Gerbera on Ubuntu 24.04 on Azure User Guide

Overview

Gerbera is an open source UPnP/DLNA media server that catalogues your own audio, video and image library and streams it to smart TVs, games consoles, and any UPnP/DLNA client on your network. It exposes a modern web administration UI for browsing your library through Database and Filesystem views, adding content, and managing what the server publishes, and it announces itself over SSDP so compliant devices discover it automatically. The cloudimg image serves Gerbera 2.0.0 on a hardened, fully patched Ubuntu 24.04 LTS base, with the media library and SQLite catalogue on a dedicated Azure data disk.

The image is secure by default. Account authentication is enabled on the web UI, and a unique administrator password is generated on the first boot of every VM, so no shared or default login ever ships. The Gerbera daemon is gated so it never starts before that per-VM password has been written. Backed by 24/7 cloudimg support.

What is included:

• Gerbera 2.0.0, the UPnP/DLNA media server, managed by systemd
• The account protected web administration UI and DLNA endpoint on :49152
• A unique administrator password generated on first boot, no default login
• Automatic library import: drop files into /var/lib/gerbera/media and they are catalogued
• A dedicated Azure data disk at /var/lib/gerbera for the media library and the SQLite catalogue
• gerbera.service and an internal loopback nginx.service health bridge as enabled systemd units
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for larger libraries. NSG inbound: allow 22/tcp from your management network, 49152/tcp for the web UI and DLNA control, and 1900/udp for SSDP discovery so DLNA clients on the same network can find the server. Because DLNA discovery uses multicast SSDP, keep the server and your DLNA clients on the same VNet or subnet.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Gerbera by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22). After creation, add inbound rules for 49152/tcp and 1900/udp in the network security group. Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name gerbera \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open the web UI / DLNA port and the SSDP discovery port:

az vm open-port --resource-group <your-rg> --name gerbera --port 49152 --priority 1010
az network nsg rule create --resource-group <your-rg> --nsg-name gerberaNSG \
  --name AllowSSDP --priority 1020 --protocol Udp --destination-port-ranges 1900 --access Allow

Step 3 - Confirm the services are running

SSH in as azureuser and confirm Gerbera is active. Gerbera serves both the DLNA endpoint and the web admin UI on port 49152 on the VM's primary network interface; a small nginx bridge answers on 127.0.0.1:80 so local health checks have a stable loopback address.

systemctl is-active gerbera nginx gerbera-firstboot

sudo ss -tlnp | grep -E ':49152 |127.0.0.1:80 ' | sed 's/  */ /g'

Step 4 - Read the per-VM administrator password

On the first boot of every VM a one shot service generates a unique administrator password and writes it, together with the site URL, to a root only credentials file. Read it with sudo:

sudo cat /root/gerbera-credentials.txt

The gerbera.admin.user is admin and gerbera.admin.password is unique to your VM. You can confirm the web UI is answering locally through the nginx bridge:

curl -s -o /dev/null -w 'GET / -> HTTP %{http_code}\n' http://127.0.0.1/

Step 5 - Sign in to the web admin UI

Open http://<your-vm-ip>:49152/ in a browser. Because account authentication is enabled, Gerbera presents a login screen. Sign in as admin with the password from the credentials file in Step 4.

Step 6 - Browse your media library

After signing in, the Database view shows your catalogued library grouped into Audio, Photos and Video containers that Gerbera builds automatically from the files it imports. This is what UPnP/DLNA clients browse when they connect.

Drill into a container, for example Photos > All Photos, to see the individual media items with per item actions to serve, edit or remove them.

Step 7 - Add your own media

Copy your media files onto the VM's dedicated data disk under /var/lib/gerbera/media (for example with scp), and Gerbera imports them automatically - the library is watched, so new files are catalogued as they arrive. You can also browse the server's filesystem and add specific folders from the File System view.

Create a place for your library and confirm the data disk is mounted:

sudo install -d -o gerbera -g gerbera /var/lib/gerbera/media
mountpoint /var/lib/gerbera && echo "media library is on the dedicated data disk"

Step 8 - Verify authentication from the command line

Gerbera's web UI login is a token challenge: the client requests a session id and a one time token, then submits md5(token + password). The commands below prove the per-VM password authenticates and that a wrong password is rejected, then list the catalogued library.

IF=http://127.0.0.1/content/interface
U=$(grep '^gerbera.admin.user=' <(sudo cat /root/gerbera-credentials.txt) | cut -d= -f2-)
P=$(grep '^gerbera.admin.password=' <(sudo cat /root/gerbera-credentials.txt) | cut -d= -f2-)
SID=$(curl -s "$IF?req_type=auth&action=get_sid" | jq -r .GerberaSID)
TOK=$(curl -s "$IF?req_type=auth&action=get_token&GerberaSID=$SID" | jq -r .token)
H=$(printf '%s' "$TOK$P" | md5sum | awk '{print $1}')
curl -s "$IF?req_type=auth&action=login&GerberaSID=$SID&username=$U&password=$H" | jq .

Step 9 - Security posture

The image ships hardened. The Gerbera daemon runs as an unprivileged gerbera system user and is gated on a first boot marker so it never starts before the per-VM administrator password has been written. The credentials file is readable only by root, and the OS is fully patched at capture.

systemctl show -p User --value gerbera.service
sudo stat -c '%n mode %a owner %U:%G' /root/gerbera-credentials.txt
grep ConditionPathExists /etc/systemd/system/gerbera.service

Where your data lives

The media library and Gerbera's SQLite catalogue live on a dedicated Azure data disk mounted at /var/lib/gerbera, separate from the OS disk and independently resizable. Because the disk is captured into and re-provisioned from the image, your library and catalogue survive an OS disk replacement. Back it up with Azure disk snapshots.

Streaming to DLNA clients

Once 49152/tcp and 1900/udp are open to your network, smart TVs, games consoles and DLNA player apps on the same VNet discover the server automatically over SSDP and browse the same Audio, Photos and Video containers you see in the Database view. To change the administrator password, edit the <account> entry in /etc/gerbera/config.xml and restart the service with sudo systemctl restart gerbera.

Support

Every cloudimg image includes 24/7 support. If you have any questions about deploying or operating Gerbera on Azure, contact us at support@cloudimg.co.uk.