Search the Community

NGINX and emby Config Version 1.0.4 Last Update 1-1-2024 Update by Pir8Radio Why Use NGINX reverse proxy ahead of my application servers like emby? With NGINX or any reverse proxy ahead of an application server you have more control over your setup. You can do things the application servers were not built to handle, have better control over your security and logging, replace lines of code without editing the application server code, better control of caching, etc, etc.... One of the main reasons is so that you don't have to open a new port on your firewall for every application server you host, all you really need to open is 80 & 443 and the internet can reach all of your different servers through one entrance. Will NGINX work on my OS? Most likely, you can find various versions of NGINX for most OS's and they come in different flavors, with options baked in, or just the bare NGINX that you need to compile. See below for download links to get you started. Will NGINX break things on emby? Absolutely if you don't configure it correctly! I HIGHLY suggest when choosing a scheme to setup your domain URL you choose SUB-DOMAIN and NOT sub-directory, more below. Also if you come to the emby forum with things not working, or issues you have and you use a Reverse Proxy, PLEASE make sure that is one of the first things you mention in your forum post. ESPECIALLY if emby works on one platform or client, but not another. So many times people complain "but it works on chrome, so I didn't think it was the reverse proxy". Mention you have a Reverse Proxy please. If the reverse proxy is setup correctly it should be totally transparent to the user and the application server (emby). I'm not going to go into how to purchase and setup a domain name. Lots of how-to's on that out there. Once you have a domain name and its pointed to your IP address, you can go to that domain name and hit your server then continue on.... Sub-Domain vs Sub-Directory: Lets say your domain name is: domain.com there are two main ways you can direct traffic from the internet to your backend application servers like emby. One is sub-directory, something like domain.com/emby or domain.com/other-server This is doable in nginx, but there are some catches and you need to know how your reverse proxy and application server work in detail.. This often breaks different features in emby and other application servers.. To keep with our "Totally Transparent" goal sub-directory doesn't work well, it requires a lot of rewriting and work-arounds to make it work smoothly, if you choose sub-directory you will run into issues you will need to address. The other option is Sub-Domain, this is the cleanest, most transparent, easiest to setup and maintain, it's also what I highly suggest you setup. A sub-domain looks like: emby.domain.com or other-server.domain.com The below config is based on Sub-Domain I will include a sub-directory example as well. NGINX Downloads: Official nginx downloads(LINUX): nginx.org Official nginx downloads(Windows): nginx.org WINDOWS users I suggest this version: nginx-win.ecsds.eu download links are at the bottom of the page. This Windows version has lots of cool features compiled into it already, and is optimized for windows. They keep up with updates, its a FREE (for non-commercial) third party build that I highly recommend. Additional Links: Content Security Policy info (CSP) (For Advanced Users): A CSP WILL break your server if you don't know what you are doing, I suggest reading up, lots of googleing, and understand what a CSP's function is and is not prior to venturing into this area Example NGINX Reverse Proxy Config: 3-29-2020 - ADDED A LINE FOR CLOUDFLARE USERS SO THAT THE X-REAL-IP HEADER IS CORRECTED. THIS ONLY EFFECTS Cloudflare USERS. 4-11-2020 (V1.0.1) - MOVED proxy_buffering off; FROM LOCATION BLOCK TO SERVER BLOCK 12-18-2020 (V1.0.2) - ADDED 301 SERVER SECTION TO FORCE ALL TRAFFIC TO SSL. 9-23-2021 no nginx config change, but cloudflare changed how they cache video files, so emby users that use Cloudflare now need to add a rule like below to make sure video is seekable and playable. 8-18-2022 - added a line for photo sync to cover large uploads of videos and images. (client_max_body_size 1000M;) 1-1-2024 - changed http2 setting per @weblesuggestion in this thread post # 1309363. ** The below "Page Rules" are only needed for Cloudflare CDN users, otherwise ignore. worker_processes auto; error_log logs/error.log; events { worker_connections 8192; } http { include mime.types; default_type application/octet-stream; server_names_hash_bucket_size 64; server_tokens off; ## The below will create a separate log file for your emby server which includes ## userId's and other emby specific info, handy for external log viewers. ## Cloudflare users will want to swap $remote_addr in first line below to $http_CF_Connecting_IP ## to log the real client IP address log_format emby '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for" $request_time $server_port "$http_x_emby_authorization"'; log_format default '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for" $request_time $server_port'; sendfile off; ## Sendfile not used in a proxy environment. gzip on; ## Compresses the content to the client, speeds up client browsing. gzip_disable "msie6"; gzip_comp_level 6; gzip_min_length 1100; gzip_buffers 16 8k; gzip_proxied any; gzip_types text/plain text/css text/js text/xml text/javascript application/javascript application/x-javascript application/json application/xml application/rss+xml image/svg+xml; proxy_connect_timeout 1h; proxy_send_timeout 1h; proxy_read_timeout 1h; tcp_nodelay on; ## Sends data as fast as it can not buffering large chunks, saves about 200ms per request. ## The below will force all nginx traffic to SSL, make sure all other server blocks only listen on 443 server { listen 80 default_server; server_name _; return 301 https://$host$request_uri; } ## Start of actual server blocks server { listen [::]:443 ssl; ## Listens on port 443 IPv6 ssl enabled listen 443 ssl; ## Listens on port 443 IPv4 ssl enabled http2 on; ## Enables HTTP2 proxy_buffering off; ## Sends data as fast as it can not buffering large chunks. server_name emby.domainname.com; ## enter your service name and domain name here example emby.domainname.com access_log logs/emby.log emby; ## Creates a log file with this name and the log info above. ## SSL SETTINGS ## ssl_session_timeout 30m; ssl_protocols TLSv1.2 TLSv1.1 TLSv1; ssl_certificate ssl/pub.pem; ## Location of your public PEM file. ssl_certificate_key ssl/pvt.pem; ## Location of your private PEM file. ssl_session_cache shared:SSL:10m; location ^~ /swagger { ## Disables access to swagger interface return 404; } location / { proxy_pass http://127.0.0.1:8096; ## Enter the IP and port of the backend emby server here. client_max_body_size 1000M; ## Allows for mobile device large photo uploads. proxy_hide_header X-Powered-By; ## Hides nginx server version from bad guys. proxy_set_header Range $http_range; ## Allows specific chunks of a file to be requested. proxy_set_header If-Range $http_if_range; ## Allows specific chunks of a file to be requested. proxy_set_header X-Real-IP $remote_addr; ## Passes the real client IP to the backend server. #proxy_set_header X-Real-IP $http_CF_Connecting_IP; ## if you use cloudflare un-comment this line and comment out above line. proxy_set_header Host $host; ## Passes the requested domain name to the backend server. proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; ## Adds forwarded IP to the list of IPs that were forwarded to the backend server. ## ADDITIONAL SECURITY SETTINGS ## ## Optional settings to improve security ## ## add these after you have completed your testing and ssl setup ## ## NOTICE: For the Strict-Transport-Security setting below, I would recommend ramping up to this value ## ## See https://hstspreload.org/ read through the "Deployment Recommendations" section first! ## add_header 'Referrer-Policy' 'origin-when-cross-origin'; add_header Strict-Transport-Security "max-age=15552000; preload" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; ## WEBSOCKET SETTINGS ## Used to pass two way real time info to and from emby and the client. proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; } } }

