Jump to content

Ombi on PMSS

From Pulsed Media Wiki

Ombi is a media request page with its own user accounts, served at your own Pulsed Media seedbox address under /user-USERNAME/ombi/ in about 200 MiB of memory when idle. The steps below create its admin before any port opens, without needing a media server first, and give it a proxy fragment that keeps Ombi's own sign-in working. It runs in rootless Docker inside your account. Tested on a Pulsed Media seedbox on 24 October 2026 with lscr.io/linuxserver/ombi v4.53.10: the install, the admin, the login and Ombi's API through the panel address were tested; connecting a media server, Sonarr or Radarr, and making a request, were not.

Privacy

Level: MEDIUM. Using Ombi reduces your privacy. What leaves your account:

  • Every Ombi page loads its fonts and icons from Google (fonts.googleapis.com), so Google sees the IP address of each visitor and that an Ombi page was opened. The served page in the test had four such links.
  • Ombi has a setting, "Allow us to collect anonymous analytical data (Uses Google Analytics)", which its source turns on at first setup (Ombi 4.53.10, src/Ombi/Startup.cs). The web page served in the test contained no Google Analytics code, but switch the setting off anyway; see Configure.
  • Ombi looks up titles on TheMovieDB, and stores the tokens of the media server you connect.

Source: the Ombi repository at v4.53.10 and the page served in the test.

Requirements

Need Ombi on PMSS
Memory About 200 MiB idle in the test. userShowLimits shows your account's memory use against its limit.
Disk The image is 444 MB.
Own login Yes. The admin is created in step 2, while no port is published.
Address https://SERVER/user-USERNAME/ombi/ through your own web server. The image's BASE_URL setting carries the path, so the proxy fragment needs no map-urlpath. Seerr, another request manager, has no such setting and does not work under a path.
Web server lighttpd 1.4.46 or newer for the fragment in step 4; /usr/sbin/lighttpd -v shows yours. The test server had 1.4.69.
Other apps A media server such as Jellyfin and Sonarr or Radarr for requests to lead anywhere; see Integrate.

Ombi logins you create let other people into an app on your service. Who gets one, and what they do with it, is your responsibility as the account holder.

Install

Run these over SSH as your own account. Replace USERNAME with your account name, SERVER with the server name in your panel address, and PORT with a free port between 2000 and 38000 that ss -tln does not list. Until its admin exists, Ombi lets anyone who reaches it create one, and other accounts on the same server can connect to 127.0.0.1. So it runs first with no published port, gets its admin, and only then gets its port.

1. Make the folder, the settings file and a random password, and start Ombi with no published port. umask 077 makes the files you create in this shell readable only by you. The image is pinned to the digest that was tested. 

mkdir -p ~/docker/ombi/config && chmod 700 ~/docker/ombi
umask 077
printf 'PUID=0\nPGID=0\nTZ=Etc/UTC\nBASE_URL=/user-USERNAME/ombi\n' > ~/docker/ombi/ombi.env
openssl rand -base64 24 > ~/docker/ombi/admin.pw
IMG=lscr.io/linuxserver/ombi@sha256:ea8248433a3d37eaf46a59e4cb5160814d35a5b5ba35eac47a5018747acf2632
docker run -d --name ombi --env-file ~/docker/ombi/ombi.env -v $HOME/docker/ombi/config:/config --restart unless-stopped $IMG
sleep 45

PUID=0 and PGID=0 make the files Ombi writes belong to your own account. The sleep gives Ombi time to start; in the test its log reported the port ready within about 40 seconds. A fail: line about __EFMigrationsHistory in the log on first start is harmless.

2. Create the admin from inside the container, in the same shell as step 1. 

printf '{"username":"admin","password":"%s","usePlexAdminAccount":false}' "$(cat ~/docker/ombi/admin.pw)" | \
  docker exec -i ombi curl -s -X POST -H 'Content-Type: application/json' -d @- http://127.0.0.1:3579/user-USERNAME/ombi/api/v1/Identity/Wizard

It prints {"result":true,"errors":[]}. Ombi accepts this request only once: in the test a second attempt answered Looks like there is an existing user!.

