ArrStack Updated

ArrStack/.env

@@ -1,69 +1,23 @@
-# ============================================================
-# Tom Spark's ARR Stack — Environment Configuration
-# https://github.com/loponai/arrstack
-#
-# INSTRUCTIONS:
-#   1. Copy this file:  cp .env.example .env
-#   2. Fill in your VPN credentials below
-#   3. Adjust timezone and user IDs if needed
-#   4. Run:  docker compose up -d
-# ============================================================
-
 # ============================================================
 # SYSTEM SETTINGS
 # ============================================================
-
-# Your timezone (list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)
 TZ=America/New_York
-
-# Your Linux user/group ID. Find yours with: id
-# Most systems default to 1000. If yours is different, change these.
 PUID=1000
 PGID=1000
 
 # ============================================================
-# VPN SETTINGS — Pick your provider and fill in credentials
+# VPN SETTINGS (AirVPN WireGuard)
-# Full provider list: https://github.com/qdm12/gluetun-wiki/tree/main/setup/providers
-#
-# IMPORTANT: VPN credentials are NOT your login email/password!
-# You need service credentials from your VPN provider's manual
-# setup or API section. See the provider examples at the bottom of this file.
 # ============================================================
-
-# Your VPN provider (surfshark, nordvpn, protonvpn, airvpn, mullvad, private internet access, windscribe, etc.)
 VPN_SERVICE_PROVIDER=airvpn
-
-# Protocol: wireguard (recommended, faster) or openvpn
 VPN_TYPE=wireguard
-
-# --- WIREGUARD CREDENTIALS ---
-# For Surfshark: go to https://my.surfshark.com/vpn/manual-setup/main → WireGuard
-# For other providers: see the examples at the bottom of this file
 WIREGUARD_PRIVATE_KEY=eDgf3GPFy2ltgx2RkD/Vx5wKZ4dVi28YbQmSJOrbWmk=
 WIREGUARD_ADDRESSES=10.175.23.30
-# Only needed for some providers (AirVPN). Leave blank if not required.
-# WIREGUARD_PUBLIC_KEY=
 WIREGUARD_PRESHARED_KEY=+0+hrSdzRUxKDNk1Q37PNmNJ2jsj2EzF45JtbZad4lI=
-# --- OPENVPN CREDENTIALS ---
-# Only needed if VPN_TYPE=openvpn. Leave blank if using WireGuard.
-# OPENVPN_USER=
-# OPENVPN_PASSWORD=
-
-# --- SERVER SELECTION ---
-# Pick a country close to you for best speeds
 SERVER_COUNTRIES=Canada
-
-# --- PORT FORWARDING ---
-# Supported by: ProtonVPN, AirVPN, PIA. Can help with upload speeds and seeding.
-# Not required for downloading. Most users don't need this.
-# Set to "on" if your provider supports it, leave blank otherwise (Surfshark, NordVPN, etc.).
-#VPN_PORT_FORWARDING=
-# If your provider requires manually specifying a port (e.g. AirVPN):
 FIREWALL_VPN_INPUT_PORTS=29261
 
