diff --git a/ArrStack/.env b/ArrStack/.env index 79b70cc..19b91bf 100644 --- a/ArrStack/.env +++ b/ArrStack/.env @@ -1,69 +1,23 @@ -# ============================================================ -# Tom Spark's ARR Stack — Environment Configuration -# https://github.com/loponai/arrstack -# -# INSTRUCTIONS: -# 1. Copy this file: cp .env.example .env -# 2. Fill in your VPN credentials below -# 3. Adjust timezone and user IDs if needed -# 4. Run: docker compose up -d -# ============================================================ - # ============================================================ # SYSTEM SETTINGS # ============================================================ - -# Your timezone (list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) TZ=America/New_York - -# Your Linux user/group ID. Find yours with: id -# Most systems default to 1000. If yours is different, change these. PUID=1000 PGID=1000 # ============================================================ -# VPN SETTINGS — Pick your provider and fill in credentials -# Full provider list: https://github.com/qdm12/gluetun-wiki/tree/main/setup/providers -# -# IMPORTANT: VPN credentials are NOT your login email/password! -# You need service credentials from your VPN provider's manual -# setup or API section. See the provider examples at the bottom of this file. +# VPN SETTINGS (AirVPN WireGuard) # ============================================================ - -# Your VPN provider (surfshark, nordvpn, protonvpn, airvpn, mullvad, private internet access, windscribe, etc.) VPN_SERVICE_PROVIDER=airvpn - -# Protocol: wireguard (recommended, faster) or openvpn VPN_TYPE=wireguard - -# --- WIREGUARD CREDENTIALS --- -# For Surfshark: go to https://my.surfshark.com/vpn/manual-setup/main → WireGuard -# For other providers: see the examples at the bottom of this file WIREGUARD_PRIVATE_KEY=eDgf3GPFy2ltgx2RkD/Vx5wKZ4dVi28YbQmSJOrbWmk= WIREGUARD_ADDRESSES=10.175.23.30 -# Only needed for some providers (AirVPN). Leave blank if not required. -# WIREGUARD_PUBLIC_KEY= WIREGUARD_PRESHARED_KEY=+0+hrSdzRUxKDNk1Q37PNmNJ2jsj2EzF45JtbZad4lI= -# --- OPENVPN CREDENTIALS --- -# Only needed if VPN_TYPE=openvpn. Leave blank if using WireGuard. -# OPENVPN_USER= -# OPENVPN_PASSWORD= - -# --- SERVER SELECTION --- -# Pick a country close to you for best speeds SERVER_COUNTRIES=Canada - -# --- PORT FORWARDING --- -# Supported by: ProtonVPN, AirVPN, PIA. Can help with upload speeds and seeding. -# Not required for downloading. Most users don't need this. -# Set to "on" if your provider supports it, leave blank otherwise (Surfshark, NordVPN, etc.). -#VPN_PORT_FORWARDING= -# If your provider requires manually specifying a port (e.g. AirVPN): FIREWALL_VPN_INPUT_PORTS=29261 # ============================================================ -# NETWORK — Static IPs for each service -# You shouldn't need to change these unless you have a conflict. +# STATIC IP ALLOCATIONS # ============================================================ IP_GLUETUN=172.39.0.2 IP_RADARR=172.39.0.3 @@ -76,69 +30,17 @@ IP_AUDIO=172.39.0.9 IP_NAVI=172.39.0.10 IP_LIST=172.39.0.11 IP_WATCH=172.39.0.12 + # ============================================================ -# PROVIDER-SPECIFIC EXAMPLES -# Uncomment and fill in the section for your VPN provider. +# WATCHTOWER CONFIGURATION # ============================================================ - -# --- NORDVPN --- -# 1. Go to: https://my.nordaccount.com/dashboard/nordvpn/manual-configuration/ -# 2. Generate a WireGuard private key (NordLynx) -# 3. Paste the private key below -# VPN_SERVICE_PROVIDER=nordvpn -# VPN_TYPE=wireguard -# WIREGUARD_PRIVATE_KEY=your_nordvpn_private_key_here -# WIREGUARD_ADDRESSES=10.5.0.2/16 -# SERVER_COUNTRIES=United States -# --- PROTONVPN --- -# 1. Go to: https://account.protonvpn.com/ → Downloads → WireGuard configuration -# 2. Generate a config, open the file, copy the PrivateKey and Address -# 3. Port forwarding is supported on paid plans -# VPN_SERVICE_PROVIDER=protonvpn -# VPN_TYPE=wireguard -# WIREGUARD_PRIVATE_KEY=your_proton_private_key_here -# WIREGUARD_ADDRESSES=10.2.0.2/32 -# SERVER_COUNTRIES=United States -# VPN_PORT_FORWARDING=on - -# --- SURFSHARK --- -# 1. Go to: https://my.surfshark.com/vpn/manual-setup/main -# 2. Get WireGuard credentials -# VPN_SERVICE_PROVIDER=surfshark -# VPN_TYPE=wireguard -# WIREGUARD_PRIVATE_KEY=your_surfshark_private_key_here -# WIREGUARD_ADDRESSES=10.14.0.2/16 -# SERVER_COUNTRIES=United States - -# --- AIRVPN --- -# 1. Go to: https://airvpn.org/ → Client Area → Config Generator -# 2. Select Linux → WireGuard → pick a server → Generate -# 3. Copy all keys and the assigned IP -# VPN_SERVICE_PROVIDER=airvpn -# VPN_TYPE=wireguard -# WIREGUARD_PRIVATE_KEY=your_airvpn_private_key_here -# WIREGUARD_PUBLIC_KEY=your_airvpn_public_key_here -# WIREGUARD_PRESHARED_KEY=your_airvpn_preshared_key_here -# WIREGUARD_ADDRESSES=your_assigned_ip/32 -# FIREWALL_VPN_INPUT_PORTS=your_forwarded_port -# VPN_PORT_FORWARDING=on - -# --- MULLVAD --- -# 1. Go to: https://mullvad.net/en/account → WireGuard configuration -# VPN_SERVICE_PROVIDER=mullvad -# VPN_TYPE=wireguard -# WIREGUARD_PRIVATE_KEY=your_mullvad_private_key_here -# WIREGUARD_ADDRESSES=your_assigned_ip/32 -# SERVER_COUNTRIES=United States - -# --- Watchtower --- WATCHTOWER_CLEANUP=true WATCHTOWER_INCLUDE_RESTARTING=true WATCHTOWER_ROLLING_RESTARTING=true -WATCHTOWER_SCHEDULE=0 0 4 * * * +WATCHTOWER_SCHEDULE="0 0 4 * * *" WATCHTOWER_INCLUDE_STOPPED=true WATCHTOWER_NOTIFICATIONS=email -WATCHTOWER_NOTIFICATIONS_HOSTNAME=Docker-Deply # Add Server Name or IP Address +WATCHTOWER_NOTIFICATIONS_HOSTNAME=Docker-Deploy WATCHTOWER_NOTIFICATION_EMAIL_FROM=miker@mmcfetridge.net WATCHTOWER_NOTIFICATION_EMAIL_TO=miker@mmcfetridge.net WATCHTOWER_NOTIFICATION_EMAIL_SERVER=mail.mmcfetridge.net @@ -146,5 +48,3 @@ WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=465 WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=miker@mmcfetridge.net WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=!Sucyetat123 WATCHTOWER_NOTIFICATION_EMAIL_DELAY=2 -PUID=1000 -PGID=1000 \ No newline at end of file diff --git a/ArrStack/docker-compose.yml b/ArrStack/docker-compose.yml index 63b06a1..f843fe1 100644 --- a/ArrStack/docker-compose.yml +++ b/ArrStack/docker-compose.yml @@ -1,20 +1,5 @@ -# Tom Spark's ARR Stack — Automated Media Server +# ARR Stack — Automated Media Server # https://github.com/loponai/arrstack -# -# Comment this out if you are not deploying this through Gitea CI/CD process. -# echo "Setting up directory nd ownership" -# Create the directory if it doesn't exist yet -# sudo mkdir -p /opt/Docker-Deployments -# Usage: -# 1. Copy .env.example to .env and fill in your VPN credentials -# 2. Run: bash setup-folders.sh -# 3. Run: docker compose up -d -# -# All VPN-protected services (qBittorrent, Prowlarr, FlareSolverr) run -# through Gluetun. If the VPN drops, traffic stops. Zero leaks. -# -# Radarr, Sonarr, Lidarr, Bazarr, Jellyfin, and Seerr do NOT run through -# the VPN — they need direct network access for speed and local connectivity. networks: arrnetwork: @@ -26,10 +11,7 @@ networks: services: # ============================================================ - # GLUETUN — VPN Container (kill switch + tunnel) - # All VPN-protected services route through this container. - # Ports for those services are mapped HERE, not on the services themselves. - # Docs: https://github.com/qdm12/gluetun-wiki + # GLUETUN — VPN Container # ============================================================ gluetun: image: qmcgaw/gluetun:latest @@ -53,21 +35,12 @@ services: environment: - VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER} - VPN_TYPE=${VPN_TYPE} - # --- WireGuard credentials (most providers) --- - WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY} - WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES} -# - WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY} - WIREGUARD_PRESHARED_KEY=${WIREGUARD_PRESHARED_KEY} - # --- OpenVPN credentials (if using OpenVPN instead) --- -# - OPENVPN_USER=${OPENVPN_USER} -# - OPENVPN_PASSWORD=${OPENVPN_PASSWORD} - # --- Server selection --- - SERVER_COUNTRIES=${SERVER_COUNTRIES} - # --- Port forwarding (ProtonVPN, AirVPN, PIA) --- -# - VPN_PORT_FORWARDING=${VPN_PORT_FORWARDING} - FIREWALL_VPN_INPUT_PORTS=${FIREWALL_VPN_INPUT_PORTS} - FIREWALL_OUTBOUND_SUBNETS=192.168.0.0/22 - # --- General --- - PUID=${PUID} - PGID=${PGID} - UMASK=002 @@ -84,8 +57,7 @@ services: restart: unless-stopped # ============================================================ - # QBITTORRENT — Torrent Client (runs through Gluetun VPN) - # ALL traffic goes through the VPN tunnel. No direct internet. + # QBITTORRENT — Torrent Client # ============================================================ qbittorrent: image: lscr.io/linuxserver/qbittorrent:latest @@ -117,7 +89,6 @@ services: # ============================================================ # DEUNHEALTH — Auto-restarts unhealthy containers - # If qBittorrent loses VPN connection, this restarts it automatically. # ============================================================ deunhealth: image: qmcgaw/deunhealth @@ -133,8 +104,7 @@ services: restart: always # ============================================================ - # PROWLARR — Indexer Manager (runs through Gluetun VPN) - # Manages torrent/usenet indexers. Syncs to Radarr/Sonarr/Lidarr. + # PROWLARR — Indexer Manager # ============================================================ prowlarr: image: lscr.io/linuxserver/prowlarr:latest @@ -154,8 +124,7 @@ services: restart: unless-stopped # ============================================================ - # FLARESOLVERR — Cloudflare Bypass (runs through Gluetun VPN) - # Some indexers use Cloudflare protection. This gets around it. + # FLARESOLVERR — Cloudflare Bypass # ============================================================ flaresolverr: image: ghcr.io/flaresolverr/flaresolverr:latest @@ -173,9 +142,7 @@ services: restart: unless-stopped # ============================================================ - # RADARR — Movie Manager (NOT behind VPN) - # Searches via Prowlarr, sends downloads to qBittorrent, - # renames and hard-links completed files to media folder. + # RADARR — Movie Manager # ============================================================ radarr: image: lscr.io/linuxserver/radarr:latest @@ -196,8 +163,7 @@ services: restart: unless-stopped # ============================================================ - # SONARR — TV Show Manager (NOT behind VPN) - # Same pattern as Radarr but for TV series. + # SONARR — TV Show Manager # ============================================================ sonarr: image: lscr.io/linuxserver/sonarr:latest @@ -218,8 +184,7 @@ services: restart: unless-stopped # ============================================================ - # LIDARR — Music Manager (NOT behind VPN) - # Optional. Comment out if you don't need music automation. + # LIDARR — Music Manager # ============================================================ lidarr: image: lscr.io/linuxserver/lidarr:latest @@ -240,8 +205,7 @@ services: restart: unless-stopped # ============================================================ - # BAZARR — Subtitle Manager (NOT behind VPN) - # Automatically downloads subtitles for movies and TV shows. + # BAZARR — Subtitle Manager # ============================================================ bazarr: image: lscr.io/linuxserver/bazarr:latest @@ -262,9 +226,7 @@ services: restart: unless-stopped # ============================================================ - # JELLYFIN — Media Server (NOT behind VPN) - # Your personal streaming service. Plays movies, TV, music. - # Needs full bandwidth — never put this behind the VPN. + # JELLYFIN — Media Server # ============================================================ jellyfin: image: lscr.io/linuxserver/jellyfin:latest @@ -279,33 +241,13 @@ services: - /data/media:/data/media ports: - 8096:8096 - # Uncomment the lines below to enable hardware transcoding (Intel Quick Sync / VAAPI). - # Only works if your system has Intel/AMD integrated graphics (/dev/dri must exist). - # If you get an error about /dev/dri not found, leave these commented out. - # devices: - # - /dev/dri:/dev/dri networks: arrnetwork: ipv4_address: ${IP_JELLYFIN} restart: unless-stopped # ============================================================ - # SEERR — Request System (NOT behind VPN) - # Netflix-like UI for requesting movies and TV shows. - # Share this with family — they never need to touch Radarr. - # - # Seerr is the unified successor to Overseerr and Jellyseerr - # (merged under seerr-team). Supports Plex, Jellyfin, and Emby. - # - # Config uses a NAMED Docker volume (not a bind mount). This is - # required: Seerr runs as the `node` user (UID 1000) and a - # bind-mounted host folder is created root-owned, causing a - # permission-denied crash loop. On Windows/WSL, bind mounts also - # corrupt the SQLite DB over SMB. Named volumes fix both cases - # (matches upstream Seerr docs). - # - # Migrating from ./jellyseerr or ./seerr bind mount? See README - # troubleshooting "Migrating Seerr config to a named volume". + # SEERR — Request System # ============================================================ seerr: image: ghcr.io/seerr-team/seerr:v3.0.1 @@ -319,7 +261,7 @@ services: - TZ=${TZ} - PORT=5055 volumes: - - seerr_volume:/app/config # <--- Needed or will cause a permissions issue. + - seerr_volume:/app/config ports: - 5055:5055 healthcheck: @@ -333,6 +275,9 @@ services: ipv4_address: ${IP_SEERR} restart: unless-stopped + # ============================================================ + # LISTENARR — Audiobooks & Podcasts + # ============================================================ listenarr: image: ghcr.io/listenarrs/listenarr:canary container_name: listenarr @@ -352,6 +297,9 @@ services: arrnetwork: ipv4_address: ${IP_LIST} + # ============================================================ + # AUDIOBOOKSHELF — Audiobook / Podcast Server + # ============================================================ audiobookshelf: image: ghcr.io/advplyr/audiobookshelf:latest container_name: audiobookshelf @@ -371,6 +319,10 @@ services: networks: arrnetwork: ipv4_address: ${IP_AUDIO} + + # ============================================================ + # NAVIDROME — Music Streaming + # ============================================================ navidrome: image: deluan/navidrome:latest container_name: navidrome @@ -391,17 +343,19 @@ services: networks: arrnetwork: ipv4_address: ${IP_NAVI} - + + # ============================================================ + # WATCHTOWER — Automatic Image Updates + # ============================================================ watchtower: image: containrrr/watchtower container_name: watchtower restart: unless-stopped - env_file: .env environment: - DOCKER_API_VERSION=1.44 - TZ=${TZ} - - PUID:=${PUID} # Reference PUID from .env - - PGID=${PGID} # Reference PGID from .env + - PUID=${PUID} + - PGID=${PGID} - WATCHTOWER_CLEANUP=${WATCHTOWER_CLEANUP} - WATCHTOWER_INCLUDE_RESTARTING=${WATCHTOWER_INCLUDE_RESTARTING} - WATCHTOWER_ROLLING_RESTARTING=${WATCHTOWER_ROLLING_RESTARTING} @@ -415,6 +369,7 @@ services: - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=${WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT} - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=${WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER} - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=${WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD} + - WATCHTOWER_NOTIFICATION_EMAIL_DELAY=${WATCHTOWER_NOTIFICATION_EMAIL_DELAY} security_opt: - no-new-privileges:true volumes: @@ -425,7 +380,7 @@ services: networks: arrnetwork: ipv4_address: ${IP_WATCH} -# Go to the VERY BOTTOM of your file (outside of services) and add this: + volumes: gluetun_volume: qbittorrent_volume: @@ -441,4 +396,4 @@ volumes: listenarr_volume: audiobookshelf_volume: navidrome_volume: - watchtower_volume: \ No newline at end of file + watchtower_volume: