Your films and series, ready to watch.

The compose file

Create an empty folder and save this file as docker-compose.yml. It works as it stands: the app answers on the server's port 3000, and its data lives in a named volume.

# Laterna - minimal deployment
# No .env: secrets are generated on first launch,
# and every setting is made in the setup assistant.

services:
  cine-app:
    image: ghcr.io/lk59/cine-app:latest   # or :<sha> to pin a version
    container_name: cine-app
    restart: unless-stopped

    # Reachable from the server only (http://localhost:3000).
    # Behind a proxy on the same Docker network, remove these two lines.
    ports:
      - "127.0.0.1:3000:3000"

    # The Docker network of your reverse proxy (and ideally Jellyfin).
    # networks:
    #   - proxy

    volumes:
      # Database, settings, secrets and logs: all of the app's state.
      - cine-data:/app/data
      # Optional, read-only: your media, for the statistics.
      # - /path/to/media:/mnt/media/video:ro

    environment:
      - TZ=Etc/UTC
      # Behind an HTTPS proxy (step 3):
      # - COOKIE_SECURE=true
      # - TRUSTED_PROXIES=nginx-proxy-manager

    # Optional: a memory ceiling.
    # mem_limit: 2g

    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/api/ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s

volumes:
  cine-data:
    name: cine-app-data   # fixed name, used by backups

# networks:
#   proxy:
#     external: true   # the name `docker network ls` gives

Set TZ to your time zone (Europe/London, America/New_York...). To keep the data in a ./data folder next to the file, replace the volume line with - ./data:/app/data and create the folder first: mkdir data && sudo chown 1001:1001 data.

Start and check

After about a minute, the container reads "healthy".

docker compose up -d
docker compose ps
docker compose logs cine-app | grep "setup code"

On a new install, the logs print a one-time setup code. The assistant asks for it to create the admin account, so only someone with access to the server can read it.

If the container stops, its last log line gives the reason. The most common case is a ./data folder owned by root: sudo chown -R 1001:1001 data.

Behind a reverse proxy

HTTPS enables home-screen install, notifications and every player feature. Pick your proxy:

large_client_header_buffers 4 32k;
client_max_body_size 110m;

laterna.example.com {
	request_body {
		max_size 110MB
	}
	reverse_proxy cine-app:3000
}

In the compose file, join the app to the proxy's network (the networks blocks), remove ports, then uncomment these two lines with your proxy's container name:

      - COOKIE_SECURE=true
      - TRUSTED_PROXIES=nginx-proxy-manager   # or caddy, traefik...

Restart with docker compose up -d. Keep these two lines commented while you test over http://.

The setup assistant

Open your address: the assistant shows until setup is finished. Each screen saves when you press Next, and tests the service you just filled in.

1. Welcomethe install's language
2. Accountthe setup code, then the local admin
3. Jellyfinaddress and API key, seen from the container
4. TMDBthe API key
5. LibraryRadarr and Sonarr, optional
6. ExtrasJellyseerr, qBittorrent, Bazarr, ratings, playback
7. Deploymentthe compose options, with the line to copy
8. Finisha summary of what is available

Addresses are seen from inside the container: use the container name (http://jellyfin:8096) on a shared Docker network, or the server's LAN address.

And after

Viewers sign in with their Jellyfin account, and Jellyfin admins are Laterna admins.

docker compose pull && docker compose up -d

docker compose stop
docker run --rm -v cine-app-data:/data -v "$PWD":/backup alpine \
  tar czf /backup/laterna-$(date +%F).tgz --exclude=./image-cache -C /data .
docker compose start

Migrations run at startup, and open tabs move to the new version between two plays. Keep config/secrets.json in every backup.