Phlix Plugin Catalog

Status: This document lists officially maintained and community- contributed plugins for the Phlix Media Server. Plugin installation is documented in install-from-catalog.md and install-from-url.md.

How the catalog works

The admin Plugins section browses a catalog of installable plugins rather than only accepting a single repo URL. A catalog is a plugins.json document hosted in a git repo. The default catalog is detain/phlix-plugins and ships configured out of the box; operators can add more catalog URLs from the UI.

The plugins.json format

A catalog document looks like this:

{
  "schemaVersion": 1,
  "name": "Phlix Official Plugins",
  "plugins": [
    {
      "name": "phlix-plugin-anidb",
      "title": "AniDB",
      "type": "metadata-provider",
      "summary": "Anime metadata from AniDB.",
      "description": "Longer description shown in the plugin detail panel.",
      "repo": "https://github.com/detain/phlix-plugin-anidb",
      "author": "detain",
      "tags": ["anime", "metadata"]
    }
  ]
}

Only name and repo are required per entry — every other field (title, type, summary, description, author, tags) degrades to a sensible empty default, so a sparse catalog still renders. repo is the git repository URL the plugin installs from (it is handed verbatim to the existing install-from-URL flow).

Browsing from the admin UI

The server fetches every configured catalog server-side (not from the browser) — both to dodge GitHub-raw CORS restrictions and to keep a single, auditable egress path. The admin Plugins section then renders each catalog's plugins as cards. Each card is annotated with its local install state (installed / not installed, and enabled / disabled), so you can install, uninstall, or configure straight from the catalog view.

A plugin you installed from a bare URL that is not listed in any catalog still appears, grouped under an "Other installed plugins" section.

Adding another catalog

You can point the section at additional catalogs (e.g. a private or community-maintained list) by adding their URL in the admin UI. The URL must be an http:// or https:// URL. The default detain/phlix-plugins source cannot be removed; operator-added sources are persisted as a plugins.catalog.sources override in server_settings. The default itself is set in the server's config/plugins.php under catalog.default_source and can be overridden per install.

The wire contract for the catalog browser (the GET /plugins/catalog and POST/DELETE /plugins/catalog/sources admin endpoints) is documented in the Admin Plugins API.

Release channel (stable / dev)

The official catalog (detain/phlix-plugins) is served from a release channel, so operators can choose between a safe pinned release and the newest unreleased entries. Set it from the admin Plugins page or with the plugins.catalog.channel setting:

Channel	Resolves the official catalog to	For
stable (default)	the audited pinned release tag (CatalogSourceResolver::OFFICIAL_PINNED_REF)	everyone — the recommended channel
dev	the catalog repo's moving master branch	opt-in / advanced — surfaces the newest, unreleased catalog entries

dev is flagged opt-in / advanced in the admin UI (a warning badge plus a server-authored description). It changes which entries are discovered on the official catalog, and it changes which document those entries are read from — read the note below before enabling it. Operator-added catalogs are unaffected by the channel; they always resolve at HEAD. Anything other than a literal dev (including an empty or unknown value) fails safe to stable.

Precedence — env > setting > default. The ref actually used for the official catalog is chosen in this order:

1. PHLIX_PLUGINS_CATALOG_REF — the environment override, highest precedence (pin a specific tag/commit; see env vars);
2. plugins.catalog.channel — dev → master, stable → the pinned tag;
3. OFFICIAL_PINNED_REF — the built-in default when neither of the above is set.

The verification path is the same on both channels — but the trust anchor is not. Switching to dev does not switch a check off. An install is still gated by the catalog entry's per-entry pin — its ref and artifactSha256 — on either channel, and a remote entry that carries no pinned digest is refused by default.

What changes is who asserts that pin. Both ref and artifactSha256 are self-asserted by the catalog document itself, so the digest check proves only that the downloaded artifact matches what that document claimed — never that the document was audited. On stable the document is an audited, pinned release tag. On dev it is whatever the catalog repository's master branch says right now, so anyone able to push master can name their own commit and the digest that matches it, and the install will verify normally.

So read dev as "I continuously trust the catalog repository's master branch" — not as "this is checked the same way stable is". The integrity check survives the channel switch; the thing it anchors to does not.

Two ways an un-pinned install is still allowed

The default-deny on un-pinned artifacts has two documented exemptions, on both channels: file:// (and scheme-less) sources are treated as operator-local bytes rather than a supply-chain artifact, and setting PHLIX_PLUGINS_ALLOW_UNVERIFIED opts back into installing un-pinned remote sources with only a warning logged.

