Damien/infra-scripts
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'Remove seedbox infrastructure' (#7) from clean/seedbox into main

Browse Source 
Reviewed-on: #7
This commit was merged in pull request #7.
This commit is contained in:
Damien Arnodo
2026-05-26 16:57:31 +00:00
parent 007cbf5f4d 1df3da81d7
commit 0def84a494
16 changed files with 1 additions and 1119 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
README.md
View File

@@ -21,11 +21,10 @@ These scripts automate the deployment of personal infrastructure components. The
| ------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| [`proxy/install.sh`](proxy/) | Reverse proxy with Tailscale + Nginx Proxy Manager | `curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/proxy/install.sh` \| `bash` |
| [`netlab/install.sh`](netlab/) | Network lab with ContainerLab | `curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/netlab/install.sh` \| `bash` |
| [`seedbox/install.sh`](seedbox/) | ISO seedbox with Transmission + NFS | `NFS_SERVER=<nas> curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/seedbox/install.sh` \| `bash` |
| [`gitea-runner/install.sh`](gitea-runner/) | Gitea Act Runner on Alpine LXC (Proxmox) | `bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/gitea-runner/install.sh)"` |
### Requirements
- Fresh Debian 12/13 installation (proxy, netlab, seedbox) or Proxmox VE host (gitea-runner)
- Fresh Debian 12/13 installation (proxy, netlab) or Proxmox VE host (gitea-runner)
- User with sudo privileges (do not run as root) — except gitea-runner which runs as root on Proxmox
- Internet access

20
seedbox/.env.example
View File

@@ -1,20 +0,0 @@
# Gitea secrets required for seedbox deployment
#
# Configure these in: Gitea > Repository > Settings > Secrets and Variables > Actions
#
# TS_AUTHKEY - Tailscale OAuth client secret (recommended) or auth key
# Create at: https://login.tailscale.com/admin/settings/oauth
# Required scopes: devices:write
# Format: tskey-client-xxxxx-yyyyyyyy
#
# SEEDBOX_SSH_KEY - SSH private key for deployment
# Generate with: ssh-keygen -t ed25519 -f seedbox-deploy -N ""
# Add public key to seedbox: ~/.ssh/authorized_keys
#
# TRANSMISSION_USER - Transmission WebUI username (default: admin)
# TRANSMISSION_PASS - Transmission WebUI password
# Example .env file (DO NOT COMMIT WITH REAL VALUES)
TS_AUTHKEY=tskey-client-xxxxx-yyyyyyyy
TRANSMISSION_USER=admin
TRANSMISSION_PASS=changeme

