1. PDO

2. PDO7-SQLITE

3. PHP7-ZIP

4. PHP7-SESSION

5. SimpleXML

6. OPENSSL

7. SQLITE3

8. CURL [For Plex & Emby Logins]

9. PHP7-LDAP [For LDAP Logins]

10. PHP7-XMLRPC [For rTorrent Homepage Item

The default backend is Organizr's built in user management. It allows all user functions such as:

• Add Users

• Delete Users

• Edit Users

Organizr + Backend

While using the default backend from Organizr, you may also add a secondary backend server to utilize as another option to authenticate. Using this option still allows you the same user functions from Organizr's backend listed above.

To get to the other backends head to the above path and change the Authentication Type option to Organizr DB + Backend and change the Authentication Backendoption.

Limitation

Coming soon...

Tab Setup

Replace komga-domain with the actual domain of your Komga instance.

Adapted from: https://technicalramblings.com/blog/optimizing-php-fpm-to-get-faster-load-times-of-tabs-in-organizr/

1. Download PHP for Windows from here: http://windows.php.net/download (Non Thread Safe version used in this guide)

2. Create a folder called PHP under your Nginx directory e.g. C:\nginx\php and copy the downloaded files to this folder

Running PHP as a service

1. Install NSSM - Skip to Step 2 if already installed

   1. Download NSSM from: https://nssm.cc/download

   2. Copy the nssm.exe from the win32 or win64 folder depending on your system to C:\Windows\System32

2. If you’ve got nssm already setup, open command prompt as admin.

3. Type in the following cmd nssm install php

   1. Path = C:\nginx\php\php-cgi.exe

   2. Startup directory = C:\nginx\php
4. Install Service

5. On the opened cmd prompt type in nssm start php to start the PHP service.

6. If the installed PHP service doesn’t start, then try manually running the php-cgi.exe file in C:\nginx\php\

   1. If you get a missing ‘VCRUNTIME’ related error then follow the solution on this link:

7. Make a copy of one of the php.ini-development or php.ini-production files and rename it to php.ini

8. Open the php.ini file and search for the following and uncomment each:

   1. extension_dir = "ext"

   2. extension=php_openssl.dll

   3. extension=php_pdo_sqlite.dll
9. Please note that if you are running PHP 7.2 or higher, look for the below lines and uncomment them instead:

   1. extension_dir = "ext"

   2. extension=openssl

   3. extension=pdo_sqlite
10. Also, uncomment the following line and add ext to the end of it:

    1. sqlite3.extension_dir =

       1. So that is becomes: sqlite3.extension_dir = ext

11. On the opened cmdprompt type in nssm restart php to restart the PHP service to apply the changes in php.ini.

Ubuntu & Debian

Download and Install

Add the repository

Install

Then, to be sure all of the PHP packages are installed, run the following command with your package manager. Some of these may also require other dependencies, so select "Yes" to install those as well.

Here is an example calibre.conf file for a subdomain of https://domain.com/calibre

Open the Tab Editor and go to Homepage Items then finally select Custom HTML

Next you will Click which Custom HTML segment you want to use and Enableit then change the Minimum Authentication to the group you want to allow to see it. Next you will copy the code from above and paste it into the box at the bottom. Finally hit the 💾 button.

Outcome

A User who is logged in

A User who is not logged in

All that you need to do is click the Create Backup Button

Once the backup process completes, the new back up will be listed at the bottom of the back up listing. There are 2 buttons that are accessible for each backup.

The left button is the download button which will download the zip file that includes all the backed up files. The right button will delete that specific backup zip file.