@pir8radio @pwhodges thanks for trying to help me I have converted Let’s Encrypt to work with emby directly without using Nginx Cer add to emby setting surf to my server and now working without any warning from the browser about the Certificate .. and the video payed as well. ok now when I try with the emby app, the video still give me an error. So it is not related with Nginx ... there is an issue with the app itself @Luke this issue only I have with Galaxy Note 5 The device is Galaxy Note 5 Android 7.0 emby 3.2.56 Server emby 4.7.5.0 (Ubuntu Linux 20.04.4) log file is attached please note that I have replace my domain name and IP to my_domain.com and my_ip on the log file Many Thanks embyserver.txt

Hello, I'm trying to run Emby through Portainer but I am having issues. I've attached the container log and the content of the stack. Thanks in advance! emby_stack.txt _emby_logs.txt

I just got a new router, which means my server has moved from local IP 10.0.x.x to 192.168.x.x. I added exactly the same port-forwarding rules to the new router that I had in the old router, changed the local IP address in the NGINX config, restarted NGINX and...it doesn't connect. The domain gets a CloudFlare 524 error. My IP address followed by ports 80, 443, 4343, 8920 and 7241 fails. My IP address followed by port 8096 succeeds. This doesn't make any sense. I have Emby's ports in the network config set to 4343 for secure and 7241 for non-secure. CanYouSeeMe.org can only see me on port 8096. NGINX isn't jumping in front of any of the attempts at direct-IP access, which from memory it's supposed to.

Hello everyone, I have been using Emby for several months now and am having difficulty. I decided to migrate from MiniDLNA to Emby's native DLNA, and the quality is very poor. Do you have an idea of the configuration to adopt to solve this problem? I am attaching you the screenshots in comparison, between the Emby web player and Emby DLNA. Thks ^^ Bad Quality, with pixel Very qood quality

Read a question just asked about copying user data to a new server with plugin. Is there any sort of documentation on things like where config data is stored, and how to back it up with and without the plugin? I like knowing a bit about systems I'm running so I can tweak a bit. It would be nice to know what I can expect moving my server from Windows to Linux, and how much my users will have to redo. As a first attempt moving my Windows server to CentOS, after I got the server up and running, I copied the contents of my Windows "User/AppData/Roaming/Emby-Server/programdata" into the Unix's "/var/lib/emby" directory (all the subdirectories were the same, so I thought it might work), which resulted in an evil core dump...lucky I backed up the original emby directory before I did that, so no permanent harm. Still, it should just be a matter of finding the right files and copying them over, not copying over the system/OS specific ones, and then making a few tweaks for the new environment, right? If only I knew which files to move and which to tweak... Thanks very much,

I'm running emby server 4.2.1.0 in docker, attaching with different browsers (Google Chrome, Chromium, Opera, Firefox) from both Linux & Mac. I'm sure the landing page after login always used to be the Home Page (layout configured in user settings), but recently (after a server update I guess), the landing page is now always the Dashboard. I've not found a landing page config item - and the name 'Home Page' suggests that's where I should land/ Am I missing something basic, or could this be a bug? I have tested both with: - Just IP & port in url - Using a bookmark created from the Home Page .. selected to initially reach the Login Page.

I really dont't know if the titles corresponds accurately to my problem, so I will give a brief explanation of what happened. I have emby-server installed an an Ubuntu 16.04 Server. For long time, I had this server turned off. So I started it again and first thing I did was to update all packages. My latest version was installed by the repo that existed for Ubuntu package. But since this repo is no longer existing, I updated to the current version, by downloading the deb package and installing it. I think that this way, broke some things up, because here it is the situation I have right now. All my libraries after the update still exists, but cannot be updated. After searching around I found out that in the Metadata manager all my libraries have there path defined to /var/lib/emby-server/root/default, but the actual path is /var/lib/emby/root/default. I tried to change this path to the correct one, but It looks like that is not possible. I want to avoid deleting the libraries and recreating them, since there are a lot of libraries and mainly because almost all the metadata inside those libraries, were created by hand in a period of 2 years. As a work around I just created a symlink /var/lib/emby-server that points to /var/lib/emby/ but if there is some other more straightforward way it would be great.

I did install the version 3.4.1.0 on my DS918+. As the disks do not enter hibernation I wanted to disable "automatic portmapping" (as suggested somwhere in this forum). However changing the parameters in the Advanced -> Hosting section do not have any effect. This does apply to all parameters - none of them is saved after pressing "Save". Only two message boxes appear. Could somebody please help ? From my point of view it look like the user requesting the cahnges does not have the permission on file system level ... Thx a lot !

Dear all, i want to know can i use ubuntu 16.04 server EMby. is this stable? how can i create front login panel. i don't want to use nas server. in this case how can i do it?

Can someone help me understand the server-side user setting called "Allow downloading that requires transcoding"? Server > Users > {select a user} > Downloading There are two settings that can each be independently enabled/disabled per user: * Allow media downloading * Allow downloading that requires transcoding The first seems pretty self-explanatory and I have it enabled for all users. The second setting is relatively new (I don't remember seeing it before) and it confuses me. I understand what transcoding means in the context of video playback over the network, but not what it means in the context of downloading a media file. What does transcoding have to do with a file download? Any help you could give me in understanding that setting would be appreciated. The wiki doesn't show the setting (yet?).