351
seedbox/README.md
View File

@@ -1,351 +0,0 @@
# Seedbox Server
Docker-based seedbox with Tailscale integration. Each service runs in its own container with a Tailscale sidecar for secure HTTPS access via your tailnet.
## Architecture
```
┌─────────────────────────────────────────────────────────────────┐
│ SEEDBOX │
│ │
│ Tailscale Host (SSH only) │
│ └─► seedbox.taila5ad8.ts.net │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Docker Stacks │ │
│ │ │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │
│ │ │ Transmission│ │ Prowlarr │ │ Sonarr │ │ │
│ │ │ + ts-sidecar│ │ + ts-sidecar│ │ + ts-sidecar│ │ │
│ │ └─────────────┘ └─────────────┘ └─────────────┘ │ │
│ │ │ │ │ │ │
│ │ ▼ ▼ ▼ │ │
│ │ transmission. prowlarr. sonarr. │ │
│ │ taila5ad8.ts.net taila5ad8.ts.net taila5ad8.ts.net │ │
│ │ │ │
│ │ ┌─────────────┐ │ │
│ │ │ Portainer │ (optional, for monitoring) │ │
│ │ │ + ts-sidecar│ │ │
│ │ └─────────────┘ │ │
│ │ │ │ │
│ │ ▼ │ │
│ │ portainer.taila5ad8.ts.net │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ Storage: │
│ ├─ /downloads (local RAID - 3.4T) │
│ └─ /mnt/media (NFS from NAS) │
└─────────────────────────────────────────────────────────────────┘
```
## Quick Start
### 1. Server Installation
```bash
# With NFS mount
NFS_SERVER=nas curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/seedbox/install.sh | bash
# Without NFS (configure later)
curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/seedbox/install.sh | bash
```
### 2. Configure Gitea Secrets
Go to **Gitea > Repository > Settings > Secrets and Variables > Actions** and add:
| Secret | Description | Example |
|--------|-------------|---------|
| `TS_AUTHKEY` | Tailscale OAuth client secret | `tskey-client-xxxxx-yyyyyyyy` |
| `SEEDBOX_SSH_KEY` | SSH private key (ed25519) | `-----BEGIN OPENSSH PRIVATE KEY-----...` |
| `TRANSMISSION_USER` | Transmission WebUI username | `admin` |
| `TRANSMISSION_PASS` | Transmission WebUI password | `your-secure-password` |
#### Creating Tailscale OAuth Client
1. Go to https://login.tailscale.com/admin/settings/oauth
2. Click "Generate OAuth Client"
3. Scopes: `devices:write`
4. Copy the **Client Secret** (starts with `tskey-client-`)
#### Creating SSH Deploy Key
```bash
# Generate key pair
ssh-keygen -t ed25519 -f seedbox-deploy -N "" -C "gitea-deploy"
# Add public key to seedbox
ssh debian@seedbox.taila5ad8.ts.net "cat >> ~/.ssh/authorized_keys" < seedbox-deploy.pub
# Copy private key content to Gitea secret SEEDBOX_SSH_KEY
cat seedbox-deploy
```
#### Tailscale ACL Configuration
Add this tag to your Tailscale ACL policy (https://login.tailscale.com/admin/acls):
```json
{
"tagOwners": {
"tag:container": ["autogroup:admins"]
}
}
```
### 3. Deploy Services
Push to the `main` branch to trigger deployment:
```bash
git push origin main
```
Or create a PR for validation first.
## Services
| Service | URL | Port | Description |
|---------|-----|------|-------------|
| Transmission | `transmission.taila5ad8.ts.net` | 9091 | BitTorrent client |
| Prowlarr | `prowlarr.taila5ad8.ts.net` | 9696 | Indexer manager |
| Sonarr | `sonarr.taila5ad8.ts.net` | 8989 | TV series manager |
| Portainer | `portainer.taila5ad8.ts.net` | 9000 | Docker management UI |
## Directory Structure
```
/srv/seedbox/
├── stacks/
│ ├── transmission/
│ │ ├── docker-compose.yml
│ │ └── serve.json
│ ├── prowlarr/
│ │ ├── docker-compose.yml
│ │ └── serve.json
│ ├── sonarr/
│ │ ├── docker-compose.yml
│ │ └── serve.json
│ └── portainer/
│ ├── docker-compose.yml
│ └── serve.json
└── .env # Secrets (created by pipeline)
/downloads/ # Local RAID storage (3.4T)
/mnt/media/ # NFS mount from NAS
```
## Adding a New Service
1. Create a new directory in `stacks/`:
