How to Install Plex Media Server on Ubuntu

Plex Media Server centralizes your personal video, music, and photo library so you can stream it anywhere without handing control to a paid service. The server optimizes media for each device automatically, supports multi-user libraries with individual profiles, and still lets you decide exactly where files live. This makes it ideal for self-hosted home theaters, media archival, and lab environments where you want full control over your content.

By the end of this guide, you will have a working Plex Media Server installed from the official repository with secure GPG key management, firewall rules for local and remote access, proper file permissions for your media directories, and an optional Nginx reverse proxy with free SSL certificates from Let’s Encrypt. Open a terminal from your applications menu or connect via SSH before starting.

These steps cover Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS installations. The Plex repository uses a universal package format that works across all current Ubuntu releases. Commands shown work identically on all supported LTS releases.

Install Plex Media Server on Ubuntu

Refresh Ubuntu Packages

Update existing packages so the APT tooling and system libraries Plex depends on are current:

sudo apt update && sudo apt upgrade -y

Reboot if the upgrade installs a new kernel or GLIBC release, then reconnect to the server.

Add the Official Plex Repository

First, install the packages needed to download and verify the Plex GPG key. Minimal Ubuntu images (Docker, cloud instances) may not include gpg by default:

sudo apt install curl gpg ca-certificates -y

Next, import Plex’s GPG signing key into the system keyring. This key verifies that packages genuinely come from Plex and have not been tampered with:

curl -fsSL https://downloads.plex.tv/plex-keys/PlexSign.key | sudo gpg --dearmor -o /usr/share/keyrings/plex.gpg

The --dearmor flag converts the ASCII-armored key into binary format, which APT requires. Storing it in /usr/share/keyrings/ keeps the key scoped to specific repositories rather than trusting it system-wide.

Now create a DEB822-format repository file. This modern format is cleaner than legacy .list files and explicitly links the repository to its signing key:

sudo tee /etc/apt/sources.list.d/plexmediaserver.sources > /dev/null <<'EOF'
Types: deb
URIs: https://downloads.plex.tv/repo/deb
Suites: public
Components: main
Signed-By: /usr/share/keyrings/plex.gpg
EOF

The Signed-By line scopes the key to this repository only, preventing unrelated packages from trusting it.

Install Plex Media Server

Pull the latest package metadata and install Plex:

sudo apt update
sudo apt install plexmediaserver -y

The installer creates the plex system user, a systemd unit, and exposes the web interface on http://SERVER_IP:32400/web.

Verify the plexmediaserver Service

The daemon starts automatically. Confirm its status and exit the pager with q when finished:

sudo systemctl status --no-pager plexmediaserver

The output should resemble the following:

● plexmediaserver.service - Plex Media Server
     Loaded: loaded (/lib/systemd/system/plexmediaserver.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-01-02 10:23:45 UTC; 1min 30s ago
   Main PID: 2847 (Plex Media Serv)
      Tasks: 48 (limit: 4915)
     Memory: 312.4M
        CPU: 4.521s
      CGroup: /system.slice/plexmediaserver.service
              └─2847 "/usr/lib/plexmediaserver/Plex Media Server"

Manage the Plex Service

The installer enables and starts the service automatically. If you need to manage it manually, use these systemctl commands:

sudo systemctl stop plexmediaserver    # Stop the service
sudo systemctl start plexmediaserver   # Start the service
sudo systemctl restart plexmediaserver # Restart after config changes
sudo systemctl enable plexmediaserver  # Enable at boot (already done by installer)
sudo systemctl disable plexmediaserver # Disable at boot

Prepare Network Access for Plex

Open Required Ports with UFW (Optional)

Ubuntu’s uncomplicated firewall (UFW) should allow SSH before you enable it, otherwise you will instantly lose remote access. Review our guide on enabling and disabling UFW on Ubuntu if you need a refresher.

Always allow SSH before turning on UFW. Even a short lapse locks out new sessions and may require an out-of-band console to fix.

Allow SSH, Plex’s default port, and the optional reverse-proxy ports:

sudo ufw allow OpenSSH
sudo ufw allow 32400/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Display the rule set at any time with sudo ufw status numbered.