Restoring Organizr

Manual Restore Process

1. Install Organizr as you would normally

2. Unzip the backup zip file somewhere

   1. Inside the zip file you will find the folder structure of where the files need to be placed.

      1. If you placed the database-folder elsewhere, you need to update the 'dbLocation' => 'dbPath' value in config.php

3. Restart the docker (or process if not in docker) and refresh the web page for Organizr

Subfolders

For configs that are just a location block, you are going to put them inside the rp-subfolder.conf file. We're going to use Sonarr as an example. Using these will create a reverse proxy that looks like http://domain.com/app

Things that may need changed in this:

If your Sonarr isn't running on the same machine, you will need to change out the 127.0.0.1 to the IP of the machine where it is running. If you are running it on a non-standard port this is also where to change it. Make sure to change it in both places.

• If you are changing the location to something else, make sure it too is changed in both places.

Subdomains

For configs that are a server block, you are going to put them inside the rp-subdomain.conf file. We're going to use Sonarr as an example as well. Using these will create a reverse proxy that looks like http://app.domain.com

Things that may need changed in this:

• Same as the subfolder, proxy_pass http://127.0.0.1:8989; will need to be if your Sonarr isn't running on the same machine, you will need to change out the 127.0.0.1 to the IP of the machine where it is running. If you are running it on a non-standard port this is also where to change it.

• This example is an SSL server block, if you are just running on HTTP, the listen 443 ssl; will need to be changed and the lines that begin with ssl will need to be removed.

• The ssl_certificate and ssl_certificate_key need to be changed to where your certs are. I recommend copying them out of the nginx.conf file.

• If you get:[emerg] 17144#3272: the size 10485760 of shared memory zone "SSL" conflicts with already declared size 52428800 remove or comment out the ssl_session_cache builtin:1000 shared:SSL:10m; line

Updating SSL Certificates

If you are adding a new subdomain and are using SSL certificates, and didn't already plan ahead when running the installer or use a wildcard certificate, you will need to update the certificate to have the new subdomains. To make this easier, in C:\nginx\winacme there is a batch script called owi_sslupdater.bat, like the installer, that just does the certificates and won't make you reinstall the whole thing. Run through the prompts to update your certificates. You shouldn't need to do the next step if you're doing this because it already reloads NGINX.

Reloading the NGINX config

Once you've made all your changes, you need to tell NGINX to reload the config. You can also test the config before reloading it. Open up a command prompt window as admin and do the following:

The first command after changing into the nginx directory tests the config. This should come back with syntax is ok. If it doesn't, don't run the next command. After running those commands, the reverse proxies should be accessible.

Miscellaneous Errors

If you do run into an error when testing the config, it will usually tell you the line on which the syntax error is. If it is related to a curly brace, that line is not always accurate because it is giving the line where it found something it shouldn't and not necessarily where your mistake actually was if you missed a closing curly brace.

The other most common error that we see is nginx: [emerg] could not build server_names_hash, you should increase server_names_hash_bucket_size: 32 If you see this error, add server_names_hash_bucket_size 64; to the top of your rp-subdomain.conf file. Depending on how long your domain/subdomains are, the 64 may need to be increased.

Version 2.1.165 and newer

With Organizr Version 2.1.165 and newer, there was a new API Endpoint added. With this endpoint, you may now use Organizr's SMTP servers to reset your password if you have not setup PHPMailer yet.

In order to enable PHP Mailer you will need to know your Organizr API Key. This is inside your /data/config/config.php file under the variable:

Once you have the API Key you can navigate to this Organizr API Endpoint:

Organizr SMTP Helper

GET http://organizr-instance/api/v2/help/smtp?apikey=12345678901234567890

Sets the smtp server account and credentials to Organizr's own smtp server account

Path Parameters

Now you can go to Organizr and use the Forgot Password link.... That is it!

Version below 2.1.165

Open up the Organizr config file, /config/www/Dashboard/api/config/config.php, in a text editor and setup the PHPMailer settings like so, with your own SMTP Server information:

You will need to check with your e-mail provider for all of the correct settings for this to work with your e-mail account.

Make sure that, if the last line of the above code is the last line in the file, that there is NO comma at the end and that the new code is inside the PHP block, before the ending );.

