Remove seedbox infrastructure

2026-05-26 18:57:07 +02:00
parent 007cbf5f4d
commit 1df3da81d7
16 changed files with 1 additions and 1119 deletions
--- a/README.md
+++ b/README.md
@@ -21,11 +21,10 @@ These scripts automate the deployment of personal infrastructure components. The
 | ------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
 | [`proxy/install.sh`](proxy/)               | Reverse proxy with Tailscale + Nginx Proxy Manager | `curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/proxy/install.sh` \| `bash`                    |
 | [`netlab/install.sh`](netlab/)             | Network lab with ContainerLab                      | `curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/netlab/install.sh` \| `bash`                   |
 | [`seedbox/install.sh`](seedbox/)           | ISO seedbox with Transmission + NFS                | `NFS_SERVER=<nas> curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/seedbox/install.sh` \| `bash` |
 | [`gitea-runner/install.sh`](gitea-runner/) | Gitea Act Runner on Alpine LXC (Proxmox)           | `bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/gitea-runner/install.sh)"`          |
 ### Requirements
- Fresh Debian 12/13 installation (proxy, netlab, seedbox) or Proxmox VE host (gitea-runner)
+- Fresh Debian 12/13 installation (proxy, netlab) or Proxmox VE host (gitea-runner)
 - User with sudo privileges (do not run as root) — except gitea-runner which runs as root on Proxmox
 - Internet access
--- a/seedbox/.env.example
+++ b/seedbox/.env.example
@@ -1,20 +0,0 @@
 # Gitea secrets required for seedbox deployment
 #
 # Configure these in: Gitea > Repository > Settings > Secrets and Variables > Actions
 #
 # TS_AUTHKEY        - Tailscale OAuth client secret (recommended) or auth key
 #                     Create at: https://login.tailscale.com/admin/settings/oauth
 #                     Required scopes: devices:write
 #                     Format: tskey-client-xxxxx-yyyyyyyy
 #
 # SEEDBOX_SSH_KEY   - SSH private key for deployment
 #                     Generate with: ssh-keygen -t ed25519 -f seedbox-deploy -N ""
 #                     Add public key to seedbox: ~/.ssh/authorized_keys
 #
 # TRANSMISSION_USER - Transmission WebUI username (default: admin)
 # TRANSMISSION_PASS - Transmission WebUI password
 # Example .env file (DO NOT COMMIT WITH REAL VALUES)
 TS_AUTHKEY=tskey-client-xxxxx-yyyyyyyy
 TRANSMISSION_USER=admin
 TRANSMISSION_PASS=changeme
--- a/seedbox/README.md
+++ b/seedbox/README.md
@@ -1,351 +0,0 @@
 # Seedbox Server
 Docker-based seedbox with Tailscale integration. Each service runs in its own container with a Tailscale sidecar for secure HTTPS access via your tailnet.
 ## Architecture
 ```
 ┌─────────────────────────────────────────────────────────────────┐
 │                         SEEDBOX                                 │
 │                                                                 │
 │  Tailscale Host (SSH only)                                     │
 │  └─► seedbox.taila5ad8.ts.net                                  │
 │                                                                 │
 │  ┌─────────────────────────────────────────────────────────┐   │
 │  │ Docker Stacks                                           │   │
 │  │                                                         │   │
 │  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │   │
 │  │  │ Transmission│  │ Prowlarr    │  │ Sonarr      │    │   │
 │  │  │ + ts-sidecar│  │ + ts-sidecar│  │ + ts-sidecar│    │   │
 │  │  └─────────────┘  └─────────────┘  └─────────────┘    │   │
 │  │        │                │                │             │   │
