Add Jellyfin media stack (LXC 106, NVIDIA GTX 1060)

- New Ansible role: jellyfin — Docker + nvidia-container-toolkit setup, full *arr stack compose file (Jellyfin, qBittorrent, Radarr, Sonarr, Prowlarr, FlareSolverr, Jellyseerr), systemd service for auto-start - New playbook: jellyfin.yml targeting media_servers group - Inventory: add media LXC (10.10.1.50) to media_servers group - Traefik: add internal .homelab routes for all 6 media services - Pi-hole: add DNS records for all 6 media services → Traefik - network-interfaces: DNAT port 6881 TCP+UDP → 10.10.1.50 for BitTorrent - homelab-requirements.md: document full Jellyfin stack requirements including NVIDIA GTX 1060 passthrough approach and driver notes - jellyfin-tools: original reference compose file from upstream Infrastructure created on Proxmox: - LXC 106 (media, Debian 12, privileged, nesting=1, 10.10.1.50/vmbr1) - ZFS dataset hdd/media mounted at /media in LXC - NVIDIA device passthrough entries in /etc/pve/lxc/106.conf Note: NVIDIA driver 580.159.03 (.run) installed on Proxmox host — not managed by apt (Debian only has 550.x which doesn't support kernel 7.x or GTX 1060 Pascal as of this driver version). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-18 13:28:37 +02:00
parent 30b2d42fcc
commit 3bb01ddaaf
13 changed files with 573 additions and 2 deletions
@@ -0,0 +1,23 @@
+---
+jellyfin_version: "10.10.7"
+qbittorrent_version: "5.1.4"
+radarr_version: "6.0.4"
+sonarr_version: "4.0.16"
+prowlarr_version: "2.3.0"
+flaresolverr_version: "v3.3.21"
+jellyseerr_version: "2.5.2"
+
+jellyfin_timezone: "Europe/Zurich"
+jellyfin_puid: "1000"
+jellyfin_pgid: "1000"
+
+nvidia_driver_version: "580.159.03"
+
+jellyfin_config_dirs:
+  - /containers/jellyfin/config
+  - /containers/qbittorrent/config
+  - /containers/radarr/config
+  - /containers/sonarr/config
+  - /containers/prowlarr/config
+  - /containers/flaresolverr/config
+  - /containers/jellyseerr/config
@@ -0,0 +1,6 @@
+---
+- name: Restart jellyfin stack
+  ansible.builtin.systemd:
+    name: jellyfin-stack
+    state: restarted
+    daemon_reload: true
@@ -0,0 +1,154 @@
+---
+# --- System setup ---
+
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ jellyfin_timezone }}"
+
+- name: Grant adyrem passwordless sudo
+  ansible.builtin.copy:
+    dest: /etc/sudoers.d/adyrem
+    content: "adyrem ALL=(ALL:ALL) NOPASSWD: ALL\n"
+    owner: root
+    group: root
+    mode: "0440"
+    validate: visudo -cf %s
+
+- name: Install base packages
+  ansible.builtin.apt:
+    name:
+      - curl
+      - ca-certificates
+      - gnupg
+      - apt-transport-https
+    state: present
+    update_cache: true
+
+# --- Docker ---
+
+- name: Add Docker GPG key
+  ansible.builtin.get_url:
+    url: https://download.docker.com/linux/debian/gpg
+    dest: /usr/share/keyrings/docker.asc
+    mode: "0644"
+
+- name: Add Docker apt repository
+  ansible.builtin.apt_repository:
+    repo: >-
+      deb [arch=amd64 signed-by=/usr/share/keyrings/docker.asc]
+      https://download.docker.com/linux/debian bookworm stable
+    filename: docker
+    state: present
+
+- name: Install Docker and compose plugin
+  ansible.builtin.apt:
+    name:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-compose-plugin
+    state: present
+    update_cache: true
+
+- name: Enable and start Docker
+  ansible.builtin.systemd:
+    name: docker
+    enabled: true
+    state: started
+
+# --- NVIDIA container toolkit ---
+
+- name: Add NVIDIA container toolkit GPG key
+  ansible.builtin.get_url:
+    url: https://nvidia.github.io/libnvidia-container/gpgkey
+    dest: /usr/share/keyrings/nvidia-container-toolkit.asc
+    mode: "0644"
+
+- name: Add NVIDIA container toolkit apt repository
+  ansible.builtin.get_url:
+    url: https://nvidia.github.io/libnvidia-container/stable/deb/amd64/Packages
+    dest: /tmp/nvidia-ct-packages
+    mode: "0644"
+  check_mode: false
+  changed_when: false
+
+- name: Write nvidia-container-toolkit sources list
+  ansible.builtin.copy:
+    dest: /etc/apt/sources.list.d/nvidia-container-toolkit.list
+    content: |
+      deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit.asc] https://nvidia.github.io/libnvidia-container/stable/deb/amd64 /
+    mode: "0644"
+
+- name: Install nvidia-container-toolkit
+  ansible.builtin.apt:
+    name: nvidia-container-toolkit
+    state: present
+    update_cache: true
+
+- name: Configure Docker to use NVIDIA runtime
+  ansible.builtin.command:
+    cmd: nvidia-ctk runtime configure --runtime=docker
+  changed_when: false
+
+- name: Restart Docker to apply NVIDIA runtime
+  ansible.builtin.systemd:
+    name: docker
+    state: restarted
+
+# --- NVIDIA userspace libraries ---
+# The LXC has /dev/nvidia* bind-mounted from the host.