```bash
mkdir -p seedbox/stacks/myservice
```
2. Create `docker-compose.yml`:
```yaml
services:
ts-myservice:
image: tailscale/tailscale:latest
hostname: myservice
environment:
- TS_AUTHKEY=${TS_AUTHKEY}
- TS_EXTRA_ARGS=--advertise-tags=tag:container
- TS_STATE_DIR=/var/lib/tailscale
- TS_SERVE_CONFIG=/config/serve.json
- TS_USERSPACE=false
volumes:
- ts-state:/var/lib/tailscale
- ./serve.json:/config/serve.json:ro
devices:
- /dev/net/tun:/dev/net/tun
cap_add:
- net_admin
restart: unless-stopped
myservice:
image: myservice/image:latest
container_name: myservice
network_mode: service:ts-myservice
depends_on:
- ts-myservice
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Paris
volumes:
- config:/config
- /downloads:/downloads
- /mnt/media:/media
restart: unless-stopped
volumes:
ts-state:
config:
```
3. Create `serve.json`:
```json
{
"TCP": {
"443": {
"HTTPS": true
}
},
"Web": {
"myservice.taila5ad8.ts.net:443": {
"Handlers": {
"/": {
"Proxy": "http://127.0.0.1:PORT"
}
}
}
}
}
```
4. Commit and push:
```bash
git add seedbox/stacks/myservice/
git commit -m "feat(seedbox): add myservice stack"
git push origin main
```
## Removing a Service
### Option A: Via Git (recommended)
1. Remove the stack directory:
```bash
rm -rf seedbox/stacks/myservice/
git add -A
git commit -m "feat(seedbox): remove myservice stack"
git push origin main
```
2. Manually stop containers on seedbox:
```bash
ssh debian@seedbox.taila5ad8.ts.net
cd /srv/seedbox/stacks/myservice
docker compose down -v
```
3. Remove Tailscale device from admin console
### Option B: Manual (emergency)
```bash
ssh debian@seedbox.taila5ad8.ts.net
cd /srv/seedbox/stacks/myservice
docker compose down -v
rm -rf /srv/seedbox/stacks/myservice
# Remove device from https://login.tailscale.com/admin/machines
```
## Updating Services
### Update Docker Images
The pipeline automatically pulls latest images on each deployment. To force an update:
```bash
# Trigger a new deployment by making any change
git commit --allow-empty -m "chore: trigger deployment"
git push origin main
```
### Manual Update
```bash
ssh debian@seedbox.taila5ad8.ts.net
cd /srv/seedbox/stacks/transmission
docker compose pull
docker compose up -d
```
## Network Access
| Service | Public | Tailscale |
|---------|--------|-----------|
| SSH | ❌ | ✅ `seedbox.taila5ad8.ts.net` |
| Transmission WebUI | ❌ | ✅ HTTPS via sidecar |
| Transmission Peer | ✅ Port 51413 | ✅ |
| Prowlarr | ❌ | ✅ HTTPS via sidecar |
| Sonarr | ❌ | ✅ HTTPS via sidecar |
| Portainer | ❌ | ✅ HTTPS via sidecar |
## Troubleshooting
### Check container status
```bash
docker ps -a
docker logs ts-transmission
docker logs transmission
```
### Check Tailscale sidecar
```bash
docker exec ts-transmission tailscale status
docker exec ts-transmission tailscale serve status
```
### Restart a stack
```bash
cd /srv/seedbox/stacks/transmission
docker compose restart
```
### View all Tailscale devices
```bash
tailscale status
```
### Force re-authentication of sidecar
```bash
cd /srv/seedbox/stacks/transmission
docker compose down
docker volume rm transmission_ts-state
docker compose up -d
```
## NAS Configuration (Synology)
Ensure your NAS exports the media share via NFS:
1. **Control Panel → Shared Folder → Edit → NFS Permissions**
2. Add rule:
- Hostname/IP: `100.64.0.0/10` (Tailscale subnet) or specific IP
- Privilege: Read/Write
- Squash: No mapping
- Security: sys
- Enable NFSv4.1: ✅
## Post-install Verification
```bash
# Check downloads mount
df -h /downloads
# Check NFS mount
df -h /mnt/media
# Check Docker
docker ps
# Check Tailscale devices
tailscale status
# Test service access
curl -k https://transmission.taila5ad8.ts.net
```

