Skip to content
Brokerr

Security and storage

Storage layout

Section titled “Storage layout”

The default persistent directory contains:

  • config.yml: bootstrap configuration;
  • app.db: runtime configuration, users, history, mappings, OAuth tokens, and metadata;
  • AniBridge cache: rebuildable mapping data;
  • artwork/thumbnails: optional, rebuildable source poster cache;
  • master_key when the Compose example uses a file under /data.

Encryption

Section titled “Encryption”

Provider credentials and OAuth tokens use AES-256-GCM encryption. Passwords are hashed. The database does not reveal usable provider tokens without the master key.

The master key can be inline in bootstrap YAML or loaded from a file. A file or Docker secret is recommended. Exactly one source is allowed.

Loss and rotation

Section titled “Loss and rotation”

Losing the master key makes encrypted API/provider credentials unreadable. It is not recoverable from the administrator password. Provider accounts must be reconnected and credentials re-entered after creating a new clean secret store.

Master-key rotation is an offline operation. Stop Brokerr, run the supported rotation command, update the bootstrap key source, then restart.

Exposure rules

Section titled “Exposure rules”

Never publish /data, commit master keys, expose provider tokens in URLs, or attach unsanitized DB/log files to support reports. Use HTTPS and protect the Brokerr login even when the service is reachable only through a reverse proxy.

Source thumbnail cache

Section titled “Source thumbnail cache”

Brokerr serves Plex, Jellyfin, and Emby posters through its authenticated API; source credentials never appear in browser image URLs. With caching enabled, the first view stores a bounded thumbnail under /data/artwork/thumbnails.

Media with a shared TMDB, TVDB, IMDb, AniDB, AniList, or MAL identifier reuse one thumbnail across sources, profiles, and targets. Items without a stable ID remain source-specific. Names and release years are not used for deduplication.

Configure caching and its TTL in Settings > General > Source artwork. A TTL of 0 disables refresh and automatic cleanup. Clear thumbnail cache removes only image files and cache metadata; run history and artwork identities remain. If a refresh fails, Brokerr keeps serving the previous cached image.