Add Jellyfin media stack (LXC 106, NVIDIA GTX 1060)

- New Ansible role: jellyfin — Docker + nvidia-container-toolkit setup,
  full *arr stack compose file (Jellyfin, qBittorrent, Radarr, Sonarr,
  Prowlarr, FlareSolverr, Jellyseerr), systemd service for auto-start
- New playbook: jellyfin.yml targeting media_servers group
- Inventory: add media LXC (10.10.1.50) to media_servers group
- Traefik: add internal .homelab routes for all 6 media services
- Pi-hole: add DNS records for all 6 media services → Traefik
- network-interfaces: DNAT port 6881 TCP+UDP → 10.10.1.50 for BitTorrent
- homelab-requirements.md: document full Jellyfin stack requirements
  including NVIDIA GTX 1060 passthrough approach and driver notes
- jellyfin-tools: original reference compose file from upstream

Infrastructure created on Proxmox:
- LXC 106 (media, Debian 12, privileged, nesting=1, 10.10.1.50/vmbr1)
- ZFS dataset hdd/media mounted at /media in LXC
- NVIDIA device passthrough entries in /etc/pve/lxc/106.conf

Note: NVIDIA driver 580.159.03 (.run) installed on Proxmox host — not
managed by apt (Debian only has 550.x which doesn't support kernel 7.x
or GTX 1060 Pascal as of this driver version).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/inventory/hosts.yml

@@ -27,6 +27,11 @@ all:
         claude-code:
           ansible_host: 10.10.2.10
 
+    media_servers:
+      hosts:
+        media:
+          ansible_host: 10.10.1.50
+
     pihole_servers:
       hosts:
         pihole:

ansible/playbooks/jellyfin.yml

@@ -0,0 +1,6 @@
+---
+- name: Deploy Jellyfin media stack
+  hosts: media_servers
+  become: true
+  roles:
+    - jellyfin

ansible/roles/jellyfin/defaults/main.yml

@@ -0,0 +1,23 @@
+---
+jellyfin_version: "10.10.7"
+qbittorrent_version: "5.1.4"
+radarr_version: "6.0.4"
+sonarr_version: "4.0.16"
+prowlarr_version: "2.3.0"
+flaresolverr_version: "v3.3.21"
+jellyseerr_version: "2.5.2"
+
+jellyfin_timezone: "Europe/Zurich"
+jellyfin_puid: "1000"
+jellyfin_pgid: "1000"
+
+nvidia_driver_version: "580.159.03"
+
+jellyfin_config_dirs:
+  - /containers/jellyfin/config
+  - /containers/qbittorrent/config
+  - /containers/radarr/config
+  - /containers/sonarr/config
+  - /containers/prowlarr/config
+  - /containers/flaresolverr/config
+  - /containers/jellyseerr/config

ansible/roles/jellyfin/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart jellyfin stack
+  ansible.builtin.systemd:
+    name: jellyfin-stack
+    state: restarted
+    daemon_reload: true

