How to Install Plex Media Server on Ubuntu (26.04, 24.04, 22.04)

Plex Media Server centralizes your personal video, music, and photo library so you can stream it to any device without relying on third-party cloud services. The server transcodes media on-the-fly to match each client’s capabilities, supports multiple users with separate watch histories, and keeps all your files stored locally where you control them. Whether you are building a home theater, archiving family videos, or setting up a media server for a small office, Plex handles the heavy lifting while you retain full ownership of your content.

This guide walks through installing Plex from the official repository with proper GPG key management, configuring firewall rules for local and remote streaming, setting file permissions so Plex can read your media directories, and optionally fronting the server with an Nginx reverse proxy secured by free Let’s Encrypt certificates. Open a terminal from your applications menu or connect via SSH before starting.

These steps cover Ubuntu 26.04 LTS, 24.04 LTS, and 22.04 LTS installations. The Plex repository uses a universal package format that works across all current Ubuntu releases. Commands shown work identically on all supported LTS releases.

Install Plex Media Server on Ubuntu

Refresh Ubuntu Packages

Start by refreshing your package index and upgrading installed software. This ensures APT has the latest dependency information and that system libraries Plex relies on are current:

sudo apt update && sudo apt upgrade -y

The -y flag automatically confirms the upgrade, which is convenient for scripted setups but means you will not see the package list before it proceeds. If the upgrade installs a new kernel or core library (GLIBC, OpenSSL), reboot the server before continuing so all services load the updated components.

Add the Official Plex Repository

Install the packages needed to download and verify the Plex GPG key. Minimal Ubuntu images, such as those used in Docker containers or cloud instances, may not include gpg by default:

sudo apt install curl gpg ca-certificates -y

Import the Plex GPG signing key into the system keyring. The curl command fetches the key from Plex’s server, and gpg --dearmor converts it from ASCII-armored text to the binary format APT requires:

curl -fsSL https://downloads.plex.tv/plex-keys/PlexSign.key | sudo gpg --dearmor -o /usr/share/keyrings/plex.gpg

The -fsSL flags tell curl to fail silently on HTTP errors (-f), suppress progress output (-sS), and follow redirects (-L). Storing the key in /usr/share/keyrings/ keeps it scoped to specific repositories rather than adding it to the system-wide trusted keyring, which is the recommended approach for third-party sources.

Create a DEB822-format repository file that references this key. DEB822 is the modern repository format that replaces the legacy single-line .list style, offering clearer syntax and better support for signed repositories:

sudo tee /etc/apt/sources.list.d/plexmediaserver.sources > /dev/null <<'EOF'
Types: deb
URIs: https://downloads.plex.tv/repo/deb
Suites: public
Components: main
Architectures: amd64
Signed-By: /usr/share/keyrings/plex.gpg
EOF

The tee command writes the heredoc content to the file with root privileges. The Signed-By field links this repository to the specific GPG key you imported, so APT will only trust packages signed by Plex for this source.

Install Plex Media Server

Refresh the package index so APT sees the new Plex repository, then install the server:

sudo apt update
sudo apt install plexmediaserver -y

The installer creates a dedicated plex system user to run the service, registers a systemd unit for automatic startup, and opens the web interface on port 32400. You can access it at http://SERVER_IP:32400/web once the service starts.

Verify Plex Service Status

The Plex daemon starts automatically after installation. Check that the service is running and enabled for boot:

sudo systemctl status --no-pager plexmediaserver

The --no-pager flag prints the output directly to the terminal instead of opening it in less, which is useful when running commands over SSH or in scripts. Look for active (running) in the output:

● plexmediaserver.service - Plex Media Server
     Loaded: loaded (/lib/systemd/system/plexmediaserver.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-01-02 10:23:45 UTC; 1min 30s ago
   Main PID: 2847 (Plex Media Serv)
      Tasks: 48 (limit: 4915)
     Memory: 312.4M
        CPU: 4.521s
      CGroup: /system.slice/plexmediaserver.service
              └─2847 "/usr/lib/plexmediaserver/Plex Media Server"

The enabled state in the Loaded line confirms Plex will start automatically after a reboot. If you see inactive or failed instead, check the journal for errors with journalctl -u plexmediaserver -n 30.

