media.yml

# media — jellyfin + the *arr stack + a torrent client.
# Torrent traffic can be routed through a VPN with the `vpn` profile (gluetun).
#
# Note on the .NET apps (jellyfin, sonarr, radarr, prowlarr): on some kernels the
# default server GC crash-loops these with "general protection" faults. If you
# hit that, uncomment the DOTNET_gc* lines below to force workstation GC. Left
# off by default since it is a per-kernel workaround.

x-logging: &logging
  logging:
    driver: json-file
    options:
      max-size: "10m"
      max-file: "3"

# Everything the *arr services share. They are the same application wearing
# different hats, so the only per-service lines below are image, name and mounts.
x-arr: &arr
  restart: unless-stopped
  security_opt: ["no-new-privileges:true"]
  profiles: ["media"]
  networks: [proxy]
  logging:
    driver: json-file
    options:
      max-size: "10m"
      max-file: "3"

x-arr-env: &arr-env
  PUID: "${PUID:-1000}"
  PGID: "${PGID:-1000}"
  TZ: "${TZ:-UTC}"
  # DOTNET_gcServer: "0"        # workstation GC (see note at top of file)
  # DOTNET_gcConcurrent: "0"

networks:
  proxy:
    name: proxy

volumes:
  jellyfin_config:
  jellyfin_cache:
  sonarr_config:
  radarr_config:
  prowlarr_config:
  bazarr_config:
  tdarr_server:
  tdarr_configs:
  tdarr_logs:
  qbittorrent_config:
  downloads:
  media:

services:

  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["media"]
    networks: [proxy]
    cpus: 3.0
    # ffmpeg is spawned per transcode; without an init the finished ones linger
    # as zombies until the server restarts.
    init: true
    environment:
      JELLYFIN_PublishedServerUrl: "https://media.${DOMAIN}"
      # DOTNET_gcServer: "0"        # workstation GC (see note at top of file)
      # DOTNET_gcConcurrent: "0"
      # Jellyfin 10.11+ runs on .NET 9, where DATAS is on by default and is a
      # known SIGSEGV trigger under transcode load. Uncomment if it crash-loops.
      # DOTNET_GCDynamicAdaptationMode: "0"
    volumes:
      - jellyfin_config:/config
      - jellyfin_cache:/cache
      - media:/media
    # Hardware transcoding. Uncomment for your platform:
    #   x86 (VAAPI / Intel QuickSync): mount /dev/dri and add the render group.
    #   Raspberry Pi 5 (V4L2 M2M): mount the /dev/video1{0,1,2} devices.
    # devices:
    #   - /dev/dri:/dev/dri
    # group_add:
    #   - "video"
    #   - "render"

  sonarr:
    <<: *arr
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    environment:
      <<: *arr-env
    volumes:
      - sonarr_config:/config
      - downloads:/downloads
      - media:/media

  radarr:
    <<: *arr
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    environment:
      <<: *arr-env
    volumes:
      - radarr_config:/config
      - downloads:/downloads
      - media:/media

  prowlarr:
    <<: *arr
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    environment:
      <<: *arr-env
    volumes:
      - prowlarr_config:/config

  bazarr:
    <<: *arr
    image: lscr.io/linuxserver/bazarr:latest
    container_name: bazarr
    environment:
      <<: *arr-env
    volumes:
      - bazarr_config:/config
      - media:/media

  tdarr:
    <<: *arr
    image: ghcr.io/haveagitgat/tdarr:latest
    container_name: tdarr
    cpus: 3.0
    # No `init: true` here even though it spawns ffmpeg: this image runs
    # s6-overlay, which must be PID 1. Docker's tini takes that slot and s6
    # dies with "s6-overlay-suexec: fatal: can only run as pid 1". The same
    # applies to every lscr.io/linuxserver image above.
    environment:
      <<: *arr-env
      UMASK_SET: "002"
      serverIP: "0.0.0.0"
      serverPort: "8266"
      webUIPort: "8265"
      internalNode: "true"
      inContainer: "true"
    volumes:
      - tdarr_server:/app/server
      - tdarr_configs:/app/configs
      - tdarr_logs:/app/logs
      - media:/media
      - downloads:/temp

  # Torrent client. With the `vpn` profile it shares gluetun's network namespace
  # so all traffic leaves through the VPN. Without it, qbittorrent joins `proxy`
  # directly (LAN-only) — see the commented block below.
  #
  # Because it has no network stack of its own here, its WebUI is published and
  # routed via gluetun, not via this service.
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["vpn"]
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    # Torrent sessions take a moment to flush to disk; the 10s default SIGKILLs
    # mid-write and loses resume data.
    stop_grace_period: 30s
    environment:
      <<: *arr-env
      WEBUI_PORT: "8080"
    volumes:
      - qbittorrent_config:/config
      - downloads:/downloads

  # qBittorrent without a VPN (LAN-only). Enable with the `media` profile and
  # comment out the gluetun-bound service above if you do not want a VPN.
  # qbittorrent:
  #   <<: *arr
  #   image: lscr.io/linuxserver/qbittorrent:latest
  #   container_name: qbittorrent
  #   stop_grace_period: 30s
  #   environment:
  #     <<: *arr-env
  #     WEBUI_PORT: "8080"
  #   volumes:
  #     - qbittorrent_config:/config
  #     - downloads:/downloads

  # VPN gateway for the torrent client. Fill in your provider in .env.
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["vpn"]
    cap_add: [NET_ADMIN]
    devices:
      - /dev/net/tun:/dev/net/tun
    networks: [proxy]
    environment:
      VPN_SERVICE_PROVIDER: "${VPN_SERVICE_PROVIDER}"
      VPN_TYPE: "${VPN_TYPE:-openvpn}"
      OPENVPN_USER: "${VPN_USER}"
      OPENVPN_PASSWORD: "${VPN_PASSWORD}"
      SERVER_COUNTRIES: "${VPN_COUNTRIES}"
      TZ: "${TZ:-UTC}"
      # Let LAN/Docker subnets reach the qBittorrent WebUI past the VPN firewall.
      FIREWALL_OUTBOUND_SUBNETS: "172.16.0.0/12,192.168.0.0/16,10.0.0.0/8"