f5cd320433
Initial documentation of the hubris Proxmox homelab as a cross-linked markdown wiki. Per-node pages, cross-cutting infrastructure pages, an investigation log, and an operations cheatsheet. Each node and topic ends with a Changelog section so changes can be tracked in-place going forward. Refreshed against live state on 2026-04-28 — 14 active LXCs (109 syncthing currently stopped) + 1 VM (108 haos). Reflects post-A/B-test state of the 2026-04-21 hubris crash-loop investigation.
112 lines
6.7 KiB
Markdown
112 lines
6.7 KiB
Markdown
# 122 — `arriman`
|
|
|
|
Docker host running the \*arr stack via [`ezarr`](https://github.com/ezarr/ezarr) compose. Replaced the old yunohost-based [LXC 100](index.md#recently-destroyed-kept-for-archaeology) on 2026-04-21.
|
|
|
|
## At a glance
|
|
- **Hostname:** `arriman`
|
|
- **IP:** `192.168.8.132`
|
|
- **Privilege:** privileged
|
|
- **Resources:** 4 cores / 8 GiB RAM / 24 GiB rootfs
|
|
- **Mounts:** `/mnt/library` ↔ `/mnt/library`
|
|
- **Public hostnames:** `jellyseerr` / `qbit` / `sab` (see below)
|
|
|
|
## Compose
|
|
|
|
`/home/arr/ezarr/docker-compose.yml`. Network `ezarr_default` `172.18.0.0/16`. Service users all run with primary GID 10000 (host `media` group) inside their containers — see [media permissions](../infrastructure/media-permissions.md). Per-app `/config/<app>-config/` dirs bind to `/config` inside.
|
|
|
|
`.env` contents:
|
|
- `DOWNLOADS_DIR=/mnt/library/downloads/`
|
|
- `MEDIA_DIR=/mnt/library/`
|
|
- `MEDIACENTER_GID=10000` ← **must be 10000, not 13000.** s6-setuidgid only honors the primary PGID; `group_add:` doesn't propagate. Without this, qBit errors every torrent with "Permission denied".
|
|
- `SONARR_UID=13001`, `RADARR_UID=13002`, `LIDARR_UID=13003`, `PROWLARR_UID=13006`, `JELLYSEERR_UID=13012`, `BAZARR_UID=13013`, `QBITTORRENT_UID`, `SABNZBD_UID`
|
|
|
|
## Service / port map
|
|
|
|
| Service | Host:Container | Public hostname |
|
|
| ------------- | -------------- | ------------------------------------ |
|
|
| sonarr | `8989:8989` | direct only |
|
|
| radarr | `7878:7878` | direct only |
|
|
| lidarr | `8686:8686` | direct only |
|
|
| prowlarr | `9696:9696` | direct only |
|
|
| bazarr | `6767:6767` | direct only |
|
|
| jellyseerr | `5056:5055` | [`jellyseerr.hubris.network`](../infrastructure/dns.md) |
|
|
| qbittorrent | `8080:8080` | [`qbit.hubris.network`](../infrastructure/dns.md) |
|
|
| sabnzbd | `8081:8080` | [`sab.hubris.network`](../infrastructure/dns.md) |
|
|
| flaresolverr | `8191:8191` | internal only |
|
|
|
|
Internal *arr ↔ *arr / *arr ↔ qBit/SAB/flaresolverr comms run on `ezarr_default` using docker service names.
|
|
|
|
## Categories (qBit + SAB + *arr)
|
|
|
|
| Category | qBit savePath | SAB dir | Consumer |
|
|
| -------- | --------------------------- | ------- | --------------------------------- |
|
|
| tv | `/data/torrents/tv` | tv | Sonarr |
|
|
| movies | `/data/torrents/movies` | movies | Radarr |
|
|
| music | `/data/torrents/music` | music | Lidarr |
|
|
| anime | `/data/torrents/anime` | anime | Sonarr (2nd download client, root `/data/media/anime`) |
|
|
| books / audiobooks / comics / podcasts | `/data/torrents/<cat>` | `<cat>` | (reserved, none in use yet) |
|
|
|
|
Path mapping: host `/mnt/library/<cat>` ↔ container `/data/media/<cat>`. Downloads: host `/mnt/library/downloads/<torrents|usenet>/<cat>` ↔ container `/data/torrents/<cat>` and `/data/usenet/<cat>`.