Manage the Plex Service

The installer enables and starts Plex automatically, so you typically do not need to touch systemctl unless something goes wrong or you want to temporarily stop the server. These commands cover the common scenarios:

sudo systemctl stop plexmediaserver    # Stop the service immediately
sudo systemctl start plexmediaserver   # Start the service
sudo systemctl restart plexmediaserver # Restart after config changes
sudo systemctl enable plexmediaserver  # Start automatically at boot
sudo systemctl disable plexmediaserver # Prevent automatic start at boot

Restarting the service is useful after editing Plex’s advanced settings or when troubleshooting library scan issues. The process usually takes a few seconds, after which clients can reconnect.

Prepare Network Access for Plex

Open Required Ports with UFW (Optional)

If your server runs Ubuntu’s Uncomplicated Firewall (UFW), you need to open the ports Plex uses for streaming. Before enabling UFW, always allow SSH first to avoid locking yourself out of the server. Review our guide on enabling and disabling UFW on Ubuntu for a complete overview of firewall management.

Enabling UFW without an SSH rule will immediately block new SSH connections. If you are connected remotely, this locks you out and typically requires out-of-band console access to fix.

Allow SSH, Plex’s primary streaming port, and the HTTP/HTTPS ports needed for the optional reverse proxy:

sudo ufw allow OpenSSH
sudo ufw allow 32400/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Port 32400 is Plex’s default port for web access and streaming. Opening ports 80 and 443 is only necessary if you plan to set up the Nginx reverse proxy later in this guide. If you only need local streaming without a reverse proxy, you can skip the 80 and 443 rules. Verify your rules with sudo ufw status numbered.

Create an SSH Tunnel for First-Time Setup

Plex requires the initial setup wizard to be accessed from localhost as a security measure. This prevents someone on the network from claiming your server before you do. If you installed Plex on a remote server, create an SSH tunnel that forwards a local port on your workstation to the Plex port on the server:

ssh -L 8888:localhost:32400 username@SERVER_IP

The -L 8888:localhost:32400 argument tells SSH to listen on port 8888 on your local machine and forward connections through the encrypted tunnel to port 32400 on the remote server. Replace username with your SSH login and SERVER_IP with your server’s address.

If your SSH server listens on a non-standard port, add the -p flag:

ssh -p 2222 -L 8888:localhost:32400 username@SERVER_IP

If your server does not have SSH installed (common on minimal cloud images), install and enable it. Our SSH installation guide for Ubuntu covers hardening options after the base install:

sudo apt install openssh-server -y
sudo systemctl enable ssh --now

With the tunnel active, open your browser and go to http://localhost:8888/web to start the setup wizard. Alternatively, navigate directly to http://localhost:32400/web/index.html#!/setup on the server itself if you have physical or console access. After completing the wizard and linking your Plex account, you can access the server from anywhere on your LAN at http://SERVER_IP:32400/web or through Plex’s relay service at app.plex.tv.

Complete the Plex Web Setup

The first time you access Plex, a setup wizard walks you through linking your Plex account and pointing the server at your media directories. The screenshots below show each stage so you know what to expect. If you already have media organized on the server, you can add those folders now; otherwise, skip the library setup and return to it later from the dashboard.

Sign in with an existing Plex, Google, Apple, or Facebook account, or create a new Plex account. Once authenticated, Plex explains how the server, apps, and relay service interact.

Walk Through the Welcome Prompts

The first screen summarizes Plex’s architecture. Click GOT IT! to continue.

