docker-compose.yml

services:
  gluetun:
    image: qmcgaw/gluetun@sha256:495cdc65ace4c110cf4de3d1f5f90e8a1dd2eb0f8b67151d1ad6101b2a02a476
    container_name: gluetun
    # Grants network admin capabilities needed for VPN tunnel management
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    env_file:
      - ./.env
    environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - SERVER_COUNTRIES=United States
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_PROVIDER=protonvpn
      - VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":{{PORT}},\"current_network_interface\":\"{{VPN_INTERFACE}}\",\"random_port\":false,\"upnp\":false}" http://127.0.0.1:8080/api/v2/app/setPreferences 2>&1'
      - VPN_PORT_FORWARDING_DOWN_COMMAND=/bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":0,\"current_network_interface\":\"lo\"}" http://127.0.0.1:8080/api/v2/app/setPreferences 2>&1'
      - TZ=${TIMEZONE:-America/New_York}
    ports:
      - 127.0.0.1:8080:8080    # qbittorrent webui
    restart: unless-stopped

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent@sha256:065792d2b11f0facff340210fc1cf13623b029a94ecdf08b02d06d922205f618
    container_name: qbittorrent
    network_mode: "service:gluetun"
    depends_on:
      - gluetun
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
      - WEBUI_PORT=8080
    volumes:
      - ${MEDIA_DIR}/config/qbittorrent:/config
      - ${MEDIA_DIR}/Downloads:/downloads
      - ${MEDIA_DIR}/Movies:/movies
      - ${MEDIA_DIR}/TV Shows:/tv
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  prowlarr:
    image: lscr.io/linuxserver/prowlarr@sha256:e74a1e093dcc223d671d4b7061e2b4946f1989a4d3059654ff4e623b731c9134
    container_name: prowlarr
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
    volumes:
      - ${MEDIA_DIR}/config/prowlarr:/config
    ports:
      - 127.0.0.1:9696:9696
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:9696/ping || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  sonarr:
    image: lscr.io/linuxserver/sonarr@sha256:37be832b78548e3f55f69c45b50e3b14d18df1b6def2a4994258217e67efb1a1
    container_name: sonarr
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
    volumes:
      - ${MEDIA_DIR}/config/sonarr:/config
      - ${MEDIA_DIR}/TV Shows:/tv
      - ${MEDIA_DIR}/Downloads:/downloads
    ports:
      - 127.0.0.1:8989:8989
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8989/ping || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  radarr:
    image: lscr.io/linuxserver/radarr@sha256:6d3e68474ea146f995af98d3fb2cb1a14e2e4457ddaf035aa5426889e2f9249c
    container_name: radarr
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
    volumes:
      - ${MEDIA_DIR}/config/radarr:/config
      - ${MEDIA_DIR}/Movies:/movies
      - ${MEDIA_DIR}/Downloads:/downloads
    ports:
      - 127.0.0.1:7878:7878
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:7878/ping || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  bazarr:
    image: lscr.io/linuxserver/bazarr@sha256:1cf40186b1bc35bec87f4e4892d5d8c06086da331010be03e3459a86869c5e74
    container_name: bazarr
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
    volumes:
      - ${MEDIA_DIR}/config/bazarr:/config
      - ${MEDIA_DIR}/Movies:/movies
      - ${MEDIA_DIR}/TV Shows:/tv
    ports:
      - 127.0.0.1:6767:6767
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:6767/ping || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr@sha256:7962759d99d7e125e108e0f5e7f3cdbcd36161776d058d1d9b7153b92ef1af9e
    container_name: flaresolverr
    environment:
      - LOG_LEVEL=info
      - LOG_HTML=false
      - TZ=${TIMEZONE:-America/New_York}
    ports:
      - 127.0.0.1:8191:8191
    restart: unless-stopped

  seerr:
    image: ghcr.io/seerr-team/seerr@sha256:1b5fc1ea825631d9d165364472663b817a4c58ef6aa1013f58d82c1570d7c866
    container_name: seerr
    init: true
    environment:
      - TZ=${TIMEZONE:-America/New_York}
    volumes:
      - ${MEDIA_DIR}/config/seerr:/app/config
    ports:
      - ${SEERR_BIND_IP:-127.0.0.1}:5055:5055
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:5055/api/v1/status || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  tdarr:
    image: ghcr.io/haveagitgat/tdarr@sha256:20a5656c4af4854e1877046294f77113f949d27e35940a9a65f231423d063207
    container_name: tdarr
    # Optional fallback mode. Native Tdarr is the default on macOS.
    profiles: ["tdarr-docker"]
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
      - serverIP=0.0.0.0
      - serverPort=8266
      - webUIPort=8265
      - internalNode=true
      - inContainer=true
    volumes:
      - ${MEDIA_DIR}/config/tdarr/server:/app/server
      - ${MEDIA_DIR}/config/tdarr/configs:/app/configs
      - ${MEDIA_DIR}/config/tdarr/logs:/app/logs
      - ${MEDIA_DIR}/Movies:/movies
      - ${MEDIA_DIR}/TV Shows:/tv
      - ${MEDIA_DIR}/tdarr-transcode-cache:/temp
    ports:
      - 127.0.0.1:8265:8265
      - 127.0.0.1:8266:8266
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8265 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 8G
    restart: unless-stopped