ansible/roles/jellyfin/tasks/main.yml

@@ -0,0 +1,154 @@
+---
+# --- System setup ---
+
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ jellyfin_timezone }}"
+
+- name: Grant adyrem passwordless sudo
+  ansible.builtin.copy:
+    dest: /etc/sudoers.d/adyrem
+    content: "adyrem ALL=(ALL:ALL) NOPASSWD: ALL\n"
+    owner: root
+    group: root
+    mode: "0440"
+    validate: visudo -cf %s
+
+- name: Install base packages
+  ansible.builtin.apt:
+    name:
+      - curl
+      - ca-certificates
+      - gnupg
+      - apt-transport-https
+    state: present
+    update_cache: true
+
+# --- Docker ---
+
+- name: Add Docker GPG key
+  ansible.builtin.get_url:
+    url: https://download.docker.com/linux/debian/gpg
+    dest: /usr/share/keyrings/docker.asc
+    mode: "0644"
+
+- name: Add Docker apt repository
+  ansible.builtin.apt_repository:
+    repo: >-
+      deb [arch=amd64 signed-by=/usr/share/keyrings/docker.asc]
+      https://download.docker.com/linux/debian bookworm stable
+    filename: docker
+    state: present
+
+- name: Install Docker and compose plugin
+  ansible.builtin.apt:
+    name:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-compose-plugin
+    state: present
+    update_cache: true
+
+- name: Enable and start Docker
+  ansible.builtin.systemd:
+    name: docker
+    enabled: true
+    state: started
+
+# --- NVIDIA container toolkit ---
+
+- name: Add NVIDIA container toolkit GPG key
+  ansible.builtin.get_url:
+    url: https://nvidia.github.io/libnvidia-container/gpgkey
+    dest: /usr/share/keyrings/nvidia-container-toolkit.asc
+    mode: "0644"
+
+- name: Add NVIDIA container toolkit apt repository
+  ansible.builtin.get_url:
+    url: https://nvidia.github.io/libnvidia-container/stable/deb/amd64/Packages
+    dest: /tmp/nvidia-ct-packages
+    mode: "0644"
+  check_mode: false
+  changed_when: false
+
+- name: Write nvidia-container-toolkit sources list
+  ansible.builtin.copy:
+    dest: /etc/apt/sources.list.d/nvidia-container-toolkit.list
+    content: |
+      deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit.asc] https://nvidia.github.io/libnvidia-container/stable/deb/amd64 /
+    mode: "0644"
+
+- name: Install nvidia-container-toolkit
+  ansible.builtin.apt:
+    name: nvidia-container-toolkit
+    state: present
+    update_cache: true
+
+- name: Configure Docker to use NVIDIA runtime
+  ansible.builtin.command:
+    cmd: nvidia-ctk runtime configure --runtime=docker
+  changed_when: false
+
+- name: Restart Docker to apply NVIDIA runtime
+  ansible.builtin.systemd:
+    name: docker
+    state: restarted
+
+# --- NVIDIA userspace libraries ---
+# The LXC has /dev/nvidia* bind-mounted from the host.
+# The host's NVIDIA driver version must match what we install here.
+
+- name: Check if NVIDIA userspace libraries are installed
+  ansible.builtin.stat:
+    path: /usr/lib/x86_64-linux-gnu/libcuda.so.{{ nvidia_driver_version }}
+  register: _nvidia_libs
+
+- name: Copy NVIDIA installer from Proxmox host to LXC
+  ansible.builtin.copy:
+    src: /tmp/nvidia-580.run
+    dest: /tmp/nvidia.run
+    mode: "0755"
+  when: not _nvidia_libs.stat.exists
+
+- name: Install NVIDIA userspace libraries (no kernel module)
+  ansible.builtin.command:
+    cmd: /tmp/nvidia.run --silent --no-kernel-module --no-drm
+    creates: /usr/lib/x86_64-linux-gnu/libcuda.so.{{ nvidia_driver_version }}
+  when: not _nvidia_libs.stat.exists
+
+# --- Config directories and compose file ---
+
+- name: Create container config directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop: "{{ jellyfin_config_dirs }}"
+
+- name: Create stack directory
+  ansible.builtin.file:
+    path: /opt/jellyfin
+    state: directory
+    mode: "0755"
+
+- name: Deploy docker-compose.yml
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: /opt/jellyfin/docker-compose.yml
+    mode: "0644"
+  notify: Restart jellyfin stack
+
+- name: Deploy systemd service
+  ansible.builtin.template:
+    src: jellyfin-stack.service.j2
+    dest: /etc/systemd/system/jellyfin-stack.service
+    mode: "0644"
+  notify: Restart jellyfin stack
+
+- name: Enable and start jellyfin stack service
+  ansible.builtin.systemd:
+    name: jellyfin-stack
+    enabled: true
+    state: started
+    daemon_reload: true