+# The host's NVIDIA driver version must match what we install here.
+
+- name: Check if NVIDIA userspace libraries are installed
+  ansible.builtin.stat:
+    path: /usr/lib/x86_64-linux-gnu/libcuda.so.{{ nvidia_driver_version }}
+  register: _nvidia_libs
+
+- name: Copy NVIDIA installer from Proxmox host to LXC
+  ansible.builtin.copy:
+    src: /tmp/nvidia-580.run
+    dest: /tmp/nvidia.run
+    mode: "0755"
+  when: not _nvidia_libs.stat.exists
+
+- name: Install NVIDIA userspace libraries (no kernel module)
+  ansible.builtin.command:
+    cmd: /tmp/nvidia.run --silent --no-kernel-module --no-drm
+    creates: /usr/lib/x86_64-linux-gnu/libcuda.so.{{ nvidia_driver_version }}
+  when: not _nvidia_libs.stat.exists
+
+# --- Config directories and compose file ---
+
+- name: Create container config directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop: "{{ jellyfin_config_dirs }}"
+
+- name: Create stack directory
+  ansible.builtin.file:
+    path: /opt/jellyfin
+    state: directory
+    mode: "0755"
+
+- name: Deploy docker-compose.yml
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: /opt/jellyfin/docker-compose.yml
+    mode: "0644"
+  notify: Restart jellyfin stack
+
+- name: Deploy systemd service
+  ansible.builtin.template:
+    src: jellyfin-stack.service.j2
+    dest: /etc/systemd/system/jellyfin-stack.service
+    mode: "0644"
+  notify: Restart jellyfin stack
+
+- name: Enable and start jellyfin stack service
+  ansible.builtin.systemd:
+    name: jellyfin-stack
+    enabled: true
+    state: started
+    daemon_reload: true
@@ -0,0 +1,95 @@
+name: jellyfin
+services:
+  jellyfin:
+    image: jellyfin/jellyfin:{{ jellyfin_version }}
+    container_name: jellyfin
+    runtime: nvidia
+    environment:
+      - NVIDIA_VISIBLE_DEVICES=all
+      - NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
+      - TZ={{ jellyfin_timezone }}
+    volumes:
+      - /containers/jellyfin/config:/config
+      - /media:/media
+    ports:
+      - "8096:8096"
+    restart: unless-stopped
+
+  qbittorrent:
+    image: lscr.io/linuxserver/qbittorrent:{{ qbittorrent_version }}
+    container_name: qbittorrent
+    environment:
+      - PUID={{ jellyfin_puid }}
+      - PGID={{ jellyfin_pgid }}
+      - TZ={{ jellyfin_timezone }}
+      - WEBUI_PORT=5080
+    volumes:
+      - /containers/qbittorrent/config:/config
+      - /media:/downloads
+    ports:
+      - "5080:5080"
+      - "6881:6881"
+      - "6881:6881/udp"
+    restart: unless-stopped
+
+  radarr:
+    image: lscr.io/linuxserver/radarr:{{ radarr_version }}
+    container_name: radarr
+    environment:
+      - PUID={{ jellyfin_puid }}
+      - PGID={{ jellyfin_pgid }}
+      - TZ={{ jellyfin_timezone }}
+    volumes:
+      - /containers/radarr/config:/config
+      - /media:/downloads
+    ports:
+      - "7878:7878"
+    restart: unless-stopped
+
+  sonarr:
+    image: lscr.io/linuxserver/sonarr:{{ sonarr_version }}
+    container_name: sonarr
+    environment:
+      - PUID={{ jellyfin_puid }}
+      - PGID={{ jellyfin_pgid }}
+      - TZ={{ jellyfin_timezone }}
+    volumes:
+      - /containers/sonarr/config:/config
+      - /media:/downloads
+    ports:
+      - "8989:8989"
+    restart: unless-stopped
+
+  prowlarr:
+    image: lscr.io/linuxserver/prowlarr:{{ prowlarr_version }}
+    container_name: prowlarr
+    environment:
+      - PUID={{ jellyfin_puid }}
+      - PGID={{ jellyfin_pgid }}
+      - TZ={{ jellyfin_timezone }}
+    volumes:
+      - /containers/prowlarr/config:/config