Create an SSH Tunnel for First-Time Setup

Plex restricts the initial configuration to localhost for security. Create a tunnel that forwards your workstation port 8888 to the server’s Plex port:

ssh -L 8888:localhost:32400 username@SERVER_IP

If SSH listens on a different port, add the -p flag:

ssh -p 2222 -L 8888:localhost:32400 username@SERVER_IP

Install and enable OpenSSH if your server image omitted it. Our SSH installation guide for Ubuntu covers hardening options after the base install:

sudo apt install openssh-server -y
sudo systemctl enable ssh --now

Once the tunnel is active, browse to http://localhost:8888/web (or directly to http://localhost:32400/web/index.html#!/setup). After completing the wizard, you can connect on your LAN at http://SERVER_IP:32400/web or through Plex’s relay at app.plex.tv, which terminates on a trusted plex.direct hostname.

Complete the Plex Web Setup

The web wizard ensures Plex links to your account and can discover media paths. The screenshots below show each stage so you know what to expect.

Sign in with an existing Plex, Google, Apple, or Facebook account, or create a new Plex account. Once authenticated, Plex explains how the server, apps, and relay service interact.

Walk Through the Welcome Prompts

The first screen summarizes Plex’s architecture. Click GOT IT! to continue.

Firefox and other browsers may prompt you to enable DRM playback. Approve it so the Plex Web UI can display protected video previews.

Without DRM enabled, Firefox cannot load Plex’s web components correctly, and the setup wizard may stall on a blank screen.

Evaluate Plex Pass (Optional)

Plex offers a Plex Pass upsell that unlocks mobile sync, HDR tone mapping, and early access builds. Click the X in the corner if you are not ready to subscribe yet.

Name the Server and Enable Remote Access

Give the server a recognizable name and decide whether to keep Allow me to access my media outside my home enabled. Leaving it on lets Plex broker connections through plex.direct; disable it if you want to rely strictly on VPNs or your own reverse proxy.

Add or Skip Media Libraries

You can pre-load media folders now or skip and return later from the dashboard. Click ADD LIBRARY when you are ready.

Choose the media type (Movies, TV, Music, etc.) so Plex knows which metadata agent to use.

Click BROWSE FOR MEDIA FOLDER and point Plex to the directories mounted on your server. You can add multiple paths per library.

Skip the library step if your disks are not mounted yet. You can add them later from Settings > Manage > Libraries.

Use the Advanced options to control language, metadata agents, and whether Plex scans for changes automatically.

Control Library Scan Behavior

After the wizard finishes, open Settings > Library to decide how Plex watches for new content. These toggles keep libraries accurate without overloading slower CPUs or disks.

• Scan my library automatically: Leave this on so Plex reacts immediately when new files sync over SMB or NFS shares.
• Run a partial scan when changes are detected: Uses inotify to rescan only impacted folders instead of the whole collection, saving time on larger arrays.
• Update my library periodically: Schedule a nightly rescan if you ingest content through cron jobs or downloaders while you sleep.

Disable CPU-heavy extras such as “Generate video preview thumbnails” or “Generate intro video markers” on low-power hardware; you can re-enable them later once the initial metadata import is complete.

Finish the Wizard

Click NEXT once libraries are added (or skipped) and Plex will confirm the server is ready. Choose DONE to load the dashboard.

The dashboard confirms the server is online and ready for library scans.

Configure Media File Permissions

The plex service account needs read and execute access to every media directory. ACLs preserve your existing ownership, while chown transfers ownership entirely to Plex.

Grant Access with setfacl (Recommended)

Install ACL utilities and grant Plex access to one or more library paths. Replace the example paths with your mount points:

sudo apt install acl -y
sudo setfacl -R -m u:plex:rx /media/yourfolder/
sudo setfacl -R -m u:plex:rx /media/yourfolder/tv
sudo setfacl -R -m u:plex:rx /media/yourfolder/movies
sudo setfacl -d -m u:plex:rx /media/yourfolder/

The final command creates a default ACL so any new files dropped into that directory stay accessible. Confirm the rule with getfacl /media/yourfolder/.

