NZBGet Self-Hosted Usenet Downloader on AWS User Guide

Overview

NZBGet is a fast, efficient free and open source Usenet (NZB) binary downloader with a lightweight C++ core and a full featured browser based Web UI. This cloudimg image runs the nzbget daemon and exposes its complete functionality through the browser: add NZB files by upload or URL, point the downloader at your own Usenet provider, verify and repair downloads with par2, unpack archives automatically, organise downloads into categories, subscribe to RSS feeds with automatic fetching, and watch progress in real time. The daemon runs as a dedicated unprivileged nzbget system user under a hardened systemd unit, with the Web UI and JSON-RPC interface bound to the loopback address 127.0.0.1:6789 behind an nginx reverse proxy on port 80. NZBGet fetches from your own Usenet provider over outbound NNTP/NNTPS, so there is no inbound download port. The download queue and completed library live on a dedicated data volume mounted at /var/lib/nzbget, and a unique control password is generated on the first boot of every instance so no shared or default credential ships in the image. Backed by 24/7 cloudimg support.

What is included:

• NZBGet 21.0 (nzbget) managed by systemd, serving a full Web UI and JSON-RPC interface
• nginx on port 80 fronting the Web UI, which is bound to the loopback address 127.0.0.1:6789
• Authentication forced for every request, so the well known nzbget/tegbzn6789 default login is never reachable
• A unique control password generated on first boot and recorded in a root-only file
• A dedicated data volume at /var/lib/nzbget holding the download queue, temporary directories and completed library
• Outbound NNTP/NNTPS connectivity to your own Usenet provider (no inbound download port)
• nzbget.service and nginx.service as systemd units, enabled and active
• An unauthenticated /healthz endpoint for load-balancer health checks
• 24/7 cloudimg support

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. Security group inbound: allow 22/tcp from your management network for SSH and 80/tcp for the Web UI. NZBGet connects outbound to your Usenet provider, so no inbound download port is required. A Usenet provider subscription is required to download.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, choose Continue to Launch, and launch through the EC2 console or the AWS CLI. Select the m5.large instance type, your key pair, and a security group that opens ports 22 and 80.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=nzbget}]'

Step 2 - Connect to your instance

Connect over SSH as the default login user for the OS variant you launched. This listing may ship more than one OS variant; use the matching login user below.

Step 3 - Confirm the services are running

NZBGet runs behind nginx, with a one-shot first-boot service that mints the per-instance control password. Confirm the two long-running services are healthy:

systemctl is-active nzbget.service nginx.service

Both report active:

active
active

Step 4 - Verify the stack and endpoints

Confirm the running NZBGet version, that the Web UI is bound to the loopback interface only, that the unauthenticated health probe answers, and that the JSON-RPC interface refuses anonymous access:

nzbget --version | head -1
ss -tln | grep 127.0.0.1:6789
curl -s -o /dev/null -w 'healthz: HTTP %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'unauthenticated JSON-RPC: HTTP %{http_code}\n' http://127.0.0.1:6789/jsonrpc/version

The version reports nzbget version: 21.0, the Web UI is bound to 127.0.0.1:6789 only, /healthz returns 200, and the unauthenticated JSON-RPC call returns 401 because authentication is enforced on every request:

nzbget version: 21.0
LISTEN 0      100        127.0.0.1:6789      0.0.0.0:*
healthz: HTTP 200
unauthenticated JSON-RPC: HTTP 401

Step 5 - Read your per-instance control credential

The image ships no shared or default login. On first boot a unique control password is generated for this instance and written to a root-only file. Read it, confirming the file permissions and the resolved URL:

sudo stat -c '%a %U:%G' /root/nzbget-credentials.txt
sudo grep -E '^NZBGET_(USERNAME|URL)=' /root/nzbget-credentials.txt

The file is 600 root:root, NZBGET_USERNAME is your control username (nzbget), and NZBGET_URL is the address to open in your browser:

600 root:root
NZBGET_URL=http://<instance-public-ip>/
NZBGET_USERNAME=nzbget

Run sudo cat /root/nzbget-credentials.txt to also see the password.

Step 6 - Prove the login round-trip from the command line

Confirm the per-instance password authenticates against the JSON-RPC interface and returns the program version, exactly as your browser will. The unauthenticated request is rejected; the authenticated request returns the version:

PW=$(sudo grep '^NZBGET_PASSWORD=' /root/nzbget-credentials.txt | cut -d= -f2-)
curl -s -u "nzbget:$PW" http://127.0.0.1:6789/jsonrpc/version
echo

The authenticated call returns a JSON result with the running NZBGet version:

{
"version" : "1.1",
"result" : "21.0"
}

Step 7 - Sign in to the Web UI

Browse to http://<instance-public-ip>/ (the value of NZBGET_URL) and sign in with the control username and password from the credentials file. Authentication is enforced on every request, so there is no anonymous access.

Step 8 - Review the downloads dashboard

After signing in you land on the Downloads tab. This is the live download queue: every NZB you add appears here with its status, category, age, size and estimated time, and the toolbar lets you add, pause, resume, reorder and delete items. Completed downloads are saved to the dedicated data volume under /var/lib/nzbget/completed.

Step 9 - Confirm the running server from Messages

The Messages tab shows NZBGet's live log. Immediately after boot it reports the daemon starting in server mode, confirming the running version:

Step 10 - Configure your Usenet provider and settings

Open the Settings tab to review and change configuration. NZBGet needs at least one news server before it can download: open the NEWS-SERVERS section and enter your Usenet provider's host, port, username and password, then click Save all changes and reload. The other sections cover paths, categories, RSS feeds, the download queue, connection and security - all applied from the browser with no configuration files to edit.

Maintenance

• Downloads and queue: the download queue, temporary directories and the completed library live on the dedicated data volume at /var/lib/nzbget (completed downloads under /var/lib/nzbget/completed). Resize the volume independently of the OS disk as your library grows. You can confirm the mount with findmnt /var/lib/nzbget.
• Credential: the per-instance control password is in /root/nzbget-credentials.txt. To rotate it, change ControlPassword in /etc/nzbget.conf (or from the Web UI Security settings) and restart the service.
• Ports: the Web UI is served on port 80 (nginx). NZBGet connects outbound to your Usenet provider over NNTP/NNTPS; there is no inbound download port to open.
• Restart: sudo systemctl restart nzbget.service nginx.service if you need to bounce the stack.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

This image packages the open source NZBGet software (GNU General Public License v2) for convenient deployment on AWS. cloudimg is not affiliated with, endorsed by, or sponsored by the NZBGet project.