Somewhere around the third time a client asked me why their brand-new Fedora box couldn’t see a single movie file after installing Plex, I stopped treating it as a one-off fluke and started treating it as a pattern. Fedora is not Ubuntu wearing a different logo. It ships with SELinux enforcing by default, firewalld locked down out of the box, and a package management philosophy that punishes shortcuts. If you’ve only ever deployed Plex on a Synology NAS or a Debian box with permissive defaults, Fedora 44 will feel like it’s actively fighting you. It isn’t. It’s just asking you to be explicit about what you want.
This guide walks through installing Plex Media Server on Fedora 44 the way you’d actually do it on a production home server or a small media appliance you’re responsible for keeping online—not the sanitized, everything-just-works version you get from a five-minute YouTube clip. That means covering the DNF repository setup Plex now requires, the SELinux contexts that silently block your library scans, the ACL work needed when your media lives outside /srv, firewalld rules that don’t leave the box wide open to the internet, and the reverse proxy configuration you’ll want the moment you decide http://192.168.1.50:32400/web isn’t a URL you want to type from your phone every night.
Plex changed its Linux repository infrastructure fairly recently, migrating to repo.plex.tv with a new signing key, and a lot of tutorials floating around the web still reference the old, retired repo path. That mismatch is responsible for a good chunk of the “gpgcheck failed” and “repository not found” errors people hit. We’ll use the current, correct repository from the start, verify the signing key fingerprint, and confirm the service is actually healthy before touching a browser.
By the end, you’ll have a Plex instance running as its own dedicated system account, correctly scoped file permissions, a firewall that only opens what’s needed, and enough troubleshooting context to fix the next three things that will inevitably go wrong six months from now.
Why Fedora 44 for a Media Server?
Fedora isn’t the first distro people reach for when building a home media server—Ubuntu Server and Debian tend to dominate that conversation. But Fedora 44 has real advantages if you’re already comfortable with DNF and RPM tooling: a current kernel with better hardware support for newer Intel Quick Sync and AMD VCN transcoding paths, SELinux enforcing security policy instead of leaving you to figure out permissions the hard way after a breach, and a six-month release cadence that keeps you closer to upstream kernel and driver updates than an LTS distro would.
The tradeoff is friction during initial setup. SELinux and firewalld are doing real work, and Plex’s installer doesn’t fully account for either one. That friction is exactly why this guide exists.
Prerequisites Before You Touch the Terminal
A few things need to be true before you start:
- Fedora 44 installed and reachable via SSH or a local terminal, with a user account that has
sudoprivileges. - At least 2 GB of RAM for basic streaming; 4 GB or more if you plan to transcode anything, especially 4K HDR content down to something a phone or older TV can handle.
- Enough free disk space on a separate partition or mount point for your media library—never store large media collections on the root partition if you can avoid it, since a full
/will take down far more than just Plex. - Network connectivity, since the initial Plex setup wizard requires signing in to a Plex account even for local playback.
- Fedora 44 ships RPM 6.0.1, which satisfies Plex’s current minimum requirement of RPM 4.16 or newer for its repository setup, so you’re covered without extra work.
If you’re running Fedora Silverblue or another rpm-ostree-based image instead of a traditional Workstation or Server install, the process differs meaningfully—you’d either install Plex inside a toolbox container without systemd integration, or layer the package with rpm-ostree install plexmediaserver and reboot. This guide assumes a standard, mutable Fedora 44 install, which covers the overwhelming majority of home server and small-office deployments.
Step-by-Step: Installing Plex Media Server on Fedora 44
Step 1: Refresh the System First
Don’t skip this, even if the system is “basically new.” A stale package cache has caused more mysterious dependency failures than almost anything else I’ve debugged.
sudo dnf upgrade --refresh -y
The --refresh flag forces DNF to re-check repository metadata rather than trusting a cached copy that might be hours or days old. If this pulls in a new kernel, reboot before continuing—starting a media server against a kernel that’s about to be replaced is asking for driver mismatches later, particularly around hardware transcoding.
Step 2: Add Plex’s Current RPM Repository
This is the step where most outdated tutorials go wrong. Plex retired its old downloads.plex.tv/repo/rpm repository and moved everything to repo.plex.tv/rpm/ with a new v2 signing key starting with Plex Media Server 1.43.0. If you copy a repo file from an older guide, you’ll get metadata errors or, worse, a repo that silently stops receiving updates.