 # ============================================================
-# NETWORK — Static IPs for each service
+# STATIC IP ALLOCATIONS
-# You shouldn't need to change these unless you have a conflict.
 # ============================================================
 IP_GLUETUN=172.39.0.2
 IP_RADARR=172.39.0.3
@@ -76,69 +30,17 @@ IP_AUDIO=172.39.0.9
 IP_NAVI=172.39.0.10
 IP_LIST=172.39.0.11
 IP_WATCH=172.39.0.12
+
 # ============================================================
-# PROVIDER-SPECIFIC EXAMPLES
+# WATCHTOWER CONFIGURATION
-# Uncomment and fill in the section for your VPN provider.
 # ============================================================
-
-# --- NORDVPN ---
-# 1. Go to: https://my.nordaccount.com/dashboard/nordvpn/manual-configuration/
-# 2. Generate a WireGuard private key (NordLynx)
-# 3. Paste the private key below
-# VPN_SERVICE_PROVIDER=nordvpn
-# VPN_TYPE=wireguard
-# WIREGUARD_PRIVATE_KEY=your_nordvpn_private_key_here
-# WIREGUARD_ADDRESSES=10.5.0.2/16
-# SERVER_COUNTRIES=United States
-# --- PROTONVPN ---
-# 1. Go to: https://account.protonvpn.com/ → Downloads → WireGuard configuration
-# 2. Generate a config, open the file, copy the PrivateKey and Address
-# 3. Port forwarding is supported on paid plans
-# VPN_SERVICE_PROVIDER=protonvpn
-# VPN_TYPE=wireguard
-# WIREGUARD_PRIVATE_KEY=your_proton_private_key_here
-# WIREGUARD_ADDRESSES=10.2.0.2/32
-# SERVER_COUNTRIES=United States
-# VPN_PORT_FORWARDING=on
-
-# --- SURFSHARK ---
-# 1. Go to: https://my.surfshark.com/vpn/manual-setup/main
-# 2. Get WireGuard credentials
-# VPN_SERVICE_PROVIDER=surfshark
-# VPN_TYPE=wireguard
-# WIREGUARD_PRIVATE_KEY=your_surfshark_private_key_here
-# WIREGUARD_ADDRESSES=10.14.0.2/16
-# SERVER_COUNTRIES=United States
-
-# --- AIRVPN ---
-# 1. Go to: https://airvpn.org/ → Client Area → Config Generator
-# 2. Select Linux → WireGuard → pick a server → Generate
-# 3. Copy all keys and the assigned IP
-# VPN_SERVICE_PROVIDER=airvpn
-# VPN_TYPE=wireguard
-# WIREGUARD_PRIVATE_KEY=your_airvpn_private_key_here
-# WIREGUARD_PUBLIC_KEY=your_airvpn_public_key_here
-# WIREGUARD_PRESHARED_KEY=your_airvpn_preshared_key_here
-# WIREGUARD_ADDRESSES=your_assigned_ip/32
-# FIREWALL_VPN_INPUT_PORTS=your_forwarded_port
-# VPN_PORT_FORWARDING=on
-
-# --- MULLVAD ---
-# 1. Go to: https://mullvad.net/en/account → WireGuard configuration
-# VPN_SERVICE_PROVIDER=mullvad
-# VPN_TYPE=wireguard
-# WIREGUARD_PRIVATE_KEY=your_mullvad_private_key_here
-# WIREGUARD_ADDRESSES=your_assigned_ip/32
-# SERVER_COUNTRIES=United States
-
-# --- Watchtower ---
 WATCHTOWER_CLEANUP=true
 WATCHTOWER_INCLUDE_RESTARTING=true
 WATCHTOWER_ROLLING_RESTARTING=true
-WATCHTOWER_SCHEDULE=0 0 4 * * *
+WATCHTOWER_SCHEDULE="0 0 4 * * *"
 WATCHTOWER_INCLUDE_STOPPED=true
 WATCHTOWER_NOTIFICATIONS=email
-WATCHTOWER_NOTIFICATIONS_HOSTNAME=Docker-Deply  # Add Server Name or IP Address
+WATCHTOWER_NOTIFICATIONS_HOSTNAME=Docker-Deploy
 WATCHTOWER_NOTIFICATION_EMAIL_FROM=miker@mmcfetridge.net
 WATCHTOWER_NOTIFICATION_EMAIL_TO=miker@mmcfetridge.net
 WATCHTOWER_NOTIFICATION_EMAIL_SERVER=mail.mmcfetridge.net
@@ -146,5 +48,3 @@ WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=465
 WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=miker@mmcfetridge.net
 WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=!Sucyetat123
 WATCHTOWER_NOTIFICATION_EMAIL_DELAY=2
-PUID=1000
-PGID=1000

ArrStack/docker-compose.yml

@@ -1,20 +1,5 @@
-# Tom Spark's ARR Stack — Automated Media Server
+# ARR Stack — Automated Media Server
 # https://github.com/loponai/arrstack
-#
-# Comment this out if you are not deploying this through Gitea CI/CD process. 
-#  echo "Setting up directory nd ownership"
-# Create the directory if it doesn't exist yet
-#  sudo mkdir -p /opt/Docker-Deployments
-# Usage:
-#   1. Copy .env.example to .env and fill in your VPN credentials
-#   2. Run: bash setup-folders.sh
-#   3. Run: docker compose up -d
-#
-# All VPN-protected services (qBittorrent, Prowlarr, FlareSolverr) run
-# through Gluetun. If the VPN drops, traffic stops. Zero leaks.
-#
-# Radarr, Sonarr, Lidarr, Bazarr, Jellyfin, and Seerr do NOT run through
-# the VPN — they need direct network access for speed and local connectivity.
 
 networks:
   arrnetwork:
@@ -26,10 +11,7 @@ networks:
 services:
 