283
seedbox/install.sh
View File

@@ -1,283 +0,0 @@
#!/bin/bash
# install.sh - Seedbox Server Initial Setup
# Usage: curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/seedbox/install.sh | bash
#
# This script prepares the server for Docker-based seedbox deployment.
# Services are deployed separately via Gitea Actions.
set -euo pipefail
# Colors for logging
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
# Configuration (can be overridden via environment)
HOSTNAME="${SEEDBOX_HOSTNAME:-seedbox}"
NFS_SERVER="${NFS_SERVER:-}"
NFS_SHARE_MEDIA="${NFS_SHARE_MEDIA:-/volume2/Multimédia}"
NFS_MOUNT_MEDIA="${NFS_MOUNT_MEDIA:-/mnt/media}"
NFS_OPTS="defaults,_netdev,nofail,x-systemd.automount,x-systemd.mount-timeout=30s"
SEEDBOX_DIR="/srv/seedbox"
REPO_URL="${REPO_URL:-https://gitea.arnodo.fr/Damien/infra-scripts.git}"
# Pre-flight checks
check_root() {
if [[ $EUID -eq 0 ]]; then
log_error "Do not run as root directly. Use a user with sudo privileges."
exit 1
fi
if ! sudo -v; then
log_error "User must have sudo privileges."
exit 1
fi
}
check_debian() {
if ! grep -qi debian /etc/os-release 2>/dev/null; then
log_warn "This script is optimized for Debian. Continuing anyway..."
fi
}
main() {
log_info "=== Seedbox Server Setup ==="
check_root
check_debian
# Step 1: System update
log_info "Updating system..."
sudo apt-get update -qq
sudo apt-get upgrade -y -qq
# Step 2: Set hostname
log_info "Setting hostname to: $HOSTNAME"
echo "$HOSTNAME" | sudo tee /etc/hostname > /dev/null
sudo hostnamectl set-hostname "$HOSTNAME"
# Step 3: Install base packages
log_info "Installing base packages..."
sudo apt-get install -y -qq \
vim \
ca-certificates \
curl \
gnupg \
lsb-release \
fail2ban \
unattended-upgrades \
nfs-common \
ufw \
at \
git \
rsync \
> /dev/null
# Ensure atd service is running (needed for delayed SSH lockdown)
sudo systemctl enable --now atd
# Step 4: Install Tailscale
log_info "Installing Tailscale..."
curl -fsSL https://tailscale.com/install.sh | sh
log_info "Connecting to Tailscale..."
sudo tailscale up
# Get Tailscale hostname for display
TS_FQDN=$(tailscale status --json 2>/dev/null | awk -F'"' '
/"Self"/ { in_self=1 }
in_self && /"DNSName"/ { gsub(/\.$/, "", $4); print $4; exit }
' || echo "${HOSTNAME}.ts.net")
# Step 5: Install Docker
log_info "Installing Docker..."
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
# shellcheck disable=SC1091
sudo tee /etc/apt/sources.list.d/docker.sources > /dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/debian
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Signed-By: /etc/apt/keyrings/docker.asc
EOF
sudo apt-get update -qq
sudo apt-get install -y -qq \
docker-ce \
docker-ce-cli \
containerd.io \
docker-buildx-plugin \
docker-compose-plugin \
> /dev/null
# Step 6: Configure Docker for user
log_info "Adding current user to docker group..."
sudo usermod -aG docker "$USER"
# Step 7: Configure UFW firewall (initial - SSH still open on public)
log_info "Configuring UFW firewall (initial setup)..."
sudo ufw --force reset > /dev/null
sudo ufw default deny incoming > /dev/null
sudo ufw default allow outgoing > /dev/null
# SSH temporarily on all interfaces (will be locked down after Tailscale is confirmed)
sudo ufw allow 22/tcp > /dev/null
# BitTorrent peer port (public)
sudo ufw allow 51413/tcp > /dev/null
sudo ufw allow 51413/udp > /dev/null
# Allow all traffic on Tailscale interface
sudo ufw allow in on tailscale0 > /dev/null
sudo ufw --force enable > /dev/null
# Step 8: Schedule SSH lockdown via 'at' (2 minutes delay for safety)
log_info "Scheduling SSH lockdown to Tailscale-only in 2 minutes..."
log_warn "IMPORTANT: Reconnect via Tailscale SSH within 2 minutes!"
log_warn " ssh ${USER}@${TS_FQDN}"
echo "sudo ufw delete allow 22/tcp" | at now + 2 minutes 2>/dev/null || {
log_warn "Failed to schedule SSH lockdown via 'at'. Manual lockdown required."
log_warn "Run manually after confirming Tailscale access: sudo ufw delete allow 22/tcp"
}
# Step 9: Create directory structure
log_info "Creating directory structure..."
sudo mkdir -p "$SEEDBOX_DIR"
