Install and connect a LAN Backbone¶
Last updated: 2026-10-27
These instructions describe the declared Linux Docker x86-64 deployment profile for an approved Standard source distribution. They do not announce a public download, published image, ARM64 support, or support for every Docker host. Standard's release location and license have not been finalized.
Run commands from the distribution root, which contains its Dockerfile and migration files. Use a trusted LAN and persistent storage before adding provider credentials.
1. Prepare the host and network¶
- Install a compatible Docker Engine on the declared Linux x86-64 host.
- Keep the host and intended clients on the same trusted LAN.
- Allow outbound access to your configured provider and guide sources.
- Restrict inbound access to the trusted LAN. Never expose this service directly to a WAN or the internet.
- Plan persistent storage for the database, encryption key, and configuration.
The examples use a named volume called wyredeck-data. The container runs as an unprivileged user and stores its database and generated key under /app/data.
2. Build, migrate, and start¶
Build the image, apply migrations as a separate required step, and start only after migration succeeds:
docker build -t wyredeck-backbone-standard .
docker run --rm \
-v wyredeck-data:/app/data \
wyredeck-backbone-standard alembic upgrade head
docker run -d \
--name wyredeck-backbone \
--network host \
--restart unless-stopped \
-v wyredeck-data:/app/data \
wyredeck-backbone-standard
Do not substitute a development auto-reload server for this production path. Container restart does not apply migrations. Future upgrades must repeat the explicit backup and migration procedure in Operate and recover.
Linux host networking lets mDNS discovery work, but it also exposes port 8745 on host interfaces without container-network isolation. Use appropriate host and network controls. The LAN service uses HTTP inside that trusted-network boundary; it is not an internet-safe listener.
Verify that the appliance container is running and reachable on port 8745 from your trusted LAN. Service reachability confirms container and database state; it does not authorize a client or prove client compatibility.
3. Discover or manually attach a client¶
mDNS advertisement is enabled by default as _wyredeck._tcp.local.. A compatible client can list the appliance by display name and appliance identity. If multicast discovery is blocked, use the client's manual LAN Backbone connection flow and enter the appliance hostname or address and port 8745 instead.
Discovery and a successful service check are not authorization. A fresh appliance requires a local claim before protected catalog or provider operations become available.
4. Approve local client trust¶
Start LAN Backbone setup on the client and keep its request code visible. On the appliance host, inspect pending requests and approve only the matching code:
docker exec wyredeck-backbone wyredeck-backbone trust pending
docker exec wyredeck-backbone wyredeck-backbone trust approve REQUEST_CODE
docker exec wyredeck-backbone wyredeck-backbone trust devices
The client receives its own appliance-bound token once after approval. The Backbone stores only a token digest. The first approved claim on a fresh appliance enables required trust automatically; an IP address, mDNS record, or previous connection does not create trust.
An upgraded populated appliance can remain in migration_open for read-only legacy catalog continuity. Pair every expected client, verify trust devices, then enable enforcement deliberately:
Read the device list and type the requested confirmation. Do not treat migration mode as the desired final state.
Local trust is separate from WyreDeck Cloud pairing. If an approved Full deployment enrolls with WAN services, its configured services origin must be a canonical https://host[:port] origin with valid certificate trust. That WAN HTTPS rule does not make the trusted-LAN HTTP listener suitable for WAN exposure, and local LAN claiming does not require a Cloud account.
5. Configure a provider from an approved owner client¶
Provider administration requires an approved owner client authenticated with its appliance-issued credential. This distribution has no appliance web management console and no provider-management CLI. Creating a provider does not automatically complete an import.
Supply the exact Xtream server URL, username, password, and optional guide URL (or live M3U playlist URL and optional XMLTV guide URL) from your lawful provider, and never place real credentials in shell history, URLs, screenshots, or support messages. Private-network M3U source access is refused by default unless explicitly enabled for that M3U source, which is not a general certificate or security bypass.
After adding a provider, queue the initial full sync from the owner client and check sync status before expecting a complete catalog.
For the shared feature boundary, see the Backbone overview. For credential handling, read Security and privacy.