AccessFlow
Docker app from Pantanet96's Repository
Overview
Readme
View on GitHub
AccessFlow
Self-hosted portal to manage invites for your Plex users.
FastAPI + Jinja2/HTMX + SQLite, shipped as a single Docker container that sits behind your reverse proxy.
Latest release
Docker Image
Docker Pulls
Python
FastAPI
License: MIT
What problem does it solve?
You share your Plex server with friends, family or other people, and keeping track of it by hand gets messy: who has been invited, who accepted, who still has access to which libraries, and when each person's access ends.
AccessFlow does that for you: it invites people to Plex, gives each one a plan with an expiry date, reminds them before it runs out, and removes their library access when it does.
What it does
Invite → Assign a plan → Remind → Suspend
Invite someone from the portal, give them a plan (free, trial or timed), get a reminder before their access expires, and have their libraries unshared automatically if it lapses. Paid plans are supported too, with renewals you confirm by hand.
- Invites — send the Plex invite and a guide email from the portal; unaccepted ones expire after 30 days and the share is withdrawn
- Plans and expiry — free, trial and custom timed plans; each plan sets which libraries the user can see
- Automatic reminders — expiry notices via email and Telegram, on a configurable schedule
- Automatic suspension — past the grace period, libraries are unshared; access comes back when the user is renewed
- Overseerr / Jellyseerr — request permissions follow the plan and the Plex access
- Multiple managers — several admins or moderators can each look after their own users
- Secure login — optional two-step verification (TOTP), login lockout, password rules
- Also — Telegram bot, reports, audit log, nightly backups, 3 themes, translatable UI
Screenshots
| Dashboard | Users |
|---|---|
 |
 |
| Collect | Reports |
|---|---|
 |
 |
Three themes (Rame, Inchiostro, Muschio), switchable from Settings.
Quick start
cp .env.example .env # fill in the secrets, never commit the real .env
docker compose up -d
App at http://localhost:8000, meant to sit behind your reverse proxy. The image is pantanet96/accessflow on Docker Hub; on Unraid use the Community Applications template.
Upgrade with docker compose pull && docker compose up -d.
Documentation
Roles, plans, workflows, deploy details, security, configuration, background jobs, translations and local development are in the full guide. Security details: docs/SECURITY.md.
Star history
Categories
Download Statistics
Related apps
Explore more like this
Explore allDetails
pantanet96/accessflowRuntime arguments
- Web UI
http://[IP]:[PORT:8000]/- Network
bridge- Shell
sh- Privileged
- false
Template configuration
Container Port: 8000
- Target
- 8000
- Default
- 8000
- Value
- 8000
SQLite DB + backups + secrets. Container Path: /data
- Target
- /data
- Default
- /mnt/user/appdata/accessflow
- Value
- /mnt/user/appdata/accessflow
REQUIRED. Random string >=32 chars, the app refuses to start without it. Generate: python -c "import secrets;print(secrets.token_urlsafe(48))"
- Target
- APP_SECRET_KEY
Your public https:// URL (through the reverse proxy). Needed for Secure session cookies.
- Target
- PUBLIC_BASE_URL
- Default
- http://localhost:8000
- Value
- http://localhost:8000
Reverse proxy source IP/subnet uvicorn trusts for X-Forwarded-*. Never "*" if exposed directly. Unraid docker bridge is typically 172.17.0.0/16.
- Target
- FORWARDED_ALLOW_IPS
- Default
- 127.0.0.1
- Value
- 127.0.0.1
Timezone for schedules/reminders/backups.
- Target
- TZ
- Default
- Europe/Rome
- Value
- Europe/Rome
UI language (it/en).
- Target
- DEFAULT_LOCALE
- Default
- it
- Value
- it
Local login username, seeded on first boot.
- Target
- SUPERADMIN_USERNAME
- Default
- admin
- Value
- admin
Leave blank: a random password is generated and logged once at first boot (change it later from /profile).
- Target
- SUPERADMIN_PASSWORD
Admin Plex token, used for invites + OAuth. https://support.plex.tv/articles/204059436
- Target
- PLEX_TOKEN
Name of the Plex server to manage.
- Target
- PLEX_SERVER_NAME
Optional: connect straight to this Plex baseurl (plex.direct dashed-host form), skipping plex.tv discovery. Leave blank for normal discovery.
- Target
- PLEX_DIRECT_URL
Optional: stable Plex client identifier. Derived from the secret key if left blank.
- Target
- PLEX_CLIENT_ID
Revoke the user's Plex server access when their AccessFlow account is deleted.
- Target
- PLEX_REVOKE_ON_DELETE
- Default
- false
- Value
- false
Optional: enables the Telegram reminder bot. From @BotFather.
- Target
- TELEGRAM_BOT_TOKEN
Bot username (without @), used for deep links.
- Target
- TELEGRAM_BOT_USERNAME
Optional: enables email reminders.
- Target
- SMTP_HOST
- Target
- SMTP_PORT
- Default
- 587
- Value
- 587
- Target
- SMTP_USER
- Target
- SMTP_PASS
From address for reminder emails.
- Target
- SMTP_FROM
Display name in the From header.
- Target
- SMTP_FROM_NAME
- Target
- SMTP_TLS
- Default
- true
- Value
- true
Hour (0-23, server TZ) the daily expiration scan + reminders run.
- Target
- NOTIFY_HOUR
- Default
- 9
- Value
- 9
Comma-separated days-before-expiry to send reminders. Admin-editable in Settings too.
- Target
- REMINDER_DAYS_BEFORE
- Default
- 7,3,1
- Value
- 7,3,1
Comma-separated overdue days for dunning follow-ups. Admin-editable in Settings too.
- Target
- REMINDER_DAYS_AFTER
- Default
- 0,3
- Value
- 0,3
Manager weekly-digest lookahead window in days. Admin-editable in Settings too.
- Target
- DIGEST_LOOKAHEAD_DAYS
- Default
- 14
- Value
- 14
How many nightly SQLite backups to keep.
- Target
- BACKUP_KEEP
- Default
- 14
- Value
- 14
Run the daily reminder/backup scheduler in-process.
- Target
- ENABLE_SCHEDULER
- Default
- true
- Value
- true
Run the Telegram bot (polling) in-process.
- Target
- ENABLE_BOT
- Default
- true
- Value
- true