Change Ownership with chown (Alternative)

If you prefer Plex to own the media outright, transfer ownership recursively. This method is simple but prevents other users or services from writing to the same folders unless you create additional ACLs.

For scenarios where multiple services still need write access, pair chown with the chmod command to fine-tune group permissions instead of granting Plex exclusive control.

sudo chown -R plex:plex /media/yourfolder/
sudo chown -R plex:plex /media/yourfolder/tv
sudo chown -R plex:plex /media/yourfolder/movies

Restart Plex if libraries were already added so it rescans with the new permissions:

sudo systemctl restart plexmediaserver

Secure External Access with Nginx Reverse Proxy (Optional)

Plex’s built-in relay works, but reverse proxying your own domain offers better performance and lets you reuse existing TLS certificates. If you need a refresher on installing Nginx or tuning performance, review our guide on installing Nginx on Ubuntu.

Install and Configure Nginx

Install Nginx, enable it, and create a proxy configuration:

sudo apt install nginx -y
sudo systemctl enable nginx --now
sudo nano /etc/nginx/conf.d/plex.conf

Add a server block that proxies requests to Plex’s local port. Replace plex.example.com with your domain.

server {
    listen 80;
    server_name plex.example.com;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_pass http://127.0.0.1:32400;
        proxy_read_timeout 3600;
    }
}

Save and exit, then test and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

Update your DNS records so the Plex subdomain resolves to the server’s public IP. You can now browse to http://plex.example.com.

Add Let’s Encrypt SSL Certificates

Certbot automates TLS provisioning for Nginx. Install the plugin, request a certificate, and enable HTTP to HTTPS redirection:

sudo apt install python3-certbot-nginx -y
sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email you@example.com -d plex.example.com

Certbot updates plex.conf automatically. The --redirect flag forces HTTPS, --hsts adds a Strict-Transport-Security header, and --staple-ocsp improves certificate revocation checking. Replace the email and domain placeholders with real values.

Ubuntu’s Certbot package installs a systemd timer for renewals. Verify it once with a dry run:

sudo certbot renew --dry-run

No additional cron job is required; the timer triggers twice per day and renews certificates 30 days before expiration.

Manage Plex Media Server

Update Plex

Plex updates arrive through the repository you added earlier. To update only Plex without upgrading other system packages, use the --only-upgrade flag:

sudo apt update
sudo apt install --only-upgrade plexmediaserver

This approach refreshes package metadata and upgrades Plex if a new version is available, leaving other packages untouched. The service restarts automatically after the upgrade completes. Confirm it is running with:

sudo systemctl status --no-pager plexmediaserver

Remove Plex and Clean Up

When Plex is no longer required, remove the package, its repository definition, and the GPG key:

sudo apt remove --purge plexmediaserver -y
sudo rm /etc/apt/sources.list.d/plexmediaserver.sources
sudo rm /usr/share/keyrings/plex.gpg
sudo apt autoremove -y

The commands above remove the Plex package, repository, and signing key. However, Plex stores configuration, metadata, and library databases in /var/lib/plexmediaserver/. If you want a complete removal, delete this directory as well.

The following command permanently deletes all Plex configuration, metadata databases, and cached thumbnails. If you plan to reinstall Plex later or migrate to another server, back up this directory first with sudo cp -r /var/lib/plexmediaserver/ ~/plex-backup/.

sudo rm -rf /var/lib/plexmediaserver/

Finally, clean up any reverse proxy configuration or firewall rules you created if other services will reuse those ports:

sudo rm /etc/nginx/conf.d/plex.conf
sudo ufw delete allow 32400/tcp

Troubleshooting Common Issues

Plex Web Interface Not Accessible

Confirm the service is bound to port 32400 and review logs for binding errors or database corruption:

sudo systemctl status plexmediaserver
sudo ss -tulpn | grep 32400
sudo journalctl -u plexmediaserver -n 50

Media Not Appearing in Libraries

Scan permissions from Plex’s perspective. These commands show whether the plex user can access each directory and which ACL entries apply:

sudo -u plex ls -la /media/yourfolder/
getfacl /media/yourfolder/

Rescan the library from the Plex dashboard after fixing permissions.

