logoalt Hacker News

kstenerud • 11/01/2026 • 0 replies • view on HN

I'm building a self-hosted media server for video, like Plex or Jellyfin. I'll be opening the beta in about a month.

Features:

- No paywalls, bandwidth limiting, or crippled behavior. No login required.

- Single go binary, deployed via Docker.

- Reaches your home server from anywhere with no port forwarding, no VPN and no paywall, even behind carrier-grade NAT. No Tailscale required.

- Cast to another device. You can use any logged in device as a playback screen.

- Watch together, with voice support: Play synced video with friends, and also chat voice. You can also mix this with casting to another device.

- Dialogue boost and loudness levelling for every film.

- Real adaptive quality, tuned for a home's upload.

- Hardware transcoding, full quality in every supported browser.

- A library that explains itself: what the scanner saw, why each title matched, guesses marked for you to check, and a disk that's gone missing shown as missing instead of its titles silently vanishing.

- Your data stays yours: The database is a rebuildable index, metadata corrections can be written back as NFO files that Kodi and Jellyfin read, and an automatic backup keeps what can't be re-derived (watch state, preferences, shares).

Security is a primary concern:

With the ever increasing pace of hacks and CVEs and AI-assisted intrusion, you simply can't be too careful anymore.

- The core (which talks to the network, handles the API, users and the database) never opens a media file or runs FFmpeg.

- A separate media node does every file read and every transcode. It has no network access and talks to the core only over Unix sockets.

- FFmpeg runs under Landlock and seccomp with no path to the file and no socket. All it can do is read and write streams.

- Small dependency tree on an allowlist, pure Go with no cgo, secrets sealed at rest and never logged.

- The library can be mounted read-only, so even a full compromise can't encrypt or delete your media.

- Cryptographically signed chain for servers and releases.

https://orpheum-app.com/