Firefox and other browsers may prompt you to enable DRM playback. Approve it so the Plex Web UI can display protected video previews.

Without DRM enabled, Firefox cannot load Plex’s web components correctly, and the setup wizard may stall on a blank screen.

Evaluate Plex Pass (Optional)

Plex offers a Plex Pass upsell that unlocks mobile sync, HDR tone mapping, and early access builds. Click the X in the corner if you are not ready to subscribe yet.

Name the Server and Enable Remote Access

Give the server a recognizable name and decide whether to keep Allow me to access my media outside my home enabled. Leaving it on lets Plex broker connections through plex.direct; disable it if you want to rely strictly on VPNs or your own reverse proxy.

Add or Skip Media Libraries

You can pre-load media folders now or skip and return later from the dashboard. Click ADD LIBRARY when you are ready.

Choose the media type (Movies, TV, Music, etc.) so Plex knows which metadata agent to use.

Click BROWSE FOR MEDIA FOLDER and point Plex to the directories mounted on your server. You can add multiple paths per library.

Skip the library step if your disks are not mounted yet. You can add them later from Settings > Manage > Libraries.

Use the Advanced options to control language, metadata agents, and whether Plex scans for changes automatically.

Control Library Scan Behavior

After the wizard finishes, open Settings > Library to decide how Plex watches for new content. These toggles keep libraries accurate without overloading slower CPUs or disks.

• Scan my library automatically: Leave this on so Plex reacts immediately when new files sync over SMB or NFS shares.
• Run a partial scan when changes are detected: Uses inotify to rescan only impacted folders instead of the whole collection, saving time on larger arrays.
• Update my library periodically: Schedule a nightly rescan if you ingest content through cron jobs or downloaders while you sleep.

Disable CPU-heavy extras such as “Generate video preview thumbnails” or “Generate intro video markers” on low-power hardware; you can re-enable them later once the initial metadata import is complete.

Finish the Wizard

Click NEXT once libraries are added (or skipped) and Plex will confirm the server is ready. Choose DONE to load the dashboard.

The dashboard confirms the server is online and ready for library scans.

Configure Media File Permissions

The plex service runs under its own dedicated system account, which means it can only read files and directories that account has access to. If your media lives on a separate disk or in home directories owned by other users, you need to grant the plex user read and execute permissions on those paths. There are two common approaches: Access Control Lists (ACLs) and ownership transfer with chown.

Grant Access with setfacl (Recommended)

ACLs let you grant Plex access without changing the files’ owner or group, which is ideal when other users or services need to write to the same directories. Install the ACL utilities if they are not already present:

sudo apt install acl -y

Grant the plex user read and execute access to your media directories. The -R flag applies the rule recursively to all existing files and subdirectories:

sudo setfacl -R -m u:plex:rx /media/yourfolder/
sudo setfacl -R -m u:plex:rx /media/yourfolder/tv
sudo setfacl -R -m u:plex:rx /media/yourfolder/movies

The -m u:plex:rx modifier adds a rule granting the plex user read (r) and execute (x) permissions. Execute permission on directories allows Plex to list their contents.

To ensure new files added later also inherit these permissions, set a default ACL on the parent directory:

sudo setfacl -d -m u:plex:rx /media/yourfolder/

The -d flag creates a default ACL that applies to any new files or subdirectories created inside this folder. Confirm the rules applied correctly with getfacl /media/yourfolder/.

Change Ownership with chown (Alternative)

If Plex is the only application accessing your media files, you can transfer ownership of the directories to the plex user. This is simpler than managing ACLs but prevents other users from writing to those folders unless you configure group permissions separately.

sudo chown -R plex:plex /media/yourfolder/
sudo chown -R plex:plex /media/yourfolder/tv
sudo chown -R plex:plex /media/yourfolder/movies

The -R flag applies the ownership change recursively. For scenarios where multiple services or users still need write access, pair ownership changes with the chmod command to set appropriate group permissions, or use ACLs instead.