+    ports:
+      - "9696:9696"
+    restart: unless-stopped
+
+  flaresolverr:
+    image: ghcr.io/flaresolverr/flaresolverr:{{ flaresolverr_version }}
+    container_name: flaresolverr
+    environment:
+      - LOG_LEVEL=info
+      - TZ={{ jellyfin_timezone }}
+    ports:
+      - "8191:8191"
+    restart: unless-stopped
+
+  jellyseerr:
+    image: ghcr.io/fallenbagel/jellyseerr:{{ jellyseerr_version }}
+    container_name: jellyseerr
+    environment:
+      - TZ={{ jellyfin_timezone }}
+    volumes:
+      - /containers/jellyseerr/config:/app/config
+    ports:
+      - "5055:5055"
+    restart: unless-stopped
@@ -0,0 +1,15 @@
+[Unit]
+Description=Jellyfin media stack
+Requires=docker.service
+After=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory=/opt/jellyfin
+ExecStart=/usr/bin/docker compose up -d --remove-orphans
+ExecStop=/usr/bin/docker compose down
+TimeoutStartSec=300
+
+[Install]
+WantedBy=multi-user.target
@@ -8,6 +8,13 @@ pihole_dns_hosts:
  - { ip: "10.10.1.2",   host: "pihole.homelab" }
  - { ip: "10.10.1.3",   host: "traefik.homelab" }
  - { ip: "10.10.1.125", host: "gitea.homelab" }
-  - { ip: "10.10.1.137", host: "grafana.homelab" }
+  - { ip: "10.10.1.3",   host: "grafana.homelab" }
+  - { ip: "10.10.1.3",   host: "proxmox.homelab" }
  - { ip: "10.10.1.3",   host: "adyrem.duckdns.org" }
  - { ip: "10.10.1.3",   host: "mtg.homelab" }
+  - { ip: "10.10.1.3",   host: "jellyfin.homelab" }
+  - { ip: "10.10.1.3",   host: "jellyseerr.homelab" }
+  - { ip: "10.10.1.3",   host: "radarr.homelab" }
+  - { ip: "10.10.1.3",   host: "sonarr.homelab" }
+  - { ip: "10.10.1.3",   host: "prowlarr.homelab" }
+  - { ip: "10.10.1.3",   host: "qbittorrent.homelab" }
@@ -25,3 +25,25 @@ traefik_services:
  - name: pihole
    host: "pihole.homelab"
    backend: "http://10.10.1.2:80"
+  - name: jellyfin
+    host: "jellyfin.homelab"
+    backend: "http://10.10.1.50:8096"
+  - name: jellyseerr
+    host: "jellyseerr.homelab"
+    backend: "http://10.10.1.50:5055"
+  - name: radarr
+    host: "radarr.homelab"
+    backend: "http://10.10.1.50:7878"
+  - name: sonarr
+    host: "sonarr.homelab"
+    backend: "http://10.10.1.50:8989"
+  - name: prowlarr
+    host: "prowlarr.homelab"
+    backend: "http://10.10.1.50:9696"
+  - name: qbittorrent
+    host: "qbittorrent.homelab"
+    backend: "http://10.10.1.50:5080"
+  - name: proxmox
+    host: "proxmox.homelab"
+    backend: "https://192.168.1.10:8006"
+    tls_skip_verify: true
@@ -6,6 +6,8 @@ http:
      service: {{ svc.name }}
      entryPoints:
        - web
+        - websecure
+      tls: {}
 {% if svc.public_host is defined %}
    {{ svc.name }}-public-redirect:
      rule: "Host(`{{ svc.public_host }}`){% if svc.public_path is defined %} && PathPrefix(`{{ svc.public_path }}`){% endif %}"
@@ -48,4 +50,23 @@ http:
      loadBalancer:
        servers:
          - url: "{{ svc.backend }}"
+{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %}
+        serversTransport: {{ svc.name }}-transport
+{% endif %}
 {% endfor %}
+
+{% set ns = namespace(has_skip_verify=false) %}
+{% for svc in traefik_services %}
+{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %}
+{% set ns.has_skip_verify = true %}
+{% endif %}
+{% endfor %}
+{% if ns.has_skip_verify %}
+  serversTransports:
+{% for svc in traefik_services %}
+{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %}
+    {{ svc.name }}-transport:
+      insecureSkipVerify: true
+{% endif %}
+{% endfor %}
+{% endif %}