Your film collection.
Your viewing story.

1. Get a TMDB token on a computer

   Open TMDB Settings → API, describe your actual use and accept the applicable terms. Use the long API Read Access Token, not the short API Key (v3 auth) or your password.

2. Save it in a protected DSM folder

   Install Text Editor from Package Center. In File Station, create /volume1/docker/roux-secrets outside the Roux project. Save only the token on one line in tmdb_read_token, without .txt, quotes or a Bearer prefix.

   Keep ordinary users and guests out of this folder. The server runtime UID 65532 must be able to read the file; do not grant Everyone full control or run the server as root. The file is not automatically encrypted. Close the editor and clear your clipboard afterward. Do not enter the key in the app, website, YAML, support messages or screenshots.

3. For a new install, choose one configuration

   If your token is ready, select docker-compose.tmdb.yml from the ZIP. To connect later, select docker-compose.yml. Each is a complete configuration; never apply both. Adjust media and secret paths to your NAS. No OpenSubtitles key or empty file is required.

4. For an existing install, merge only the changes

   Stop the project and back up its YAML and data. Do not replace the whole configuration. Merge the partial example below, change the existing ROUX_METADATA_MODE to direct, and remove ROUX_PUBLIC_METADATA_URL if present. Do not duplicate existing secret entries. Preserve image, media/data paths, ports and other secrets.

   Where to add settings — partial example, not a complete YAML

   services:
     roux-server:
       environment:
         ROUX_METADATA_MODE: "direct"
       secrets:
         - tmdb_read_token
   secrets:
     tmdb_read_token:
       file: "/volume1/docker/roux-secrets/tmdb_read_token"

   Apply/deploy to recreate the container. Restarting alone may retain the old mounted key file. Do not use Clean or delete data.

5. Check configuration and actual lookups separately

   Once the server is healthy, open Settings → Synology setup and checks → Check again in Roux. Detecting settings does not validate the key or confirm successful lookups. Refresh Library, check a known title/poster and play a video. Adding a key later also enriches the existing library.

Launch candidate version 1.0 build 76 is ad-free. Connect TMDB with a personal key under the provider’s terms. Any future advertising depends on separate confirmation of applicable terms. Real NAS testing of new installations, adding a key later and token rotation remains pending.

TMDB getting started · Read Access Token · Usage terms and attribution

1. Prepare an OpenSubtitles.com account and API key

   Register at OpenSubtitles.com, confirm your email and obtain a key through API consumers, reviewing the terms and describing your use. Downloads require the API key and your username and password. Roux social sign-in is separate; do not use legacy .org API credentials.

   Check your OpenSubtitles account and API terms for allowance and pricing. Roux promises no fixed free quota.

2. Store credentials only on your NAS

   Using DSM Text Editor, save one value per file in /volume1/docker/roux-secrets, outside the project: opensubtitles_api_key, opensubtitles_username and opensubtitles_password. No .txt or quotes; preserve password spaces.

   Restrict access to the administrator and necessary read access for runtime UID 65532. Never enter credentials in the app, website, YAML, email or logs. This store is not automatically encrypted; protect backups too. Close the editor and clear the clipboard after entry.

3. Connect the server configuration

   For a new install choose one complete configuration: docker-compose.subtitles.yml (subtitles) or docker-compose.tmdb-subtitles.yml (metadata and subtitles). Prepare the required secrets first. The default configuration runs without these files.

   For an existing installation, update the server, back up YAML/data, then merge the following entries only. Preserve existing media/data paths, ports and TMDB settings; do not duplicate secret blocks.

   Where to add entries — a partial example, not a full configuration

   services:
     roux-server:
       secrets:
         - opensubtitles_api_key
         - opensubtitles_username
         - opensubtitles_password
   secrets:
     opensubtitles_api_key:
       file: "/volume1/docker/roux-secrets/opensubtitles_api_key"
     opensubtitles_username:
       file: "/volume1/docker/roux-secrets/opensubtitles_username"
     opensubtitles_password:
       file: "/volume1/docker/roux-secrets/opensubtitles_password"

   Apply/deploy to recreate the container. Do not mount secrets into the data initializer. Do not Clean or delete data.

4. Check the connection, then try one subtitle

   Open Settings → Synology setup and checks → Check OpenSubtitles connection to verify the account and remaining downloads. This check consumes no download allowance. Counts reflect the last check. Then search your language in the player's subtitles menu, download and apply one result. Actual downloads can consume allowance. Saved subtitles use the NAS cache.