After adjusting permissions, restart Plex if you already added libraries so it can rediscover files with the new access rights:

sudo systemctl restart plexmediaserver

Secure External Access with Nginx Reverse Proxy (Optional)

Plex includes a built-in relay service that routes external connections through Plex’s servers, but running your own reverse proxy offers several advantages: you can use a custom domain, terminate TLS with your own certificates, consolidate multiple services behind one IP address, and avoid relying on Plex’s infrastructure for remote access. If you already have Nginx installed for other sites, adding Plex takes only a few minutes. For a fresh Nginx installation, see our guide on installing Nginx on Ubuntu.

Install and Configure Nginx

Install Nginx and enable it to start at boot, then create a configuration file for the Plex proxy:

sudo apt install nginx -y
sudo systemctl enable nginx --now
sudo nano /etc/nginx/conf.d/plex.conf

Add the following server block. Replace plex.example.com with the domain or subdomain you control:

server {
    listen 80;
    server_name plex.example.com;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_pass http://127.0.0.1:32400;
        proxy_read_timeout 3600;
    }
}

The Upgrade and Connection headers enable WebSocket support, which Plex uses for real-time updates to the web interface. The proxy_read_timeout of 3600 seconds (one hour) prevents Nginx from closing long-running streaming connections prematurely. The X-Forwarded-* headers pass the original client IP and protocol to Plex so logging and access controls work correctly.

Save and exit the editor, then test the configuration and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

If the syntax test passes, update your DNS records to point the Plex subdomain to your server’s public IP. You can then access Plex at http://plex.example.com.

Add Let’s Encrypt SSL Certificates

Running Plex over plain HTTP exposes your login credentials and streaming traffic to eavesdropping. Certbot automates obtaining free TLS certificates from Let’s Encrypt and configuring Nginx to use them. Install the Nginx plugin for Certbot:

sudo apt install python3-certbot-nginx -y

Request a certificate and configure Nginx to redirect all HTTP traffic to HTTPS:

sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email you@example.com -d plex.example.com

Replace the email and domain with your actual values. Certbot modifies your plex.conf file to add the SSL configuration. The flags do the following:

• --redirect: Automatically redirects HTTP requests to HTTPS.
• --hsts: Adds the Strict-Transport-Security header so browsers remember to always use HTTPS.
• --staple-ocsp: Enables OCSP stapling for faster certificate validation by clients.

Ubuntu’s Certbot package installs a systemd timer that checks for expiring certificates twice daily. Verify that automatic renewals are working with a dry run:

sudo certbot renew --dry-run

If the dry run succeeds, no additional cron job is needed. Certbot renews certificates automatically 30 days before they expire.

Manage Plex Media Server

Update Plex

Plex releases updates frequently, and the official repository makes upgrades straightforward. To update Plex without upgrading all other system packages at the same time, use the --only-upgrade flag:

sudo apt update
sudo apt install --only-upgrade plexmediaserver

The --only-upgrade flag tells APT to upgrade the package only if it is already installed, and to skip installation if it is not. This is useful when you want to target a specific package for updates without pulling in new dependencies or upgrading unrelated software. APT restarts the Plex service automatically after the upgrade completes.

Verify the service restarted successfully:

sudo systemctl status --no-pager plexmediaserver

Remove Plex and Clean Up

If you no longer need Plex, remove the package along with its repository configuration and GPG key. The --purge flag removes package configuration files in addition to the software itself:

sudo apt remove --purge plexmediaserver -y
sudo rm -f /etc/apt/sources.list.d/plexmediaserver.sources
sudo rm -f /usr/share/keyrings/plex.gpg
sudo apt autoremove -y

The autoremove command cleans up any dependencies that were installed solely for Plex and are no longer needed. However, Plex stores its configuration, metadata databases, and cached thumbnails in /var/lib/plexmediaserver/. The commands above leave this directory intact in case you want to reinstall later or migrate your library to another server.