   # ============================================================
-  # GLUETUN — VPN Container (kill switch + tunnel)
+  # GLUETUN — VPN Container
-  # All VPN-protected services route through this container.
-  # Ports for those services are mapped HERE, not on the services themselves.
-  # Docs: https://github.com/qdm12/gluetun-wiki
   # ============================================================
   gluetun:
     image: qmcgaw/gluetun:latest
@@ -53,21 +35,12 @@ services:
     environment:
       - VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
       - VPN_TYPE=${VPN_TYPE}
-      # --- WireGuard credentials (most providers) ---
       - WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
       - WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
-#      - WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY}
       - WIREGUARD_PRESHARED_KEY=${WIREGUARD_PRESHARED_KEY}
-      # --- OpenVPN credentials (if using OpenVPN instead) ---
-#      - OPENVPN_USER=${OPENVPN_USER}
-#      - OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
-      # --- Server selection ---
       - SERVER_COUNTRIES=${SERVER_COUNTRIES}
-      # --- Port forwarding (ProtonVPN, AirVPN, PIA) ---
-#      - VPN_PORT_FORWARDING=${VPN_PORT_FORWARDING}
       - FIREWALL_VPN_INPUT_PORTS=${FIREWALL_VPN_INPUT_PORTS}
       - FIREWALL_OUTBOUND_SUBNETS=192.168.0.0/22
-      # --- General ---
       - PUID=${PUID}
       - PGID=${PGID}
       - UMASK=002
@@ -84,8 +57,7 @@ services:
     restart: unless-stopped
 
   # ============================================================
-  # QBITTORRENT — Torrent Client (runs through Gluetun VPN)
+  # QBITTORRENT — Torrent Client
-  # ALL traffic goes through the VPN tunnel. No direct internet.
   # ============================================================
   qbittorrent:
     image: lscr.io/linuxserver/qbittorrent:latest
@@ -117,7 +89,6 @@ services:
 
   # ============================================================
   # DEUNHEALTH — Auto-restarts unhealthy containers
-  # If qBittorrent loses VPN connection, this restarts it automatically.
   # ============================================================
   deunhealth:
     image: qmcgaw/deunhealth
@@ -133,8 +104,7 @@ services:
     restart: always
 
   # ============================================================
-  # PROWLARR — Indexer Manager (runs through Gluetun VPN)
+  # PROWLARR — Indexer Manager
-  # Manages torrent/usenet indexers. Syncs to Radarr/Sonarr/Lidarr.
   # ============================================================
   prowlarr:
     image: lscr.io/linuxserver/prowlarr:latest
@@ -154,8 +124,7 @@ services:
     restart: unless-stopped
 
   # ============================================================
-  # FLARESOLVERR — Cloudflare Bypass (runs through Gluetun VPN)
+  # FLARESOLVERR — Cloudflare Bypass
-  # Some indexers use Cloudflare protection. This gets around it.
   # ============================================================
   flaresolverr:
     image: ghcr.io/flaresolverr/flaresolverr:latest
@@ -173,9 +142,7 @@ services:
     restart: unless-stopped
 
   # ============================================================
-  # RADARR — Movie Manager (NOT behind VPN)
+  # RADARR — Movie Manager
-  # Searches via Prowlarr, sends downloads to qBittorrent,
-  # renames and hard-links completed files to media folder.
   # ============================================================
   radarr:
     image: lscr.io/linuxserver/radarr:latest
@@ -196,8 +163,7 @@ services:
     restart: unless-stopped
 
   # ============================================================
-  # SONARR — TV Show Manager (NOT behind VPN)
+  # SONARR — TV Show Manager
-  # Same pattern as Radarr but for TV series.
   # ============================================================
   sonarr:
     image: lscr.io/linuxserver/sonarr:latest
@@ -218,8 +184,7 @@ services:
     restart: unless-stopped
 
   # ============================================================
-  # LIDARR — Music Manager (NOT behind VPN)
+  # LIDARR — Music Manager
-  # Optional. Comment out if you don't need music automation.
   # ============================================================
   lidarr:
     image: lscr.io/linuxserver/lidarr:latest
@@ -240,8 +205,7 @@ services:
     restart: unless-stopped
 
   # ============================================================
-  # BAZARR — Subtitle Manager (NOT behind VPN)
+  # BAZARR — Subtitle Manager
-  # Automatically downloads subtitles for movies and TV shows.
   # ============================================================
   bazarr:
     image: lscr.io/linuxserver/bazarr:latest
@@ -262,9 +226,7 @@ services:
     restart: unless-stopped
 
