Self-hosted BitTorrent + arr-stack + catalog-update pipeline targeting
nullstone (Debian 13). Replaces the legacy onyx -> rsync -> import
round-trip.
Contents:
- README.md headline + ASCII architecture diagram + quickstart
- CLAUDE.md project rules (mirrors beta-flix style)
- .gitignore secrets dirs (.env, gluetun, qbt config, ssh keys)
- .gitleaksignore allowlist nullstone LAN addr + Tailscale CGNAT
- docs/architecture.md the plan in detail (gluetun + qbt + arr + catalog)
- docs/migration.md onyx-qbt -> nullstone-qbt runbook (3 phases)
- docs/trackers.md tracker schema + IP-pinning + ratio notes (user-curated)
- compose/docker-compose.yml gluetun v3.40 + qbt 5.0.5 (netns=gluetun) +
sonarr/radarr/prowlarr (hotio) + betaflix-catalog
- compose/.env.example documented env-var template (no secrets)
- compose/traefik/arr.yml file-provider for qbt/sonarr/radarr/prowlarr
.s8n.ru subdomains, LAN+TS only via
trusted-only@file + authentik-forwardauth@file
- catalog/catalog.py Flask service, ~340 LoC, /sonarr + /radarr +
/healthz; pulls beta-flix, inserts alphabetic
row into MEDIA-LIST.md, writes run log, commits
+ pushes as obsidian-ai. Idempotent via
payload-hash cache.
- catalog/Dockerfile python:3.12-slim + git + tini
- catalog/requirements.txt flask + jinja2 + requests + gitpython + pyyaml (pinned)
- catalog/templates/*.j2 run log + catalog row Jinja templates
- catalog/README.md service docs
- scripts/migrate-onyx.sh phase-2 helper (rsync + .torrent ship, dry-run by default)
- scripts/add-tracker.sh Prowlarr API helper
- scripts/killswitch-test.sh gluetun kill-switch verification (3 steps)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2.8 KiB
Trackers — schema, IP-pinning, ratio notes
Single source of truth for what trackers feed this pipeline, and what their quirks are. Per-tracker entries get added by the operator; the schema is below.
IP-pinning risk
Many private trackers pin sessions to a single source IP. Switching
from onyx public IP → Proton exit IP (via gluetun) will trip them: tracker
returns unauthorized: source IP mismatch on announce, the torrent stops
announcing → seeding stats halt → ratio decays.
Mitigations, ordered cheapest → most invasive:
- Read the tracker's FAQ first. Most private trackers have a documented policy: "1 IP, change requires staff" / "rolling IP allowed, contact us after change" / "IP locked to account, no exceptions".
- Request an IP update from staff before migrating that torrent.
Provide the new Proton exit IP (gluetun reports current exit via
docker exec gluetun cat /tmp/gluetun/ip). - Hot-swap manually: announce on onyx, immediately re-add on nullstone, force-announce. Some trackers' anti-abuse is rate-limited and won't catch the swap.
- Multiple exit profiles. Run two gluetun containers with different Proton server selections (one for tracker A, one for tracker B). Heavy.
If a tracker rejects all of the above, leave that torrent on onyx. The migration is not all-or-nothing; some seedboxes will live forever on the old host. Document the exception in the table below.
Per-tracker schema
Use this table format in this file. Sort alphabetically by tracker name.
| Tracker | URL | Type | IP-Pinning | Ratio Required | Notes |
|---|---|---|---|---|---|
| example.tracker | https://example.tracker/ | private | locked, request swap | 1.0 over 30d | Staff respond on IRC in < 24h. |
| public.example | http://public.example/ | public | n/a | n/a | No account, no ratio. |
(Replace the example rows with real trackers as they are onboarded.)
Onboarding a new tracker
When adding a new private tracker:
- Read the tracker's FAQ / rules. Record IP-pinning + ratio policy in the table above.
- Run
scripts/add-tracker.sh <name> <url>to push it into Prowlarr. The script prompts for cookies / API key as needed. - Add a row to the per-tracker table above. Commit.
- Monitor first 24h: check Prowlarr → Indexer → Stats for failed-query rate.
10% failures → recheck the IP-pinning column.
Public trackers
Public trackers (e.g. open BitTorrent indexers) have no IP-pinning concerns but generally bad quality + slow speeds. List them sparingly; prefer private trackers for the long tail of niche media.