ansible/roles/jellyfin/templates/docker-compose.yml.j2

@@ -0,0 +1,95 @@
+name: jellyfin
+services:
+  jellyfin:
+    image: jellyfin/jellyfin:{{ jellyfin_version }}
+    container_name: jellyfin
+    runtime: nvidia
+    environment:
+      - NVIDIA_VISIBLE_DEVICES=all
+      - NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
+      - TZ={{ jellyfin_timezone }}
+    volumes:
+      - /containers/jellyfin/config:/config
+      - /media:/media
+    ports:
+      - "8096:8096"
+    restart: unless-stopped
+
+  qbittorrent:
+    image: lscr.io/linuxserver/qbittorrent:{{ qbittorrent_version }}
+    container_name: qbittorrent
+    environment:
+      - PUID={{ jellyfin_puid }}
+      - PGID={{ jellyfin_pgid }}
+      - TZ={{ jellyfin_timezone }}
+      - WEBUI_PORT=5080
+    volumes:
+      - /containers/qbittorrent/config:/config
+      - /media:/downloads
+    ports:
+      - "5080:5080"
+      - "6881:6881"
+      - "6881:6881/udp"
+    restart: unless-stopped
+
+  radarr:
+    image: lscr.io/linuxserver/radarr:{{ radarr_version }}
+    container_name: radarr
+    environment:
+      - PUID={{ jellyfin_puid }}
+      - PGID={{ jellyfin_pgid }}
+      - TZ={{ jellyfin_timezone }}
+    volumes:
+      - /containers/radarr/config:/config
+      - /media:/downloads
+    ports:
+      - "7878:7878"
+    restart: unless-stopped
+
+  sonarr:
+    image: lscr.io/linuxserver/sonarr:{{ sonarr_version }}
+    container_name: sonarr
+    environment:
+      - PUID={{ jellyfin_puid }}
+      - PGID={{ jellyfin_pgid }}
+      - TZ={{ jellyfin_timezone }}
+    volumes:
+      - /containers/sonarr/config:/config
+      - /media:/downloads
+    ports:
+      - "8989:8989"
+    restart: unless-stopped
+
+  prowlarr:
+    image: lscr.io/linuxserver/prowlarr:{{ prowlarr_version }}
+    container_name: prowlarr
+    environment:
+      - PUID={{ jellyfin_puid }}
+      - PGID={{ jellyfin_pgid }}
+      - TZ={{ jellyfin_timezone }}
+    volumes:
+      - /containers/prowlarr/config:/config
+    ports:
+      - "9696:9696"
+    restart: unless-stopped
+
+  flaresolverr:
+    image: ghcr.io/flaresolverr/flaresolverr:{{ flaresolverr_version }}
+    container_name: flaresolverr
+    environment:
+      - LOG_LEVEL=info
+      - TZ={{ jellyfin_timezone }}
+    ports:
+      - "8191:8191"
+    restart: unless-stopped
+
+  jellyseerr:
+    image: ghcr.io/fallenbagel/jellyseerr:{{ jellyseerr_version }}
+    container_name: jellyseerr
+    environment:
+      - TZ={{ jellyfin_timezone }}
+    volumes:
+      - /containers/jellyseerr/config:/app/config
+    ports:
+      - "5055:5055"
+    restart: unless-stopped

ansible/roles/jellyfin/templates/jellyfin-stack.service.j2

@@ -0,0 +1,15 @@
+[Unit]
+Description=Jellyfin media stack
+Requires=docker.service
+After=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory=/opt/jellyfin
+ExecStart=/usr/bin/docker compose up -d --remove-orphans
+ExecStop=/usr/bin/docker compose down
+TimeoutStartSec=300
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/pihole/defaults/main.yml

@@ -8,6 +8,13 @@ pihole_dns_hosts:
   - { ip: "10.10.1.2",   host: "pihole.homelab" }
   - { ip: "10.10.1.3",   host: "traefik.homelab" }
   - { ip: "10.10.1.125", host: "gitea.homelab" }
-  - { ip: "10.10.1.137", host: "grafana.homelab" }
+  - { ip: "10.10.1.3",   host: "grafana.homelab" }
+  - { ip: "10.10.1.3",   host: "proxmox.homelab" }
   - { ip: "10.10.1.3",   host: "adyrem.duckdns.org" }
   - { ip: "10.10.1.3",   host: "mtg.homelab" }
+  - { ip: "10.10.1.3",   host: "jellyfin.homelab" }
+  - { ip: "10.10.1.3",   host: "jellyseerr.homelab" }
+  - { ip: "10.10.1.3",   host: "radarr.homelab" }
+  - { ip: "10.10.1.3",   host: "sonarr.homelab" }
+  - { ip: "10.10.1.3",   host: "prowlarr.homelab" }
+  - { ip: "10.10.1.3",   host: "qbittorrent.homelab" }

