safe-stremio: Streaming for the Cyberpunk Era

Alright, you like your streaming the same way you like your internet: secure, anonymous, and fully under your control. Meet Safe-Stremio, your badass DIY streaming server powered by Docker, Nginx, and OpenVPN. It’s for digital pirates and cyberpunks who don’t want their media habits exposed to nosy ISPs or prying eyes.

What’s the Deal?

Safe-Stremio puts Stremio Server and Stremio Web behind Nginx, with optional basic auth and rate limiting. OpenVPN can route the container’s internet traffic through your provider. That is a deployment arrangement, not a guarantee of anonymity or leak prevention.

Worried about your VPN dropping? You should be, because the IP monitor that’s supposed to catch it has never worked. It runs in a background subshell forked before OpenVPN comes up, so it never sees the VPN as started and never fires, and even if it did, its shutdown would only kill that subshell. The one thing that does take the container down is the OpenVPN process itself dying. A tunnel that drops while OpenVPN stays alive and reconnects gets nothing, and there’s no firewall rule keeping Stremio’s traffic off your real connection in the meantime, so your real IP can leak.

Why You Need It

The useful part is hosting the streaming server yourself and choosing its network path. Nginx serves the web client and proxies the backend, and the Compose layout keeps LAN access separate from the VPN route. The tunnel failure caveat above still applies. A working web interface is not evidence that your traffic cannot escape through the host’s normal connection.

Setup Guide

Wanna build your cyber fortress? Here’s how:

1. Pull the Docker Image:

   docker pull psyb0t/safe-stremio:latest

2. Run It (quick test, no VPN or VPN without LAN access needed):

   docker run -d --cap-add=NET_ADMIN -e WITH_OPENVPN=true -e USERNAME=user -e PASSWORD=pass -p 8080:80 -v $(pwd)/openvpn/config.ovpn:/vpn-config.ovpn -v $(pwd)/openvpn/auth.txt:/vpn-auth.txt --restart always psyb0t/safe-stremio:latest

Note: With VPN enabled, the container routes all traffic through the VPN, which breaks LAN access. For VPN + LAN setup, use the Docker Compose method below.

3. Configure OpenVPN: Throw in your .ovpn file and credentials for seamless VPN integration.

Docker-Compose Setup

When VPN is enabled, the container routes all traffic through the VPN tunnel, which breaks LAN access (responses route back through VPN instead of local network). The fix is a separate nginx proxy running outside the VPN container on the same Docker network:

services:
  safe-stremio:
    image: psyb0t/safe-stremio:latest
    cap_add:
      - NET_ADMIN
    environment:
      - WITH_OPENVPN=true
      - USERNAME=user
      - PASSWORD=pass
    volumes:
      - ./openvpn/config.ovpn:/vpn-config.ovpn
      - ./openvpn/auth.txt:/vpn-auth.txt
    restart: always
  proxy:
    image: nginx:alpine
    ports:
      - "8080:80"
    configs:
      - source: proxy_conf
        target: /etc/nginx/nginx.conf
    depends_on:
      - safe-stremio
    restart: always
configs:
  proxy_conf:
    content: |
      events { worker_connections 1024; }
      http {
          server {
              listen 80;
              location / {
                  proxy_pass http://safe-stremio:80;
                  proxy_http_version 1.1;
                  proxy_set_header Host $$host;
                  proxy_set_header Upgrade $$http_upgrade;
                  proxy_set_header Connection "upgrade";
                  proxy_set_header X-Real-IP $$remote_addr;
                  proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
                  proxy_set_header X-Forwarded-Proto $$scheme;
              }
          }
      }

The proxy handles LAN requests; safe-stremio handles the VPN tunnel and Stremio. Container-to-container traffic bypasses VPN routing entirely.

Final Steps

Once your container’s up, head to the Stremio Web UI, and under Settings, set the Streaming URL to http://yourdomain:8080/stremio-server/. That way, your web client will be synced with your self-hosted server, making sure you’re streaming like a true digital pirate.

Nginx at Work

Safe-Stremio’s Nginx config handles all your HTTP requests, ensuring smooth and secure streaming. Here’s what it does:

• Proxying Requests: Routes /stremio-server/ to your Stremio server.
• Serving Static Files: Handles direct access to the Stremio Web UI.
• Auth & Rate-Limiting: Keeps out freeloaders and limits brute-force attacks. Only legit users allowed.