Delete Plex Data Directory

For a complete removal that also deletes your library metadata, watch history, and cached thumbnails, remove the data directory.

The following command permanently deletes all Plex configuration, metadata databases, and cached thumbnails. If you plan to reinstall Plex later or migrate to another server, back up this directory first with sudo cp -r /var/lib/plexmediaserver/ ~/plex-backup/.

sudo rm -rf /var/lib/plexmediaserver/

The -rf flags force recursive deletion without prompts. Double-check the path before running this command.

Remove Reverse Proxy and Firewall Rules

If you configured the optional Nginx reverse proxy or opened firewall ports specifically for Plex, clean those up as well:

sudo rm -f /etc/nginx/conf.d/plex.conf
sudo systemctl reload nginx
sudo ufw delete allow 32400/tcp

Reload Nginx after removing the configuration so it stops listening for requests to the Plex domain.

Troubleshooting Common Issues

Plex Web Interface Not Accessible

If you cannot reach the Plex web interface, start by verifying the service is running and listening on the expected port:

sudo systemctl status plexmediaserver
sudo ss -tulpn | grep 32400
sudo journalctl -u plexmediaserver -n 50

The ss command shows whether Plex is listening on port 32400. If the port does not appear in the output, the service may have failed to start or crashed immediately after startup. The journalctl command displays the last 50 log entries for the Plex service, which often reveals the cause: database corruption, missing libraries, or permission problems on the data directory.

Media Not Appearing in Libraries

When Plex scans a library but shows zero items, the plex user almost certainly lacks read access to the media directories. Test permissions from Plex’s perspective by running a command as the plex user:

sudo -u plex ls -la /media/yourfolder/
getfacl /media/yourfolder/

The sudo -u plex command runs ls as the Plex service account. If it returns “Permission denied,” the issue is confirmed. The getfacl command shows the ACL entries on the directory, helping you identify what permissions exist and what is missing. After fixing permissions (see the earlier section), trigger a library rescan from the Plex dashboard under Settings > Manage > Libraries.

Nginx Reverse Proxy Connection Issues

If the reverse proxy returns 502 Bad Gateway or connection timeouts, the problem is usually a configuration syntax error, DNS misconfiguration, or Plex not running. Validate the Nginx configuration and inspect the logs:

sudo nginx -t
sudo systemctl reload nginx
sudo journalctl -u nginx -n 50

The nginx -t command tests the configuration for syntax errors without reloading. If it passes, check that Plex is actually running on port 32400 (see the first troubleshooting section). Also verify that your DNS records point to the correct server IP and that ports 80 and 443 are open in your firewall.

Remote Access Still Shows Offline

Plex’s Remote Access feature requires an unobstructed TCP path from the internet to port 32400 on your server. If the Remote Access page in Plex settings shows “Not available outside your network,” something is blocking the connection. Run these diagnostics:

curl -4 ifconfig.me
sudo ss -tulpn | grep 32400
sudo ufw status numbered

The first command shows your server’s public IP address, which should match what Plex displays on the Remote Access page. The second confirms Plex is listening on 32400. The third shows your firewall rules. If all three checks pass, the issue is likely your router or ISP:

• Router port forwarding: Log into your router and forward TCP 32400 from the WAN interface to your server’s local IP address.
• CGNAT: Some ISPs use Carrier-Grade NAT, which places your connection behind another NAT layer you cannot control. In this case, Remote Access will not work without a VPN or tunnel service.
• Double NAT: If you have multiple routers (e.g., ISP modem plus your own router), you may need to configure port forwarding on both or put one in bridge mode.

Keep the SSH tunnel method from earlier in this guide as a fallback. It provides guaranteed access to Plex while you troubleshoot NAT issues or ISP restrictions.