sudo chown -R "$USER:$USER" "$SEEDBOX_DIR"
# Step 10: Configure NFS mount (if NFS_SERVER provided)
if [[ -n "$NFS_SERVER" ]]; then
log_info "Configuring NFS mount..."
sudo mkdir -p "$NFS_MOUNT_MEDIA"
if ! grep -q "${NFS_SERVER}:${NFS_SHARE_MEDIA}" /etc/fstab; then
log_info "Adding NFS mount: ${NFS_SERVER}:${NFS_SHARE_MEDIA} -> ${NFS_MOUNT_MEDIA}"
echo "${NFS_SERVER}:${NFS_SHARE_MEDIA} ${NFS_MOUNT_MEDIA} nfs ${NFS_OPTS} 0 0" | sudo tee -a /etc/fstab > /dev/null
fi
sudo mount -a || log_warn "NFS mount failed - ensure NAS is accessible via Tailscale"
else
log_warn "NFS_SERVER not set. NFS mount skipped. Set it later if needed."
fi
# Step 11: Clone repository (sparse checkout for seedbox/ only)
log_info "Cloning seedbox configuration..."
if [[ -d "${SEEDBOX_DIR}/.git" ]]; then
cd "$SEEDBOX_DIR"
git pull origin main || log_warn "Git pull failed"
else
# Clean any existing content
rm -rf "${SEEDBOX_DIR:?}"/*
rm -rf "${SEEDBOX_DIR}"/.[!.]* 2>/dev/null || true
cd "$SEEDBOX_DIR"
git init
git remote add origin "$REPO_URL"
# Configure sparse checkout to only get seedbox/ directory
git sparse-checkout init --cone
git sparse-checkout set seedbox
# Fetch and checkout
git fetch origin main
git checkout main
# Move contents of seedbox/ to root and clean up
if [[ -d "${SEEDBOX_DIR}/seedbox" ]]; then
# Move all files including hidden ones
shopt -s dotglob
mv "${SEEDBOX_DIR}/seedbox"/* "${SEEDBOX_DIR}/" 2>/dev/null || true
shopt -u dotglob
rmdir "${SEEDBOX_DIR}/seedbox" 2>/dev/null || true
fi
# Disable sparse checkout now that we have the files
git sparse-checkout disable 2>/dev/null || true
fi
# Step 12: Configure MOTD
log_info "Configuring MOTD..."
sudo chmod -x /etc/update-motd.d/* 2>/dev/null || true
cat << 'MOTD' | sudo tee /etc/update-motd.d/00-seedbox > /dev/null
#!/bin/bash
TS_FQDN=$(tailscale status --json 2>/dev/null | awk -F'"' '
/"Self"/ { in_self=1 }
in_self && /"DNSName"/ { gsub(/\.$/, "", $4); print $4; exit }
')
[[ -z "$TS_FQDN" ]] && TS_FQDN="$(hostname).ts.net"
echo ""
echo " ____ _____ _____ ____ ____ _____ __"
echo "/ ___|| ____| ____| _ \| __ ) / _ \ \/ /"
echo "\___ \| _| | _| | | | | _ \| | | \ /"
echo " ___) | |___| |___| |_| | |_) | |_| / \\"
echo "|____/|_____|_____|____/|____/ \___/_/\_\\"
echo ""
echo "Docker Seedbox Server"
echo "─────────────────────────────────────────"
echo "Access:"
echo " • SSH : ${TS_FQDN} (Tailscale only)"
echo " • Seeding : Public port 51413"
echo ""
echo "Services: (via Tailscale)"
docker ps --format ' • {{.Names}} : {{.Status}}' 2>/dev/null || echo " Docker not running"
echo ""
echo "Storage:"
echo " • Downloads : /downloads (local RAID)"
echo " • Media : /mnt/media (NFS)"
echo ""
echo "Useful commands:"
echo " cd /srv/seedbox && docker compose ls"
echo " docker logs -f <container>"
echo "─────────────────────────────────────────"
echo ""
MOTD
sudo chmod +x /etc/update-motd.d/00-seedbox
# Final summary
echo ""
log_info "==========================================="
log_info "Server setup complete!"
log_info "==========================================="
echo ""
log_warn "⚠️ SSH LOCKDOWN SCHEDULED IN 2 MINUTES!"
log_warn " Reconnect NOW via Tailscale:"
echo ""
echo " ssh ${USER}@${TS_FQDN}"
echo ""
echo "Server accessible at:"
echo " SSH: ssh user@${TS_FQDN}"
echo ""
echo "Directory structure:"
echo " ${SEEDBOX_DIR}/"
echo " ├── stacks/ # Docker Compose stacks"
echo " └── .env # Secrets (created by Gitea Actions)"
echo ""
echo "Storage:"
echo " • Downloads: /downloads (local RAID - 3.4T)"
echo " • Media: /mnt/media (NFS)"
echo ""
echo "NFS mount:"
if [[ -n "$NFS_SERVER" ]]; then
echo " ${NFS_SERVER}:${NFS_SHARE_MEDIA} -> ${NFS_MOUNT_MEDIA}"
else
echo " Not configured. Run with NFS_SERVER=<ip> to configure."
fi
echo ""
echo "Next steps:"
echo " 1. Reconnect via Tailscale SSH IMMEDIATELY"
echo " 2. Configure Gitea secrets (see README.md)"
echo " 3. Push to main branch to trigger deployment"
echo " 4. Services will be available at <service>.taila5ad8.ts.net"
echo ""
log_info "SSH access via Tailscale: ssh user@${TS_FQDN}"
echo ""
}
main "$@"