For example, if you're appending the code to the end of your config file, it would end up looking like this:

You will need the hashed value of the password, so, to get hashed value for PHPMAILER-smtpHostPassword

Before you do that, you will need your Organizr hash key. This is inside your /data/config/config.php file under the variable:

Once you have the organizrHash you can head over to: Organizr's password hashing tool here

Put the hashed password into the config.php file and then you SHOULD be able to recover/reset your Organizr account password.

• Fail2ban installed and configured

Fail2Ban filter

Go to your filter.d folder in your Fail2Ban install location /etc/fail2ban/filter.d and create a file called organizr-auth.conf and add the following:

Organizr Jail

Edit the jail.local file in the Fail2Ban directory and add the following:

The ignore IP is so that fail2ban won’t ban your local IP. Check out https://www.aelius.com/njh/subnet_sheet.html if you are wondering what your CIDR notation is. Most often it will be /24 (netmask 255.255.255.0) To find your netmask run ipconfig /all on windows or ifconfig | grep netmask on linux.

Restart Fail2Ban with sudo service fail2ban restart

Organizr logs

Normal Install

Docker Install

Docker

Because the Organizr container only logs the docker IP addresses e.g 172.17.0.2 you need to add this in the Organizr default nginx site file. Go to \organizr\nginx\site-confs\default and add the following inside the server block:

If you're using organizr/organizr it's already added and you only need to uncomment the set_real_ip_from line.

Then restart the container: docker restart organizr

Using the linuxserver/swag container

For this to work you need the SWAG container to be able to read the organizr-<date>.log file in the Organizr container.

Mount the Organizr log like this:

And set the log path in the Fail2Ban jail.local file to /organizrlog/organizr*.log

Banned

The fail2ban.log file should output something like this:

If you managed to ban yourself or a friend banned themself you can run one of these commands:

Thanks to rix1337 for the fail2ban config:

• organizr-auth.conf

• jail.local

Note: This was only supposed to be a temporary setting and it seems like Chrome is starting to ignore what this is set to so you'll have to use one of the other options if you try and it doesn't work.

Edge

Access this page from your browser edge://flags/

Search for SameSite and disable it.

FireFox

Access this page from your browser about:config

Search for SameSite and disable it.

Application Errors

Jackett and Tautulli seem to hardcode the SameSite cookie as Lax

Sonarr/Radarr/Lidarr are starting to hardcode the SameSite cookie as Strict

The only way to bypass that is to use Option #1 or Option #2

Read more about SameSite

This is where you would choose if this is for Personal Use of Business use,

Admin Info

Here you will need to fill out the Admin's info. If you choose the personal License and you are using Plex or Emby as a backend you should fill out the username/email/password all the same as that admin's information so you can use SSO.

Security

This is where locking down the system comes into play. There are 3 fields that are needed, 1 of them is auto-generated, which is the API field.

Database

Organizr uses SQLITE for its Database. All that is needed is what you want to name the Database - for security reasons... and The location of where to store it - also for security reasons. Once you have filled out the information, it's best to click the Test/Create Path button to see if everything is good to go.

Verify

Once you have completed all the steps, you will be taken to an overview page so you may see everything that was entered. You may hover over the items that are sensitive so you may see that information. Once you have verified all information, you may click Finish. This will create the Database and import you as the Admin user. Once completed it will refresh to the login screen.

Login Screen

Now that the Database is created, you will now be automatically logged in. If that doesn't happen, login with the credentials that you just finished creating.

Here is a sample Caddy directive using caddy-jwt to protect a path using the Organizr token:

The secret to use to validate the token needs to be passed to Caddy either as an environment variable named JWT_SECRET or in a file, specified with the secret configuration option.

Tips

Enable

When setting up the homepage item, the first option is to enable it, do that by toggling the Enable Switch. After that you need to set the Minimum Authentication group that will be able to use this item.

Connection

If you already went through the Plex SSO or Plex Authentication setup you will have these next fields already saved, if not, you can hit set those values using the provided buttons.

