project. This image is not affiliated with or endorsed by it.

Deploy on AWS

Launch Yamtrack from AWS Marketplace and follow this guide to a working personal media tracker for movies, TV, anime, manga, games and books in minutes.

Deploy on AWS

Launch Yamtrack on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com