 │  │        ▼                ▼                ▼             │   │
 │  │   transmission.    prowlarr.        sonarr.           │   │
 │  │   taila5ad8.ts.net taila5ad8.ts.net taila5ad8.ts.net │   │
 │  │                                                         │   │
 │  │  ┌─────────────┐                                       │   │
 │  │  │ Portainer   │  (optional, for monitoring)          │   │
 │  │  │ + ts-sidecar│                                       │   │
 │  │  └─────────────┘                                       │   │
 │  │        │                                                │   │
 │  │        ▼                                                │   │
 │  │   portainer.taila5ad8.ts.net                           │   │
 │  └─────────────────────────────────────────────────────────┘   │
 │                                                                 │
 │  Storage:                                                      │
 │  ├─ /downloads (local RAID - 3.4T)                            │
 │  └─ /mnt/media (NFS from NAS)                                  │
 └─────────────────────────────────────────────────────────────────┘
 ```
 ## Quick Start
 ### 1. Server Installation
 ```bash
 # With NFS mount
 NFS_SERVER=nas curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/seedbox/install.sh | bash
 # Without NFS (configure later)
 curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/seedbox/install.sh | bash
 ```
 ### 2. Configure Gitea Secrets
 Go to **Gitea > Repository > Settings > Secrets and Variables > Actions** and add:
 | Secret | Description | Example |
 |--------|-------------|---------|
 | `TS_AUTHKEY` | Tailscale OAuth client secret | `tskey-client-xxxxx-yyyyyyyy` |
 | `SEEDBOX_SSH_KEY` | SSH private key (ed25519) | `-----BEGIN OPENSSH PRIVATE KEY-----...` |
 | `TRANSMISSION_USER` | Transmission WebUI username | `admin` |
 | `TRANSMISSION_PASS` | Transmission WebUI password | `your-secure-password` |
 #### Creating Tailscale OAuth Client
 1. Go to https://login.tailscale.com/admin/settings/oauth
 2. Click "Generate OAuth Client"
 3. Scopes: `devices:write`
 4. Copy the **Client Secret** (starts with `tskey-client-`)
 #### Creating SSH Deploy Key
 ```bash
 # Generate key pair
 ssh-keygen -t ed25519 -f seedbox-deploy -N "" -C "gitea-deploy"
 # Add public key to seedbox
 ssh debian@seedbox.taila5ad8.ts.net "cat >> ~/.ssh/authorized_keys" < seedbox-deploy.pub
 # Copy private key content to Gitea secret SEEDBOX_SSH_KEY
 cat seedbox-deploy
 ```
 #### Tailscale ACL Configuration
 Add this tag to your Tailscale ACL policy (https://login.tailscale.com/admin/acls):
 ```json
 {
  "tagOwners": {
    "tag:container": ["autogroup:admins"]
  }
 }
 ```
 ### 3. Deploy Services
 Push to the `main` branch to trigger deployment:
 ```bash
 git push origin main
 ```
 Or create a PR for validation first.
 ## Services
 | Service | URL | Port | Description |
 |---------|-----|------|-------------|
 | Transmission | `transmission.taila5ad8.ts.net` | 9091 | BitTorrent client |
 | Prowlarr | `prowlarr.taila5ad8.ts.net` | 9696 | Indexer manager |
 | Sonarr | `sonarr.taila5ad8.ts.net` | 8989 | TV series manager |
 | Portainer | `portainer.taila5ad8.ts.net` | 9000 | Docker management UI |
 ## Directory Structure
 ```
 /srv/seedbox/
 ├── stacks/
 │   ├── transmission/
 │   │   ├── docker-compose.yml
 │   │   └── serve.json
 │   ├── prowlarr/
 │   │   ├── docker-compose.yml
 │   │   └── serve.json
 │   ├── sonarr/
 │   │   ├── docker-compose.yml
 │   │   └── serve.json
 │   └── portainer/
 │       ├── docker-compose.yml
 │       └── serve.json