ansible/roles/traefik/defaults/main.yml

@@ -25,3 +25,25 @@ traefik_services:
   - name: pihole
     host: "pihole.homelab"
     backend: "http://10.10.1.2:80"
+  - name: jellyfin
+    host: "jellyfin.homelab"
+    backend: "http://10.10.1.50:8096"
+  - name: jellyseerr
+    host: "jellyseerr.homelab"
+    backend: "http://10.10.1.50:5055"
+  - name: radarr
+    host: "radarr.homelab"
+    backend: "http://10.10.1.50:7878"
+  - name: sonarr
+    host: "sonarr.homelab"
+    backend: "http://10.10.1.50:8989"
+  - name: prowlarr
+    host: "prowlarr.homelab"
+    backend: "http://10.10.1.50:9696"
+  - name: qbittorrent
+    host: "qbittorrent.homelab"
+    backend: "http://10.10.1.50:5080"
+  - name: proxmox
+    host: "proxmox.homelab"
+    backend: "https://192.168.1.10:8006"
+    tls_skip_verify: true

ansible/roles/traefik/templates/routes.yml.j2

@@ -6,6 +6,8 @@ http:
       service: {{ svc.name }}
       entryPoints:
         - web
+        - websecure
+      tls: {}
 {% if svc.public_host is defined %}
     {{ svc.name }}-public-redirect:
       rule: "Host(`{{ svc.public_host }}`){% if svc.public_path is defined %} && PathPrefix(`{{ svc.public_path }}`){% endif %}"
@@ -48,4 +50,23 @@ http:
       loadBalancer:
         servers:
           - url: "{{ svc.backend }}"
+{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %}
+        serversTransport: {{ svc.name }}-transport
+{% endif %}
 {% endfor %}
+
+{% set ns = namespace(has_skip_verify=false) %}
+{% for svc in traefik_services %}
+{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %}
+{% set ns.has_skip_verify = true %}
+{% endif %}
+{% endfor %}
+{% if ns.has_skip_verify %}
+  serversTransports:
+{% for svc in traefik_services %}
+{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %}
+    {{ svc.name }}-transport:
+      insecureSkipVerify: true
+{% endif %}
+{% endfor %}
+{% endif %}

homelab-requirements.md

@@ -298,7 +298,88 @@ In the event of full hardware loss, the rebuild order is:
 