3. Start Ombi again with its port on 127.0.0.1. The admin and settings stay in the config folder. The command uses IMG from step 1; in a new shell, run the IMG= line from step 1 first. 

docker rm -f ombi
docker run -d --name ombi --env-file ~/docker/ombi/ombi.env -p 127.0.0.1:PORT:3579 -v $HOME/docker/ombi/config:/config --restart unless-stopped $IMG

4. Add the proxy fragment and check the syntax. Run the check from your home folder. 

cat > ~/.lighttpd/custom.d/ombi.conf << 'EOF'
$HTTP["url"] =~ "^/user-USERNAME/ombi/" {
  auth.require = ()
  $REQUEST_HEADER["Authorization"] =~ "^Basic " {
    setenv.set-request-header = ( "Authorization" => "" )
  }
  proxy.server = ( "" => ( ( "host" => "127.0.0.1", "port" => PORT ) ) ),
  proxy.header = ( "upgrade" => "enable" )
}
EOF
/usr/sbin/lighttpd -t -f ~/.lighttpd.conf

The last command prints Syntax OK. If it prints an error, fix or delete ombi.conf at once: a broken fragment keeps your web panel down at the next restart.

This fragment differs from most guides on this wiki. A browser logged into your panel sends your panel login, which is your account password, with every request in an Authorization: Basic header. Ombi signs its own users in with an Authorization: Bearer token in the same header. The usual line, setenv.set-request-header = ( "Authorization" => "" ) on its own, removes both: in the test, sign-in then succeeded and every request after it was refused with 401. The condition removes only the panel's Basic login, so Ombi's token gets through and your password does not. auth.require = () lets requests past your panel login to Ombi's own sign-in. Your web server usually picks up the file within about a minute (Lighttpd Custom Configuration); the first fragment of an account can take longer, see Troubleshooting.

What the test ran: these steps, with a fixed port in place of PORT.

Configure

  • Open https://SERVER/user-USERNAME/ombi/ and sign in as admin with the password that cat ~/docker/ombi/admin.pw shows.
  • In Settings → Ombi, switch off Allow us to collect anonymous analytical data (Uses Google Analytics).
  • Ombi's own base URL setting stops working while BASE_URL is set in ombi.env; change the path there, then run step 3 again.
  • Add a media server and Sonarr or Radarr in Ombi's settings; see Integrate. Not tested.

Integrate

Not tested. Ombi's setup wizard goes on to connect a media server such as Jellyfin; the test created the admin and stopped there, and connecting Sonarr or Radarr was not tried either. Install Media Stack installs Jellyfin, Sonarr and Radarr directly in your account. Inside a container, 127.0.0.1 is the container itself, not the server, and no address that a container can use to reach those apps has been tested on Pulsed Media servers.

Test

  1. docker ps --filter name=ombi shows the container as Up.
  2. https://SERVER/user-USERNAME/ombi/ shows Ombi's sign-in page. Sign in as admin. In the test the sign-in through this address returned a token, and a request made with that token after it succeeded; this was checked with Ombi's API, not in a browser session.
  3. A request with no login straight to the port is refused, which is what another account on the server sees:
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:PORT/user-USERNAME/ombi/api/v1/Identity/Users

In the test this returned 401, and so did a sign-in with a wrong password.

Ombi's sign-in page at /user-USERNAME/ombi/ in the 24 October 2026 test.

Uninstall

docker rm -f ombi
rm -f ~/.lighttpd/custom.d/ombi.conf
touch ~/.lighttpd/custom

Deleting a fragment changes no remaining file, so touch ~/.lighttpd/custom makes your web server restart without it (deleting or disabling a fragment explains why). docker rmi lscr.io/linuxserver/ombi@sha256:ea8248433a3d37eaf46a59e4cb5160814d35a5b5ba35eac47a5018747acf2632 frees the image's 444 MB.

Deleting the data is your choice. rm -rf ~/docker/ombi deletes the password file, the settings file and Ombi's config folder with its database, users and stored tokens. The test ran these commands and also removed the image.

Troubleshooting

  • Sign-in succeeds, then Ombi's requests are refused: the fragment removes Ombi's own token as well as the panel login. In the test, with the plain removal line, every request after sign-in returned 401. Use the conditional form from step 4.
  • The address without the final slash answers 404: the fragment matches /user-USERNAME/ombi/ with the slash, as in the test. Use the address with it.
  • /usr/sbin/lighttpd -t reports an error on the $REQUEST_HEADER line: your lighttpd is older than 1.4.46. Check with /usr/sbin/lighttpd -v. Not seen in the test.
  • Step 2 prints nothing or a connection error: Ombi was not ready yet. Wait a little longer and run step 2 again; in the test Ombi was ready within about 40 seconds.
  • The address still answers 404 several minutes after you added the fragment: your web server has not picked it up yet; in the test the first fragment of an account took about 15 minutes. Run touch ~/.lighttpd/custom.
  • docker stats shows the same memory figure for every container: on some servers rootless Docker reports the whole account there. The figures on this page are the sum of the container's own processes.
  • docker pull or docker run fails before Ombi starts: see the troubleshooting section of the Rootless DOCKER page.

See also

Retrieved from "https://wiki.pulsedmedia.com/index.php?title=Ombi_on_PMSS&oldid=1005275"