docker-compose.arr-stack.yml

#########################
# Centralized Volumes   #
#########################
volumes:
  qbittorrent-config:
  sabnzbd-config:
  sonarr-config:
  prowlarr-config:
  radarr-config:
  jellyfin-config:
  jellyfin-cache:
  seerr-config:
  bazarr-config:
  shelfmark-config:
  audiobookshelf-config:
  audiobookshelf-metadata:
  tailscale-state:

#########################
# Networks              #
#########################
networks:
  arr-stack:
    name: arr-stack
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24
          ip_range: 172.20.0.128/25
          gateway: 172.20.0.1

#########################
# Logging               #
#########################
x-logging: &default-logging
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "3"

# LinuxServer.io images use s6-overlay which needs CHOWN/SETUID/SETGID/DAC_OVERRIDE
# to switch users during init.
x-security-lsio: &lsio-security
  security_opt:
    - no-new-privileges:true
  cap_drop:
    - ALL
  cap_add:
    - CHOWN
    - SETUID
    - SETGID
    - DAC_OVERRIDE

#########################
# Services              #
#########################
services:
  # ═══════════════════════════════════════════════════════════════════════════
  # DIRS-INIT - One-shot busybox container that ensures the expected /data
  # directory layout exists before the stack starts using it.
  # ═══════════════════════════════════════════════════════════════════════════
  dirs-init:
    image: busybox:latest
    container_name: dirs-init
    restart: "no"
    user: "0:0"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
    command: >
      sh -c "mkdir -p /data/media/audiobooks /data/media/ebooks /data/download /data/transcodes &&
             chown -R $${PUID}:$${PGID} /data/media /data/download /data/transcodes &&
             find /data/media /data/download /data/transcodes -type d -exec chmod 755 {} + &&
             echo 'Ensured /data layout (owner $${PUID}:$${PGID}):' &&
             ls -ld /data/media /data/media/audiobooks /data/media/ebooks /data/download /data/transcodes"
    volumes:
      - ${MEDIA_ROOT:-/data}:/data
    networks:
      - arr-stack

  # ═══════════════════════════════════════════════════════════════════════════
  # QBITTORRENT - Torrent download client.
  # Access: 172.20.0.17:8085 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    <<: *lsio-security
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
      - WEBUI_PORT=8085
      - WEBUI_USERNAME=${QBIT_USERNAME:-admin}
      - WEBUI_PASSWORD=${QBIT_PASSWORD:-adminadmin}
      - DOCKER_MODS=ghcr.io/vuetorrent/vuetorrent-lsio-mod:latest
    volumes:
      - qbittorrent-config:/config
      - ${MEDIA_ROOT:-/data}:/data
    networks:
      arr-stack:
        ipv4_address: 172.20.0.17
    restart: always
    logging: *default-logging
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8085/"]
      interval: 2m
      timeout: 15s
      retries: 4
      start_period: 60s

  # ═══════════════════════════════════════════════════════════════════════════
  # SABNZBD - Usenet download client.
  # Access: 172.20.0.18:8080 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  sabnzbd:
    image: lscr.io/linuxserver/sabnzbd:latest
    container_name: sabnzbd
    <<: *lsio-security
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    volumes:
      - sabnzbd-config:/config
      - ${MEDIA_ROOT:-/data}:/data
    networks:
      arr-stack:
        ipv4_address: 172.20.0.18
    restart: always
    logging: *default-logging
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8080/"]
      interval: 3m
      timeout: 15s
      retries: 4
      start_period: 60s

  # ═══════════════════════════════════════════════════════════════════════════
  # SONARR - TV show monitor. Watches for new episodes and sends to download.
  # Access: 172.20.0.10:8989 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    <<: *lsio-security
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    networks:
      arr-stack:
        ipv4_address: 172.20.0.10
    volumes:
      - sonarr-config:/config
      - ${MEDIA_ROOT:-/data}:/data
    restart: always
    logging: *default-logging
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8989/"]
      interval: 2m
      timeout: 15s
      retries: 3
      start_period: 60s