 └── .env                        # Secrets (created by pipeline)
 /downloads/                     # Local RAID storage (3.4T)
 /mnt/media/                     # NFS mount from NAS
 ```
 ## Adding a New Service
 1. Create a new directory in `stacks/`:
 ```bash
 mkdir -p seedbox/stacks/myservice
 ```
 2. Create `docker-compose.yml`:
 ```yaml
 services:
  ts-myservice:
    image: tailscale/tailscale:latest
    hostname: myservice
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_EXTRA_ARGS=--advertise-tags=tag:container
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_USERSPACE=false
    volumes:
      - ts-state:/var/lib/tailscale
      - ./serve.json:/config/serve.json:ro
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
    restart: unless-stopped
  myservice:
    image: myservice/image:latest
    container_name: myservice
    network_mode: service:ts-myservice
    depends_on:
      - ts-myservice
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
    volumes:
      - config:/config
      - /downloads:/downloads
      - /mnt/media:/media
    restart: unless-stopped
 volumes:
  ts-state:
  config:
 ```
 3. Create `serve.json`:
 ```json
 {
  "TCP": {
    "443": {
      "HTTPS": true
    }
  },
  "Web": {
    "myservice.taila5ad8.ts.net:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://127.0.0.1:PORT"
        }
      }
    }
  }
 }
 ```
 4. Commit and push:
 ```bash
 git add seedbox/stacks/myservice/
 git commit -m "feat(seedbox): add myservice stack"
 git push origin main
 ```
 ## Removing a Service
 ### Option A: Via Git (recommended)
 1. Remove the stack directory:
 ```bash
 rm -rf seedbox/stacks/myservice/
 git add -A
 git commit -m "feat(seedbox): remove myservice stack"
 git push origin main
 ```
 2. Manually stop containers on seedbox:
 ```bash
 ssh debian@seedbox.taila5ad8.ts.net
 cd /srv/seedbox/stacks/myservice
 docker compose down -v
 ```
 3. Remove Tailscale device from admin console
 ### Option B: Manual (emergency)
 ```bash
 ssh debian@seedbox.taila5ad8.ts.net
 cd /srv/seedbox/stacks/myservice
 docker compose down -v
 rm -rf /srv/seedbox/stacks/myservice
 # Remove device from https://login.tailscale.com/admin/machines
 ```
 ## Updating Services
 ### Update Docker Images
 The pipeline automatically pulls latest images on each deployment. To force an update:
 ```bash
 # Trigger a new deployment by making any change
 git commit --allow-empty -m "chore: trigger deployment"
 git push origin main
 ```
 ### Manual Update
 ```bash
 ssh debian@seedbox.taila5ad8.ts.net
 cd /srv/seedbox/stacks/transmission
 docker compose pull
 docker compose up -d
 ```
 ## Network Access
 | Service | Public | Tailscale |
 |---------|--------|-----------|
 | SSH | ❌ | ✅ `seedbox.taila5ad8.ts.net` |
 | Transmission WebUI | ❌ | ✅ HTTPS via sidecar |
 | Transmission Peer | ✅ Port 51413 | ✅ |
 | Prowlarr | ❌ | ✅ HTTPS via sidecar |
 | Sonarr | ❌ | ✅ HTTPS via sidecar |
 | Portainer | ❌ | ✅ HTTPS via sidecar |
 ## Troubleshooting
 ### Check container status
 ```bash
 docker ps -a
 docker logs ts-transmission
 docker logs transmission
 ```
 ### Check Tailscale sidecar
 ```bash
 docker exec ts-transmission tailscale status
 docker exec ts-transmission tailscale serve status
 ```
 ### Restart a stack
 ```bash
 cd /srv/seedbox/stacks/transmission
 docker compose restart
 ```
 ### View all Tailscale devices
 ```bash
 tailscale status
 ```
 ### Force re-authentication of sidecar
 ```bash
 cd /srv/seedbox/stacks/transmission
 docker compose down
 docker volume rm transmission_ts-state
 docker compose up -d
 ```
 ## NAS Configuration (Synology)
 Ensure your NAS exports the media share via NFS:
 1. **Control Panel → Shared Folder → Edit → NFS Permissions**
 2. Add rule:
   - Hostname/IP: `100.64.0.0/10` (Tailscale subnet) or specific IP
   - Privilege: Read/Write
   - Squash: No mapping
   - Security: sys
   - Enable NFSv4.1: ✅
 ## Post-install Verification
 ```bash
 # Check downloads mount
 df -h /downloads
 # Check NFS mount
 df -h /mnt/media
 # Check Docker
 docker ps
 # Check Tailscale devices
 tailscale status
 # Test service access
 curl -k https://transmission.taila5ad8.ts.net
 ```
--- a/seedbox/install.sh
+++ b/seedbox/install.sh
@@ -1,283 +0,0 @@
 #!/bin/bash
 # install.sh - Seedbox Server Initial Setup
 # Usage: curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/seedbox/install.sh | bash
 #
 # This script prepares the server for Docker-based seedbox deployment.
 # Services are deployed separately via Gitea Actions.
 set -euo pipefail
 # Colors for logging
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
 NC='\033[0m'
 log_info()  { echo -e "${GREEN}[INFO]${NC} $1"; }
 log_warn()  { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
 # Configuration (can be overridden via environment)
 HOSTNAME="${SEEDBOX_HOSTNAME:-seedbox}"
 NFS_SERVER="${NFS_SERVER:-}"
 NFS_SHARE_MEDIA="${NFS_SHARE_MEDIA:-/volume2/Multimédia}"
 NFS_MOUNT_MEDIA="${NFS_MOUNT_MEDIA:-/mnt/media}"
 NFS_OPTS="defaults,_netdev,nofail,x-systemd.automount,x-systemd.mount-timeout=30s"
 SEEDBOX_DIR="/srv/seedbox"
 REPO_URL="${REPO_URL:-https://gitea.arnodo.fr/Damien/infra-scripts.git}"
 # Pre-flight checks
 check_root() {
    if [[ $EUID -eq 0 ]]; then
        log_error "Do not run as root directly. Use a user with sudo privileges."
        exit 1
    fi
    if ! sudo -v; then
        log_error "User must have sudo privileges."
        exit 1
    fi
 }
 check_debian() {
    if ! grep -qi debian /etc/os-release 2>/dev/null; then
        log_warn "This script is optimized for Debian. Continuing anyway..."
    fi
 }
 main() {
    log_info "=== Seedbox Server Setup ==="
    check_root
    check_debian
    # Step 1: System update
    log_info "Updating system..."
    sudo apt-get update -qq
    sudo apt-get upgrade -y -qq
    # Step 2: Set hostname
    log_info "Setting hostname to: $HOSTNAME"
    echo "$HOSTNAME" | sudo tee /etc/hostname > /dev/null
    sudo hostnamectl set-hostname "$HOSTNAME"
    # Step 3: Install base packages
    log_info "Installing base packages..."
    sudo apt-get install -y -qq \
        vim \
        ca-certificates \
        curl \
        gnupg \
        lsb-release \
        fail2ban \
        unattended-upgrades \
        nfs-common \
        ufw \
        at \
        git \
        rsync \
        > /dev/null
    # Ensure atd service is running (needed for delayed SSH lockdown)
    sudo systemctl enable --now atd
    # Step 4: Install Tailscale
    log_info "Installing Tailscale..."
    curl -fsSL https://tailscale.com/install.sh | sh
    log_info "Connecting to Tailscale..."
    sudo tailscale up
    # Get Tailscale hostname for display
    TS_FQDN=$(tailscale status --json 2>/dev/null | awk -F'"' '
        /"Self"/ { in_self=1 }
        in_self && /"DNSName"/ { gsub(/\.$/, "", $4); print $4; exit }
    ' || echo "${HOSTNAME}.ts.net")
    # Step 5: Install Docker
    log_info "Installing Docker..."
    sudo install -m 0755 -d /etc/apt/keyrings
    sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
    sudo chmod a+r /etc/apt/keyrings/docker.asc
    # shellcheck disable=SC1091
    sudo tee /etc/apt/sources.list.d/docker.sources > /dev/null <<EOF
 Types: deb
 URIs: https://download.docker.com/linux/debian
 Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
 Components: stable
 Signed-By: /etc/apt/keyrings/docker.asc
 EOF
    sudo apt-get update -qq
    sudo apt-get install -y -qq \
        docker-ce \
        docker-ce-cli \
        containerd.io \
        docker-buildx-plugin \
        docker-compose-plugin \
        > /dev/null
    # Step 6: Configure Docker for user
    log_info "Adding current user to docker group..."
    sudo usermod -aG docker "$USER"
    # Step 7: Configure UFW firewall (initial - SSH still open on public)
    log_info "Configuring UFW firewall (initial setup)..."
    sudo ufw --force reset > /dev/null
    sudo ufw default deny incoming > /dev/null
    sudo ufw default allow outgoing > /dev/null
    # SSH temporarily on all interfaces (will be locked down after Tailscale is confirmed)
    sudo ufw allow 22/tcp > /dev/null
    # BitTorrent peer port (public)
    sudo ufw allow 51413/tcp > /dev/null
    sudo ufw allow 51413/udp > /dev/null
    # Allow all traffic on Tailscale interface
    sudo ufw allow in on tailscale0 > /dev/null
    sudo ufw --force enable > /dev/null
    # Step 8: Schedule SSH lockdown via 'at' (2 minutes delay for safety)
    log_info "Scheduling SSH lockdown to Tailscale-only in 2 minutes..."