  unpackerr:
    image: ghcr.io/unpackerr/unpackerr@sha256:dc72256942ce50d1c8a1aeb5aa85b6ae2680a36eefd2182129d8d210fce78044
    container_name: unpackerr
    env_file:
      - ./.env
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
      - UN_SONARR_0_URL=http://sonarr:8989
      - UN_SONARR_0_PATHS_0=/downloads
      - UN_RADARR_0_URL=http://radarr:7878
      - UN_RADARR_0_PATHS_0=/downloads
    volumes:
      - ${MEDIA_DIR}/Downloads:/downloads
    restart: unless-stopped

  kometa:
    image: kometateam/kometa@sha256:46fc4bdd6f64dbd92655c6495d9f9d1a745845bd60fa13a7283755db48de8bc0
    container_name: kometa
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
      - KOMETA_RUN=true
      - KOMETA_TIME=04:00
    volumes:
      - ${MEDIA_DIR}/config/kometa:/config
    restart: "no"

  recyclarr:
    image: ghcr.io/recyclarr/recyclarr@sha256:30e13877e8ef2242b053b986e69e64801797b39ae4f74b744d8f4dc3f98757ab
    container_name: recyclarr
    environment:
      - TZ=${TIMEZONE:-America/New_York}
      - CRON_SCHEDULE=0 3 * * *
    volumes:
      - ${MEDIA_DIR}/config/recyclarr:/config
    restart: unless-stopped

  jellyfin:
    image: lscr.io/linuxserver/jellyfin@sha256:4ee07757abcaa0b74fbc74179392311dc2874c03b0bef04bc2d79e9e1a875793
    container_name: jellyfin
    profiles: ["jellyfin"]
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
    volumes:
      - ${MEDIA_DIR}/config/jellyfin:/config
      - ${MEDIA_DIR}/Movies:/data/movies
      - ${MEDIA_DIR}/TV Shows:/data/tvshows
    ports:
      - 127.0.0.1:8096:8096
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8096/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  jellystat-db:
    image: postgres@sha256:1090bc3a8ccfb0b55f78a494d76f8d603434f7e4553543d6e807bc7bd6bbd17f
    container_name: jellystat-db
    profiles: ["jellyfin"]
    environment:
      - POSTGRES_DB=jfstat
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=${JELLYSTAT_DB_PASSWORD}
    volumes:
      - ${MEDIA_DIR}/config/jellystat/db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  jellystat:
    image: cyfershepard/jellystat@sha256:c8c451704ba7985340142cd047e2364cabaf41b613669b6c5340688ed217f82a
    container_name: jellystat
    profiles: ["jellyfin"]
    depends_on:
      jellystat-db:
        condition: service_healthy
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=${JELLYSTAT_DB_PASSWORD}
      - POSTGRES_IP=jellystat-db
      - POSTGRES_PORT=5432
      - JWT_SECRET=${JELLYSTAT_JWT_SECRET}
      - TZ=${TIMEZONE:-America/New_York}
    volumes:
      - ${MEDIA_DIR}/config/jellystat/backup:/app/backend/backup-data
    ports:
      - 127.0.0.1:3000:3000
    restart: unless-stopped

  # ─── Optional: Music (Lidarr + Tidarr) ───
  # Uncomment to add music management. Run: bash scripts/setup-music.sh first.

  lidarr:
    image: lscr.io/linuxserver/lidarr@sha256:37a3df74f4c2a6f10eead66f4d8034362ebf2866f935026b4a71dd888b9e7f08
    container_name: lidarr
    profiles: ["music"]
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
    volumes:
      - ${MEDIA_DIR}/config/lidarr:/config
      - ${MEDIA_DIR}/Music:/music
      - ${MEDIA_DIR}/Downloads:/downloads
      - ${MEDIA_DIR}/Downloads/tidarr:/downloads/tidarr
    ports:
      - 127.0.0.1:8686:8686
    restart: unless-stopped

  tidarr:
    image: cstaelen/tidarr@sha256:79a2c62aed04dbe9770272443192eae145f26bdc2d188e665b13ab763341206c
    container_name: tidarr
    profiles: ["music"]
    environment:
      - PUID=${PUID:-501}
      - PGID=${PGID:-20}
      - TZ=${TIMEZONE:-America/New_York}
    volumes:
      - ${MEDIA_DIR}/config/tidarr:/shared
      - ${MEDIA_DIR}/Downloads/tidarr:/shared/nzb_downloads
      - ${MEDIA_DIR}/Music:/music
      - ${MEDIA_DIR}/Downloads:/downloads
    ports:
      - 127.0.0.1:8484:8484
    restart: unless-stopped

  watchtower:
    image: containrrr/watchtower@sha256:6dd50763bbd632a83cb154d5451700530d1e44200b268a4e9488fefdfcf2b038
    container_name: watchtower
    profiles: ["autoupdate"]
    environment:
      - TZ=${TIMEZONE:-America/New_York}
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_SCHEDULE=0 0 4 * * *
    volumes:
      # Allows Watchtower to manage Docker containers
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped