From 3bb01ddaaf1af1ff7afe1e97c991a391beb0786a Mon Sep 17 00:00:00 2001 From: Adyrem Date: Mon, 18 May 2026 13:28:37 +0200 Subject: [PATCH] Add Jellyfin media stack (LXC 106, NVIDIA GTX 1060) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - New Ansible role: jellyfin — Docker + nvidia-container-toolkit setup, full *arr stack compose file (Jellyfin, qBittorrent, Radarr, Sonarr, Prowlarr, FlareSolverr, Jellyseerr), systemd service for auto-start - New playbook: jellyfin.yml targeting media_servers group - Inventory: add media LXC (10.10.1.50) to media_servers group - Traefik: add internal .homelab routes for all 6 media services - Pi-hole: add DNS records for all 6 media services → Traefik - network-interfaces: DNAT port 6881 TCP+UDP → 10.10.1.50 for BitTorrent - homelab-requirements.md: document full Jellyfin stack requirements including NVIDIA GTX 1060 passthrough approach and driver notes - jellyfin-tools: original reference compose file from upstream Infrastructure created on Proxmox: - LXC 106 (media, Debian 12, privileged, nesting=1, 10.10.1.50/vmbr1) - ZFS dataset hdd/media mounted at /media in LXC - NVIDIA device passthrough entries in /etc/pve/lxc/106.conf Note: NVIDIA driver 580.159.03 (.run) installed on Proxmox host — not managed by apt (Debian only has 550.x which doesn't support kernel 7.x or GTX 1060 Pascal as of this driver version). Co-Authored-By: Claude Sonnet 4.6 --- ansible/inventory/hosts.yml | 5 + ansible/playbooks/jellyfin.yml | 6 + ansible/roles/jellyfin/defaults/main.yml | 23 +++ ansible/roles/jellyfin/handlers/main.yml | 6 + ansible/roles/jellyfin/tasks/main.yml | 154 ++++++++++++++++++ .../jellyfin/templates/docker-compose.yml.j2 | 95 +++++++++++ .../templates/jellyfin-stack.service.j2 | 15 ++ ansible/roles/pihole/defaults/main.yml | 9 +- ansible/roles/traefik/defaults/main.yml | 22 +++ ansible/roles/traefik/templates/routes.yml.j2 | 21 +++ homelab-requirements.md | 83 +++++++++- jellyfin-tools | 132 +++++++++++++++ proxmox/network-interfaces | 4 + 13 files changed, 573 insertions(+), 2 deletions(-) create mode 100644 ansible/playbooks/jellyfin.yml create mode 100644 ansible/roles/jellyfin/defaults/main.yml create mode 100644 ansible/roles/jellyfin/handlers/main.yml create mode 100644 ansible/roles/jellyfin/tasks/main.yml create mode 100644 ansible/roles/jellyfin/templates/docker-compose.yml.j2 create mode 100644 ansible/roles/jellyfin/templates/jellyfin-stack.service.j2 create mode 100644 jellyfin-tools diff --git a/ansible/inventory/hosts.yml b/ansible/inventory/hosts.yml index de41926..29d5076 100644 --- a/ansible/inventory/hosts.yml +++ b/ansible/inventory/hosts.yml @@ -27,6 +27,11 @@ all: claude-code: ansible_host: 10.10.2.10 + media_servers: + hosts: + media: + ansible_host: 10.10.1.50 + pihole_servers: hosts: pihole: diff --git a/ansible/playbooks/jellyfin.yml b/ansible/playbooks/jellyfin.yml new file mode 100644 index 0000000..ac5fe78 --- /dev/null +++ b/ansible/playbooks/jellyfin.yml @@ -0,0 +1,6 @@ +--- +- name: Deploy Jellyfin media stack + hosts: media_servers + become: true + roles: + - jellyfin diff --git a/ansible/roles/jellyfin/defaults/main.yml b/ansible/roles/jellyfin/defaults/main.yml new file mode 100644 index 0000000..8080c4e --- /dev/null +++ b/ansible/roles/jellyfin/defaults/main.yml @@ -0,0 +1,23 @@ +--- +jellyfin_version: "10.10.7" +qbittorrent_version: "5.1.4" +radarr_version: "6.0.4" +sonarr_version: "4.0.16" +prowlarr_version: "2.3.0" +flaresolverr_version: "v3.3.21" +jellyseerr_version: "2.5.2" + +jellyfin_timezone: "Europe/Zurich" +jellyfin_puid: "1000" +jellyfin_pgid: "1000" + +nvidia_driver_version: "580.159.03" + +jellyfin_config_dirs: + - /containers/jellyfin/config + - /containers/qbittorrent/config + - /containers/radarr/config + - /containers/sonarr/config + - /containers/prowlarr/config + - /containers/flaresolverr/config + - /containers/jellyseerr/config diff --git a/ansible/roles/jellyfin/handlers/main.yml b/ansible/roles/jellyfin/handlers/main.yml new file mode 100644 index 0000000..9dadb33 --- /dev/null +++ b/ansible/roles/jellyfin/handlers/main.yml @@ -0,0 +1,6 @@ +--- +- name: Restart jellyfin stack + ansible.builtin.systemd: + name: jellyfin-stack + state: restarted + daemon_reload: true diff --git a/ansible/roles/jellyfin/tasks/main.yml b/ansible/roles/jellyfin/tasks/main.yml new file mode 100644 index 0000000..abe3881 --- /dev/null +++ b/ansible/roles/jellyfin/tasks/main.yml @@ -0,0 +1,154 @@ +--- +# --- System setup --- + +- name: Set timezone + community.general.timezone: + name: "{{ jellyfin_timezone }}" + +- name: Grant adyrem passwordless sudo + ansible.builtin.copy: + dest: /etc/sudoers.d/adyrem + content: "adyrem ALL=(ALL:ALL) NOPASSWD: ALL\n" + owner: root + group: root + mode: "0440" + validate: visudo -cf %s + +- name: Install base packages + ansible.builtin.apt: + name: + - curl + - ca-certificates + - gnupg + - apt-transport-https + state: present + update_cache: true + +# --- Docker --- + +- name: Add Docker GPG key + ansible.builtin.get_url: + url: https://download.docker.com/linux/debian/gpg + dest: /usr/share/keyrings/docker.asc + mode: "0644" + +- name: Add Docker apt repository + ansible.builtin.apt_repository: + repo: >- + deb [arch=amd64 signed-by=/usr/share/keyrings/docker.asc] + https://download.docker.com/linux/debian bookworm stable + filename: docker + state: present + +- name: Install Docker and compose plugin + ansible.builtin.apt: + name: + - docker-ce + - docker-ce-cli + - containerd.io + - docker-compose-plugin + state: present + update_cache: true + +- name: Enable and start Docker + ansible.builtin.systemd: + name: docker + enabled: true + state: started + +# --- NVIDIA container toolkit --- + +- name: Add NVIDIA container toolkit GPG key + ansible.builtin.get_url: + url: https://nvidia.github.io/libnvidia-container/gpgkey + dest: /usr/share/keyrings/nvidia-container-toolkit.asc + mode: "0644" + +- name: Add NVIDIA container toolkit apt repository + ansible.builtin.get_url: + url: https://nvidia.github.io/libnvidia-container/stable/deb/amd64/Packages + dest: /tmp/nvidia-ct-packages + mode: "0644" + check_mode: false + changed_when: false + +- name: Write nvidia-container-toolkit sources list + ansible.builtin.copy: + dest: /etc/apt/sources.list.d/nvidia-container-toolkit.list + content: | + deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit.asc] https://nvidia.github.io/libnvidia-container/stable/deb/amd64 / + mode: "0644" + +- name: Install nvidia-container-toolkit + ansible.builtin.apt: + name: nvidia-container-toolkit + state: present + update_cache: true + +- name: Configure Docker to use NVIDIA runtime + ansible.builtin.command: + cmd: nvidia-ctk runtime configure --runtime=docker + changed_when: false + +- name: Restart Docker to apply NVIDIA runtime + ansible.builtin.systemd: + name: docker + state: restarted + +# --- NVIDIA userspace libraries --- +# The LXC has /dev/nvidia* bind-mounted from the host. +# The host's NVIDIA driver version must match what we install here. + +- name: Check if NVIDIA userspace libraries are installed + ansible.builtin.stat: + path: /usr/lib/x86_64-linux-gnu/libcuda.so.