52
seedbox/stacks/portainer/README.md
View File

@@ -1,52 +0,0 @@
# Portainer Stack
Docker management UI, accessible via Tailscale.
## Access
- **URL**: https://portainer.taila5ad8.ts.net
- **Initial setup**: Create admin account on first access
## Ports
| Port | Protocol | Exposure | Description |
|------|----------|----------|-------------|
| 9000 | TCP | Tailscale only | WebUI |
## Features
- View and manage all Docker containers
- View logs in real-time
- Execute commands in containers
- Manage Docker networks and volumes
- Deploy stacks from templates
## First Setup
1. Access https://portainer.taila5ad8.ts.net
2. Create an admin account
3. Select "Docker" as environment type
4. Connect to local Docker socket
## Troubleshooting
```bash
# Check logs
docker logs portainer
# Check Tailscale sidecar
docker exec ts-portainer tailscale status
# Restart stack
cd /srv/seedbox/stacks/portainer
docker compose restart
```
## Note
Portainer is optional and mainly useful for:
- Visual monitoring of containers
- Quick access to logs
- Emergency container management
All deployments should still go through Gitea Actions for proper version control.

33
seedbox/stacks/portainer/docker-compose.yml
View File

@@ -1,33 +0,0 @@
services:
ts-portainer:
image: tailscale/tailscale:latest
hostname: portainer
environment:
- TS_AUTHKEY=${TS_AUTHKEY}
- TS_EXTRA_ARGS=--advertise-tags=tag:container
- TS_STATE_DIR=/var/lib/tailscale
- TS_SERVE_CONFIG=/config/serve.json
- TS_USERSPACE=false
volumes:
- ts-state:/var/lib/tailscale
- ./serve.json:/config/serve.json:ro
devices:
- /dev/net/tun:/dev/net/tun
cap_add:
- net_admin
restart: unless-stopped
portainer:
image: portainer/portainer-ce:latest
container_name: portainer
network_mode: service:ts-portainer
depends_on:
- ts-portainer
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- data:/data
restart: unless-stopped
volumes:
ts-state:
data:

16
seedbox/stacks/portainer/serve.json
View File

@@ -1,16 +0,0 @@
{
"TCP": {
"443": {
"HTTPS": true
}
},
"Web": {
"portainer.taila5ad8.ts.net:443": {
"Handlers": {
"/": {
"Proxy": "http://127.0.0.1:9000"
}
}
}
}
}

61
seedbox/stacks/prowlarr/README.md
View File

@@ -1,61 +0,0 @@
# Prowlarr Stack
Indexer manager for Sonarr, Radarr, and other *arr applications.
## Access
- **URL**: https://prowlarr.taila5ad8.ts.net
- **Initial setup**: Configure on first access (no default credentials)
## Ports
| Port | Protocol | Exposure | Description |
|------|----------|----------|-------------|
| 9696 | TCP | Tailscale only | WebUI |
## Features
- Centralized indexer management
- Automatic sync with Sonarr/Radarr
- Support for Usenet and Torrent indexers
- Built-in indexer testing
## Configuration
### Connect to Sonarr
1. In Prowlarr: **Settings → Apps → Add**
2. Select "Sonarr"
3. Prowlarr Server: `http://localhost:9696` (or use Tailscale hostname)
4. Sonarr Server: `http://sonarr.taila5ad8.ts.net` or internal Docker network
5. API Key: Get from Sonarr **Settings → General**
### Add Indexers
1. Go to **Indexers → Add**
2. Search for your preferred indexer
3. Configure credentials if required
4. Test and save
## Troubleshooting
```bash
# Check logs
docker logs prowlarr
# Check Tailscale sidecar
docker exec ts-prowlarr tailscale status
# Restart stack
cd /srv/seedbox/stacks/prowlarr
docker compose restart
# Check WebUI is responding
docker exec ts-prowlarr curl -s http://127.0.0.1:9696
```
## Integration Notes
Prowlarr can communicate with other *arr apps via:
1. **Tailscale hostnames** (e.g., `sonarr.taila5ad8.ts.net`) - Recommended
2. **Docker network** - Requires additional network configuration

