Magent/docs/installation-and-recovery.md

Installation, backup and recovery

Fresh installation

Choose Docker Compose/CLI, Portainer, native Linux services or foreground source installation from the installation overview. Follow that guide for private configuration, startup, health checks and the correct setup-token command.

The managed container image is published as rephl3xnz/magent:latest; its root Compose file has no environment inputs and retains explicit security defaults. Managed containers persist generated secrets and confirm their application URL when creating the first administrator. Native/manual installations instead load their own private keys, exact URL/CORS and HTTP/HTTPS cookie policy explicitly. See ENVIRONMENT.md for all environment options. Neither mode configures DNS, installs a reverse proxy or issues TLS certificates.

Once the selected installation is healthy, visit its frontend. A new database redirects to /setup:

1. Enter SETUP_TOKEN and create a local administrator with a unique password of at least 12 characters. Alternatively, set ADMIN_USERNAME and ADMIN_PASSWORD in the environment before the first start, then sign in with that account.
2. Expand each app you use: Jellyfin, Seerr/Jellyseerr, Sonarr, Radarr, Prowlarr, qBittorrent, Bazarr and Jellystat. Enter its internal address and credentials, then Save & test. For Sonarr/Radarr, a successful check loads quality profiles and root folders.
3. Set site access, request refresh/retention and optional SMTP preferences. Invite signup remains invite-only.
4. Review and finish. Magent starts its configured background jobs, unless BACKGROUND_TASKS_ENABLED=false.

Use server-reachable addresses: localhost in a container refers to that container. Optional apps can be skipped. Each successful save persists; closing the tab leaves setup resumable. Unsaved form fields are not retained. Manual/native operators remove the environment SETUP_TOKEN after administrator creation and restart the backend. Managed-container operators must not edit/delete their generated secrets file; the console command and bootstrap refuse token reuse after the first administrator exists. Administrators can revisit the wizard from Settings without resetting the installation.

Upgrades with an existing users table are marked configured automatically. Setup status reveals only whether setup is needed and whether the first administrator is missing. Configuration and wizard progress require administrator authentication. First-admin creation uses a constant-time token comparison, persistent rate limits and a database transaction to prevent concurrent claims.

Create a backup

Open Settings → Advanced tools → Backup & restore (/admin/backups). Choose a unique backup passphrase of 12–1024 characters, confirm it, optionally include the filesystem artwork cache, and download the .magent-backup file.

Every backup includes:

• A consistent SQLite snapshot: users, password hashes, invite records, requests, issues, settings, saved statistics, subscriptions and database-backed caches.
• Portable runtime configuration, including environment-provided app credentials. Secrets are decrypted only inside the private export staging area and encrypted archive; they are re-encrypted with the destination installation key when restoring.
• Custom branding (data/branding/logo.png and favicon.ico).

The optional cache adds supported TMDB artwork from data/artwork/tmdb. In-memory caches are rebuilt, not backed up. Media files, the connected apps' databases, log files, .env, TLS private keys, host paths, signing/encryption keys and deployment/network controls are not included. Keep a separate secure record of the deployment configuration and backup passphrase.

Backups use authenticated AES-256-GCM encryption with a per-backup salt and scrypt-derived key. The passphrase is never stored by Magent and cannot be recovered. Keep backups and their passphrases separately, off the Magent host. Treat backups as sensitive even though encrypted.

Current limits: 32 MiB encrypted archive, 128 MiB expanded data, and 20,000 entries. These bound memory and disk use; including a large artwork cache can exceed them. Retry without artwork if necessary. For larger installations, use a separate operator-managed offline volume/database backup; this UI does not silently omit oversized data. Automatic scheduled backups and media-server backups are not part of this feature.

The frontend and backend accept up to 34 MiB for the whole multipart request, including the 32 MiB file. Configure any external reverse proxy's upload limit accordingly (for example client_max_body_size 34m in nginx); otherwise it may reject valid files before they reach Magent.

Restore safely

1. Make a fresh backup of the destination. Stop external writes/other backend processes sharing its SQLite file. The supplied deployment uses one backend worker; do not run restore against a multi-worker/shared-database deployment.
2. Sign in as an administrator, select a .magent-backup, enter its passphrase and type RESTORE. A fresh replacement installation must first create its temporary administrator through /setup; then use the Restore it here link before connecting apps.
3. Upload and stage the restore. Magent checks authentication, encrypted integrity, archive paths and sizes, checksums, SQLite integrity, schema compatibility and an active restored administrator. Live data is unchanged at this point. A pending restore can be cancelled from the same page.
4. Restart the backend using your installation guide: for the documented Compose project, docker compose -f compose.yml -p magent restart magent; for direct Docker, docker restart magent; in Portainer, restart its Magent container; for native Linux, sudo systemctl restart magent-backend.service. Substitute your actual project/container/unit names. Foreground users stop and relaunch their API process with the same working directory and private environment. The UI never restarts a server automatically.
5. On startup, before schema initialization or workers, Magent creates a private rollback copy, replaces the database/selected assets and records the result. Failed or interrupted replacement is rolled back using a durable journal. Review the backend logs if startup stops.
6. Sign in with an account from the restored backup, verify Settings/service checks, requests, issues and invite policy, then create a new backup. Old sessions and password-reset tokens are invalidated. Existing invite records and links are retained, with their original expiry and usage state.

Restore replaces the destination database; it does not merge changes made after the backup. After staging, pause normal usage until the restart so new writes are not mistaken for restored data. Do not change the destination encryption key between staging and restart. Restoring earlier invite state can also restore its remaining uses: review active invitations after recovery.

Use the same Magent version for restore, then upgrade normally. Portable settings follow the backup, but destination host identity, JWT/encryption keys, local paths, TLS/cookie/proxy controls and ports remain destination-owned. For managed installations, restore also preserves the destination's confirmed application URL rather than adopting the backup source's URL; its CORS/cookie policy therefore stays aligned with the destination site. Configure and verify that destination URL before staging a restore. Review service addresses when moving hosts. Without the optional artwork cache, database artwork flags are reset and missing artwork can be fetched again; the existing destination artwork directory is left in place.

Recovery files

The backups/ directory beside the configured SQLite database contains private staging, lock/journal/status files and rollback-<id>/ copies. It is not a library of exported encrypted downloads. Rollback copies contain the old database and assets; protect the data volume with host encryption and restrictive access. Magent does not automatically delete rollback copies after success. After validating the restored installation and saving a separate backup, an operator may archive or remove the specific old rollback directories during maintenance. Never remove an active pending/ directory or restore-journal.json during a restore.

Insufficient disk space or invalid input stops the operation rather than partially accepting a backup. Allow room for the upload, extracted staging database/assets, live data and a rollback copy. The supplied Docker image's unprivileged user must have write access to the persistent data volume. Do not delete the data volume or replace .env to retry setup or recovery.