    log_warn "IMPORTANT: Reconnect via Tailscale SSH within 2 minutes!"
    log_warn "  ssh ${USER}@${TS_FQDN}"
    echo "sudo ufw delete allow 22/tcp" | at now + 2 minutes 2>/dev/null || {
        log_warn "Failed to schedule SSH lockdown via 'at'. Manual lockdown required."
        log_warn "Run manually after confirming Tailscale access: sudo ufw delete allow 22/tcp"
    }
    # Step 9: Create directory structure
    log_info "Creating directory structure..."
    sudo mkdir -p "$SEEDBOX_DIR"
    sudo chown -R "$USER:$USER" "$SEEDBOX_DIR"
    # Step 10: Configure NFS mount (if NFS_SERVER provided)
    if [[ -n "$NFS_SERVER" ]]; then
        log_info "Configuring NFS mount..."
        sudo mkdir -p "$NFS_MOUNT_MEDIA"
        if ! grep -q "${NFS_SERVER}:${NFS_SHARE_MEDIA}" /etc/fstab; then
            log_info "Adding NFS mount: ${NFS_SERVER}:${NFS_SHARE_MEDIA} -> ${NFS_MOUNT_MEDIA}"
            echo "${NFS_SERVER}:${NFS_SHARE_MEDIA} ${NFS_MOUNT_MEDIA} nfs ${NFS_OPTS} 0 0" | sudo tee -a /etc/fstab > /dev/null
        fi
        sudo mount -a || log_warn "NFS mount failed - ensure NAS is accessible via Tailscale"
    else
        log_warn "NFS_SERVER not set. NFS mount skipped. Set it later if needed."
    fi
    # Step 11: Clone repository (sparse checkout for seedbox/ only)
    log_info "Cloning seedbox configuration..."
    if [[ -d "${SEEDBOX_DIR}/.git" ]]; then
        cd "$SEEDBOX_DIR"
        git pull origin main || log_warn "Git pull failed"
    else
        # Clean any existing content
        rm -rf "${SEEDBOX_DIR:?}"/*
        rm -rf "${SEEDBOX_DIR}"/.[!.]* 2>/dev/null || true
        cd "$SEEDBOX_DIR"
        git init
        git remote add origin "$REPO_URL"
        # Configure sparse checkout to only get seedbox/ directory
        git sparse-checkout init --cone
        git sparse-checkout set seedbox
        # Fetch and checkout
        git fetch origin main
        git checkout main
        # Move contents of seedbox/ to root and clean up
        if [[ -d "${SEEDBOX_DIR}/seedbox" ]]; then
            # Move all files including hidden ones
            shopt -s dotglob
            mv "${SEEDBOX_DIR}/seedbox"/* "${SEEDBOX_DIR}/" 2>/dev/null || true
            shopt -u dotglob
            rmdir "${SEEDBOX_DIR}/seedbox" 2>/dev/null || true
        fi
        # Disable sparse checkout now that we have the files
        git sparse-checkout disable 2>/dev/null || true
    fi
    # Step 12: Configure MOTD
    log_info "Configuring MOTD..."
