webtor-io/self-hosted v2.0.0

on GitHub

The image is now assembled from prebuilt component images instead of compiling everything from source: multi-arch (amd64 + arm64), and a build takes about a minute instead of 40+.

Breaking changes

• The web UI is closed by default. ONLY_AUTHORIZED=true redirects every page to /login; set ADMIN_PASSWORD to log in, or ONLY_AUTHORIZED=false to restore the old open behavior. Surfaces with their own auth stay reachable: /api/v1, /stremio, /s3, /embed (embedding is governed by the profile's domain list; EMBED_ONLY_AUTHORIZED=true turns that list into an allowlist).
• /rest-api/ is no longer exposed. It has no auth of its own. Use /api/v1 instead — same paths and JSON, but it requires an API key issued on the profile page (Authorization: Bearer <key>).
• A /storage volume is expected, and it must be a named Docker volume, not a host bind mount — the embedded S3 store keeps object metadata in extended attributes, which macOS/Windows bind mounts don't support. The container tells you exactly this at startup if the volume is unsuitable.

New

• Embedded S3 store (versitygw) over /storage; credentials are generated once and persisted.
• Vault: pledge-based file persistence with its own database and scheduled reap/GC jobs.
• NATS with JetStream as the internal event bus.
• Notifications: in-app feed at /notifications with an unread counter, plus optional mail via SMTP_*; a confirmable notification address on the profile page.
• content-prober is wired in — playback of containers that need transcoding (mkv) works now.
• AI features, both off by default and needing ANTHROPIC_API_KEY: metadata-enrich fallback and Discover recommendations. The free-tier daily quota defaults to 100 in this image (upstream default of 1 only makes sense where an upgrade is being sold).
• Stremio addon, WebDAV and webtor-cli verified against a self-hosted instance.
• ADMIN_PASSWORD support and a persisted random SESSION_SECRET — a container restart no longer logs the admin out.
• Production scheduled jobs (subscription polling, cache-index cleanup, enrichment, notification mail) run inside the image.
• End-to-end smoke suite (tests/run.sh), gating every PR natively on amd64 and arm64; Renovate keeps component digests fresh.

Fixes

• rest-api export URLs are signed, so torrent-http-proxy accepts them — archives, HLS and subtitles work again.
• The proxy's session-IP check is off, matching production — fixes playback stopping at "probing content media info".
• nginx preserves the port in the proxied Host header.
• Postgres no longer restart-loops when USE_LOCALPG=false; vault listens on 127.0.0.1 only.

All operator-facing variables are documented in the README.