Managed to trash my server somehow in one move, made one setting change (public https port number) in the process of setting up https in advanced, saved setting, clicked restart, and it hung there without restarting. Did system reboot, etc. all the standard stuff, app would seem to run, but refused to stay open when attempting to open dashboard, could see it drop out of processes in Activity Monitor when accessed. Tried reinstall of latest package, still no joy. The only thing I could think of as a factor is the machine OS was recently updated to 10.12.5, but emby seemed to be working fine after that update until I tried the config change/restart. Tried restoring emby app and emby-server files in ~/.config using Time Machine backup from yesterday, no dice. On the theory of it being an issue with 10.12.5, I did a complete system restore from yesterday prior to the update to bring it back to 10/12.4, and that didn't work either. So, I trashed the app file and the emby-server config file again, and started an install from scratch. That seems to be working just fine, but it's going to take me several hours to get back to where I was, and will have lost track of a bunch off-air recording data, etc. What is going on here that I'm missing in terms of where files are located? And why is this config so difficult to restore from a backup?

Hi, I just had an interesting experience this afternoon. Since is I switched to beta for some time because of a bug, the Dashboard has been asking me to update, always showing a beta version. But any update mechanisms correctly update to the next stable version. Not a real problem here... So I started looking around and found SystemUpdateLevel in config/system.xml and proceeded to set it to "Stable". After a quick restart I found myself faced by the 1st Install Wizzard... dafuq? ok... system.xml has been reset to defaults. no backup to be found... ...but nice to find out that the correct keyord would have been "Release" So I go through the install steps and near the end username is already filled out with "exampleuser" i change it to my admin username and complete. Now the login screen comes up and admin is there twice. I can't login with either. One or more errors occurred. System.AggregateException at System.Threading.Tasks.Task.WaitAll (System.Threading.Tasks.Task[] tasks, Int32 millisecondsTimeout, CancellationToken cancellationToken) <0x7f30e81e38b0 + 0x004ee> in <filename unknown>:0 at System.Threading.Tasks.Task.WaitAll (System.Threading.Tasks.Task[] tasks, Int32 millisecondsTimeout) <0x7f30e81e3850 + 0x00028> in <filename unknown>:0 at System.Threading.Tasks.Task.WaitAll (System.Threading.Tasks.Task[] tasks) <0x7f30e81e37c0 + 0x00016> in <filename unknown>:0 at MediaBrowser.Server.Mono.MainClass.RunApplication (MediaBrowser.Server.Implementations.ServerApplicationPaths appPaths, ILogManager logManager, MediaBrowser.Server.Startup.Common.StartupOptions options) <0x41054750 + 0x00398> in <filename unknown>:0 at MediaBrowser.Server.Mono.MainClass.Main (System.String[] args) <0x40ffa0e0 + 0x001c7> in <filename unknown>:0 InnerException: System.InvalidCastException Specified cast is not valid. at System.Data.SQLite.SQLiteDataReader.VerifyType (Int32 i, DbType typ) <0x4118f280 + 0x001af> in <filename unknown>:0 at System.Data.SQLite.SQLiteDataReader.GetBytes (Int32 i, Int64 fieldOffset, System.Byte[] buffer, Int32 bufferoffset, Int32 length) <0x411d2510 + 0x000a7> in <filename unknown>:0 at MediaBrowser.Server.Implementations.Persistence.DataExtensions.GetMemoryStream (IDataReader reader, Int32 ordinal) <0x411d23f0 + 0x00097> in <filename unknown>:0 at MediaBrowser.Server.Implementations.Persistence.SqliteUserRepository.RetrieveAllUsers () <0x411d1cf0 + 0x0014b> in <filename unknown>:0 at MediaBrowser.Server.Implementations.Library.UserManager+<LoadUsers>c__async3.MoveNext () <0x411d1470 + 0x0009e> in <filename unknown>:0 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw () <0x7f30e813fea0 + 0x00029> in <filename unknown>:0 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Threading.Tasks.Task task) <0x7f30e813dd60 + 0x000b3> in <filename unknown>:0 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Threading.Tasks.Task task) <0x7f30e813dcc0 + 0x00093> in <filename unknown>:0 at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd (System.Threading.Tasks.Task task) <0x7f30e813dc70 + 0x0003a> in <filename unknown>:0 at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1+ConfiguredTaskAwaiter[TResult].GetResult () <0x7f30e813e4e0 + 0x00017> in <filename unknown>:0 at MediaBrowser.Server.Implementations.Library.UserManager+<Initialize>c__async0.MoveNext () <0x411d0810 + 0x001e4> in <filename unknown>:0 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw () <0x7f30e813fea0 + 0x00029> in <filename unknown>:0 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Threading.Tasks.Task task) <0x7f30e813dd60 + 0x000b3> in <filename unknown>:0 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Threading.Tasks.Task task) <0x7f30e813dcc0 + 0x00093> in <filename unknown>:0 at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd (System.Threading.Tasks.Task task) <0x7f30e813dc70 + 0x0003a> in <filename unknown>:0 at System.Runtime.CompilerServices.ConfiguredTaskAwaitable+ConfiguredTaskAwaiter.GetResult () <0x7f30e813e2e0 + 0x00012> in <filename unknown>:0 at MediaBrowser.Server.Startup.Common.ApplicationHost+<RegisterResources>c__async1.MoveNext () <0x41142f20 + 0x08768> in <filename unknown>:0 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw () <0x7f30e813fea0 + 0x00029> in <filename unknown>:0 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Threading.Tasks.Task task) <0x7f30e813dd60 + 0x000b3> in <filename unknown>:0 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Threading.Tasks.Task task) <0x7f30e813dcc0 + 0x00093> in <filename unknown>:0 at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd (System.Threading.Tasks.Task task) <0x7f30e813dc70 + 0x0003a> in <filename unknown>:0 at System.Runtime.CompilerServices.ConfiguredTaskAwaitable+ConfiguredTaskAwaiter.GetResult () <0x7f30e813e2e0 + 0x00012> in <filename unknown>:0 at MediaBrowser.Common.Implementations.BaseApplicationHost`1+<Init>c__async0[TApplicationPathsType].MoveNext () <0x410f5520 + 0x00813> in <filename unknown>:0 This would seem to have caused some problem. I guess related to having 2 users by the same name. Now I go looking again, find users.db and delete the row of the now erroneously named exampleuser. I can login again \o/ but only to find none of my shows or movies had any of the associated metadata show up. Why did that happen? At the moment the libraries are still being scanned at about the speed I'd expect from a first scan, all the settings have .nfo files, which are present, priotitized. So why is the scan semingly not using those for speedup? I'm not even sure there's a bug in here, but it certainly would have been nice if emby had made a backup before resetting everything, instead of relying on me not to forget making one... greetings /moddie

