A media station you run yourself
Search it here.
Watch it on Plex.
Find a film, a series or a YouTube video, and Central Station fetches it through your VPN, scans it, and files it on a drive at home, named the way Plex wants it. Your photos live there too. Nothing at home is on the internet.
Runs on a Mac with Apple Silicon, Tailscale and Railway. Plays on Plex.
- Remote accessup
- Torrent searchup
- Torrentsup
- VPNup
- YouTube downloadsup
- Delete queueup
- Galleryup
What it does
Everything you watch and keep, in one place you own
One search for films, series and YouTube. One drive at home that holds them, filed for Plex. One sign-in for the web app, the desktop app and your photos.
-
Films and series
Search by title and get posters, ratings and years from TMDB. A film offers its ten best-seeded releases. A series offers whole-show packs, then each season, then single episodes, and you can tick several seasons at once.
VPN only · scanned twice · filed for Plex
-
YouTube
Search, or paste a link. Save the video as MP4 or just its audio as MP3. Each video is filed in a folder of its own with its thumbnail as the poster, so Plex shows it like a film. For you suggests what to save next.
Media/YouTube/Title (Year)/
-
Your Plex library
A title you already own carries an In library badge and opens straight in Plex instead of offering a second download. The library page shows what is on disk and how far through each series you are.
matched on the TMDB id, never the title
-
Recommendations
Rows of things you don't own yet, built from what you hold, watch and rate in Plex. A series you finished can lead a row of films. Rating a title in Plex is how you steer it.
films and series together
-
Photos
Immich shows the Photos folder on your drive and never writes to it. Your phone backs up to it over your tailnet instead of to iCloud. Guides cover moving out of iCloud Photos and Google Photos.
Live Photos stay paired
-
Delete after watching
Add a title to a Plex playlist called Delete from the TV, or press Delete… on the site. Anything still owed seeding time leaves Plex first and goes once it has paid. It only logs what it would do until you turn it on.
14 days of seeding, or a 1:1 ratio
-
One window on the Mac
Central Station.app puts Plex, search, YouTube, the gallery and the status page side by side, signs in to all of them at once, and keeps the stack running from the menu bar.
⌘1 to ⌘5, one per app
-
On your phone
Add the site to your home screen and it opens full screen. Plex and photo backup travel over Tailscale, and three Shortcuts check, start and restart the stack from anywhere.
Status · Start · Restart
-
Guests, kept to browsing
One owner can download and see the status page. Guests you add can search, browse the library and watch, with no download buttons, and the server refuses them even if they try. Scripts use personal API tokens.
sign-ups closed
How it works
The route a download takes
The web app lives on Railway, so it answers from anywhere. Everything that touches a torrent or the drive stays on your Mac, and the web app reaches it through one door, over your own private network.
-
Anywhere
Your screens
A browser, the phone's home-screen app, or Central Station.app on a Mac. You sign in once.
-
Railway
The web app and its database
Search, your account and the download history. It may reach TMDB, its database and the gateway at home. Every other host, and starting any program, is refused by the runtime, so it cannot scrape or torrent even by mistake.
- Private from here on: your tailnet only
-
Tailscale
Your tailnet
A private network between your own devices, on your own Tailscale account. The web app joins it as
tag:railway, and your access policy lets it reach one port on the Mac and nothing else. -
Your Mac
The gateway
The one door. Every request carries a long shared token, only a fixed list of routes passes, Transmission is reduced to reading the torrent list, and the Plex token is added here, so it never leaves the Mac.
-
Your Mac, in containers
The downloaders
Torrent search, Transmission inside ProtonVPN, yt-dlp, the photo library and the delete queue. Every port they publish is bound to the Mac itself.
-
Your drive
Media/
Movies, TV Shows, YouTube and Photos, named for Plex. Each container sees only the folders it writes to.
What you need
A Mac, a drive, and accounts in your own name
Every account below is yours. Central Station keeps nothing in common with any other install: not the network, not the database, not a single key.
At home
- A Mac with Apple Silicon that stays on. A Mac mini is ideal. macOS 13 or later.
- A drive for the media, usually external. Name it Home Media Storage and every default lines up.
- Plex Media Server on the same Mac, if you want the library features. It is free.
- An iPhone, if you want photo backup and the Shortcuts. Optional.
| Account | What it is for | Cost |
|---|---|---|
| Tailscale | The private network between Railway, the Mac and your phone. Sign in with your own account. | Free personal plan |
| Railway | Hosts the web app and its database. | Hobby plan |
| GitHub | Your private copy of the code, which Railway deploys. | Free |
| TMDB | Search, posters, and the names Plex matches on. | Free API key |
| ProtonVPN | The tunnel every torrent byte goes through. Port forwarding needs a paid plan. | Plus plan |
| IPTorrents | Torrent search and downloads. | Invite-only membership |
| Plex | Watching, the library page and In library badges. | Free, optional |
| YouTube Data API | YouTube search while the Mac is off. | Free, optional |
| An email account | “Forgot password?” emails. A Gmail app password works. | Free, optional |
Setup
Four stops to a running station
One command asks for everything, makes every secret, and writes a checklist with your own addresses in it. Plan on an hour, most of it waiting for the first build.
-
Get your copy
Make a private copy of the repository on your GitHub account and clone it to the Mac.
-
Run the onboarding
make onboardsigns the Mac in to your tailnet, works out every address from it, and writes the Mac's settings and Railway's variables. -
Two dashboards
Paste your tailnet policy and make an OAuth client in Tailscale. Create two services in Railway and paste their variables.
-
Start the Mac
make install STACK=1builds the app and starts the stack at every login.make doctorchecks it all, end to end.
Bring your own Tailscale account. Your station lives on your tailnet. The onboarding has you sign the Mac in with your account and confirm it is yours, then derives the gateway's address, the access policy and your phone's settings from it.