Hello, Super interested in getting started with TomSparkBox! I'm on a Mac Mini M2 and thought I'd host there after trying to install on my Synology D1516+ within Portainer - Ubuntu and it would fail on "ed255169 signature verification FAILED". If running on my NAS is not possible or advised, and the Mac Mini M2 is a decent host, please let me know what you recommend. I installed UTM and attempted to create an Ubuntu VM and I couldn't get my cursor working. I'd gladly support this project as a legend if I can make sure my current hardware can support this. Thank you!
27 replies
tomspark wrote:
Good news — you dont need a WireGuard key for PIA. PIA doesnt hand those out to users, which is exactly why you couldnt find it anywhere on their site. The fix: in the media/VPN setup, switch the VPN Protocol from WireGuard to OpenVPN. Then it just uses the PIA username and password you already entered — no key needed. (WireGuard is only for providers that give you a key; PIA works over OpenVPN.) That should let you finish setting up the media center on your existing PIA subscription. And nice work getting Ubuntu + SparkBox running on the M2! When your 8 months of PIA eventually run out, Surfshark is the one we recommend and test against (works great with WireGuard, and theres a big discount here: https://get.surfshark.net/affc?offerid=1126&affid=9447&affsub=hr52es) — but no rush at all, PIA is fine today.
tomspark wrote:
Sorry about that — this is actually a bug on our end. When you set the VPN protocol to OpenVPN in Settings before installing the media module, the install screen doesn't pick that up and still asks for a WireGuard key you don't have. The workaround: open your Ubuntu terminal and run these two commands: sudo sparkbox enable media sudo sparkbox up That bypasses the install screen entirely and uses your PIA/OpenVPN settings that are already saved. Gluetun should connect within a minute or two.
tomspark wrote:
You found a real bug — thank you! The install form was wrongly forcing that WireGuard key even in OpenVPN mode, where you dont have one. I just pushed a fix (v1.6.329); once your box auto-updates (within a day) that field wont block you anymore. To get going RIGHT NOW without waiting: since youre on OpenVPN, the VPN engine completely ignores the WireGuard key field — so just type any placeholder into it (e.g. paste 40-odd random characters) to get past the form. Your PIA connection authenticates with the username/password you entered, not that field, so a dummy value there is totally harmless. Then finish the media install and youre good. Really appreciate you flagging it — it was blocking every OpenVPN user.
tomspark wrote:
Welcome to the supporter tier — really glad you stuck with it through all those install steps! TomAI is great for the day-to-day stuff; we're here if anything tricky comes up.
tomspark wrote:
PIA doesn't have servers in the Bahamas — that one will always fail, so you didn't break anything new there. Before trying more country settings, let's see what the actual error is. Paste this in your terminal: docker logs sb-gluetun --tail 30 That shows exactly what PIA is rejecting. Without it we're guessing at the cause. While you're at it — if you've got 8 months left on PIA you're definitely not stuck, but if you're already leaning toward Surfshark it genuinely is the simpler route with SparkBox (WireGuard key is right in their app, no country config fiddling). Surfshark (87% off + 4 months free): https://get.surfshark.net/affc?offerid=1126&affid=9447&affsub=hr52es
tomspark wrote:
YES — thats what I love to hear! 🎉 Surfshark + WireGuard is exactly the smooth path, and Im really glad it clicked and the Media Center apps are all happy now. Youre fully up and running. Enjoy the build — and any time you want to fine-tune something (remote access, backups, adding apps), just holler. Welcome aboard properly!
tomspark wrote:
Mac Mini M2 is a solid host — SparkBox runs fine on Apple Silicon. In UTM, pick the Ubuntu 24.04 ARM template (hit Browse on the create screen), install it, then come back once Ubuntu is up and running. One quick UTM tip: if your cursor gets stuck inside the VM, press Control+Option on your keyboard to release it. For the Synology error: try downloading the install.sh file on your Mac first and then copying it to the NAS — running it from inside Portainer sometimes causes that verification failure.
mtechnic wrote:
Hello. Thanks for the response! Tried installing Ubuntu server 24.04 ARM and I can't get the installer to complete; never installed Linux server, only desktop, so probably something I'm doing wrong. Tried copying the install.sh file to my mac and pasting onto my Synology NAS, ssh'd into the path via terminal and it seems like it doesn't like the file I created, possibly due to rich text format (I copied and pasted the install.sh text into a notes file and saved as install.sh). Copilot recommended I download it via "curl -fsSL https://get.tomsparkbox.com/install.sh -o install.sh" which I did, and then ran the install.sh, but I am still getting: [SparkBox] ed25519 signature verification FAILED. Release is not authentic. [SparkBox] Do NOT retry — this is a supply-chain tamper signal. curl: (23) Failure writing output to destination Any other recommendations?