Automatically tested prerelease feature. Authentication, downloads and invited-member use on a real NAS still need verification.

1. Check playback at home and your router

   Complete owner setup and play a video on the same Wi-Fi. Reserve a stable LAN IP for the NAS in your router. Check whether the router’s internet (WAN) address is public IPv4. A private address or 100.64.0.0–100.127.255.255 may indicate double NAT or CGNAT. Ask your ISP about a public IP or configure a VPN separately in that case. Opening one port alone will not solve it.

2. Create a Synology DDNS address

   In DSM, open Control Panel → External Access → DDNS → Add. Select Synology and register an available hostname. Check Test Connection and the status. Replace every example roux-example.synology.me below with your own hostname. DDNS maps a name to an address; it does not open ports.

3. Get a certificate for that hostname

   Use the Let’s Encrypt option during DDNS setup, or Control Panel → Security → Certificate → Add. After creating the proxy below, assign this certificate to its service in certificate Settings/Configure. Changing the default certificate can affect other services.

   Check automatic renewal too. HTTP validation for custom domains may need TCP 80 connectivity; follow Synology’s certificate instructions. Playback uses HTTPS 443. Do not bypass certificate warnings.

4. Create the reverse proxy to Roux

   Open Control Panel → Login Portal → Advanced → Reverse Proxy → Create. Name the rule Roux.

   Source

   Protocol HTTPS
   Hostname roux-example.synology.me
   Port 443

   Destination

   Protocol HTTP
   Hostname 127.0.0.1
   Port 8080

   8080 is the Roux port mapped on the NAS; use your existing YAML’s host port if different. Set the custom request header X-Forwarded-Proto to https and retain existing forwarding headers. Roux uses these to recognize proxy connections as remote requests. Do not point the rule at DSM management or owner enrollment port 8081.

5. Forward HTTPS through your router

   In your router’s port forwarding settings, map external TCP 443 → NAS LAN IP, TCP 443. If DSM Firewall is enabled, allow the required clients to reach port 443. If 443 is already in use, check hostname-based proxy rules without overwriting existing services.

   How to set up port forwarding

   This routes incoming HTTPS connections from your router to your NAS. First prepare the certificate and reverse proxy in the steps above.

   1. Open your router’s admin page. On an iPhone connected to home Wi-Fi, open Settings → Wi-Fi → ⓘ beside the connected network. Enter its Router address in Safari and sign in with your router admin account.
   2. Find port forwarding. Depending on your router, look under “NAT”, “Port Forwarding” or “Virtual Server”. Add a rule with these values.

   Rule name

   Roux HTTPS

   Protocol

   TCP

   External port

   443 (enter 443 for both start and end, if shown)

   Internal IP

   Your NAS’s LAN IP
   Example: 192.168.1.100 — replace this with your own.

   Internal port

   443 — the DSM reverse proxy’s source port

   Find the NAS IP in DSM under Control Panel → Network → Network Interface. Reserve that address in your router’s DHCP settings so it stays the same.

   Save/apply, then turn Wi-Fi off to test. On cellular, open https://roux-example.synology.me/health and check for status: ok, then play a video in the app. Use your own DDNS hostname.

   Is another device already using 443? Keep its existing rule. To use a separate port, set the external port, internal port and DSM proxy source port all to 9443, and allow it through the firewall. Add :9443 to the app and test URLs, for example https://roux-example.synology.me:9443. The proxy destination remains Roux port 8080.

   For timeouts, check the NAS IP, ports and firewall first. See “If the connection fails” below for double NAT or CGNAT. To stop remote access, disable only the Roux rule you added.

   Do not expose Roux 8080/8081 or DSM management 5000/5001 directly, and do not enable DMZ. This guide explains the settings; it does not open ports automatically.

6. Set the app address and permissions

   Enter https://roux-example.synology.me in Roux’s server address field and connect. Do not append /health, /webman or the internal port. Guests request access using this HTTPS address and a join code from the owner. The owner must grant both the appropriate libraries and remote access permission.

7. Turn Wi-Fi off and test on cellular

   In Safari, open https://roux-example.synology.me/health without certificate warnings. Then play and seek a video in Roux. Testing on home Wi-Fi alone does not prove remote connectivity. Turn Wi-Fi back on afterward.

Synology DDNS · Certificate · Reverse proxy · QuickConnect