Clean up any stale repo file first, just in case:
if sudo grep -R "downloads.plex.tv/repo/rpm" /etc/yum.repos.d/plex* 2>/dev/null; then
sudo rm -f /etc/yum.repos.d/plex*
sudo dnf clean metadata
fi
Now write the current repository definition. Use sudo tee rather than a plain redirect—shell redirection with > doesn’t inherit root privileges even when the command itself is prefixed with sudo, and that trips people up constantly when writing to root-owned paths under /etc:
printf '%s\n' \
'[PlexTv]' \
'name=Plex.tv' \
'baseurl=https://repo.plex.tv/rpm/' \
'enabled=1' \
'gpgcheck=1' \
'repo_gpgcheck=1' \
'gpgkey=https://downloads.plex.tv/plex-keys/PlexSign.v2.key' | sudo tee /etc/yum.repos.d/plex.repo > /dev/null
sudo dnf clean metadata
sudo dnf makecache -y
During the metadata refresh, DNF imports Plex’s signing key. Confirm the fingerprint matches 6EFFEB478A6559D75C7C4FE706C521790B9CFFDE—this small verification step is the difference between trusting an official package source and blindly trusting whatever a network path hands you. Never skip signature verification on a repo you’re about to grant root-level install privileges to.
Confirm Fedora actually sees the repository before moving on:
sudo dnf repo list --enabled | grep -i plex
You should see PlexTv Plex.tv in the output.
Step 3: Install the plexmediaserver Package
sudo dnf install -y plexmediaserver
The package pulls in roughly 200 MB and, critically, creates a dedicated plex system account during installation—this account has no login shell and exists purely to run the service with limited privileges, which matters a lot once you get into permissions further down. On Fedora 44, the install script also enables and starts plexmediaserver.service automatically, so you may not even need to start it manually.
Step 4: Verify the Service Is Actually Healthy
Don’t just trust that “Complete!” in the DNF output means everything’s fine. Check the systemd unit and the local web endpoint together:
systemctl status --no-pager plexmediaserver
curl -I -s http://127.0.0.1:32400/web
A freshly started Plex instance can briefly return 503 Service Unavailable while it finishes its first-run initialization—this is normal and usually resolves within ten to twenty seconds. If the service shows active (running) but the curl request still fails after half a minute, something else is wrong and it’s worth checking the journal before proceeding:
sudo journalctl -u plexmediaserver -n 50
A healthy response looks like an HTTP/1.1 302 Moved Temporarily redirecting to the setup wizard URL, which confirms Plex is not only running but actively serving requests.
Step 5: Open the Firewall
Fedora Workstation ships firewalld active by default; Fedora Server and minimal installs sometimes need it installed first. Plex listens on TCP 32400 by default.
sudo firewall-cmd --permanent --add-port=32400/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --query-port=32400/tcp
That last command should return yes. If it doesn’t, you forgot the --reload—a mistake I’ve made more times than I’d like to admit, since forgetting it leaves your runtime and persistent firewall configs out of sync until the next reboot.
If this box sits on a network you don’t fully trust—shared VPS, coworking space, whatever—consider restricting the rule to specific source addresses rather than opening the port to the whole LAN:
sudo firewall-cmd --permanent --remove-port=32400/tcp
sudo firewall-cmd --permanent --new-zone=plex
sudo firewall-cmd --permanent --zone=plex --add-source=192.168.1.10
sudo firewall-cmd --permanent --zone=plex --add-port=32400/tcp
sudo firewall-cmd --reload
Step 6: Complete the Web Setup Wizard
On a desktop with a browser, just navigate to http://127.0.0.1:32400/web. On a headless server—which describes most production Plex deployments I’ve touched—Plex’s first-run wizard insists the connection look local, so tunnel it:
ssh -L 8888:localhost:32400 username@SERVER_IP
Leave that session open and browse to http://localhost:8888/web from your workstation. Sign in with your Plex account, choose a server name that actually means something on your network (not “New Server,” please), and decide whether to leave remote access enabled. Turning it off makes sense if you’re planning to sit behind a VPN or your own reverse proxy anyway.
Attach your media libraries during the wizard if your mounts are already in place, or skip that step and add them once storage is finalized. Picking the correct library type—Movies, TV Shows, Music—matters here, since it determines which metadata agent and matching rules Plex applies during scans.
Fixing Media Permissions: The Part Everyone Underestimates
Here’s the thing nobody tells you clearly enough: Plex runs as its own unprivileged plex system account, not as you. If your media sits in your home directory, on a separately mounted drive, or on a NAS share owned by another user, Plex simply cannot read it until you tell the system to let it.
Grant Access with ACLs
ACLs are the cleanest option because they don’t touch ownership or the broader permission model of your files—you’re just adding an extra grant for the plex user specifically.
sudo dnf install -y acl
sudo setfacl -R -m u:plex:rx /srv/media
sudo setfacl -d -m u:plex:rx /srv/media
The recursive flag fixes everything already on disk; the -d default ACL makes sure new files added later inherit the same read permission automatically, which matters because otherwise you’ll be re-running this command every time you drop a new season of a show into the folder. Verify it worked from the Plex account’s own perspective, not just as root:
sudo -u plex ls -la /srv/media
getfacl /srv/media
The Home Directory Trap
If your media lives inside /home/yourusername/Movies, Fedora’s default 700 or 750 home directory permissions block the plex account before it even gets to your media folder—it can’t traverse the parent directory at all. This produces a maddeningly generic “permission denied” error that has nothing to do with the media folder itself.
stat -c '%A %n' /home/username
sudo setfacl -m u:plex:x /home/username
sudo setfacl -R -m u:plex:rx /home/username/PlexTestMedia
sudo setfacl -d -m u:plex:rx /home/username/PlexTestMedia
Honestly, at this point it’s usually less painful to move your library out to /srv/media entirely rather than punching ACL holes through your home directory. It’s cleaner, easier to reason about later, and doesn’t require touching a directory that also holds your SSH keys and dotfiles.
SELinux: The Layer Everyone Blames and Few Actually Understand
ACLs solve the Unix permission problem. SELinux is a completely separate enforcement layer, and Fedora enables it in enforcing mode by default. Even with perfect ACLs, Plex can still get blocked if the media directory carries the wrong SELinux context.
sudo semanage fcontext -a -t public_content_t '/srv/media(/.*)?'
sudo restorecon -RFv /srv/media
ls -Zd /srv/media
If semanage isn’t installed, grab it from policycoreutils-python-utils. The public_content_t label is a practical, purpose-built type for read-only content that network-facing services need to serve. Some guides suggest samba_share_t instead, which also works and is arguably more common for shared media directories that multiple services touch—either is defensible, just be consistent.
Whatever you do, resist the urge to run setenforce 0 to “just make it work.” Disabling SELinux doesn’t fix the underlying permission mismatch; it just hides it, and it removes a meaningful security boundary on a service that’s often exposed to the internet. Check journalctl -t setroubleshoot for a human-readable denial summary before reaching for a sledgehammer.
Hardware Transcoding on Fedora 44
If you’re streaming to more than one device simultaneously, or converting 4K HDR sources down for a phone on cellular data, software transcoding will pin every core on modest hardware fast. Fedora 44 ships current VA-API drivers, and most recent Intel and AMD integrated GPUs support hardware-accelerated encode/decode through /dev/dri.
Check driver availability first:
sudo dnf install -y libva-utils
vainfo
If vainfo lists supported profiles, you’re in business. Make sure the plex account has access to the render node:
sudo usermod -aG render plex
sudo systemctl restart plexmediaserver
Then enable hardware acceleration inside Plex’s own settings under Transcoder—this requires Plex Pass, which is worth it the moment your household has more than one active stream. Without it, plan your CPU headroom around worst-case simultaneous transcodes, not average usage; a quiet Tuesday afternoon tells you nothing about a Friday night when three people are streaming at once.
Reverse Proxy with Nginx: Because Port 32400 Isn’t a URL Anyone Wants
Typing http://192.168.1.50:32400/web every time gets old fast, and if you ever want TLS or a clean hostname like plex.yourdomain.com, you need a reverse proxy in front of Plex.
sudo dnf install -y nginx python3-certbot-nginx
Write the server block:
server {
listen 80;
server_name plex.example.com;
location / {
proxy_pass http://127.0.0.1:32400;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 3600;
}
}
The Upgrade/Connection headers matter more than they look—Plex leans on WebSocket connections for real-time UI updates, and without those headers you’ll get a proxy that loads the page but never refreshes playback status or notifications properly.
Here’s the SELinux gotcha that catches almost everyone the first time: Nginx runs confined in the httpd_t domain, and by default it’s not allowed to open outbound connections to other local services, even ones on 127.0.0.1. You’ll get a 502 Bad Gateway and an error log entry reading “Permission denied” for a connection that should obviously work.
sudo setsebool -P httpd_can_network_connect 1
sudo systemctl restart nginx
Once that boolean is flipped, test and enable everything:
sudo nginx -t
sudo systemctl enable --now nginx
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo certbot --nginx -d plex.example.com
Certbot’s Nginx plugin handles certificate issuance and can auto-configure the HTTPS redirect. Confirm the renewal timer is actually running after the first successful issuance—Fedora 44 enables certbot-renew.timer by package default, but it doesn’t always start automatically:
sudo systemctl start certbot-renew.timer
systemctl is-active certbot-renew.timer
Performance Tuning for Production-Grade Plex
A media server that works fine for one user falls apart under real household load if you don’t plan ahead.
CPU: Reserve headroom for transcoding, not just playback. A single 4K-to-1080p software transcode can consume an entire modern core; two simultaneous transcodes on a quad-core box with background tasks running will visibly stutter. Hardware transcoding via VA-API changes this math dramatically, offloading the heavy lifting to the integrated GPU.
RAM: Plex itself is not memory-hungry, but its metadata scanning and thumbnail generation processes spike during library scans. Give the box at least 4 GB if you’re running any other services alongside it (Nginx, Certbot, monitoring agents).
Disk I/O: Never put your media library and your Plex metadata/database on the same slow spinning disk if you can help it. /var/lib/plexmediaserver holds the SQLite database that tracks watch state, metadata, and thumbnails—putting that on an SSD while media sits on cheaper bulk storage is a meaningful, low-cost performance win.
Network: For direct-play streaming (no transcoding), a 1 Gbps LAN handles 4K Blu-ray remuxes without breaking a sweat. Remote access over a residential upload connection is a different story entirely—if your upstream bandwidth is under 20 Mbps, transcoding down to a lower bitrate for remote viewers isn’t optional, it’s required.
A quick systemd override can also help if Plex competes for resources with other services:
sudo mkdir -p /etc/systemd/system/plexmediaserver.service.d
sudo tee /etc/systemd/system/plexmediaserver.service.d/limits.conf <<'EOF'
[Service]
CPUWeight=150
IOWeight=150
EOF
sudo systemctl daemon-reload
sudo systemctl restart plexmediaserver
This nudges the scheduler to prioritize Plex slightly over lower-priority background services without hard-capping anything.
Security Hardening Checklist
- Keep the firewall scoped to trusted sources rather than exposing 32400 broadly, especially on a public-facing VPS.
- Run
sudo dnf upgrade --refresh -yon a schedule—asystemdtimer or cron job weekly is reasonable for a home server that isn’t being watched daily. - Prefer the reverse proxy plus TLS setup over Plex’s own remote access relay if you’re at all concerned about exposing the raw Plex port to the internet.
- Never disable SELinux to solve a permissions problem; fix the context or the ACL instead.
- If the server is internet-facing at all, pair firewalld with Fail2Ban to catch repeated authentication attempts against exposed services.
- Audit the
plexaccount’s group memberships periodically—adding it torenderfor GPU access is fine, adding it to broader admin groups is not.
Troubleshooting Common Plex Errors on Fedora 44
Repository metadata errors mentioning downloads.plex.tv/repo/rpm: You’re using a stale repo definition from an older guide. Remove it and rewrite it pointing at repo.plex.tv/rpm/ as shown in Step 2.
Web interface won’t load at all: Check the service, the listening socket, and the local redirect in that order:
sudo systemctl status --no-pager plexmediaserver
sudo ss -ltnp | grep 32400
curl -I -s http://127.0.0.1:32400/web
If the socket isn’t listening, the problem is local to Plex—don’t waste time on firewall or router rules yet.
Library scan finds nothing, or shows “permission denied” in logs: Almost always ACL or SELinux context. Re-run getfacl on the media path and ls -Z to confirm the context is public_content_t or samba_share_t, not default_t or user_home_t.
Nginx returns 502 Bad Gateway: Check /var/log/nginx/error.log. If it shows “Permission denied” connecting to 127.0.0.1:32400, it’s SELinux blocking the httpd_t domain, not a broken proxy config. Flip httpd_can_network_connect as shown above.
Hardware transcoding silently falls back to software: Confirm vainfo reports supported profiles and that the plex account belongs to the render group. A mismatched or missing driver package is the usual culprit on newer GPUs.
