A Jellyfin Debian install gives you the same core experience as Plex or Emby, streaming your own movies and shows to a browser, phone or smart TV, but with the code fully free and open source and no paywalled apps. The Jellyfin server itself needs to go on a PC, mini server or Raspberry Pi on your network before any client app can connect to it. This guide covers the current install steps for Debian 12 and 13, plus the setup that follows.
Prerequisites
Before you proceed with the guide, we will need to make sure that we meet the basic requirements for a seamless streaming experience.
- You will need to set a static IP address on your Linux device. This is really easy and can be done by following this simple guide.
- A connection with the PC: Either you need physical access to the PC using a Keyboard or Mouse, or you need to access the PC using SSH
- You will also need an HDD or SSD attached to the PC where we can store our Movie files.
- A PC or Raspberry Pi with a processor strong enough to encode and decode the Movie files.
- Jellyfin’s official repository currently supports Debian 12 (Bookworm) and Debian 13 (Trixie).
A Raspberry Pi works well for this too. See Docker on Raspberry Pi if you would rather run Jellyfin as a container instead of through apt.
Installing Jellyfin on Debian
Update your system
First of all, fully upgrade your system so that you don’t have to face any kind of dependency mismatch. To update your system, run the following commands in your Terminal window: so that you don’t have to face any kind of dependency mismatch. To update your system, run the following commands in your Terminal window:
sudo apt update && sudo apt full-upgrade
Install the dependencies
Now, we will have to install a few packages which will enable HTTPS support for repositories through which we will be able to access the Jellyfin package repository. Just type the following commands in your Terminal:
sudo apt install apt-transport-https lsb-release
Import the GPG signing key
Now, we will import the GPG signing key of Jellyfin from the servers. Just run the following commands:
(Note: Jellyfin moved its keyring location from /usr/share/keyrings to /etc/apt/keyrings, so create that folder first.)
sudo mkdir -p /etc/apt/keyrings
curl https://repo.jellyfin.org/debian/jellyfin_team.gpg.key | gpg --dearmor | sudo tee /etc/apt/keyrings/jellyfin.gpg >/dev/null
Add the repository and refresh
Now, finally, we can just add the Jellyfin repository to the apt command. Debian’s newer deb822 format replaces the old single-line entry, so create the source file below rather than editing jellyfin.list directly. In the terminal, copy-paste the following:
cat <<EOF | sudo tee /etc/apt/sources.list.d/jellyfin.sources
Types: deb
URIs: https://repo.jellyfin.org/debian
Suites: $( lsb_release -c -s )
Components: main
Architectures: $( dpkg --print-architecture )
Signed-By: /etc/apt/keyrings/jellyfin.gpg
EOF
# And now, refresh the repository again
sudo apt update
Install the server
Finally, we can just install the server:
sudo apt install jellyfin
Once installed, confirm the service came up cleanly:
sudo systemctl status jellyfin
An active (running) status means you’re ready for the setup wizard below.
Alternative ways to install Jellyfin on Debian
The apt method above matches what Jellyfin documents as the standard path, but it is not the only one.
- Official install script: Jellyfin publishes a signed bash script that automates the repository and key setup in one step. Download it from repo.jellyfin.org/install-debuntu.sh and inspect it before running with sudo bash.
- Docker: Jellyfin ships an official container image, a good fit if you already run other services through Docker on Debian.
- Snap: a community-maintained itrue-jellyfin snap exists in the Snap Store. It is unofficial and not maintained by the Jellyfin project, useful mainly if you already lean on snapd for other apps.
Stick with the apt method above unless you already have a reason to run a container or script instead.
Set file permissions for your media folders
Jellyfin runs as its own system user and that user needs read access to wherever your movies and shows live, especially if they sit on a drive owned by your regular login account.
Install the ACL (access control list) package and grant Jellyfin read and execute access recursively:
sudo apt install acl
sudo setfacl -R -m u:jellyfin:rx /path/to/your/media
Swap /path/to/your/media for your real mount point. This step is easy to skip and the resulting error reads like a Jellyfin bug rather than a permissions issue. Run the command again any time you add a new top-level media folder, since -R only covers what exists the moment you run it.
Post installation setup
Open the web interface
Now that we have installed Jellyfin on our PC/Raspberry Pi, we need to do a few things from the web interface. Open a web browser and type the IP address of your PC/Pi and then add :8096 at the end of it, and you will be redirected to the Jellyfin welcome page. If you are not sure what’s the IP of your PC then just run hostname -I in your terminal window.
Run the setup wizard
Just select your preferred language and go to the next page. Now, you will be asked to create a Username and Password.
Finally, you can allow Jellyfin to scan the directories where you have stored the Movies and Web Series on your PC.
As you can see, I have added the directories where I will keep my media files. Jellyfin will automatically scan the directory and add it to the main Interface.
Open playback settings
Now, you will see the Homepage of Jellyfin, we have to tweak a few settings in order to achieve the perfect streaming setup. From the homepage, go to the settings menu and open ‘Playback Settings’.
Enable the fMP4-HLS container
From the playback settings, enable the ‘Prefer fMP4-HLS media container’ checkbox (in current versions this has moved under Playback, Advanced). Also, if any decoders are shown in your settings, then choose appropriately (select a GPU which is capable of decoding videos).
Finish the media scan
Now, let the server scan all your directories, and then you will be able to stream your Media from the browser.
Open the Jellyfin ports in your firewall
If UFW (Uncomplicated Firewall) is active on your Debian box, Jellyfin’s default ports need explicit rules or nothing on the network will reach it.
sudo apt install ufw
sudo ufw allow 8096/tcp
sudo ufw allow 8920/tcp
sudo ufw allow 7359/udp
sudo ufw enable
Port 8096 handles the web interface over plain HTTP, 8920 is only used if you enable TLS directly in Jellyfin and 7359 lets other devices on the same network find the server automatically. See linuxfordevices.com’s UFW guide for the full command reference if you also need to allow SSH or other services through the same firewall.
Put Jellyfin behind a reverse proxy for remote access
Port forwarding straight to 8096 works, but it sends unencrypted traffic and exposes Jellyfin directly to the internet. A reverse proxy with a real TLS certificate is the safer way to reach your server from outside the house.
Install Nginx, point a subdomain at your public IP, then proxy requests through to Jellyfin on the loopback address. Jellyfin’s live features (SyncPlay, session updates) run over a websocket, so that route needs its own location block with the upgrade headers or those features silently stop working while normal playback still looks fine:
server {
listen 80;
server_name jellyfin.example.com;
location / {
proxy_pass http://127.0.0.1:8096;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location /socket {
proxy_pass http://127.0.0.1:8096/socket;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
Run Certbot’s Nginx plugin afterward to issue a free Let’s Encrypt certificate and switch the site to HTTPS automatically. Linuxfordevices.com’s Let’s Encrypt on Nginx guide covers the certbot side step by step.
Manage, update and troubleshoot your Jellyfin installation
Since Jellyfin lives in a normal apt repository, updates and removal follow the same pattern as any other Debian package.
sudo apt update && sudo apt upgrade jellyfin
sudo apt remove jellyfin
A few issues come up often enough to mention directly. If the setup wizard needs to run again, for example after copying a config to new hardware, set IsStartupWizardCompleted to false in /etc/jellyfin/system.xml and restart the service.
If apt update returns a 404 right after upgrading to a brand-new Debian release, wait a few days for Jellyfin’s repository to catch up before filing a bug report.
If the web interface loads but libraries stay empty, recheck the ACL permissions from earlier rather than the Jellyfin config itself, since that is the more common cause.
Key takeaways
- Jellyfin’s Debian repository now uses the deb822 sources format and /etc/apt/keyrings, not the old single-file method
- apt install jellyfin pulls in jellyfin-server, jellyfin-web and jellyfin-ffmpeg together
- Debian 12 Bookworm and Debian 13 Trixie both have official Jellyfin packages
- Set ACL permissions on media folders before adding libraries, or Jellyfin can’t read them
- Open 8096/tcp, 8920/tcp and 7359/udp in UFW if the firewall is active
- Avoid raw port forwarding, use a reverse proxy with Let’s Encrypt instead
- The community itrue-jellyfin snap is unofficial and not maintained by the Jellyfin project
Frequently asked questions
What is the easiest way to install Jellyfin on Debian?
Add Jellyfin’s official apt repository with its GPG key, then run sudo apt install jellyfin. This installs the server, web client and bundled FFmpeg build in one command.
Does Jellyfin support Debian 13 Trixie yet?
Yes, Jellyfin’s repository publishes packages for Debian 13 Trixie and Debian 12 Bookworm. A 404 right after a new Debian release usually clears up within days.
Why can’t Jellyfin see my media files after install?
The Jellyfin system user usually lacks read permission on the folder. Run setfacl -R -m u:jellyfin:rx on the media path, then rescan the library from the dashboard.
Which ports does Jellyfin need open in the firewall?
Open 8096/tcp for the web interface, 8920/tcp only if TLS is enabled directly in Jellyfin and 7359/udp so client apps can find the server automatically.
Is it safe to port forward Jellyfin straight to the internet?
It works but sends unencrypted traffic and exposes the server directly. A reverse proxy with a Let’s Encrypt certificate adds encryption and keeps Jellyfin off the open internet.
Can I run Jellyfin in Docker instead of apt on Debian?
Yes, Jellyfin publishes an official Docker image. It suits setups already running other services in containers, though apt stays simpler to manage for a single dedicated server.
How do I update Jellyfin on Debian after installing it?
Run sudo apt update followed by sudo apt upgrade jellyfin. Because it lives in a normal apt repository, it updates alongside the rest of the system.