    sudo chmod -x /etc/update-motd.d/* 2>/dev/null || true
    cat << 'MOTD' | sudo tee /etc/update-motd.d/00-seedbox > /dev/null
 #!/bin/bash
 TS_FQDN=$(tailscale status --json 2>/dev/null | awk -F'"' '
    /"Self"/ { in_self=1 }
    in_self && /"DNSName"/ { gsub(/\.$/, "", $4); print $4; exit }
 ')
 [[ -z "$TS_FQDN" ]] && TS_FQDN="$(hostname).ts.net"
 echo ""
 echo " ____  _____ _____ ____  ____   _____  __"
 echo "/ ___|| ____| ____| _ \| __ ) / _ \ \/ /"
 echo "\___ \|  _| |  _| | | | |  _ \| | | \  /"
 echo " ___) | |___| |___| |_| | |_) | |_| /  \\"
 echo "|____/|_____|_____|____/|____/ \___/_/\_\\"
 echo ""
 echo "Docker Seedbox Server"
 echo "─────────────────────────────────────────"
 echo "Access:"
 echo "  • SSH        : ${TS_FQDN} (Tailscale only)"
 echo "  • Seeding    : Public port 51413"
 echo ""
 echo "Services: (via Tailscale)"
 docker ps --format '  • {{.Names}} : {{.Status}}' 2>/dev/null || echo "  Docker not running"
 echo ""
 echo "Storage:"
 echo "  • Downloads  : /downloads (local RAID)"
 echo "  • Media      : /mnt/media (NFS)"
 echo ""
 echo "Useful commands:"
 echo "  cd /srv/seedbox && docker compose ls"
 echo "  docker logs -f <container>"
 echo "─────────────────────────────────────────"
 echo ""
 MOTD
    sudo chmod +x /etc/update-motd.d/00-seedbox
    # Final summary
    echo ""
    log_info "==========================================="
    log_info "Server setup complete!"
    log_info "==========================================="
    echo ""
    log_warn "⚠️  SSH LOCKDOWN SCHEDULED IN 2 MINUTES!"
    log_warn "    Reconnect NOW via Tailscale:"
    echo ""
    echo "    ssh ${USER}@${TS_FQDN}"
    echo ""
    echo "Server accessible at:"
    echo "  SSH: ssh user@${TS_FQDN}"
    echo ""
    echo "Directory structure:"
    echo "  ${SEEDBOX_DIR}/"
    echo "  ├── stacks/          # Docker Compose stacks"
    echo "  └── .env             # Secrets (created by Gitea Actions)"
    echo ""
    echo "Storage:"
    echo "  • Downloads: /downloads (local RAID - 3.4T)"
    echo "  • Media:     /mnt/media (NFS)"
    echo ""
    echo "NFS mount:"
    if [[ -n "$NFS_SERVER" ]]; then
        echo "  ${NFS_SERVER}:${NFS_SHARE_MEDIA} -> ${NFS_MOUNT_MEDIA}"
    else
        echo "  Not configured. Run with NFS_SERVER=<ip> to configure."
    fi
    echo ""
    echo "Next steps:"
    echo "  1. Reconnect via Tailscale SSH IMMEDIATELY"
    echo "  2. Configure Gitea secrets (see README.md)"
    echo "  3. Push to main branch to trigger deployment"
    echo "  4. Services will be available at <service>.taila5ad8.ts.net"
    echo ""
    log_info "SSH access via Tailscale: ssh user@${TS_FQDN}"
    echo ""
 }
 main "$@"
--- a/seedbox/stacks/portainer/README.md
+++ b/seedbox/stacks/portainer/README.md
@@ -1,52 +0,0 @@
 # Portainer Stack
 Docker management UI, accessible via Tailscale.
 ## Access
 - **URL**: https://portainer.taila5ad8.ts.net
 - **Initial setup**: Create admin account on first access
 ## Ports
 | Port | Protocol | Exposure | Description |
 |------|----------|----------|-------------|
 | 9000 | TCP | Tailscale only | WebUI |
 ## Features
 - View and manage all Docker containers
 - View logs in real-time
 - Execute commands in containers
 - Manage Docker networks and volumes
 - Deploy stacks from templates
 ## First Setup
 1. Access https://portainer.taila5ad8.ts.net
 2. Create an admin account
 3. Select "Docker" as environment type
 4. Connect to local Docker socket
 ## Troubleshooting
 ```bash
 # Check logs
 docker logs portainer
 # Check Tailscale sidecar
 docker exec ts-portainer tailscale status
 # Restart stack
 cd /srv/seedbox/stacks/portainer
 docker compose restart
 ```
 ## Note
 Portainer is optional and mainly useful for:
 - Visual monitoring of containers
 - Quick access to logs
 - Emergency container management
 All deployments should still go through Gitea Actions for proper version control.