{{ nvidia_driver_version }} + register: _nvidia_libs + +- name: Copy NVIDIA installer from Proxmox host to LXC + ansible.builtin.copy: + src: /tmp/nvidia-580.run + dest: /tmp/nvidia.run + mode: "0755" + when: not _nvidia_libs.stat.exists + +- name: Install NVIDIA userspace libraries (no kernel module) + ansible.builtin.command: + cmd: /tmp/nvidia.run --silent --no-kernel-module --no-drm + creates: /usr/lib/x86_64-linux-gnu/libcuda.so.{{ nvidia_driver_version }} + when: not _nvidia_libs.stat.exists + +# --- Config directories and compose file --- + +- name: Create container config directories + ansible.builtin.file: + path: "{{ item }}" + state: directory + mode: "0755" + loop: "{{ jellyfin_config_dirs }}" + +- name: Create stack directory + ansible.builtin.file: + path: /opt/jellyfin + state: directory + mode: "0755" + +- name: Deploy docker-compose.yml + ansible.builtin.template: + src: docker-compose.yml.j2 + dest: /opt/jellyfin/docker-compose.yml + mode: "0644" + notify: Restart jellyfin stack + +- name: Deploy systemd service + ansible.builtin.template: + src: jellyfin-stack.service.j2 + dest: /etc/systemd/system/jellyfin-stack.service + mode: "0644" + notify: Restart jellyfin stack + +- name: Enable and start jellyfin stack service + ansible.builtin.systemd: + name: jellyfin-stack + enabled: true + state: started + daemon_reload: true diff --git a/ansible/roles/jellyfin/templates/docker-compose.yml.j2 b/ansible/roles/jellyfin/templates/docker-compose.yml.j2 new file mode 100644 index 0000000..976ce01 --- /dev/null +++ b/ansible/roles/jellyfin/templates/docker-compose.yml.j2 @@ -0,0 +1,95 @@ +name: jellyfin +services: + jellyfin: + image: jellyfin/jellyfin:{{ jellyfin_version }} + container_name: jellyfin + runtime: nvidia + environment: + - NVIDIA_VISIBLE_DEVICES=all + - NVIDIA_DRIVER_CAPABILITIES=compute,video,utility + - TZ={{ jellyfin_timezone }} + volumes: + - /containers/jellyfin/config:/config + - /media:/media + ports: + - "8096:8096" + restart: unless-stopped + + qbittorrent: + image: lscr.io/linuxserver/qbittorrent:{{ qbittorrent_version }} + container_name: qbittorrent + environment: + - PUID={{ jellyfin_puid }} + - PGID={{ jellyfin_pgid }} + - TZ={{ jellyfin_timezone }} + - WEBUI_PORT=5080 + volumes: + - /containers/qbittorrent/config:/config + - /media:/downloads + ports: + - "5080:5080" + - "6881:6881" + - "6881:6881/udp" + restart: unless-stopped + + radarr: + image: lscr.io/linuxserver/radarr:{{ radarr_version }} + container_name: radarr + environment: + - PUID={{ jellyfin_puid }} + - PGID={{ jellyfin_pgid }} + - TZ={{ jellyfin_timezone }} + volumes: + - /containers/radarr/config:/config + - /media:/downloads + ports: + - "7878:7878" + restart: unless-stopped + + sonarr: + image: lscr.io/linuxserver/sonarr:{{ sonarr_version }} + container_name: sonarr + environment: + - PUID={{ jellyfin_puid }} + - PGID={{ jellyfin_pgid }} + - TZ={{ jellyfin_timezone }} + volumes: + - /containers/sonarr/config:/config + - /media:/downloads + ports: + - "8989:8989" + restart: unless-stopped + + prowlarr: + image: lscr.io/linuxserver/prowlarr:{{ prowlarr_version }} + container_name: prowlarr + environment: + - PUID={{ jellyfin_puid }} + - PGID={{ jellyfin_pgid }} + - TZ={{ jellyfin_timezone }} + volumes: + - /containers/prowlarr/config:/config + ports: + - "9696:9696" + restart: unless-stopped + + flaresolverr: + image: ghcr.io/flaresolverr/flaresolverr:{{ flaresolverr_version }} + container_name: flaresolverr + environment: + - LOG_LEVEL=info + - TZ={{ jellyfin_timezone }} + ports: + - "8191:8191" + restart: unless-stopped + + jellyseerr: + image: ghcr.io/fallenbagel/jellyseerr:{{ jellyseerr_version }} + container_name: jellyseerr + environment: + - TZ={{ jellyfin_timezone }} + volumes: + - /containers/jellyseerr/config:/app/config + ports: + - "5055:5055" + restart: unless-stopped diff --git a/ansible/roles/jellyfin/templates/jellyfin-stack.service.j2 b/ansible/roles/jellyfin/templates/jellyfin-stack.service.j2 new file mode 100644 index 0000000..bd58aca --- /dev/null +++ b/ansible/roles/jellyfin/templates/jellyfin-stack.service.j2 @@ -0,0 +1,15 @@ +[Unit] +Description=Jellyfin media stack +Requires=docker.service +After=docker.service + +[Service] +Type=oneshot +RemainAfterExit=yes +WorkingDirectory=/opt/jellyfin +ExecStart=/usr/bin/docker compose up -d --remove-orphans +ExecStop=/usr/bin/docker compose down +TimeoutStartSec=300 + +[Install] +WantedBy=multi-user.target diff --git a/ansible/roles/pihole/defaults/main.yml b/ansible/roles/pihole/defaults/main.yml index d8904d1..0fabb99 100644 --- a/ansible/roles/pihole/defaults/main.yml +++ b/ansible/roles/pihole/defaults/main.yml @@ -8,6 +8,13 @@ pihole_dns_hosts: - { ip: "10.10.1.2", host: "pihole.homelab" } - { ip: "10.10.1.3", host: "traefik.homelab" } - { ip: "10.10.1.125", host: "gitea.homelab" } - - { ip: "10.10.1.137", host: "grafana.homelab" } + - { ip: "10.10.1.3", host: "grafana.homelab" } + - { ip: "10.10.1.3", host: "proxmox.homelab" } - { ip: "10.10.1.3", host: "adyrem.duckdns.org" } - { ip: "10.10.1.3", host: "mtg.homelab" } + - { ip: "10.10.1.3", host: "jellyfin.homelab" } + - { ip: "10.10.1.3", host: "jellyseerr.homelab" } + - { ip: "10.10.1.3", host: "radarr.homelab" } + - { ip: "10.10.1.3", host: "sonarr.homelab" } + - { ip: "10.10.1.3", host: "prowlarr.homelab" } + - { ip: "10.10.1.3", host: "qbittorrent.homelab" } diff --git a/ansible/roles/traefik/defaults/main.yml b/ansible/roles/traefik/defaults/main.yml index 8413f37..bc8ee3a 100644 --- a/ansible/roles/traefik/defaults/main.yml +++ b/ansible/roles/traefik/defaults/main.yml @@ -25,3 +25,25 @@ traefik_services: - name: pihole host: "pihole.homelab" backend: "http://10.10.1.2:80" + - name: jellyfin + host: "jellyfin.homelab" + backend: "http://10.10.1.50:8096" + - name: jellyseerr + host: "jellyseerr.homelab" + backend: "http://10.10.1.50:5055" + - name: radarr + host: "radarr.homelab" + backend: "http://10.10.1.50:7878" + - name: sonarr + host: "sonarr.homelab" + backend: "http://10.10.1.50:8989" + - name: prowlarr + host: "prowlarr.homelab" + backend: "http://10.10.1.50:9696" + - name: qbittorrent + host: "qbittorrent.homelab" + backend: "http://10.10.1.50:5080" + - name: proxmox + host: "proxmox.homelab" + backend: "https://192.168.1.10:8006" + tls_skip_verify: true diff --git a/ansible/roles/traefik/templates/routes.yml.j2 b/ansible/roles/traefik/templates/routes.yml.j2 index 54bd09e..30ea627 100644 --- a/ansible/roles/traefik/templates/routes.yml.j2 +++ b/ansible/roles/traefik/templates/routes.yml.j2 @@ -6,6 +6,8 @@ http: service: {{ svc.name }} entryPoints: - web + - websecure + tls: {} {% if svc.public_host is defined %} {{ svc.name }}-public-redirect: rule: "Host(`{{ svc.public_host }}`){% if svc.public_path is defined %} && PathPrefix(`{{ svc.public_path }}`){% endif %}" @@ -48,4 +50,23 @@ http: loadBalancer: servers: - url: "{{ svc.backend }}" +{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %} + serversTransport: {{ svc.name }}-transport +{% endif %} {% endfor %} + +{% set ns = namespace(has_skip_verify=false) %} +{% for svc in traefik_services %} +{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %} +{% set ns.has_skip_verify = true %} +{% endif %} +{% endfor %} +{% if ns.has_skip_verify %} + serversTransports: +{% for svc in traefik_services %} +{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %} + {{ svc.name }}-transport: + insecureSkipVerify: true +{% endif %} +{% endfor %} +{% endif %} diff --git a/homelab-requirements.md b/homelab-requirements.md index cf5a5c3..08e9bac 100644 --- a/homelab-requirements.md +++ b/homelab-requirements.md @@ -298,7 +298,88 @@ In the event of full hardware loss, the rebuild order is: --- -## 10. Out of Scope (for now) +## 10. Media Stack (Jellyfin) + +### Overview +A self-hosted media server and automation stack running in a dedicated LXC container on `infra-net`. All web UIs are internal-only, accessible via VPN or LAN. Port 6881 (BitTorrent peering) is the only internet-facing port. + +### Services +| Container | Purpose | Port | +|---|---|---| +| Jellyfin | Media server / streaming | 8096 | +| Jellyseerr | Media request UI | 5055 | +| Radarr | Movie download management | 7878 | +| Sonarr | TV show download management | 8989 | +| Prowlarr | Indexer aggregator (feeds Radarr/Sonarr) | 9696 | +| FlareSolverr | Cloudflare bypass for Prowlarr | 8191 | +| qBittorrent | Torrent client | 5080 (UI), 6881 (peers) | + +### LXC Container +- **Host:** Proxmox LXC, ID 106 +- **Template:** Debian 12 +- **Mode:** Privileged (required for NVIDIA device passthrough) +- **Features:** `nesting=1` (required for Docker) +- **Network:** `vmbr1` (infra-net), static IP `10.10.1.50` +- **Resources:** 4 CPU cores, 4GB RAM +- **GPU passthrough:** NVIDIA GTX 1060 via device node bind-mount (not PCIe passthrough) + - NVIDIA proprietary driver installed on Proxmox host + - Same driver version installed inside the LXC (versions must match exactly) + - Device nodes passed into LXC via `lxc.cgroup2.devices.allow`: `/dev/nvidia0`, `/dev/nvidiactl`, `/dev/nvidia-uvm`, `/dev/nvidia-uvm-tools` + - `nvidia-container-toolkit` installed inside LXC to enable Docker GPU access + - Jellyfin container configured to use NVENC (encoding) and NVDEC (decoding) + +### Storage +- **Media library:** ZFS dataset `hdd/media`, bind-mounted into LXC at `/media` + - All containers share this path for downloads and library access +- **Config state:** `/containers//config` on LXC root dataset (SSD, rpool) + - Directories: `jellyfin`, `qbittorrent`, `radarr`, `sonarr`, `prowlarr`, `flaresolverr`, `jellyseerr` + +### Deployment +- All services run via a single Docker Compose file managed by the `jellyfin` Ansible role +- Compose file derived from reference stack (`jellyfin-tools` in repo root) with: + - Jellyfin container added + - Traefik