Misc Options

Signing up at HealthChecks.io

Head over to https://healthchecks.io and create an account. Once created head over to User Menu and select Project Settings to copy your API Key.

Enable the API and once enabled click on Show API Keys

Copy the API key (Top one) and paste into Organizr

Tips

You can setup logo/images for the checks if you add an images URL to the tags section for that check

• Latest version of PowerShell, if you're on Windows 7/Win Server 2008 download

• Windows 10 recommended but it should work on Windows 7 if you have the latest version of PowerShell

• The user account running the installer should have admin privileges and a password set.

OWI Tested on the following OS Versions:

• Windows 10 Pro (Fall creators update)

• Windows Server 2012 R2

What does it do?

• Downloads Nginx, PHP, NSSM and Visual C++ Redistributable

• Creates services for Nginx and PHP

• Downloads Organizr

• Configures PHP as per Org requirements

• Adds in a working Nginx conf file with PHP block enabled

Steps

1. Clone\Download the OWI folder from: https://github.com/elmerfdz/OrganizrInstaller

2. Extract the zip file to your desktop

3. Navigate to \OrganizrInstaller\windows\owi

4. Right-click on owi_installer.bat and click on Run as administrator

5. Installer will ask you for the nginx install location, type in the full path as per the e.g. c:\nginx

6. The installer will ask you to provide the password of the current user during installation, the nginx service requires that you run it under a user account instead of the 'Local System' account, if you don't then you won't be able to save and reload your nginx config

For more information regarding the differences between Authorization vs Authentication, check out this website: https://www.geeksforgeeks.org/difference-between-authentication-and-authorization/

Methodology

There are two methods you may use to enable authorization, via the Organizr authorization API or using OAuth / JWT tokens.

The Organizr authorization API method has the drawback of making calls to Organizr's authorization API for each and every HTTP request made against your protected location blocks, therefore impacting performance.

The Oauth / JWT Token method allows you to securely trust the Organizr authentication simply based on the JWT token passed in your authenticated requests cookies. It does not require any extra roundtrip to the Organizr API, nor the rewrite directives.

Using the Organizr authorization API method

To utilize the block add auth_request /organizr-auth/$; See table below:

For this to work, a URL rewrite directive needs to be added so that the static /organizr-auth/$ locations can be understood by Organizr's authentication API, i.e. use the /api/v2/auth/$1 format. You may find instructions and examples for Nginx, Caddy, and Traefik on subpages in this documentation.

Using the OAuth / JWT token method

The first method has the drawback of making calls to Organizr's authorization API for each and every HTTP request made against your protected location blocks, therefore impacting performance.

This method allows you to securely trust the Organizr authentication simply based on the JWT token passed in your authenticated requests cookies. It does not require any extra roundtrip to the Organizr API, nor the rewrite directives.

The flow is as follows:

1. An unauthenticated user accesses Organizr UI and logs in, using any of the supported login methods.

2. After successful login, the browser will keep an authentication cookie generated by Organizr using the standard JSON Web Token (JWT) format. This signed token includes a number of claims (such as user id, group memberships etc) that the user has. For more info on this standard, visit https://jwt.io/

3. This cookie is then passed to any subsequent visit to your Organizr domain and subdomains.

4. Capable web servers can easily read the JWT token from this cookie and validate it to trust the user's identity and make an allow/deny decision based on the claims mentioned in the token.

Organizr JWT token structure

You can easily check the contents of Organizr-generated JWT tokens by inspecting your browser cookies and pasting the contents of the cookie named organizr_token_<uuid> to a JWT inspector such as https://jwt.io/

Once decoded, an Organizr token includes a JWT payload similar to this:

It includes various claims such as your user name, group name, user id, group id, which can all be used by your JWT-aware web server to make an authorization decision.

Validating the token

Of course, your web server should not blindly trust the content of the JWT token since it cold have been forged. In order to trust the token content, your web server will need to validate its signature. This requires the server to know a secret specific to your Organizr instance.