 ---
 
-## 10. Out of Scope (for now)
+## 10. Media Stack (Jellyfin)
+
+### Overview
+A self-hosted media server and automation stack running in a dedicated LXC container on `infra-net`. All web UIs are internal-only, accessible via VPN or LAN. Port 6881 (BitTorrent peering) is the only internet-facing port.
+
+### Services
+| Container | Purpose | Port |
+|---|---|---|
+| Jellyfin | Media server / streaming | 8096 |
+| Jellyseerr | Media request UI | 5055 |
+| Radarr | Movie download management | 7878 |
+| Sonarr | TV show download management | 8989 |
+| Prowlarr | Indexer aggregator (feeds Radarr/Sonarr) | 9696 |
+| FlareSolverr | Cloudflare bypass for Prowlarr | 8191 |
+| qBittorrent | Torrent client | 5080 (UI), 6881 (peers) |
+
+### LXC Container
+- **Host:** Proxmox LXC, ID 106
+- **Template:** Debian 12
+- **Mode:** Privileged (required for NVIDIA device passthrough)
+- **Features:** `nesting=1` (required for Docker)
+- **Network:** `vmbr1` (infra-net), static IP `10.10.1.50`
+- **Resources:** 4 CPU cores, 4GB RAM
+- **GPU passthrough:** NVIDIA GTX 1060 via device node bind-mount (not PCIe passthrough)
+  - NVIDIA proprietary driver installed on Proxmox host
+  - Same driver version installed inside the LXC (versions must match exactly)
+  - Device nodes passed into LXC via `lxc.cgroup2.devices.allow`: `/dev/nvidia0`, `/dev/nvidiactl`, `/dev/nvidia-uvm`, `/dev/nvidia-uvm-tools`
+  - `nvidia-container-toolkit` installed inside LXC to enable Docker GPU access
+  - Jellyfin container configured to use NVENC (encoding) and NVDEC (decoding)
+
+### Storage
+- **Media library:** ZFS dataset `hdd/media`, bind-mounted into LXC at `/media`
+  - All containers share this path for downloads and library access
+- **Config state:** `/containers/<service>/config` on LXC root dataset (SSD, rpool)
+  - Directories: `jellyfin`, `qbittorrent`, `radarr`, `sonarr`, `prowlarr`, `flaresolverr`, `jellyseerr`
+
+### Deployment
+- All services run via a single Docker Compose file managed by the `jellyfin` Ansible role
+- Compose file derived from reference stack (`jellyfin-tools` in repo root) with:
+  - Jellyfin container added
+  - Traefik Docker labels removed (Traefik is a standalone LXC, not a Docker container)
+  - Docker `proxy` network removed; services reach each other by container name within Compose
+  - All image tags pinned (no `latest`)
+  - Timezone: `Europe/Zurich`
+- Managed as a systemd service so it starts on LXC boot
+
+### Routing (internal-only)
+All services accessible at `.homelab` hostnames via Traefik (LXC 104, `10.10.1.3`). No public host — reachable via VPN or LAN only.
+
+| Hostname | Backend |
+|---|---|
+| `jellyfin.homelab` | `http://10.10.1.50:8096` |
+| `jellyseerr.homelab` | `http://10.10.1.50:5055` |
+| `radarr.homelab` | `http://10.10.1.50:7878` |
+| `sonarr.homelab` | `http://10.10.1.50:8989` |
+| `prowlarr.homelab` | `http://10.10.1.50:9696` |
+| `qbittorrent.homelab` | `http://10.10.1.50:5080` |
+
+FlareSolverr has no web UI worth routing; Prowlarr reaches it by container name internally.
+
+### DNS
+Pi-hole A records: all 6 routed hostnames → `10.10.1.3` (Traefik).
+
+### Port 6881 (BitTorrent Peering)
+- **Proxmox DNAT** (in `proxmox/network-interfaces`): TCP+UDP 6881 on `192.168.1.10` → `10.10.1.50:6881`
+- **Manual step:** Home router port-forward: 6881 TCP+UDP → `192.168.1.10`
+- qBittorrent web UI (5080) remains internal-only
+
+### Ansible
+- New role: `jellyfin` — installs Docker, creates config dirs, deploys Compose file, enables systemd service
+- New playbook: `jellyfin.yml` — targets the media LXC
+- Media LXC added to inventory; included in `site.yml` for common/node_exporter/promtail roles
+
+### NVIDIA Driver Notes
+- Driver version on host and in LXC must be identical — this is a hard requirement for NVIDIA device passthrough
+- The LXC does **not** need the full NVIDIA driver package (kernel modules already loaded on host); it only needs the userspace libraries (`nvidia-utils` / `libnvidia-compute`)
+- `nvidia-smi` inside the LXC is the verification step after setup
+- If a Proxmox host kernel update bumps the NVIDIA driver, the LXC libraries must be updated to match before Jellyfin transcoding will work again
+
+---
+
+## 11. Out of Scope (for now)
 
 - External/cloud backups (architecture must not preclude adding later)
 - Additional VM distros beyond those listed — template mechanism should make adding easy