36
seedbox/stacks/prowlarr/docker-compose.yml
View File

@@ -1,36 +0,0 @@
services:
ts-prowlarr:
image: tailscale/tailscale:latest
hostname: prowlarr
environment:
- TS_AUTHKEY=${TS_AUTHKEY}
- TS_EXTRA_ARGS=--advertise-tags=tag:container
- TS_STATE_DIR=/var/lib/tailscale
- TS_SERVE_CONFIG=/config/serve.json
- TS_USERSPACE=false
volumes:
- ts-state:/var/lib/tailscale
- ./serve.json:/config/serve.json:ro
devices:
- /dev/net/tun:/dev/net/tun
cap_add:
- net_admin
restart: unless-stopped
prowlarr:
image: linuxserver/prowlarr:latest
container_name: prowlarr
network_mode: service:ts-prowlarr
depends_on:
- ts-prowlarr
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Paris
volumes:
- config:/config
restart: unless-stopped
volumes:
ts-state:
config:

16
seedbox/stacks/prowlarr/serve.json
View File

@@ -1,16 +0,0 @@
{
"TCP": {
"443": {
"HTTPS": true
}
},
"Web": {
"prowlarr.taila5ad8.ts.net:443": {
"Handlers": {
"/": {
"Proxy": "http://127.0.0.1:9696"
}
}
}
}
}

82
seedbox/stacks/sonarr/README.md
View File

@@ -1,82 +0,0 @@
# Sonarr Stack
TV series management and automation.
## Access
- **URL**: https://sonarr.taila5ad8.ts.net
- **Initial setup**: Configure on first access (no default credentials)
## Ports
| Port | Protocol | Exposure | Description |
|------|----------|----------|-------------|
| 8989 | TCP | Tailscale only | WebUI |
## Volumes
| Path in container | Host path | Description |
|-------------------|-----------|-------------|
| `/config` | Docker volume | Sonarr configuration |
| `/downloads` | `/downloads` | Download directory (local RAID) |
| `/media` | `/mnt/media` | Media library (NFS) |
## Configuration
### Root Folders
1. Go to **Settings → Media Management → Root Folders**
2. Add `/media/TV` or your preferred path
### Download Client
1. Go to **Settings → Download Clients → Add**
2. Select "Transmission"
3. Host: `transmission.taila5ad8.ts.net`
4. Port: `443`
5. Use SSL: ✅
6. Username/Password: Your Transmission credentials
### Connect to Prowlarr
1. Go to **Settings → Indexers**
2. Prowlarr will auto-sync indexers if configured correctly
### Quality Profiles
Configure in **Settings → Profiles** based on your preferences.
## Troubleshooting
```bash
# Check logs
docker logs sonarr
# Check Tailscale sidecar
docker exec ts-sonarr tailscale status
# Restart stack
cd /srv/seedbox/stacks/sonarr
docker compose restart
# Check WebUI is responding
docker exec ts-sonarr curl -s http://127.0.0.1:8989
```
## Recommended Folder Structure
```
/mnt/media/
├── TV/
│ ├── Show Name (Year)/
│ │ ├── Season 01/
│ │ └── Season 02/
│ └── Another Show/
└── downloads/
└── completed/
```
## API Key
Find your API key in **Settings → General → Security**.
This is needed for Prowlarr integration.