  # ═══════════════════════════════════════════════════════════════════════════
  # PROWLARR - Indexer manager. Finds download sources for Sonarr/Radarr.
  # Access: 172.20.0.19:9696 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    <<: *lsio-security
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    volumes:
      - prowlarr-config:/config
    networks:
      arr-stack:
        ipv4_address: 172.20.0.19
    restart: always
    logging: *default-logging
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:9696/"]
      interval: 2m
      timeout: 15s
      retries: 3
      start_period: 60s

  # ═══════════════════════════════════════════════════════════════════════════
  # RADARR - Movie monitor. Watches for new movies and sends to download.
  # Access: 172.20.0.11:7878 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    <<: *lsio-security
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    networks:
      arr-stack:
        ipv4_address: 172.20.0.11
    volumes:
      - radarr-config:/config
      - ${MEDIA_ROOT:-/data}:/data
    restart: always
    logging: *default-logging
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:7878/"]
      interval: 2m
      timeout: 15s
      retries: 3
      start_period: 60s

  # ═══════════════════════════════════════════════════════════════════════════
  # AUDIOBOOKSHELF - Audiobook server (progress sync, mobile apps, chapters).
  # Ebooks are handled by Jellyfin; this is for audiobooks only.
  # Access: 172.20.0.12:80 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  audiobookshelf:
    image: advplyr/audiobookshelf:latest
    container_name: audiobookshelf
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    volumes:
      - audiobookshelf-config:/config
      - audiobookshelf-metadata:/metadata
      - ${MEDIA_ROOT:-/data}/media/audiobooks:/audiobooks
      - ${MEDIA_ROOT:-/data}/media/ebooks:/ebooks
    networks:
      arr-stack:
        ipv4_address: 172.20.0.12
    restart: always
    logging: *default-logging

  # ═══════════════════════════════════════════════════════════════════════════
  # JELLYFIN - Media server. Stream your movies and TV shows like Netflix.
  # Access: 172.20.0.4:8096 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    environment:
      - TZ=${TZ:-UTC}
    volumes:
      - jellyfin-config:/config
      - jellyfin-cache:/cache
      - ${MEDIA_ROOT:-/data}/media:/data/media
      - /data/transcodes:/transcodes
    networks:
      arr-stack:
        ipv4_address: 172.20.0.4
    restart: always
    logging: *default-logging
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8096/health"]
      interval: 1m
      timeout: 30s
      retries: 2
      start_period: 30s

  # ═══════════════════════════════════════════════════════════════════════════
  # SEERR (formerly Jellyseerr) - Request portal. Users request movies/shows here.
  # Access: 172.20.0.8:5055 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  seerr:
    image: ghcr.io/seerr-team/seerr:latest
    init: true
    container_name: seerr
    environment:
      - LOG_LEVEL=info
      - TZ=${TZ:-UTC}
      - PORT=5055
    networks:
      arr-stack:
        ipv4_address: 172.20.0.8
    volumes:
      - seerr-config:/app/config
    restart: always
    logging: *default-logging
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:5055/api/v1/status",
        ]
      interval: 2m
      timeout: 10s
      retries: 3
      start_period: 20s

  # ═══════════════════════════════════════════════════════════════════════════
  # BAZARR - Subtitle manager. Automatically downloads subtitles.
  # Access: 172.20.0.9:6767 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  bazarr:
    image: lscr.io/linuxserver/bazarr:latest
    container_name: bazarr
    <<: *lsio-security
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    networks:
      arr-stack:
        ipv4_address: 172.20.0.9
    volumes:
      - bazarr-config:/config
      - ${MEDIA_ROOT:-/data}/media:/data/media
    restart: always
    logging: *default-logging
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:6767/"]
      interval: 3m
      timeout: 10s
      retries: 2
      start_period: 60s

