DiscVault

DiscVault is a self-hosted physical media collection manager for 4K UHD, Blu-ray, and DVD.

DiscVault 26 is the next-generation app experience. It is available as a beta today and will become the production channel when promoted to stable.

It includes:

• DiscVault 26 library with poster, list, and detail views
• Rich movie, container, box-set, poster, backdrop, video, and metadata pages
• PostgreSQL-backed v26 foundation with a guided migration path
• Plugin runtime for metadata, import sources, receivers, digital sources, API, and MCP
• Plex/Jellyfin digital media matching and MovieVault metadata integration
• Barcode scanning and manual entry
• Metadata lookup through configurable plugins
• Collection filtering, search, and format-aware browsing
• Backup and restore tools
• User management, groups, owner/admin tooling, and RBAC
• MemberGroups — user-created collaboration groups with invite system
• Watchlist & watch history
• Passkey authentication and recovery
• Invite-only registration — admin issues one-time passwords, open sign-up can be disabled
• Multilingual UI
• URL routing and deep links — share direct links to movies or views
• MCP endpoint integration for AI workflows
• PWA — works offline after adding to homescreen
• Push notifications — group members are notified when a new disc is added to a shared group
• User-scoped MCP access — personal API keys connect your AI assistant to your own collection only

Live Website

• https://discvault.eu

Docker Images

ghcr.io/helmerznl/discvault:latest   # production / stable
ghcr.io/helmerznl/discvault:beta     # DiscVault 26 beta

Docker image references are lowercase. GitHub may show the repository name as helmerzNL/DiscVault, but Docker pulls should use ghcr.io/helmerznl/discvault.

Unraid

• Unraid template repo: https://github.com/helmerzNL/unraid-templates
• Support thread: https://forums.unraid.net/topic/198808-support-discvault-physical-disc-collection-manager/

Screenshots

DiscVault 26 desktop preview

Library posters	Library list
Rich detail page	Backdrops
Watchlist detail	Watched history
RBAC admin	Plugin admin
Operations	Preferences

Migration to DiscVault 26

DiscVault 26 includes a guided migration flow for existing installations. The wizard checks your current data, confirms what can be imported, runs the migration, and then opens the new DiscVault 26 app.

Start migration	Authenticate with current passkey
Review migration wizard	Confirm migration scope
Ready to start	Migration in progress
Migration finished	Start DiscVault 26

Current stable desktop

Sign in	Collection	Import
Backup & Restore	User Management	Logfiles
Advanced & MCP

Mobile

Sign in	Search	Add movie	Profile
Metadata	Authentication	User management	Backup & Restore
Logfiles	Advanced	Collection

Install DiscVault 26 Beta

Use the beta channel to try DiscVault 26 while it is still being finalized. Create a backup before moving an existing library between stable and beta. Generate JWT_SECRET once, store it securely, and reuse the same value for every container recreation:

export JWT_SECRET="$(openssl rand -base64 48)"

docker run -d \
  --name discvault \
  -p 6080:80 \
  -p 6090:6090 \
  -e TZ=Europe/Amsterdam \
  -e RP_ID=localhost \
  -e RP_ORIGIN=http://localhost:6080 \
  -e JWT_SECRET="$JWT_SECRET" \
  -v /mnt/user/appdata/discvault:/data \
  ghcr.io/helmerznl/discvault:beta

Open: http://localhost:6080

For a reverse-proxy production-like beta host, set passkey values to the public hostname:

RP_ID=discvault.example.com
RP_ORIGIN=https://discvault.example.com
JWT_SECRET=<stable value generated with: openssl rand -base64 48>

JWT_SECRET is required for every deployment and must remain unchanged across container restarts. DiscVault stops during startup when it is missing rather than deriving a predictable value from the database configuration.

Optional password + TOTP authentication

Passkeys remain the preferred sign-in method. To expose Legacy password authentication, set LEGACY_AUTH_ENABLED=true. Existing installations must then enable password login in Users & roles and confirm the warning with a fresh passkey assertion.

