Wariarr
Invite links and an admin dashboard for a self-hosted Plex server, written in Rust.
Running on the home server
Description
Sharing a Plex server with friends usually means sending invites by hand and explaining the app setup again for each person. Wariarr puts that in one place. A guest opens a link, enters the email on their Plex account, and the share is created on plex.tv; the setup instructions are served from the same site. I sign in to see invitations, who has accepted, what is playing now and the server's viewing history.
Block diagram
- Join page
- Invite rules
- SQLite store
- Plex backend
- plex.tv
Decisions
Reserve the use before asking Plex to share
The redeem path takes a use with a guarded SQL UPDATE before it calls the media server, and gives the use back if the grant fails. A counter checked after the grant cannot refuse anyone, because by then both shares exist; a concurrent-redeem test got two guests through one link that way. The member row is written only after Plex confirms the share, so the database never lists access that is not there.
A session cookie plus an Origin check on admin writes
The admin pages started behind HTTP Basic, which a browser replays on requests another site causes, so any page on the internet could post a delete. They now use a login that sets an HttpOnly, SameSite=Strict session cookie, and every write under /admin must carry an Origin naming this site. The Origin check is the half that does not depend on the browser honouring SameSite.
Pure-Rust TLS with compiled-in trust anchors
The Plex client moved from reqwest to hyper with rustls. reqwest's defaults pulled in AWS-LC, which needs a C compiler and cmake, and Cargo feature unification meant no setting in this workspace could turn it off. Root certificates come from webpki-roots at build time, so the container image needs no CA package. The cost is a lower-level HTTP client to maintain, and a root store that changes only when the binary is rebuilt.
Errata
- Withdrawing access is unverified against live Plex, and the reaper that would do it automatically ships turned off.
- Only the all-library invite is proven end to end. A share limited to selected libraries still needs a live check.
Revision history
| Version | Changes |
|---|---|
| Unreleased | Docker deployment, the admin dashboard with users and watch history, session login with an Origin check, and fixes to one-use links. |
| 0.1.0 | First cut: create, redeem and list invites, a CLI, and a reaper that is off by default. |