Magent/docs/installation-and-recovery.md

Installation, backup and recovery

Fresh installation

For a new Portainer installation without a Dockerfile or .env, use the single-file stack guide. It generates persistent deployment secrets and provides a console-only setup-token command. The root stack pulls rephl3xnz/magent:latest with no environment inputs. Confirm the application URL alongside the token when creating your first administrator; managed CORS and cookie security follow that URL automatically. SQLite is fixed at /app/data/magent.db, and API documentation remains disabled. Leave the Compose runtime-security defaults unchanged. The updated image still needs publishing before latest provides this behaviour; repository changes alone do not deploy or publish it. Record deployed digests because latest is mutable.

The manual-secret and source-build instructions below remain supported for other deployments. All environment options and defaults are documented in ENVIRONMENT.md; they are not required inputs to the managed Portainer template.

Start with .env.example. Generate independent random values for JWT_SECRET and SETUP_TOKEN (at least 32 characters each), plus a Fernet SETTINGS_ENCRYPTION_KEY. Never deploy the example placeholders. Keep the environment file private.

python -c "import secrets; print(secrets.token_urlsafe(48))"
python -c "import secrets; print(secrets.token_urlsafe(48))"
python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

The first two commands produce the JWT secret and setup token respectively. The third requires the backend dependencies. Alternatively generate the Fernet key using Python's standard library: python -c "import base64, secrets; print(base64.urlsafe_b64encode(secrets.token_bytes(32)).decode())".

For a manual-secret installation, set the correct browser-facing CORS_ALLOW_ORIGIN, MAGENT_APPLICATION_URL, cookie HTTPS settings and host paths before starting. Changing the application URL in its wizard does not replace its explicit environment CORS policy. Managed Portainer installations instead confirm their origin during token-authorized first-admin setup, and automatically follow that saved origin for CORS and cookie security. Neither mode changes reverse-proxy configuration or creates certificates.

After docker compose -f compose.yml -f compose.build.yml up -d --build for a source build, visit the frontend. A new database redirects to /setup:

1. Enter SETUP_TOKEN and create a local administrator with a unique password of at least 12 characters. Alternatively, set ADMIN_USERNAME and ADMIN_PASSWORD in the environment before the first start, then sign in with that account.
2. Expand each app you use: Jellyfin, Seerr/Jellyseerr, Sonarr, Radarr, Prowlarr, qBittorrent, Bazarr and Jellystat. Enter its internal address and credentials, then Save & test. For Sonarr/Radarr, a successful check loads quality profiles and root folders.
3. Set site access, request refresh/retention and optional SMTP preferences. Invite signup remains invite-only.
4. Review and finish. Magent starts its configured background jobs, unless BACKGROUND_TASKS_ENABLED=false.

Use server-reachable addresses: localhost in a container refers to that container. Optional apps can be skipped. Each successful save persists; closing the tab leaves setup resumable. Unsaved form fields are not retained. Remove SETUP_TOKEN after finishing. Bootstrap is permanently disabled after setup, and cannot replace an existing administrator. Administrators can revisit the wizard from Settings without resetting the installation.

Upgrades with an existing users table are marked configured automatically. Setup status reveals only whether setup is needed and whether the first administrator is missing. Configuration and wizard progress require administrator authentication. First-admin creation uses a constant-time token comparison, persistent rate limits and a database transaction to prevent concurrent claims.

Create a backup

Open Settings → Advanced tools → Backup & restore (/admin/backups). Choose a unique backup passphrase of 12–1024 characters, confirm it, optionally include the filesystem artwork cache, and download the .magent-backup file.

Every backup includes:

• A consistent SQLite snapshot: users, password hashes, invite records, requests, issues, settings, saved statistics, subscriptions and database-backed caches.
• Portable runtime configuration, including environment-provided app credentials. Secrets are decrypted only inside the private export staging area and encrypted archive; they are re-encrypted with the destination installation key when restoring.
• Custom branding (data/branding/logo.png and favicon.ico).