|
|
|
|
## Auth (qBit reverse-proxy + Authentik forward-auth)
|
|
|
|
qBit auto-login behind forward-auth via IP whitelist. `qBittorrent.conf` lines:
|
|
- `WebUI\AuthSubnetWhitelist=172.18.0.0/16, 172.17.0.0/16, 192.168.8.175/32`
|
|
- `WebUI\ReverseProxySupportEnabled=true`
|
|
- `WebUI\TrustedReverseProxiesList=192.168.8.175, 172.18.0.0/16`
|
|
|
|
> **Stop the container before editing `qBittorrent.conf`.** qBit writes its in-memory config on graceful shutdown and clobbers any live edits. Recipe: `docker stop qbittorrent && sed -i ... && docker start qbittorrent`.
|
|
|
|
Mobile/desktop clients keep working via `/api/v2/*` path bypass on Caddy.
|
|
|
|
SABnzbd `host_whitelist`: `sabnzbd, localhost, 127.0.0.1, 192.168.8.132, sab.hubris.network` — extend before accessing SAB from a new host.
|
|
|
|
## Credentials
|
|
|
|
Backups of all migration-time secrets at `/mnt/library/backup/arr-migration-2026-04-21/state/`:
|
|
- `lxc100-apikey-{sonarr,radarr,prowlarr,lidarr}.txt`
|
|
- `qbit-creds.txt`, `sab-creds.txt`
|
|
- `lxc100-jellyseerr-settings.json`
|
|
|
|
\*arr API keys were preserved from the yunohost DB — don't rotate unless needed.
|
|
|
|
qBittorrent: `admin` / `CDyjxMKvjfGupCKzXFkjsKw4nRrXMRL`.
|
|
|
|
## Migration gotchas (apply if ever re-importing)
|
|
|
|
- Imported \*arr `config.xml`: must have `<BindAddress>*</BindAddress>`, `<Port>{ezarr-port}</Port>`, `<UrlBase></UrlBase>`. Otherwise app listens only on 127.0.0.1, wrong port, wrong path.
|
|
- Imported DB paths must be rewritten `/mnt/library/` → `/data/media/` (RootFolders / Series / Movies / Artists tables). Without this, scans and imports fail silently.
|
|
- Bazarr `config/config.yaml` (yaml, not ini) — `ip: 0.0.0.0`, `port: 6767`, empty top-level `base_url`; sonarr/radarr connection sections normalized to docker service names.
|
|
- Staging dir for migrations: `/mnt/library/backup/stage/<app>/` (visible to both old LXC 100 and arriman because both bind-mount the same host path).
|
|
|
|
## Permissions
|
|
|
|
Member of [media GID 10000](../infrastructure/media-permissions.md). The LXC has `www-data, audiobookshelf, radarr, sonarr, lidarr, prowlarr, qbittorrent, bazarr, jellyseerr, mylar, jackett, overseerr, plex, arr` in the `media` group. Each docker container also receives GID 10000 as its primary group via `MEDIACENTER_GID=10000`.
|
|
|
|
## Rollback material (kept until 2026-04-28+)
|
|
|
|
`/mnt/library/backup/arr-migration-2026-04-21/`:
|
|
- `tars/` — per-subtree tars of yunohost app data (granular restore)
|
|
- `snapshots/` — vzdumps of LXC 100 (pre-migration) and LXC 122 (pre-import), plus post-stop vzdumps of LXC 100 + 106
|
|
- `stage/<app>-preimport.tar.gz` — original empty ezarr `/config/<app>-config/` dirs
|
|
- `state/` — service dumps, listening ports, API keys, jellyseerr settings at migration time
|
|
- `DESTROY_AFTER_2026-04-28.md` — destroy checklist + post-destroy restore commands
|
|
|
|
## Related
|
|
- [Caddy (121)](121-caddy.md)
|
|
- [Authentik (124)](124-authentik.md) — forward-auth wiring + per-app `/api/*` bypass
|
|
- [DNS](../infrastructure/dns.md)
|
|
- [Media permissions](../infrastructure/media-permissions.md)
|
|
- [Hubris host](../hosts/hubris.md)
|
|
|
|
## Changelog
|
|
|
|
### 2026-04-28 — wiki entry created
|
|
Initial documentation.
|
|
|
|
### 2026-04-26 — `MEDIACENTER_GID` flipped 13000 → 10000
|
|
qBit was erroring every torrent with "Permission denied" because s6-setuidgid only honors the primary PGID and `group_add:` doesn't propagate. Setting the primary GID to 10000 (the host `media` group) fixed it.
|
|
|
|
### 2026-04-21 — \*arr stack migrated yunohost → docker-compose
|
|
Old LXC 100 stopped; ezarr stack stood up here; data and DBs imported with path rewrites. flaresolverr folded in from old LXC 106. Three Caddy sites added (jellyseerr, qbit, sab) → see [caddy](121-caddy.md). Rollback artifacts under `/mnt/library/backup/arr-migration-2026-04-21/`.
|