See Trusted Plugin List for the signature trust model, which is a separate control. Choosing "always latest" via the GitHub Releases API is a deferred follow-up, not part of this channel setting.

The read/write wire contract (GET/PUT /api/v1/admin/plugins/catalog/channel, returning { channel, options: [{ value, label, description, advanced }] }) is documented in the Admin Plugins API.

Official Plugins (Maintained by Phlix)

The first-party plugins below are published in the default detain/phlix-plugins catalog — phlix-plugin-anidb, phlix-plugin-myanimelist, and phlix-plugin-trakt — and each installs from its own repository.

phlix-plugin-anidb

Type: metadata-provider | Repository: detain/phlix-plugin-anidb

Anime metadata provider sourcing titles, descriptions, and topics/tags from AniDB. Listed as a catalog plugin in detain/phlix-plugins.

phlix-plugin-myanimelist

Type: metadata-provider | Repository: detain/phlix-plugin-myanimelist

Anime metadata provider sourcing descriptions and topics from MyAnimeList. Listed as a catalog plugin in detain/phlix-plugins.

phlix-plugin-trakt

Type: scrobbler | Repository: detain/phlix-plugin-trakt

Trakt scrobbler / sync integration. Previously bundled into the server, Trakt is now maintained in its own repository and is published as a catalog plugin in detain/phlix-plugins.

phlix-plugin-oidc

Type: auth-provider | Version: 1.0.0

OpenID Connect / OAuth2 authentication provider plugin. Adds SSO login via any OIDC-compliant identity provider (Keycloak, Authelia, Authentik, Google Workspace, GitHub OAuth).

Repository: detain/phlix-plugin-oidc (bundled in src/Plugins/Oidc/)

Features:

• Authorization Code flow with PKCE support
• RS256/RS384/RS512 signature validation
• Discovery document caching (24h)
• Automatic user provisioning on first login
• Account linking for existing users
• Admin UI for provider configuration

Manifest fields:

{
  "name": "phlix-plugin-oidc",
  "version": "1.0.0",
  "phlix_min_server_version": "0.11.0",
  "type": "auth-provider",
  "entry": "Phlix\\Plugins\\Oidc\\Plugin",
  "settings": {
    "provider_url": { "type": "string", "required": true, "secret": false },
    "client_id": { "type": "string", "required": true, "secret": false },
    "client_secret": { "type": "string", "required": true, "secret": true },
    "scopes": { "type": "string", "required": false, "default": "openid profile email" }
  }
}

Configuration:

1. Install the plugin from the admin UI
2. Navigate to Admin → Auth Providers → OIDC
3. Enter your OIDC provider's base URL, client ID, and client secret
4. Register https://your-phlix-server/auth/oidc/callback as a redirect URI in your OIDC provider
5. Save settings and enable the provider

Supported providers:

• Keycloak (any version with OIDC support)
• Authelia
• Authentik
• Google Workspace / Gmail OAuth
• GitHub OAuth (limited — not a true OIDC provider)
• Any OIDC-compliant IdP

Community Plugins

Community plugins are not officially supported by Phlix. Use at your own risk.

Plugin	Type	Description
(none yet)

Plugin Types

Type	Description
metadata-provider	Provides movie/TV show metadata (TMDB, TVDB, etc.)
auth-provider	External authentication (OIDC, LDAP, SAML, passkeys)
scrobbler	Scrobbles watched content to third-party services
transcoder	Alternative transcoding pipelines
storage	Cloud storage backends
ui-theme	Web portal visual themes
dlna	DLNA/Digital Media Server features
syncplay	SyncPlay replacement for synchronized viewing
livetv	Live TV / DVR functionality
analytics	Usage analytics and reporting
admin-plugin	Admin UI enhancements

Plugin Manifest Reference

Full plugin.json schema is documented in manifest.md.

Security

All plugins run with the same privileges as the Phlix server process. Only install plugins from trusted sources. Review the plugin's code before installing, especially if it requires network access or handles sensitive data.

Signing is optional and off by default: PHLIX_PLUGINS_REQUIRE_SIGNATURE defaults to 0, so an unsigned catalog plugin installs with a warning on the plugins log channel. Set it to 1 to refuse unsigned installs. What the catalog gates on by default is the per-entry artifact pin (ref + artifactSha256), not a signature — see the un-pinned exemptions above. See trusted-plugin-list.md for the signature trust model and how to add trusted keys.