--- a/seedbox/stacks/portainer/docker-compose.yml
+++ b/seedbox/stacks/portainer/docker-compose.yml
@@ -1,33 +0,0 @@
 services:
  ts-portainer:
    image: tailscale/tailscale:latest
    hostname: portainer
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_EXTRA_ARGS=--advertise-tags=tag:container
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_USERSPACE=false
    volumes:
      - ts-state:/var/lib/tailscale
      - ./serve.json:/config/serve.json:ro
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
    restart: unless-stopped
  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    network_mode: service:ts-portainer
    depends_on:
      - ts-portainer
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - data:/data
    restart: unless-stopped
 volumes:
  ts-state:
  data:
--- a/seedbox/stacks/portainer/serve.json
+++ b/seedbox/stacks/portainer/serve.json
@@ -1,16 +0,0 @@
 {
  "TCP": {
    "443": {
      "HTTPS": true
    }
  },
  "Web": {
    "portainer.taila5ad8.ts.net:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://127.0.0.1:9000"
        }
      }
    }
  }
 }
--- a/seedbox/stacks/prowlarr/README.md
+++ b/seedbox/stacks/prowlarr/README.md
@@ -1,61 +0,0 @@
 # Prowlarr Stack
 Indexer manager for Sonarr, Radarr, and other *arr applications.
 ## Access
 - **URL**: https://prowlarr.taila5ad8.ts.net
 - **Initial setup**: Configure on first access (no default credentials)
 ## Ports
 | Port | Protocol | Exposure | Description |
 |------|----------|----------|-------------|
 | 9696 | TCP | Tailscale only | WebUI |
 ## Features
 - Centralized indexer management
 - Automatic sync with Sonarr/Radarr
 - Support for Usenet and Torrent indexers
 - Built-in indexer testing
 ## Configuration
 ### Connect to Sonarr
 1. In Prowlarr: **Settings → Apps → Add**
 2. Select "Sonarr"
 3. Prowlarr Server: `http://localhost:9696` (or use Tailscale hostname)
 4. Sonarr Server: `http://sonarr.taila5ad8.ts.net` or internal Docker network
 5. API Key: Get from Sonarr **Settings → General**
 ### Add Indexers
 1. Go to **Indexers → Add**
 2. Search for your preferred indexer
 3. Configure credentials if required
 4. Test and save
 ## Troubleshooting
 ```bash
 # Check logs
 docker logs prowlarr
 # Check Tailscale sidecar
 docker exec ts-prowlarr tailscale status
 # Restart stack
 cd /srv/seedbox/stacks/prowlarr
 docker compose restart
 # Check WebUI is responding
 docker exec ts-prowlarr curl -s http://127.0.0.1:9696
 ```
 ## Integration Notes
 Prowlarr can communicate with other *arr apps via:
 1. **Tailscale hostnames** (e.g., `sonarr.taila5ad8.ts.net`) - Recommended
 2. **Docker network** - Requires additional network configuration
--- a/seedbox/stacks/prowlarr/docker-compose.yml
+++ b/seedbox/stacks/prowlarr/docker-compose.yml
@@ -1,36 +0,0 @@
 services:
  ts-prowlarr:
    image: tailscale/tailscale:latest
    hostname: prowlarr
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_EXTRA_ARGS=--advertise-tags=tag:container
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_USERSPACE=false
    volumes:
      - ts-state:/var/lib/tailscale
      - ./serve.json:/config/serve.json:ro
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
    restart: unless-stopped
  prowlarr:
    image: linuxserver/prowlarr:latest
    container_name: prowlarr
    network_mode: service:ts-prowlarr
    depends_on:
      - ts-prowlarr
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
    volumes:
      - config:/config
    restart: unless-stopped
 volumes:
  ts-state:
  config:
--- a/seedbox/stacks/prowlarr/serve.json
+++ b/seedbox/stacks/prowlarr/serve.json
@@ -1,16 +0,0 @@
 {
  "TCP": {
    "443": {
      "HTTPS": true
    }
  },
  "Web": {
    "prowlarr.taila5ad8.ts.net:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://127.0.0.1:9696"
        }
      }
    }
  }
 }
--- a/seedbox/stacks/sonarr/README.md
+++ b/seedbox/stacks/sonarr/README.md
@@ -1,82 +0,0 @@
 # Sonarr Stack
 TV series management and automation.