Docker labels removed (Traefik is a standalone LXC, not a Docker container) + - Docker `proxy` network removed; services reach each other by container name within Compose + - All image tags pinned (no `latest`) + - Timezone: `Europe/Zurich` +- Managed as a systemd service so it starts on LXC boot + +### Routing (internal-only) +All services accessible at `.homelab` hostnames via Traefik (LXC 104, `10.10.1.3`). No public host — reachable via VPN or LAN only. + +| Hostname | Backend | +|---|---| +| `jellyfin.homelab` | `http://10.10.1.50:8096` | +| `jellyseerr.homelab` | `http://10.10.1.50:5055` | +| `radarr.homelab` | `http://10.10.1.50:7878` | +| `sonarr.homelab` | `http://10.10.1.50:8989` | +| `prowlarr.homelab` | `http://10.10.1.50:9696` | +| `qbittorrent.homelab` | `http://10.10.1.50:5080` | + +FlareSolverr has no web UI worth routing; Prowlarr reaches it by container name internally. + +### DNS +Pi-hole A records: all 6 routed hostnames → `10.10.1.3` (Traefik). + +### Port 6881 (BitTorrent Peering) +- **Proxmox DNAT** (in `proxmox/network-interfaces`): TCP+UDP 6881 on `192.168.1.10` → `10.10.1.50:6881` +- **Manual step:** Home router port-forward: 6881 TCP+UDP → `192.168.1.10` +- qBittorrent web UI (5080) remains internal-only + +### Ansible +- New role: `jellyfin` — installs Docker, creates config dirs, deploys Compose file, enables systemd service +- New playbook: `jellyfin.yml` — targets the media LXC +- Media LXC added to inventory; included in `site.yml` for common/node_exporter/promtail roles + +### NVIDIA Driver Notes +- Driver version on host and in LXC must be identical — this is a hard requirement for NVIDIA device passthrough +- The LXC does **not** need the full NVIDIA driver package (kernel modules already loaded on host); it only needs the userspace libraries (`nvidia-utils` / `libnvidia-compute`) +- `nvidia-smi` inside the LXC is the verification step after setup +- If a Proxmox host kernel update bumps the NVIDIA driver, the LXC libraries must be updated to match before Jellyfin transcoding will work again + +--- + +## 11. Out of Scope (for now) - External/cloud backups (architecture must not preclude adding later) - Additional VM distros beyond those listed — template mechanism should make adding easy diff --git a/jellyfin-tools b/jellyfin-tools new file mode 100644 index 0000000..6fe7d08 --- /dev/null +++ b/jellyfin-tools @@ -0,0 +1,132 @@ +name: jellyfin-tools +services: + qbittorrent: + container_name: qbittorrent + image: lscr.io/linuxserver/qbittorrent:5.1.4 + networks: + - proxy + labels: + - "traefik.enable=true" + - "traefik.http.routers.qbittorrent.rule=Host(`bittorrent.home.sjaun.ch`)" + - "traefik.http.services.qbittorrent.loadbalancer.server.port=5080" + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Zurich + - WEBUI_PORT=5080 + volumes: + - /containers/qbittorrent/config:/config + - /media:/downloads + ports: + - 5080:5080 + - 6881:6881 + - 6881:6881/udp + restart: "unless-stopped" + + radarr: + container_name: radarr + image: lscr.io/linuxserver/radarr:6.0.4 + networks: + - proxy + labels: + - "traefik.enable=true" + - "traefik.http.routers.radarr.rule=Host(`radarr.home.sjaun.ch`)" + - "traefik.http.services.radarr.loadbalancer.server.port=7878" + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Zurich + ports: + - 7878:7878 + volumes: + - /containers/radarr/config:/config + - /media:/downloads + restart: "unless-stopped" + + sonarr: + image: linuxserver/sonarr:4.0.16 + container_name: sonarr + networks: + - proxy + labels: + - "traefik.enable=true" + - "traefik.http.routers.sonarr.rule=Host(`sonarr.home.sjaun.ch`)" + - "traefik.http.services.sonarr.loadbalancer.server.port=8989" + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Zurich + volumes: + - /containers/sonarr/config:/config + - /media:/downloads + ports: + - 8989:8989 + restart: unless-stopped + + prowlarr: + container_name: prowlarr + image: linuxserver/prowlarr:2.3.0 + networks: + - proxy + labels: + - "traefik.enable=true" + - "traefik.http.routers.prowlarr.rule=Host(`prowlarr.home.sjaun.ch`)" + - "traefik.http.services.prowlarr.loadbalancer.server.port=9696" + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Zurich + volumes: + - /containers/prowlarr/config:/config + ports: + - 9696:9696 + restart: unless-stopped + + flaresolverr: + # DockerHub mirror flaresolverr/flaresolverr:latest + image: ghcr.io/flaresolverr/flaresolverr:latest + networks: + - proxy + labels: + - "traefik.enable=true" + - "traefik.http.routers.flaresolverr.rule=Host(`flaresolverr.home.sjaun.ch`)" + - "traefik.http.services.flaresolverr.loadbalancer.server.port=8191" + container_name: flaresolverr + environment: + - LOG_LEVEL=${LOG_LEVEL:-info} + - LOG_FILE=${LOG_FILE:-none} + - LOG_HTML=${LOG_HTML:-false} + - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none} + - TZ=Europe/Zurich + ports: + - "${PORT:-8191}:8191" + volumes: + - /containers/flaresolver/config:/config + restart: unless-stopped + + jellyseerr: + image: ghcr.io/fallenbagel/jellyseerr:latest + init: true + container_name: jellyseerr + networks: + - proxy + labels: + - "traefik.enable=true" + - "traefik.http.routers.jellyseerr.rule=Host(`jellyseerr.home.sjaun.ch`)" + - "traefik.http.services.jellyseerr.loadbalancer.server.port=5055" + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Zurich + volumes: + - /containers/jellyseerr/config:/app/config + healthcheck: + test: wget --no-verbose --tries=1 --spider http://localhost:5055/api/v1/status || exit 1 + start_period: 20s + timeout: 3s + interval: 15s + retries: 3 + restart: unless-stopped +networks: + proxy: + external: true \ No newline at end of file diff --git a/proxmox/network-interfaces b/proxmox/network-interfaces index da8151f..78f1745 100644 --- a/proxmox/network-interfaces +++ b/proxmox/network-interfaces @@ -10,6 +10,10 @@ iface vmbr0 inet static bridge-ports nic0 bridge-stp off bridge-fd 0 + post-up iptables -t nat -A PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 6881 -j DNAT --to-destination 10.10.1.50:6881 + post-up iptables -t nat -A PREROUTING -i vmbr0 -d 192.168.1.10 -p udp --dport 6881 -j DNAT --to-destination 10.10.1.50:6881 + post-down iptables -t nat -D PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 6881 -j DNAT --to-destination 10.10.1.50:6881 + post-down iptables -t nat -D PREROUTING -i vmbr0 -d 192.168.1.10 -p udp --dport 6881 -j DNAT --to-destination 10.10.1.50:6881 post-up iptables -t nat -A PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 80 -j DNAT --to-destination 10.10.1.3:80 post-up iptables -t nat -A PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 443 -j DNAT --to-destination 10.10.1.3:443 post-down iptables -t nat -D PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 80 -j DNAT --to-destination 10.10.1.3:80