Skip to content

Backbone security and privacy

Last updated: 2026-10-27

A LAN Backbone moves provider imports and appliance-held data onto hardware you operate. It does not turn a home network into an internet-safe service, and it does not send your provider subscription to the WyreDeck account service.

What stays on the appliance

Depending on the configured sources and source edition, the appliance can store:

  • encrypted provider usernames, passwords, source headers, and protected URLs;
  • imported live, movie, series, episode, and guide data;
  • appliance identity and digests of local client device tokens;
  • content-filter preferences and, on Full, household and playback state; and
  • a local encryption keyfile unless an environment key is supplied.

Provider credentials, provider catalogs, favorites, viewing history, and resume state are not sent to the WyreDeck account service. The appliance must still contact your provider or XMLTV source to refresh the data you configured. Other outbound connections depend on edition and configuration, such as managed TMDB work on Full or WAN account services when enrolled.

The account service handles account, tier, expiry, and paired-device records. Its canonical data boundary is in the WyreDeck Privacy policy.

Protect the database and encryption key together

Provider credentials and protected source values are encrypted at rest. The corresponding key is either in the appliance data directory or supplied through WYREDECK_ENCRYPTION_KEY; an environment value takes precedence over a keyfile.

Keep the database, original key, and required configuration on private persistent storage. They are a recovery pair: a replacement key does not unlock an existing database. Startup validates recognized encrypted values and stops on a missing, malformed, wrong, or mixed key instead of silently generating access under a new identity.

Backups can include both the database and keyfile and must receive the same protection. Do not place key material, environment files, database snapshots, or backup bundles in public source control, tickets, email, or diagnostic archives.

Encryption at rest does not make an exposed management port safe, and backup hashes do not prove that an untrusted bundle is authentic.

Trusted-LAN transport has a specific boundary

The appliance's LAN listener uses HTTP on port 8745. Local bearer tokens can be observed and replayed by someone able to capture traffic on a hostile network. Use only a LAN whose peers and network equipment you trust, restrict inbound access, and never expose the listener directly to a WAN or the internet.

Linux Docker host networking provides no container-network isolation. mDNS makes the service discoverable; it provides neither encryption nor authorization.

WAN account enrollment is a separate connection. Its configured services origin must use canonical HTTPS with valid certificate trust. Do not copy the LAN HTTP pattern into WAN configuration or disable certificate validation to make an enrollment succeed.

Discovery is not authorization

A compatible client creates a short-lived local claim and displays its request code. An operator with appliance command-line access compares and approves that code. Only then does the client receive its one-time appliance-bound device token.

The Backbone stores a digest, not the plaintext device token. Revoking one device does not revoke every other client or change provider credentials. Recover lost local access by listing or revoking devices and approving a fresh claim from the appliance, not by bypassing authentication.

A fresh appliance enables required trust after its first approved claim. An existing populated installation can remain in explicit migration mode until the operator pairs expected devices and enables enforcement. Migration mode is not a permanent guest-access policy.

Local trust proves approval by the appliance operator. It is not WyreDeck Cloud pairing, a subscription check, or proof that a client supports every feature.

Accounts and entitlements stay separate

Local Free use does not require a WyreDeck account. When you choose to use an anonymous account, protect its account number as a bearer credential and keep it out of support messages. The account service cannot recover a lost number.

An enrolled appliance consumes an ordinary device slot reported by the account service; it does not receive a separate appliance quota. Current service configuration, rather than an old tier example, determines the applicable limit.

The appliance is not an entitlement authority. Standard physically omits Premium implementation. Full contains private implementation but still needs the applicable account grant for planned Premium operations. Premium is not active, and payments are unavailable.

A direct TMDB key used by a client is a separate planned client-to-TMDB path. It does not add managed enrichment to Standard or unlock managed Discovery. Review Free, Premium, and Backbone editions before treating a metadata option as an account upgrade.

Practical operator checklist

  • Keep the appliance and clients on a trusted LAN with no direct WAN exposure.
  • Approve only request codes shown on clients you intended to pair.
  • Revoke a local device that is lost or no longer should have access.
  • Preserve the database/key/configuration recovery set before upgrades.
  • Use provider-specific credentials with only the access you intend to grant.
  • Do not weaken provider HTTPS validation or private-network source protections as a general troubleshooting step.
  • Review logs and diagnostic text manually before sharing them.
  • Follow Operate and recover for consistent backup and restore procedures.

For the connection sequence, return to Install and connect.