85 lines
4.7 KiB
Markdown
85 lines
4.7 KiB
Markdown
# rrr — Media Automation Stack
|
|
|
|
**Purpose:** Automated media acquisition pipeline (TV + movies) routed entirely through MullvadVPN.
|
|
|
|
| Service | Image | Web UI |
|
|
| --------- | -------------------------------------- | ---------------------------------------- |
|
|
| gluetun | `qmcgaw/gluetun:latest` | — |
|
|
| Sonarr | `lscr.io/linuxserver/sonarr:latest` | <https://sonarr.home.jens.pub> |
|
|
| Radarr | `lscr.io/linuxserver/radarr:latest` | <https://radarr.home.jens.pub> |
|
|
| Prowlarr | `lscr.io/linuxserver/prowlarr:latest> | <https://prowlarr.home.jens.pub> |
|
|
| SABnzbd | `lscr.io/linuxserver/sabnzbd:latest` | <https://sabnzbd.home.jens.pub> |
|
|
| Compose | [`../services/rrr/docker-compose.yml`](../services/rrr/docker-compose.yml) | |
|
|
|
|
---
|
|
|
|
## Architecture
|
|
|
|
All traffic from this stack is forced through MullvadVPN via **gluetun**. Sonarr, Radarr, Prowlarr, and NZBGet all set `network_mode: service:gluetun`, which means they share gluetun's network namespace. Any outbound connection from these containers exits through the WireGuard tunnel — they have no direct internet access.
|
|
|
|
```
|
|
Traefik (proxy network)
|
|
│
|
|
└── gluetun (proxy network + WireGuard tunnel to Mullvad)
|
|
│ (shared network namespace via network_mode: service:gluetun)
|
|
├── sonarr :8989 — TV show management
|
|
├── radarr :7878 — Movie management
|
|
├── prowlarr :9696 — Indexer management (feeds Sonarr + Radarr)
|
|
└── sabnzbd :8080 — Usenet downloader
|
|
```
|
|
|
|
Since all four containers share one network namespace, they communicate with each other via `localhost:<port>`. Use these addresses when configuring integrations:
|
|
|
|
| Connection | Address |
|
|
| ------------------- | ------------------------- |
|
|
| Prowlarr → Sonarr | `http://localhost:8989` |
|
|
| Prowlarr → Radarr | `http://localhost:7878` |
|
|
| Sonarr → SABnzbd | `http://localhost:8080` |
|
|
| Radarr → SABnzbd | `http://localhost:8080` |
|
|
|
|
Traefik labels live on gluetun (not the individual apps) because gluetun is the only container attached to the `proxy` network. Each router explicitly references its service with the correct backend port.
|
|
|
|
Sonarr, Radarr, and NZBGet all mount the same `DOWNLOADS_PATH` so completed downloads are immediately available for import.
|
|
|
|
---
|
|
|
|
## Environment Variables
|
|
|
|
Set these in Portainer's stack environment variables when deploying.
|
|
|
|
| Variable | Description |
|
|
| ---------------------- | ------------------------------------------------------------- |
|
|
| `WIREGUARD_PRIVATE_KEY` | WireGuard private key from Mullvad account |
|
|
| `WIREGUARD_ADDRESSES` | WireGuard IP assigned by Mullvad (e.g. `10.66.109.243/32`) |
|
|
| `SERVER_CITIES` | Optional preferred cities (e.g. `Gothenburg,Stockholm`) |
|
|
| `PUID` | Host user ID for volume file ownership (`id -u`) |
|
|
| `PGID` | Host group ID for volume file ownership (`id -g`) |
|
|
| `TZ` | Timezone (e.g. `Europe/Berlin`) |
|
|
| `TV_PATH` | Host path to TV library |
|
|
| `MOVIES_PATH` | Host path to movies library |
|
|
| `DOWNLOADS_PATH` | Host path to NZBGet downloads directory |
|
|
|
|
To get the WireGuard credentials: log in to mullvad.net → Account → WireGuard configuration → Generate key → download the config file. Copy `PrivateKey` and `Address` from that file.
|
|
|
|
---
|
|
|
|
## Volumes
|
|
|
|
| Volume | Mount | Purpose |
|
|
| ---------------- | -------------------- | ------------------------------ |
|
|
| `gluetun_data` | `/gluetun` | gluetun state and cert cache |
|
|
| `sonarr_config` | `/config` | Sonarr database and settings |
|
|
| `radarr_config` | `/config` | Radarr database and settings |
|
|
| `prowlarr_config`| `/config` | Prowlarr database and settings |
|
|
| `sabnzbd_config` | `/config` | SABnzbd config and scripts |
|
|
| `${TV_PATH}` | `/tv` | TV library (Sonarr) |
|
|
| `${MOVIES_PATH}` | `/movies` | Movies library (Radarr) |
|
|
| `${DOWNLOADS_PATH}` | `/downloads` | Shared download dir (all) |
|
|
|
|
---
|
|
|
|
## Networks
|
|
|
|
- **gluetun**: `proxy` (external) — only container Traefik can reach
|
|
- **sonarr / radarr / prowlarr / nzbget**: `network_mode: service:gluetun` — no independent network attachment
|