This requires the following 2 pieces of information:

• The name of the cookie to use to extract the token from. This value is dynamic, of the form organizr_token_<uuid> where <uuid> is your Organizr instance's $this->config['uuid'] value.

• The secret to use to validate the token signature, which is your Organizr instance's $this->config['organizrHash'] value.

Both these values can be taken from your Organizr server's www/Dashboard/api/config/config.php after initial setup.

On Linux, you may use the following commands to parse them:

Providers that block wildcard cookies

URL Endpoints

Example API Call

API Socks

GET https://demo.organizr.app/api/v2/socks/sonarr/api/system/status?apikey=sonarrAPIkey

Calls Sonarr's API

Path Parameters

Headers

Fill out the URL for your Ombi install (it can be the local IP or local DNS and port) and copy your API key from Ombi's settings to the Token box. Toggle the enabled switch to turn it on.

If you are doing a subdomain for Ombi, go to your tabs and set the Tab URL to:

Tips

Please make sure that you have the following options enabled in Ombi.

By enabling those options, your users under User Management should have the User Type as Plex User now.

I.E.

• Calendar (Upcoming and Past TV Shows)

• Queue (Current Downloading Items)

• API Socks (Access to API without needing to Reverse Proxy Sonarr)

Setting up

Enable Tab

When setting up the homepage item, the first option is to enable it, do that by toggling the Enable Switch. After that you need to set the Minimum Authentication group that will be able to use this item.

Connection

Enter the connection details of your Sonarr server. This homepage item allows multiple Sonarr server connections.

API Socks

Organizr's API Socks allows you to access Sonarr's API without needing to Reverse Proxy it.

API Socks URL

Depending on if you entered either one Sonarr Connection or multiple will determine which URL you will use.

Queue

Enabling this module will output Sonarr's Download Queue on the homepage.

Calendar

This module adds past and future TV Shows on the homepage Calendar

Test Connection

Prerequisites

DOCKER USERS

First of all, if you are using an Organizr docker container, please make sure you are using the new Organizr Image:

If you are using or you have now switched over to this container, you will not need to add the new api location block as that has been added for you in the container image. If you are using Nginx's Auth_Request module, you will need to update that address by following these instructions: HERE

Note: the branch variable will take short hand such as master instead of v2-master and dev or develop instead of v2-develop as may be seen in the tag migration examples.

NON-DOCKER USERS

We will need to update your webserver to include the new API location block.

API Location Block

Nginx

Please include this location block within the server block that houses Organizr.

If you are using Nginx's Auth_Request module, you will need to update that address by following these instructions:

Apache

Caddy v2

Caddy v1

IIS

1. Head to IIS webpage Settings

2. Import Rules

3. Paste code below and Apply

Also make sure you allow the following HTTP Methods:

1. Put

2. Delete

3. Options

Nginx Auth_Request

You will need to update your url for the auth_request module.

Subdirectories

The complete config block will look like this:

Subdomains

The complete config block will look like this:

Jellyfin & Emby

We have separated Jellyfin from Emby. Please head to the homepage item section and fix accordingly. If you are using Jellyfin for authentication, please edit the Authentication settings and input your URL and Token respectively.

Troubleshooting

Nothing loading at all/Blank Organizr

If your Organizr is totally blank or you see 404's in the Browser Console (F12) then more than likely you did not perform the API location block addition at all or correctly. Please refer to the changes above for the appropriate webserver.

Settings/Homepage won't load

If you cannot access the settings/homepage page in Organizr - more than likely the tab url updater didn't run successfully.

Head over to your browser and type in the following:

Migration API Endpoint

GET http://organizr-location/api/v2/update/migrate/2.1.0

Migrates some settings from 2.0 to 2.1

Now you can go back to Organizr and reload if you haven't and check the settings/homepage page.

Custom Homepage Items Missing

There was a type on the there config item keys. There are a total of 4 of them. Go to the file /api/config/config.php and change these four keys from the left side of the image to the right side of the image. All that was missing was the letter e