The optional cache adds supported TMDB artwork from data/artwork/tmdb. In-memory caches are rebuilt, not backed up. Media files, the connected apps' databases, log files, .env, TLS private keys, host paths, signing/encryption keys and deployment/network controls are not included. Keep a separate secure record of the deployment configuration and backup passphrase.

Backups use authenticated AES-256-GCM encryption with a per-backup salt and scrypt-derived key. The passphrase is never stored by Magent and cannot be recovered. Keep backups and their passphrases separately, off the Magent host. Treat backups as sensitive even though encrypted.

Current limits: 32 MiB encrypted archive, 128 MiB expanded data, and 20,000 entries. These bound memory and disk use; including a large artwork cache can exceed them. Retry without artwork if necessary. For larger installations, use a separate operator-managed offline volume/database backup; this UI does not silently omit oversized data. Automatic scheduled backups and media-server backups are not part of this feature.

The frontend and backend accept up to 34 MiB for the whole multipart request, including the 32 MiB file. Configure any external reverse proxy's upload limit accordingly (for example client_max_body_size 34m in nginx); otherwise it may reject valid files before they reach Magent.

Restore safely

1. Make a fresh backup of the destination. Stop external writes/other backend processes sharing its SQLite file. The supplied deployment uses one backend worker; do not run restore against a multi-worker/shared-database deployment.
2. Sign in as an administrator, select a .magent-backup, enter its passphrase and type RESTORE. A fresh replacement installation must first create its temporary administrator through /setup; then use the Restore it here link before connecting apps.
3. Upload and stage the restore. Magent checks authentication, encrypted integrity, archive paths and sizes, checksums, SQLite integrity, schema compatibility and an active restored administrator. Live data is unchanged at this point. A pending restore can be cancelled from the same page.
4. Restart the application using your normal deployment process, for example docker compose restart magent for a source build, or restart the container in Portainer. The UI never restarts a server automatically.
5. On startup, before schema initialization or workers, Magent creates a private rollback copy, replaces the database/selected assets and records the result. Failed or interrupted replacement is rolled back using a durable journal. Review the backend logs if startup stops.
6. Sign in with an account from the restored backup, verify Settings/service checks, requests, issues and invite policy, then create a new backup. Old sessions and password-reset tokens are invalidated. Existing invite records and links are retained, with their original expiry and usage state.

Restore replaces the destination database; it does not merge changes made after the backup. After staging, pause normal usage until the restart so new writes are not mistaken for restored data. Do not change the destination encryption key between staging and restart. Restoring earlier invite state can also restore its remaining uses: review active invitations after recovery.

Use the same Magent version for restore, then upgrade normally. Portable settings follow the backup, but destination host identity, JWT/encryption keys, local paths, TLS/cookie/proxy controls and ports remain destination-owned. For managed installations, restore also preserves the destination's confirmed application URL rather than adopting the backup source's URL; its CORS/cookie policy therefore stays aligned with the destination site. Configure and verify that destination URL before staging a restore. Review service addresses when moving hosts. Without the optional artwork cache, database artwork flags are reset and missing artwork can be fetched again; the existing destination artwork directory is left in place.

Recovery files

The backups/ directory beside the configured SQLite database contains private staging, lock/journal/status files and rollback-<id>/ copies. It is not a library of exported encrypted downloads. Rollback copies contain the old database and assets; protect the data volume with host encryption and restrictive access. Magent does not automatically delete rollback copies after success. After validating the restored installation and saving a separate backup, an operator may archive or remove the specific old rollback directories during maintenance. Never remove an active pending/ directory or restore-journal.json during a restore.

Insufficient disk space or invalid input stops the operation rather than partially accepting a backup. Allow room for the upload, extracted staging database/assets, live data and a rollback copy. The supplied Docker image's unprivileged user must have write access to the persistent data volume. Do not delete the data volume or replace .env to retry setup or recovery.