38
seedbox/stacks/sonarr/docker-compose.yml
View File

@@ -1,38 +0,0 @@
services:
ts-sonarr:
image: tailscale/tailscale:latest
hostname: sonarr
environment:
- TS_AUTHKEY=${TS_AUTHKEY}
- TS_EXTRA_ARGS=--advertise-tags=tag:container
- TS_STATE_DIR=/var/lib/tailscale
- TS_SERVE_CONFIG=/config/serve.json
- TS_USERSPACE=false
volumes:
- ts-state:/var/lib/tailscale
- ./serve.json:/config/serve.json:ro
devices:
- /dev/net/tun:/dev/net/tun
cap_add:
- net_admin
restart: unless-stopped
sonarr:
image: linuxserver/sonarr:latest
container_name: sonarr
network_mode: service:ts-sonarr
depends_on:
- ts-sonarr
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Paris
volumes:
- config:/config
- /downloads:/downloads
- /mnt/media:/media
restart: unless-stopped
volumes:
ts-state:
config:

16
seedbox/stacks/sonarr/serve.json
View File

@@ -1,16 +0,0 @@
{
"TCP": {
"443": {
"HTTPS": true
}
},
"Web": {
"sonarr.taila5ad8.ts.net:443": {
"Handlers": {
"/": {
"Proxy": "http://127.0.0.1:8989"
}
}
}
}
}

52
seedbox/stacks/transmission/README.md
View File

@@ -1,52 +0,0 @@
# Transmission Stack
BitTorrent client with web interface, accessible via Tailscale.
## Access
- **URL**: https://transmission.taila5ad8.ts.net
- **Default credentials**: Set via `TRANSMISSION_USER` and `TRANSMISSION_PASS` secrets
## Ports
| Port | Protocol | Exposure | Description |
|------|----------|----------|-------------|
| 9091 | TCP | Tailscale only | WebUI |
| 51413 | TCP/UDP | Public | BitTorrent peer port |
## Volumes
| Path in container | Host path | Description |
|-------------------|-----------|-------------|
| `/config` | Docker volume | Transmission configuration |
| `/downloads` | `/downloads` | Download directory (local RAID - 3.4T) |
| `/media` | `/mnt/media` | Media library (NFS) |
## Configuration
### Download Paths
In Transmission settings:
- **Download to**: `/downloads`
- **Move completed to**: `/media/downloads` (optional)
### Peer Port
The peer port 51413 is exposed publicly for optimal seeding performance. Ensure your firewall/router allows this port.
## Troubleshooting
```bash
# Check logs
docker logs transmission
# Check Tailscale sidecar
docker exec ts-transmission tailscale status
# Restart stack
cd /srv/seedbox/stacks/transmission
docker compose restart
# Check WebUI is responding
docker exec ts-transmission curl -s http://127.0.0.1:9091
```

45
seedbox/stacks/transmission/docker-compose.yml
View File

@@ -1,45 +0,0 @@
services:
ts-transmission:
image: tailscale/tailscale:latest
hostname: transmission
environment:
- TS_AUTHKEY=${TS_AUTHKEY}
- TS_EXTRA_ARGS=--advertise-tags=tag:container
- TS_STATE_DIR=/var/lib/tailscale
- TS_SERVE_CONFIG=/config/serve.json
- TS_USERSPACE=false
volumes:
- ts-state:/var/lib/tailscale
- ./serve.json:/config/serve.json:ro
devices:
- /dev/net/tun:/dev/net/tun
cap_add:
- net_admin
ports:
# BitTorrent peer port - exposed publicly for seeding
- "51413:51413"
- "51413:51413/udp"
restart: unless-stopped
transmission:
image: linuxserver/transmission:latest
container_name: transmission
network_mode: service:ts-transmission
depends_on:
- ts-transmission
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Paris
- USER=${TRANSMISSION_USER:-admin}
- PASS=${TRANSMISSION_PASS}
- PEERPORT=51413
volumes:
- config:/config
- /downloads:/downloads
- /mnt/media:/media
restart: unless-stopped
volumes:
ts-state:
config:

16
seedbox/stacks/transmission/serve.json
View File

@@ -1,16 +0,0 @@
{
"TCP": {
"443": {
"HTTPS": true
}
},
"Web": {
"transmission.taila5ad8.ts.net:443": {
"Handlers": {
"/": {
"Proxy": "http://127.0.0.1:9091"
}
}
}
}
}