Nginx Reverse Proxy Connection Issues

Syntax errors or missing DNS records commonly break the proxy. Validate the configuration, reload Nginx, and inspect the last 50 log entries:

sudo nginx -t
sudo systemctl reload nginx
sudo journalctl -u nginx -n 50

Remote Access Still Shows Offline

Plex’s Remote Access page needs an open TCP 32400 path from the internet to your server. Confirm the server knows its public IP, the firewall allows the port, and your router forwards the connection.

curl -4 ifconfig.me
sudo ss -tulpn | grep 32400
sudo ufw status numbered

Use the first command to verify the public IP shown in Plex matches your real address. The second confirms Plex is listening locally, and the third ensures UFW (or another firewall) allows port 32400. If those checks pass, log into your router and forward TCP 32400 to the Plex server’s LAN IP, then refresh the Remote Access page.

As a fallback, keep the SSH tunnel method from earlier sections handy; it gives you guaranteed access while you troubleshoot NAT or ISP restrictions.

APT Repository or GPG Key Errors

If apt update fails with signature verification errors or “NO_PUBKEY” warnings, the GPG key may have been corrupted or not imported correctly. Re-import the signing key and refresh the package cache:

sudo rm /usr/share/keyrings/plex.gpg
curl -fsSL https://downloads.plex.tv/plex-keys/PlexSign.key | sudo gpg --dearmor -o /usr/share/keyrings/plex.gpg
sudo apt update

If the repository file is missing or malformed, recreate it:

sudo tee /etc/apt/sources.list.d/plexmediaserver.sources > /dev/null <<'EOF'
Types: deb
URIs: https://downloads.plex.tv/repo/deb
Suites: public
Components: main
Signed-By: /usr/share/keyrings/plex.gpg
EOF
sudo apt update

After running apt update successfully, verify the Plex repository appears in the package sources:

apt-cache policy plexmediaserver

The output should show a candidate version from https://downloads.plex.tv/repo/deb. If the candidate is listed as “(none)” or missing, check the repository file spelling and ensure the GPG key file exists.

First-Time User Tips

Organize Your Media Library

Plex’s metadata agents expect consistent naming. Adopt clean directory structures for every media type:

• Movies: /media/movies/Movie Name (Year)/Movie Name (Year).mkv
• TV Shows: /media/tv/Show Name/Season 01/Show Name - S01E01.mkv
• Music: /media/music/Artist Name/Album Name/01 - Track Name.mp3

Including the year for films and the season/episode numbers for TV shows gives Plex enough data to pull the right posters and metadata.

Optimize Transcoding Performance

Transcoding converts high-bitrate masters into streams devices can handle. Keep sessions smooth with these tweaks:

1. Enable hardware acceleration in Settings > Transcoder if your CPU or GPU supports Intel Quick Sync, AMD VCN, or NVIDIA NVENC.
2. Point the transcoding temporary directory to SSD-backed storage so Plex does not stall on slow spinning disks.
3. Ask remote users to pick the appropriate quality preset inside the Plex app to avoid unnecessary 4K to 1080p conversions.

Conclusion

Plex Media Server now runs from the official repository with secure key handling, controlled firewall exposure, guided setup, and hardened file permissions. Whether you keep it on your LAN or front it with an Nginx reverse proxy, remember to apply Ubuntu security updates consistently or enable unattended upgrades on Ubuntu so Plex’s dependencies stay patched.

Useful Links

For further reading, updates, and community support, consult these official Plex resources:

• Plex Official Website: Visit the official Plex website for information about Plex Media Server, its features, and download options.
• Plex Linux Installation Guide: The official Plex documentation for installing Plex Media Server on Linux, including Ubuntu and Debian.
• Plex Support: Access the Plex support page for troubleshooting, guides, and FAQs to help resolve issues and optimize your Plex experience.
• Plex Forums: Join the Plex community forums to discuss issues, share solutions, and get support from other Plex users.