d300d83ce1
Self-hosted BitTorrent + arr-stack + catalog-update pipeline targeting
nullstone (Debian 13). Replaces the legacy onyx -> rsync -> import
round-trip.
Contents:
- README.md headline + ASCII architecture diagram + quickstart
- CLAUDE.md project rules (mirrors beta-flix style)
- .gitignore secrets dirs (.env, gluetun, qbt config, ssh keys)
- .gitleaksignore allowlist nullstone LAN addr + Tailscale CGNAT
- docs/architecture.md the plan in detail (gluetun + qbt + arr + catalog)
- docs/migration.md onyx-qbt -> nullstone-qbt runbook (3 phases)
- docs/trackers.md tracker schema + IP-pinning + ratio notes (user-curated)
- compose/docker-compose.yml gluetun v3.40 + qbt 5.0.5 (netns=gluetun) +
sonarr/radarr/prowlarr (hotio) + betaflix-catalog
- compose/.env.example documented env-var template (no secrets)
- compose/traefik/arr.yml file-provider for qbt/sonarr/radarr/prowlarr
.s8n.ru subdomains, LAN+TS only via
trusted-only@file + authentik-forwardauth@file
- catalog/catalog.py Flask service, ~340 LoC, /sonarr + /radarr +
/healthz; pulls beta-flix, inserts alphabetic
row into MEDIA-LIST.md, writes run log, commits
+ pushes as obsidian-ai. Idempotent via
payload-hash cache.
- catalog/Dockerfile python:3.12-slim + git + tini
- catalog/requirements.txt flask + jinja2 + requests + gitpython + pyyaml (pinned)
- catalog/templates/*.j2 run log + catalog row Jinja templates
- catalog/README.md service docs
- scripts/migrate-onyx.sh phase-2 helper (rsync + .torrent ship, dry-run by default)
- scripts/add-tracker.sh Prowlarr API helper
- scripts/killswitch-test.sh gluetun kill-switch verification (3 steps)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
77 lines
1.9 KiB
YAML
77 lines
1.9 KiB
YAML
# Traefik file-provider snippet for the media-acquisition stack.
|
|
#
|
|
# Symlink (or cp) this file into /opt/docker/traefik/config/arr.yml on
|
|
# nullstone. Traefik picks up file-provider configs without restart.
|
|
#
|
|
# All routes are LAN+Tailscale-only (trusted-only@file middleware) AND
|
|
# require Authentik forward-auth. Add the arr-stack Authentik group as
|
|
# needed.
|
|
#
|
|
# Backends are 127.0.0.1:<port> because gluetun publishes the qbt/prowlarr/
|
|
# sonarr/radarr ports on host loopback (network_mode: service:gluetun).
|
|
|
|
http:
|
|
routers:
|
|
qbt:
|
|
rule: "Host(`qbt.s8n.ru`)"
|
|
entryPoints: [websecure]
|
|
service: qbt
|
|
tls:
|
|
certResolver: gandi
|
|
middlewares:
|
|
- trusted-only@file
|
|
- authentik-forwardauth@file
|
|
|
|
prowlarr:
|
|
rule: "Host(`prowlarr.s8n.ru`)"
|
|
entryPoints: [websecure]
|
|
service: prowlarr
|
|
tls:
|
|
certResolver: gandi
|
|
middlewares:
|
|
- trusted-only@file
|
|
- authentik-forwardauth@file
|
|
|
|
sonarr:
|
|
rule: "Host(`sonarr.s8n.ru`)"
|
|
entryPoints: [websecure]
|
|
service: sonarr
|
|
tls:
|
|
certResolver: gandi
|
|
middlewares:
|
|
- trusted-only@file
|
|
- authentik-forwardauth@file
|
|
|
|
radarr:
|
|
rule: "Host(`radarr.s8n.ru`)"
|
|
entryPoints: [websecure]
|
|
service: radarr
|
|
tls:
|
|
certResolver: gandi
|
|
middlewares:
|
|
- trusted-only@file
|
|
- authentik-forwardauth@file
|
|
|
|
# Catalog service has no public route — Sonarr/Radarr hit it via
|
|
# host.docker.internal:5055 from inside their gluetun netns.
|
|
|
|
services:
|
|
qbt:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://127.0.0.1:8080"
|
|
|
|
prowlarr:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://127.0.0.1:9696"
|
|
|
|
sonarr:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://127.0.0.1:8989"
|
|
|
|
radarr:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://127.0.0.1:7878"
|