   # ============================================================
-  # JELLYFIN — Media Server (NOT behind VPN)
+  # JELLYFIN — Media Server
-  # Your personal streaming service. Plays movies, TV, music.
-  # Needs full bandwidth — never put this behind the VPN.
   # ============================================================
   jellyfin:
     image: lscr.io/linuxserver/jellyfin:latest
@@ -279,33 +241,13 @@ services:
       - /data/media:/data/media
     ports:
       - 8096:8096
-    # Uncomment the lines below to enable hardware transcoding (Intel Quick Sync / VAAPI).
-    # Only works if your system has Intel/AMD integrated graphics (/dev/dri must exist).
-    # If you get an error about /dev/dri not found, leave these commented out.
-    # devices:
-    #   - /dev/dri:/dev/dri
     networks:
       arrnetwork:
         ipv4_address: ${IP_JELLYFIN}
     restart: unless-stopped
 
   # ============================================================
-  # SEERR — Request System (NOT behind VPN)
+  # SEERR — Request System
-  # Netflix-like UI for requesting movies and TV shows.
-  # Share this with family — they never need to touch Radarr.
-  #
-  # Seerr is the unified successor to Overseerr and Jellyseerr
-  # (merged under seerr-team). Supports Plex, Jellyfin, and Emby.
-  #
-  # Config uses a NAMED Docker volume (not a bind mount). This is
-  # required: Seerr runs as the `node` user (UID 1000) and a
-  # bind-mounted host folder is created root-owned, causing a
-  # permission-denied crash loop. On Windows/WSL, bind mounts also
-  # corrupt the SQLite DB over SMB. Named volumes fix both cases
-  # (matches upstream Seerr docs).
-  #
-  # Migrating from ./jellyseerr or ./seerr bind mount? See README
-  # troubleshooting "Migrating Seerr config to a named volume".
   # ============================================================
   seerr:
     image: ghcr.io/seerr-team/seerr:v3.0.1
@@ -319,7 +261,7 @@ services:
       - TZ=${TZ}
       - PORT=5055
     volumes:
-      - seerr_volume:/app/config # <--- Needed or will cause a permissions issue. 
+      - seerr_volume:/app/config
     ports:
       - 5055:5055
     healthcheck:
@@ -333,6 +275,9 @@ services:
         ipv4_address: ${IP_SEERR}
     restart: unless-stopped
 
+  # ============================================================
+  # LISTENARR — Audiobooks & Podcasts
+  # ============================================================
   listenarr:
     image: ghcr.io/listenarrs/listenarr:canary
     container_name: listenarr
@@ -352,6 +297,9 @@ services:
       arrnetwork:
         ipv4_address: ${IP_LIST}
 
+  # ============================================================
+  # AUDIOBOOKSHELF — Audiobook / Podcast Server
+  # ============================================================
   audiobookshelf:
     image: ghcr.io/advplyr/audiobookshelf:latest
     container_name: audiobookshelf
@@ -371,6 +319,10 @@ services:
     networks:
       arrnetwork:
         ipv4_address: ${IP_AUDIO}
+
+  # ============================================================
+  # NAVIDROME — Music Streaming
+  # ============================================================
   navidrome:
     image: deluan/navidrome:latest
     container_name: navidrome
@@ -392,16 +344,18 @@ services:
       arrnetwork:
         ipv4_address: ${IP_NAVI}
 
+  # ============================================================
+  # WATCHTOWER — Automatic Image Updates
+  # ============================================================
   watchtower:
     image: containrrr/watchtower
     container_name: watchtower
     restart: unless-stopped
-    env_file: .env
     environment:
       - DOCKER_API_VERSION=1.44
       - TZ=${TZ}
-      - PUID:=${PUID} # Reference PUID from .env
+      - PUID=${PUID}
-      - PGID=${PGID} # Reference PGID from .env
+      - PGID=${PGID}
       - WATCHTOWER_CLEANUP=${WATCHTOWER_CLEANUP}
       - WATCHTOWER_INCLUDE_RESTARTING=${WATCHTOWER_INCLUDE_RESTARTING}
       - WATCHTOWER_ROLLING_RESTARTING=${WATCHTOWER_ROLLING_RESTARTING}
@@ -415,6 +369,7 @@ services:
       - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=${WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT}
       - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=${WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER}
       - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=${WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD}
+      - WATCHTOWER_NOTIFICATION_EMAIL_DELAY=${WATCHTOWER_NOTIFICATION_EMAIL_DELAY}
     security_opt:
       - no-new-privileges:true
     volumes:
@@ -425,7 +380,7 @@ services:
     networks:
       arrnetwork:
         ipv4_address: ${IP_WATCH}
-# Go to the VERY BOTTOM of your file (outside of services) and add this:
+
 volumes:
   gluetun_volume:
   qbittorrent_volume: