NZBGet - Secure Self-Hosted Usenet Downloader

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

NZBGet is a fast, efficient free and open-source Usenet (NZB) binary downloader with a lightweight C++ core and a full-featured browser-based web interface. This AMI runs the nzbget daemon and exposes its complete functionality through the browser - giving you a private, self-hosted Usenet download manager you run and control in your own AWS account. It is delivered fully installed and secured so a working downloader is operational within minutes of launch. NZBGet connects to your own Usenet provider, so a Usenet subscription is required to download.

## Why This Image vs a Manual Install

This image eliminates the manual package setup, config templating, reverse-proxy configuration, and credential hardening that a manual install requires. NZBGet ships with a well-known default nzbget/tegbzn6789 control login; this image never keeps it. What typically requires several steps across package management, service configuration, and security hardening is completed for you at image build time. Launch the instance, read your unique credential, point NZBGet at your Usenet provider, and start downloading.

## Application Stack

nzbget is installed from the distribution repository and runs as an unprivileged system user under a hardened systemd unit. Its Web UI and JSON-RPC interface are bound to the loopback interface only and fronted by an nginx reverse proxy on port 80. systemd starts the daemon and the web server on boot and restarts them on failure. The download queue, temporary directories and the completed downloads library live on a dedicated data volume, independently resizable and separate from the OS disk.

## Security Hardening

This image follows a defence-in-depth approach:

• Network isolation: the Web UI and JSON-RPC interface bind exclusively to the loopback interface; only the nginx reverse proxy is exposed
• Authentication enforced: every Web UI and JSON-RPC request is authenticated - nothing is served anonymously
• No default or shared credentials: the well-known default control password is removed and a cryptographically random control password is generated on each instance's first boot and written only to a root-only file
• Least privilege: the daemon runs as an unprivileged system user with NoNewPrivileges, PrivateTmp, and ProtectHome set
• Dedicated data volume: the download queue and library live on their own disk, surviving OS-disk changes and resizable independently
• Automatic restart: systemd monitors both nzbget and nginx and restarts them on failure

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Automated media library building: A home-lab or small studio fetching NZB releases via RSS feeds and post-processing scripts, storing completed downloads on a resizable EBS volume for a media server to index
• Large dataset retrieval from Usenet: Research and data teams pulling large public datasets distributed as NZB archives, with par2 verification and automatic unpacking handled by the downloader
• Reliable background downloading: DevOps or archival teams running a headless, self-hosted downloader on a dedicated EC2 instance with scheduled bandwidth limits and category-based organisation

## AWS Integration

Deploy on any EC2 instance type. Use the unauthenticated health endpoint with an Application Load Balancer for availability monitoring. Back up your configuration and download library using EBS snapshots or AWS Backup. Resize the dedicated download volume independently of the OS disk as your library grows. NZBGet connects outbound to your Usenet provider over NNTP/NNTPS - there is no inbound download port to open.

## Getting Started

Read your credential from the root-only file, open the web interface in your browser, sign in, and add your Usenet provider under Settings then News Servers. Add NZB files by upload or URL, organise downloads into categories, schedule bandwidth, and automate fetching via RSS subscriptions with rules.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, reverse-proxy termination with your own domain and certificate, Web UI configuration, Usenet provider setup, categories and RSS automation, and backup planning for your download library.