psyb0t/safe-stremio
psyb0t/safe-stremio has 41 GitHub stars and 3 forks. GitHot measured 0 stars in 24 hours. Last checked 2026-11-15 05:50 UTC. Last push 2026-11-12.
What you can do
- Basic auth: nginx asks for one username and password on the UI and the streaming server.
- Rate limiting: 1 request per second per IP with a burst of 10. Brute force gets a wall of 503s.
- VPN: OpenVPN inside the container sends Stremio's traffic through your provider, and if OpenVPN dies, the container goes down with it.
- Self-hosted: your server, your rules. Stream what you want, when you want.
Measured star growth
- in 24h
- 0
- in 7 days
- Collecting history
- in 15 days
- Collecting history
- in 1 month
- Collecting history
Net star changes over overlapping periods, not daily totals. Missing measurements are left blank. Stars measure attention, not software quality.
About
Safe-Stremio is your gateway to running Stremio Server and Stremio Web within a Docker container, wrapped in layers of security, anonymity, and badassery. This ain't your grandma's streaming setup. This is for digital pirates and cyberpunks who value privacy and control.
SecurityREADME.md
OriginalSafe-Stremio
Your Secure, Pirate-Friendly Streaming Solution
safe-stremio runs Stremio Server and Stremio Web in one Docker container, behind nginx with a password, a rate limit and an optional OpenVPN client. This ain't your grandma's streaming setup. It's for digital pirates and cyberpunks who want privacy and control.
Note: If Stremio Web says "Streaming Server is not available", you skipped the last step. See Point Stremio Web at your server.
Contents
Features
- Basic auth: nginx asks for one username and password on the UI and the streaming server.
- Rate limiting: 1 request per second per IP with a burst of 10. Brute force gets a wall of 503s.
- VPN: OpenVPN inside the container sends Stremio's traffic through your provider, and if OpenVPN dies, the container goes down with it.
- Self-hosted: your server, your rules. Stream what you want, when you want.
The VPN guard has a known gap: the public IP check in run.sh only logs the address and does not stop the container. The security page has the details. Read it before you trust the VPN with your IP.
Quick start
docker pull psyb0t/safe-stremio:latest
Put your OpenVPN config in ./openvpn/config.ovpn (and credentials, if your VPN needs them, in ./openvpn/auth.txt, username on line 1, password on line 2). Grab docker-compose.yml, change USERNAME and PASSWORD, and spin it up:
docker compose up -d
The Compose file runs safe-stremio plus a small nginx proxy that publishes port 8080. You need the proxy for LAN access with the VPN on, because the container's replies would otherwise go out through the tunnel. Running without the VPN, or with plain docker run, is in Getting started.
Point Stremio Web at your server
Open http://yourdomain:8080, log in, go to Settings, and under Streaming set the server URL to http://yourdomain:8080/stremio-server/. That makes Stremio Web talk to your self-hosted server. Now you're ready to stream like a true digital pirate.
Documentation
The whole manual lives at psyb0t.github.io/safe-stremio.
| Page | What's in it |
|---|---|
| Getting started | Compose and docker run, VPN files, logs, the server URL |
| Configuration | Environment variables, VPN files, ports, the data volume, image tags |
| How it works | Start order, nginx routes, the process watchdog, the LAN proxy |
| Security | What the auth, rate limit and VPN cover, and what they do not |
| Troubleshooting | Every log message and error, and what to do about it |
| Development | Make targets, smoke test, CI and releases |
Development
make lint # shellcheck, shfmt and actionlint in Docker
make test # build the image and run the container smoke test
make help # everything else
Sponsor
License
This project is licensed under the WTFPL. Do whatever the fuck you want. Release notes are in the CHANGELOG.
Stay secure. Stay anonymous. Happy streaming! Hack the planet, one stream at a time.