Security Notifications for Jellyfin — guide

Installation

You need Jellyfin Server 12.2 or newer and a MediaLab Works account with a licence that covers the plugin (an active subscription, a lifetime licence within its update window, the Jellyfin bundle or the free 30-day trial).

From your plugin repository (recommended). Jellyfin then installs and updates the plugin by itself.

In your MediaLab Works account open Licences → Jellyfin plugin repository and click Create address. Copy it: it is private (it contains a token), so do not share it; you can regenerate or revoke it at any time.
In Jellyfin open Dashboard → Plugins → Repositories, click +, give it a name (for example MediaLab Works), paste the address and save.
In Dashboard → Plugins → Catalog find Security Notifications, click Install, then restart Jellyfin.

The repository lists only the plugins your licences cover, and only the versions they allow. Its download links are signed and expire after a few hours, so Jellyfin always reads a fresh list.

Manually, from a zip file.

In Account → Licences download jf-securitynotifications_x.y.z.zip (the SHA-256 of the file is shown next to the button).
Extract it into a new folder Security Notifications_x.y.z.0 inside the Jellyfin plugins folder:
- Linux (package): /var/lib/jellyfin/plugins/
- Docker (official image): /config/plugins/ in the config volume
- Windows: %ProgramData%\Jellyfin\Server\plugins\
Restart Jellyfin.

Licence activation

Open the plugin page in Dashboard → Plugins → Security Notifications and click Open License page.
Paste your licence key and click Activate with key. The plugin contacts the licence server, binds the key to this Jellyfin server and shows the licence as Active.
No key yet? On the same page enter your e-mail and start the 30-day free trial (card needed, 0 € today) or buy a licence; the plugin activates itself when the payment is done.

The licence is checked once a day and at every Jellyfin start. Without internet the plugin keeps working for 7 days after the last successful check. Without a valid licence the plugin stops its work and only its License page keeps working (trial, key, renewal); nothing is deleted, and everything resumes as soon as the licence is valid again. Move license (release this server) on the same page frees the key for another server.

Updates and rollback

From the repository: Jellyfin shows new versions in Dashboard → Plugins and can update the plugin automatically; restart Jellyfin to load the new version.
From the plugin's License page: with a valid licence, Install update installs the newest version your licence allows and Roll back to x.y.z goes back to the previous version (for example if something stopped working after an update). Restart Jellyfin after either. Both packages are checked against the checksum published by the licence server.
A lifetime licence receives the versions released during its update window; after it, the plugin keeps working on the last version it may use.
After a rollback, if your plugin repository is added in Jellyfin, Jellyfin's scheduled task Update Plugins (at start-up and daily) installs the newest version again. To stay on the previous version for a while, remove the triggers of that task in Dashboard → Scheduled Tasks and add them back later.

Source code

The GPL-3.0 source code of each version is in Account → Licences (Source code), next to the download, as a .tar.gz archive made from the exact commit of that version.

Configuration

Open Security Notifications in the Jellyfin dashboard menu. The page has five tabs: Overview, History, Rules, Channels and Settings.

Channels: turn on the channels you want and set the minimum severity for each, then use Send a test.
- Telegram: enter the bot token, send /start to the bot (or add it to a group), then click Find to fill in the chat.
- E-mail: recipients and your SMTP server. Port 587 with STARTTLS is recommended (port 465 with implicit TLS is not supported). If Registration is installed, you can reuse its SMTP server.
- Webhook: choose Discord, Slack, ntfy, Gotify or JSON and paste the address. The address contains the token and is stored apart from the settings. For Gotify, add ?token=… to the /message address.
- Jellyfin activity log: alerts also appear in the dashboard's activity list.
No spam (same tab): how often the same alert may repeat, the quiet hours (only critical alerts go out at once, the rest arrive in a summary when they end) and the optional daily digest for medium and informational alerts.
Rules: each of the 20 rules has a switch, a severity and, where it applies, thresholds (for example how many wrong passwords in how many minutes, the speed for impossible travel or the administrator's usual hours).
Settings:
- Location: DB-IP Lite (free, no account), MaxMind GeoLite2 (your account id and licence key) or off. Without location, the new-country, impossible-travel and new-network rules do not work.
- Network: trusted networks (CIDR) treated as local, such as your own VPN. Private networks and those in Jellyfin's network settings are included automatically. Turn on The server is behind its own proxy if Jellyfin is behind nginx, Caddy, Traefik or similar, so forwarded headers are expected; Cloudflare is recognised by itself.
- Bad IP lists: Tor exits (refreshed hourly) and Spamhaus DROP (daily).

Daily use

Overview shows the recent alerts and the plugin's status.
History lists every alert with account, address, location, device and the channels it was sent to; filter by severity, rule and period, or export to CSV.
Each alert says why it is suspicious and what to check. If it was you (a new phone, a trip abroad), nothing needs to be done.

Troubleshooting

Every alert shows the same address (your proxy or Cloudflare): add the proxy to Jellyfin's Known proxies (Dashboard → Networking) so Jellyfin passes on the real visitor address, and turn on The server is behind its own proxy in Settings.
No Telegram messages: send /start to the bot again and click Find; check the minimum severity of the channel.
No location: check the Location source in Settings; with MaxMind, check the account id and key.