jellyfin-tools

@@ -0,0 +1,132 @@
+name: jellyfin-tools
+services:
+  qbittorrent:
+    container_name: qbittorrent
+    image: lscr.io/linuxserver/qbittorrent:5.1.4
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.qbittorrent.rule=Host(`bittorrent.home.sjaun.ch`)"
+      - "traefik.http.services.qbittorrent.loadbalancer.server.port=5080"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Zurich
+      - WEBUI_PORT=5080
+    volumes:
+      - /containers/qbittorrent/config:/config
+      - /media:/downloads
+    ports:
+      - 5080:5080
+      - 6881:6881
+      - 6881:6881/udp
+    restart: "unless-stopped"
+
+  radarr:
+    container_name: radarr
+    image: lscr.io/linuxserver/radarr:6.0.4
+    networks:
+      - proxy    
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.radarr.rule=Host(`radarr.home.sjaun.ch`)"
+      - "traefik.http.services.radarr.loadbalancer.server.port=7878"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Zurich
+    ports:
+      - 7878:7878
+    volumes:
+      - /containers/radarr/config:/config
+      - /media:/downloads
+    restart: "unless-stopped"
+
+  sonarr:
+    image: linuxserver/sonarr:4.0.16
+    container_name: sonarr
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.sonarr.rule=Host(`sonarr.home.sjaun.ch`)"
+      - "traefik.http.services.sonarr.loadbalancer.server.port=8989"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Zurich
+    volumes:
+      - /containers/sonarr/config:/config
+      - /media:/downloads
+    ports:
+      - 8989:8989
+    restart: unless-stopped
+
+  prowlarr:
+    container_name: prowlarr
+    image: linuxserver/prowlarr:2.3.0
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.prowlarr.rule=Host(`prowlarr.home.sjaun.ch`)"
+      - "traefik.http.services.prowlarr.loadbalancer.server.port=9696"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Zurich
+    volumes:
+      - /containers/prowlarr/config:/config
+    ports:
+      - 9696:9696
+    restart: unless-stopped
+
+  flaresolverr:
+    # DockerHub mirror flaresolverr/flaresolverr:latest
+    image: ghcr.io/flaresolverr/flaresolverr:latest
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.flaresolverr.rule=Host(`flaresolverr.home.sjaun.ch`)"
+      - "traefik.http.services.flaresolverr.loadbalancer.server.port=8191"
+    container_name: flaresolverr
+    environment:
+      - LOG_LEVEL=${LOG_LEVEL:-info}
+      - LOG_FILE=${LOG_FILE:-none}
+      - LOG_HTML=${LOG_HTML:-false}
+      - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none}
+      - TZ=Europe/Zurich
+    ports:
+      - "${PORT:-8191}:8191"
+    volumes:
+      - /containers/flaresolver/config:/config
+    restart: unless-stopped
+
+  jellyseerr:
+    image: ghcr.io/fallenbagel/jellyseerr:latest
+    init: true
+    container_name: jellyseerr
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.jellyseerr.rule=Host(`jellyseerr.home.sjaun.ch`)"
+      - "traefik.http.services.jellyseerr.loadbalancer.server.port=5055"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Zurich
+    volumes:
+      - /containers/jellyseerr/config:/app/config
+    healthcheck:
+      test: wget --no-verbose --tries=1 --spider http://localhost:5055/api/v1/status || exit 1
+      start_period: 20s
+      timeout: 3s
+      interval: 15s
+      retries: 3
+    restart: unless-stopped
+networks:
+  proxy:
+    external: true

proxmox/network-interfaces

@@ -10,6 +10,10 @@ iface vmbr0 inet static
 	bridge-ports nic0
 	bridge-stp off
 	bridge-fd 0
+	post-up   iptables -t nat -A PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 6881 -j DNAT --to-destination 10.10.1.50:6881
+	post-up   iptables -t nat -A PREROUTING -i vmbr0 -d 192.168.1.10 -p udp --dport 6881 -j DNAT --to-destination 10.10.1.50:6881
+	post-down iptables -t nat -D PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 6881 -j DNAT --to-destination 10.10.1.50:6881
+	post-down iptables -t nat -D PREROUTING -i vmbr0 -d 192.168.1.10 -p udp --dport 6881 -j DNAT --to-destination 10.10.1.50:6881
 	post-up   iptables -t nat -A PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 80  -j DNAT --to-destination 10.10.1.3:80
 	post-up   iptables -t nat -A PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 443 -j DNAT --to-destination 10.10.1.3:443
 	post-down iptables -t nat -D PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 80  -j DNAT --to-destination 10.10.1.3:80