Guardian
Access control for Plex, a self-hosted media server: device approval, per-user rules and termination of non-compliant sessions.
Background
A full TypeScript application: a NestJS backend and a Next.js frontend bundled into a single Docker image, with a GitHub Actions pipeline (lint, typecheck, tests, coverage) and around thirty published releases. The image has passed 60,000 pulls on Docker Hub, and the bugs and requests reported by users shape the releases that follow.
Technologies and tools used
Backend & data
A REST API and a NestJS cron poll Plex and terminate sessions, with TypeORM on top of SQLite.
Frontend
An admin console, paired with a portal where Plex users can review their own devices.
Security & access control
- JWT & Passport
- bcrypt
- Helmet
- Rate limiting & CAPTCHA
Rules combine device state, time windows, temporary access, a concurrent-stream limit and IPv4/IPv6 CIDR lists.
Notifications
Notifications are sent over SMTP or through Apprise.
Deployment & continuous integration
The frontend and backend are bundled into a single image, published to Docker Hub on every release once lint, typecheck and tests have passed.
Challenges
- Recovering the real client IP from behind a reverse proxy.
- Combining the global setting with per-user exceptions into a single decision per session.
- Moving from two containers to a single image without breaking existing installations.
Project preview
Source code
github.com/HydroshieldMKII/Guardian