tomspark wrote:
For the Ubuntu server installer in UTM: the step that trips most people up is storage. When you get to "Storage configuration," hit Done, then confirm the warning it shows. After that it's just a name and password, skip the OpenSSH option, and wait for it to install — takes a few minutes, then it'll ask you to reboot. For the Synology: the curl: (23) error usually means there wasn't a writable spot to unpack the files. Try cd /tmp && sudo bash install.sh from your SSH session. But once you've got Ubuntu running on the M2, the install there will be much cleaner.
mtechnic wrote:
Thanks! Unbuntu server now running successfully and updated. Was able to install TomSparkBox finally, thanks to your help! I'm at the step where i'm ready to install the media center. I currently use PIA for my VPN service, and I'd switch to Surfshark but I have an additional 8 months left on my subscription, so I'd like to stick with PIA. I entered my PIA VPN username and password, and I'm not sure where to get the WireGuard Private Key (from VPN provider). I'm new to WireGuard, and understand it's a VPN protocol, but I'm not understanding how I would collect the private key from PIA. I checked their site while logged in and cannot find anywhere that the private key is listed.
mtechnic wrote:
I appreciate the continued support and patience, Tom! I did go to Settings VPN Edit VPN Settings and changed the Protocol from WireGuard to OpenVPN, added PIA credentials, set the VPN server, etc. but when I go back to the Media Center install it still prompts me to enter a WireGuard Private Key otherwise it won't let me proceed with the install. When I re-checked the VPN settings, I clicked the Save & Restart button, and it says "they'll apply when you enable the media module". In the screenshot below, you can see the empty WireGuard Private Key field and after clicking 'Save & Install', it does not proceed and I can see the highlighted prompt in the backround top left notification section. If I cancel the install it states: "Please Fill In: WireGuard Private Key (from your VPN Provider)".
mtechnic wrote:
Wahoo! Found and squashed a bug! /high-5 I saw the update and just applied it. Media Center started installing immediately after the service restarted. I just joined as a supporter. Thanks again, will try to use TomAI first, otherwise i'll reach out here. Thanks again for an incredible build!
mtechnic wrote:
Struggling with the VPN connection, and I hit the limit of interactions with TomAI, which was thinking the issue was with the SERVER COUNTRIES= entry, which I originally had as 'United States' and 'San Francisco' for the SERVER CITIES=, but have since removed both entries so they are empty, with the hope that it would self-select the country and city. I've tried setting a different country as well, and set 'Bahamas', but that failed as well. What do you recommend to try next? I'm nearly ready to just purchase Surfshark at this point.
tomspark wrote:
Totally fair to be frustrated — the VPN provider config is the fiddliest part of the whole build. Two things: Emptying SERVERCOUNTRIES and SERVERCITIES was actually the RIGHT move (it auto-selects), so if its still failing, the cause is almost always the VPN credentials or the provider itself — not the country. Fastest way to see the real reason: open the VPN (gluetun) containers logs in your dashboard and read the last few lines — theyll tell you exactly whats wrong (auth rejected, no matching server, etc.). That said — since youre already eyeing Surfshark, Id honestly go for it. Its the one we recommend first because its WireGuard setup in SparkBox is far simpler and skips this whole class of connection headaches. Theres a big discount here: https://get.surfshark.net/affc?offerid=1126&affid=9447&affsub=hr52es (87% off + 4 months free). Grab it and Ill walk you through the SparkBox side — its usually a 2-minute setup.
mtechnic wrote:
Docker log results (w/ invalid country, note, I got that country from PIA's site, losing confidence in them, haha): 2026-07-03T09:36:34-07:00 ERROR VPN settings: provider settings: server selection: for VPN service provider private internet access: the country specified is not valid: one or more values is set but there is no possible value available 2026-07-03T09:36:34-07:00 INFO Shutdown successful Docker log results after removing the country entry and restarting tomsparkbox (same error, odd, so I grep'd to confirm it saved the empty country entry): 2026-07-03T09:39:39-07:00 ERROR VPN settings: provider settings: server selection: for VPN service provider private internet access: the country specified is not valid: one or more values is set but there is no possible value available 2026-07-03T09:39:39-07:00 INFO Shutdown successful root@arrbuckle:~ exit logout jason@arrbuckle:/opt/sparkbox$ grep -E 'SERVER|VPNPROVIDER|VPNTYPE' /opt/sparkbox/.env MATRIXSERVERNAME=matrix.sparkbox.local VPNPROVIDER=private internet access VPNTYPE=openvpn SERVERCOUNTRIES= SERVERCITIES= SERVERHOSTNAMES=
tomspark wrote:
Found it — and its not the country at all. Look at the very last line of your .env: SERVERHOSTNAMES= That asterisk is the culprit. gluetun treats as a literal server name to match (not a wildcard), so it hunts for a PIA server literally named , finds none, and throws that no possible value available error — which is why blanking the country didnt help. Fix: clear it so its empty like your country/city lines. Easiest in the dashboard — open VPN settings, empty the Server Hostnames field, save (it rebuilds the container). Or in terminal: set SERVERHOSTNAMES= (empty) in .env and run sparkbox up. With all three blank, PIA auto-selects a server and should connect. Give that a shot and let me know!
mtechnic wrote:
Also, I noticed that after editing the VPN provider line, as recommended by TomAI from 'privateinternetaccess' which is what was written to .env from the TomSparkBox UI edit VPN settings, to 'private internet access', the UI edit VPN settings VPN provider drop-down was cleared out when I checked it just now. So I set it back to 'Private Internet Access' on the drop-down, saved, and it failed again. Grep'd the logs and from what I can tell, it's the UI settings that are writing 'privateinternetaccess' as the VPN provider in .env, which seems like a bug and it needs to write it with spaces.
mtechnic wrote:
I just re-checked the SERVERHOSTNAMES entry and there is no , I assume you may have seen that as a comment editor entry where I was trying to italicize the logs to make it easier to read -- sorry to make it more confusing.
tomspark wrote:
No worries — that makes total sense! So all three server fields are genuinely blank, which is correct for auto-select. Here's the one thing I want to check: run this in your terminal and paste what it says: grep VPNPROVIDER /opt/sparkbox/.env There's a known bug where using the VPN dropdown in Settings writes privateinternetaccess (no spaces) but gluetun needs it as private internet access with spaces. If you saved VPN settings from the UI at any point during our troubleshooting, it might have reset to the wrong format. One paste and I'll know what we're dealing with.
mtechnic wrote:
Just signed up for Surfshark via your affiliate link. Looking through your documentation now to see if I can figure it out.
mtechnic wrote:
I was able to generate the wireguard private key via Surfshark, edit the VPN settings from the UI, and i'm now successfully connected! Media Center apps all seem to be fine now, and the VPN details show I am connected on the dashboard. Wireshark FTW!
mtechnic wrote:
Hoping for a sanity check on moving the SBDATADIR and MEDIAROOT to my NAS as my Mac Mini M2 has very limited storage at the moment (should have opted for a larger internal drive). Note: I do have an additional m.2 drive installed on the Mac Mini with plenty of storage available, so that might be a good initial download location, but ultimately i'd like all downloaded content to transfer, or write to on download, to my NAS which I've mounted in the screenshot below via smb: Does this look correct for the .env redirect, where I assume all media downloads via arr-stack will download to arr-data/sparkbox and then be saved to arr-data/media (where my existing library lives, note, ideally I'd point it to two libraries that I have across two NAS's, but for now i'm just connecting to one)
tomspark wrote:
Great question — heres the sanity check (I cant read the exact paths in the screenshots, but these are the rules that matter): 1) MEDIAROOT on the NAS 👍 — with one key thing: keep your DOWNLOADS folder and your MEDIA library on the SAME NAS mount (sounds like arr-data/sparkbox for downloads and arr-data/media for the library — perfect). That lets the arr-stack hardlink / instant-move finished downloads instead of slowly copying them across drives, and it wont double your disk usage. 2) SBDATADIR on the NAS — Id NOT move this one. Thats where the app configs and databases live, and databases on an SMB share are prone to corruption and locking. Keep SBDATADIR on your local M.2 drive — fast and reliable, and its small so it wont eat much space. So the sweet spot: SBDATADIR → local M.2, MEDIAROOT + downloads → the NAS (same mount). Paste your exact .env lines as text and Ill check them line by line.
mtechnic wrote:
SBDATADIR=/opt/sparkbox/data (I reverted this back to the original setup for now) MEDIAROOT=/mnt/arr-data/media In Linux, I have my Media Library NAS mounted via... SMB://192.168.143.144/arr-data Media library is located at /arr-data/media/movies ... /tv/ etc.
tomspark wrote:
Those two lines look right — SBDATADIR staying local is exactly what you want. One thing decides whether the NAS part works: the share has to be mounted at that exact path on the Ubuntu machine itself, not just visible from your Mac. Quick check, run this on the box: ls /mnt/arr-data/media If you see your movies and tv folders, you're set — run sudo sparkbox up and you're done. Downloads automatically land on that same NAS mount, so finished downloads move to your library instantly instead of copying. If it says No such file or directory instead, the NAS isn't mounted where SparkBox looks — paste what it says plus how you mounted it and I'll walk you through a mount that also survives reboots. Small heads-up: SparkBox creates its own Movies/TV folders (capital letters) next to your existing lowercase ones — that's normal, and we can point the apps at your existing folders after.
mtechnic wrote:
listing the mount worked, and I can see the uppercase Movies, Music and TV, however when I browse to that path on my NAS I only see movies and tv (lowercase).
tomspark wrote:
That's totally normal behavior and nothing to worry about. When SparkBox mounts your NAS, it creates its own uppercase folder structure (Movies, Music, TV) at the mount point for its own use. Your original lowercase folders (movies, tv) on the NAS aren't touched and coexist fine — they both work together. The uppercase ones are just where the container reads from. Your setup is working as designed. Keep moving forward with the media center!