APT Repository or GPG Key Errors

If apt update fails with signature verification errors or “NO_PUBKEY” warnings, the GPG key was either not imported correctly or became corrupted. Remove the existing key and re-import it:

sudo rm -f /usr/share/keyrings/plex.gpg
curl -fsSL https://downloads.plex.tv/plex-keys/PlexSign.key | sudo gpg --dearmor -o /usr/share/keyrings/plex.gpg
sudo apt update

If the error mentions a missing or malformed repository file, recreate it with the correct DEB822 syntax:

sudo tee /etc/apt/sources.list.d/plexmediaserver.sources > /dev/null <<'EOF'
Types: deb
URIs: https://downloads.plex.tv/repo/deb
Suites: public
Components: main
Architectures: amd64
Signed-By: /usr/share/keyrings/plex.gpg
EOF
sudo apt update

After a successful apt update, verify the Plex repository is recognized:

apt-cache policy plexmediaserver

The output should show a candidate version from https://downloads.plex.tv/repo/deb. If the candidate is listed as “(none)” or the Plex repository does not appear, check the repository file for typos and confirm the GPG key file exists at /usr/share/keyrings/plex.gpg.

First-Time User Tips

Getting Plex installed is only the first step. These tips help you avoid common pitfalls and get the most out of your media server from day one.

Organize Your Media Library

Plex identifies your media by parsing folder names and file names. Consistent naming allows the metadata agents to fetch the correct posters, descriptions, and episode information automatically. Adopt these directory structures:

• Movies: /media/movies/Movie Name (Year)/Movie Name (Year).mkv
• TV Shows: /media/tv/Show Name/Season 01/Show Name - S01E01.mkv
• Music: /media/music/Artist Name/Album Name/01 - Track Name.mp3

Including the release year in movie folder names prevents mix-ups when multiple films share the same title. For TV shows, the folder hierarchy (show > season > episode) is critical because Plex uses it to determine where episodes belong in the series.

Optimize Transcoding Performance

Transcoding converts media on-the-fly when a client device cannot play the original format directly. This is CPU-intensive and can stutter on underpowered hardware. A few adjustments help keep playback smooth:

1. Enable hardware acceleration: Navigate to Settings > Transcoder and enable hardware transcoding if your CPU supports Intel Quick Sync or your GPU supports AMD VCN or NVIDIA NVENC. This offloads the work from the CPU and dramatically reduces transcoding overhead.
2. Use SSD-backed temporary storage: Transcoding writes temporary files frequently. Pointing the Transcoder Temporary Directory to an SSD prevents I/O bottlenecks that can cause playback stuttering, especially when streaming to multiple clients simultaneously.
3. Encourage direct play: Ask family members and remote users to select “Original” or “Maximum” quality in their Plex app settings when bandwidth permits. This avoids transcoding entirely by streaming the file as-is.

Hardware transcoding requires a Plex Pass subscription for most acceleration methods. If you do not have Plex Pass and need to transcode regularly, consider upgrading or encouraging clients to use players that support more codecs natively.

Frequently Asked Questions

Conclusion

You now have a fully functional Plex Media Server running on Ubuntu with secure repository management, file permissions configured for your media directories, and optional network hardening through UFW and an Nginx reverse proxy with TLS. From here, consider enabling unattended upgrades on Ubuntu to keep Plex and its dependencies patched automatically, and explore Plex’s built-in features like watch history sync, parental controls, and bandwidth management under Settings > Remote Access.

Useful Links

These official Plex resources provide additional documentation, troubleshooting help, and community support:

• Plex Official Website: Download links for all platforms, feature overview, and Plex Pass subscription details.
• Plex Linux Installation Guide: Official installation documentation covering Linux, NAS devices, and Docker deployments.
• Plex Support: Searchable knowledge base with troubleshooting guides, library management tips, and client app FAQs.
• Plex Forums: Community discussions, bug reports, feature requests, and help from other Plex users and staff.