Emby For Roku Setup Guide Assumptions The Author only had access to a Roku 3 (Model 4200X Software v5.4 2240) . It is assumed that all Rokus behave in the same way in respect of this guide.Prerequisites Install EMBY Server. Create an EMBY User. Optionally (and recommended) make user an EMBY Connect User (by registering on community forums and adding the valid MB community username to the user account under server configuration and authorising via email) http://emby.media/connect/ Follow the Roku product installation instructions to register your email address/Roku account. Ensure the Roku has a valid IP route to your EMBY server and ensure the necessary rules are applied on any intermediary firewalls. See Client<>Server Connection Troubleshooting. Guide Chapters Adding EMBY Channel to Your Roku. Connect EMBY Roku Client to EMBY Server Client<>Server Connection Troubleshooting. Note many of the pictures in this guide need updating for the latest version and new product name. Media Browser is now EMBY

I am just after some clarification around setting up MBS. I have MBS installed on a PC that has all my media on it. I then have another PC in my living room with MBC installed on it. Do I need to install codecs either on the MBS PC or MBC PC to be able to play all file types including .mkv files and also have external subtitles working? I have read about transcoding and not sure how it all works and if I need to configure anything to get it all going.

A setting in config that, when checked, would block exit from MBC (like some themes have done). It is very easy to hit the "back" button to many times and accidentally exit out of MBC. For me, it would be best to simply the block the action when checked since I use MBC exclusively on my HTPC. For other, perhaps a sub setting that if the block is enabled, a second check box would throw up a confirmation dialog and exit if the user selects "yes" (like what theme Crystal or Breeze is doing). Thanks.