On a completely fresh installation (no users or credentials), the setup wizard may instead create the first Owner with a 15+ character password and mandatory TOTP. This no-passkey bootstrap is atomic and single-use. TOTP secrets and recovery codes are never included in backups; restored MFA-enabled password users are prompted to enroll TOTP again.

Install DiscVault 26 Production / Stable

Use the production channel for stable deployments. When DiscVault 26 is promoted from beta to production, this is the channel to run. Set JWT_SECRET to the same securely stored value used by the existing instance.

docker run -d \
  --name discvault \
  -p 6080:80 \
  -p 6090:6090 \
  -e TZ=Europe/Amsterdam \
  -e RP_ID=localhost \
  -e RP_ORIGIN=http://localhost:6080 \
  -e JWT_SECRET="$JWT_SECRET" \
  -v /mnt/user/appdata/discvault:/data \
  ghcr.io/helmerznl/discvault:latest

Open: http://localhost:6080

Before updating production:

• Create a backup from the admin tools or copy the persistent data directory while the container is stopped.
• Keep the same /data volume mapping so posters, backdrops, uploads, users, passkeys, and settings remain available.
• Review release notes before moving between beta and production channels.

Install the standalone MovieVault v2 plugin

DiscVault 26.4.44 and newer provide the local anonymous synchronization bridge used by the separately released movievault_v2 plugin. Download the plugin ZIP and checksum from helmerzNL/DiscVault-Plugins, verify the SHA-256 checksum, and extract its movievault_v2/ root folder into DISCVAULT_PLUGIN_INSTALL_DIR (normally /data/plugins in the persistent volume).

Restart DiscVault or refresh its plugin registry. The plugin supplies the standard https://movies2.vaultstack.eu origin and safe operational defaults while remaining disabled. Review or override those settings, then enable the plugin; DiscVault queues the first synchronization automatically. Normal barcode, title, release, and box-set queries then use the derived PostgreSQL index. The existing movievault_26 plugin remains independently available for MovieVault Next. Its attributed contribution connection is not used for MovieVault v2 anonymous reads.

DiscVault 26.4.57 adds negotiated distribution-3 support. The matching deterministic movievault_v2 1.1.0 feature package is also available under dist/plugins/ for staged installation. Older plugins continue to use distribution-2; v3 is selected only when both the plugin manifest and core declare support.

DiscVault no longer bundles or distributes a local bluray_com metadata provider. Blu-ray.com release-detail fallback is owned by MovieVault v2 and is reached only through the standalone movievault_v2 plugin and DiscVault's anonymous core bridge. Existing installations must disable and uninstall the old bluray_com metadata provider before enabling this route. The separate import_bluray_com collection-import plugin and the legacy movievault_26 connector remain available and unchanged.

DiscVault 26.4.61 adds core consumer support for distribution-4 (a strict distribution-3 superset that adds a required-nullable primary poster on release and box-set upserts, with bounded anonymous background caching and authenticated local poster URLs). Distribution-4 is negotiated only when both the installed plugin manifest and DiscVault core declare support, so it stays inactive by default until the matching movievault_v2 plugin release advertises distribution-4 in its distributionContractRange; that plugin change ships separately from helmerzNL/DiscVault-Plugins and is not part of this repository. Existing distribution-2/distribution-3 installations are unaffected.

DiscVault 26.5.10 adds a bounded, anonymous release-technical-1 bridge for the existing barcode scanner and manual barcode entry. Matching movievault_v2 plugin releases keep this technical fallback disabled by default. When an operator enables it, DiscVault still checks the synchronized local index and optional hash bucket first. Only a genuine miss sends the normalized barcode and bounded release hints to MovieVault; no account, instance, collection, contribution credential, cookie, or client address is sent. Pending results are polled only by their opaque resolution ID. External results remain visibly unreviewed and require confirmation.

The same DiscVault server-side bridge is used by PWA, Android, and iOS clients. Client scanners only submit a barcode to DiscVault and never contact MovieVault or a metadata provider directly.

Repository Structure

• app/ - Main application code (backend, frontend, mcp-server, deployment files)
• .github/workflows/ - CI/CD workflows

The marketing website (https://discvault.eu) lives in its own repository: helmerzNL/DiscVault.EU.

License

MIT