  # ═══════════════════════════════════════════════════════════════════════════
  # SHELFMARK - Self-hosted book & audiobook search/request hub.
  # Ebooks -> /ebooks (INGEST_DIR), audiobooks -> /audiobooks (DESTINATION_AUDIOBOOK).
  # Point the ebook volume at your CWA/Grimmory ingest folder for auto-import.
  # Access: 172.20.0.13:8084 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  shelfmark:
    image: ghcr.io/calibrain/shelfmark:latest
    container_name: shelfmark
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
      - FLASK_PORT=8084
      - INGEST_DIR=/ebooks
      - DESTINATION_AUDIOBOOK=/audiobooks
      - SEARCH_MODE=universal
    volumes:
      - shelfmark-config:/config
      - ${MEDIA_ROOT:-/data}/media/ebooks:/ebooks
      - ${MEDIA_ROOT:-/data}/media/audiobooks:/audiobooks
      - ${MEDIA_ROOT:-/data}/download:/data/download
    networks:
      arr-stack:
        ipv4_address: 172.20.0.13
    restart: always
    logging: *default-logging
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8084/api/health"]
      interval: 2m
      timeout: 15s
      retries: 3
      start_period: 60s

  # ═══════════════════════════════════════════════════════════════════════════
  # HOMER - Dashboard. Static YAML config, no backend.
  # Access: 172.20.0.30:8080 (via Tailscale)
  # ═══════════════════════════════════════════════════════════════════════════
  homer:
    image: b4bz/homer:latest
    container_name: homer
    user: "${PUID:-1000}:${PGID:-1000}"
    volumes:
      - ./config/homer:/www/assets
    networks:
      arr-stack:
        ipv4_address: 172.20.0.30
    restart: always
    logging: *default-logging

  # ═══════════════════════════════════════════════════════════════════════════
  # FLARESOLVERR - Cloudflare challenge solver. Helps Prowlarr access
  # Cloudflare-protected indexer sites. No web UI. Used internally by Prowlarr.
  # ═══════════════════════════════════════════════════════════════════════════
  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    environment:
      - LOG_LEVEL=info
      - TZ=${TZ:-UTC}
    networks:
      arr-stack:
        ipv4_address: 172.20.0.21
    restart: always
    logging: *default-logging
    healthcheck:
      test:
        [
          "CMD",
          "curl",
          "-sf",
          "-X",
          "POST",
          "-H",
          "Content-Type: application/json",
          "-d",
          '{"cmd":"request.get","url":"http://localhost:8191/","maxTimeout":30000}',
          "http://localhost:8191/v1",
        ]
      interval: 10m
      timeout: 60s
      retries: 2
      start_period: 60s

  # ═══════════════════════════════════════════════════════════════════════════
  # TAILSCALE - Private remote access to the internal Docker network.
  # Connects to your Tailscale tailnet so authorised devices can reach
  # containers by internal Docker IPs without any externally-exposed ports.
  # Access: Connect to tailnet, then browse to e.g. http://172.20.0.10:8989
  # ═══════════════════════════════════════════════════════════════════════════
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale
    hostname: ${TS_HOSTNAME:-arr-stack-nas}
    networks:
      arr-stack:
        ipv4_address: 172.20.0.100
    cap_add:
      - NET_ADMIN
      - NET_RAW
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - tailscale-state:/var/lib/tailscale
    environment:
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=false
      - TS_ACCEPT_DNS=false
      - TS_AUTHKEY=${TS_AUTHKEY:-}
      - TS_EXTRA_ARGS=--advertise-routes=${LAN_SUBNET:-10.10.0.0/24},172.20.0.0/24 --accept-routes
    healthcheck:
      test: ["CMD", "tailscale", "status", "--peers=false"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # ═══════════════════════════════════════════════════════════════════════════
  # CONFIGURATOR - One-shot setup. Creates media dirs and configures services.
  # Run: docker compose --profile setup up configurator
  # ═══════════════════════════════════════════════════════════════════════════
  configurator:
    build: ./configurator
    container_name: configurator
    profiles: ["setup"]
    environment:
      - QBIT_USERNAME=${QBIT_USERNAME:-admin}
      - QBIT_PASSWORD=${QBIT_PASSWORD:-adminadmin}
    volumes:
      - ${MEDIA_ROOT:-/data}/media:/data/media
      - sonarr-config:/config/sonarr
      - radarr-config:/config/radarr
      - prowlarr-config:/config/prowlarr
      - bazarr-config:/config/bazarr
    networks:
      - arr-stack
    depends_on:
      sonarr:
        condition: service_healthy
      radarr:
        condition: service_healthy
      prowlarr:
        condition: service_healthy
      qbittorrent:
        condition: service_healthy
    restart: "no"
    logging: *default-logging