 ## Access
 - **URL**: https://sonarr.taila5ad8.ts.net
 - **Initial setup**: Configure on first access (no default credentials)
 ## Ports
 | Port | Protocol | Exposure | Description |
 |------|----------|----------|-------------|
 | 8989 | TCP | Tailscale only | WebUI |
 ## Volumes
 | Path in container | Host path | Description |
 |-------------------|-----------|-------------|
 | `/config` | Docker volume | Sonarr configuration |
 | `/downloads` | `/downloads` | Download directory (local RAID) |
 | `/media` | `/mnt/media` | Media library (NFS) |
 ## Configuration
 ### Root Folders
 1. Go to **Settings → Media Management → Root Folders**
 2. Add `/media/TV` or your preferred path
 ### Download Client
 1. Go to **Settings → Download Clients → Add**
 2. Select "Transmission"
 3. Host: `transmission.taila5ad8.ts.net`
 4. Port: `443`
 5. Use SSL: ✅
 6. Username/Password: Your Transmission credentials
 ### Connect to Prowlarr
 1. Go to **Settings → Indexers**
 2. Prowlarr will auto-sync indexers if configured correctly
 ### Quality Profiles
 Configure in **Settings → Profiles** based on your preferences.
 ## Troubleshooting
 ```bash
 # Check logs
 docker logs sonarr
 # Check Tailscale sidecar
 docker exec ts-sonarr tailscale status
 # Restart stack
 cd /srv/seedbox/stacks/sonarr
 docker compose restart
 # Check WebUI is responding
 docker exec ts-sonarr curl -s http://127.0.0.1:8989
 ```
 ## Recommended Folder Structure
 ```
 /mnt/media/
 ├── TV/
 │   ├── Show Name (Year)/
 │   │   ├── Season 01/
 │   │   └── Season 02/
 │   └── Another Show/
 └── downloads/
    └── completed/
 ```
 ## API Key
 Find your API key in **Settings → General → Security**.
 This is needed for Prowlarr integration.
--- a/seedbox/stacks/sonarr/docker-compose.yml
+++ b/seedbox/stacks/sonarr/docker-compose.yml
@@ -1,38 +0,0 @@
 services:
  ts-sonarr:
    image: tailscale/tailscale:latest
    hostname: sonarr
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_EXTRA_ARGS=--advertise-tags=tag:container
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_USERSPACE=false
    volumes:
      - ts-state:/var/lib/tailscale
      - ./serve.json:/config/serve.json:ro
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
    restart: unless-stopped
  sonarr:
    image: linuxserver/sonarr:latest
    container_name: sonarr
    network_mode: service:ts-sonarr
    depends_on:
      - ts-sonarr
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
    volumes:
      - config:/config
      - /downloads:/downloads
      - /mnt/media:/media
    restart: unless-stopped
 volumes:
  ts-state:
  config:
--- a/seedbox/stacks/sonarr/serve.json
+++ b/seedbox/stacks/sonarr/serve.json
@@ -1,16 +0,0 @@
 {
  "TCP": {
    "443": {
      "HTTPS": true
    }
  },
  "Web": {
    "sonarr.taila5ad8.ts.net:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://127.0.0.1:8989"
        }
      }
    }
  }
 }
--- a/seedbox/stacks/transmission/README.md
+++ b/seedbox/stacks/transmission/README.md
@@ -1,52 +0,0 @@
 # Transmission Stack
 BitTorrent client with web interface, accessible via Tailscale.
 ## Access
 - **URL**: https://transmission.taila5ad8.ts.net
 - **Default credentials**: Set via `TRANSMISSION_USER` and `TRANSMISSION_PASS` secrets
 ## Ports
 | Port | Protocol | Exposure | Description |
 |------|----------|----------|-------------|
 | 9091 | TCP | Tailscale only | WebUI |
 | 51413 | TCP/UDP | Public | BitTorrent peer port |
 ## Volumes
 | Path in container | Host path | Description |
 |-------------------|-----------|-------------|
 | `/config` | Docker volume | Transmission configuration |
 | `/downloads` | `/downloads` | Download directory (local RAID - 3.4T) |
 | `/media` | `/mnt/media` | Media library (NFS) |
 ## Configuration
 ### Download Paths
 In Transmission settings:
 - **Download to**: `/downloads`
 - **Move completed to**: `/media/downloads` (optional)
 ### Peer Port
 The peer port 51413 is exposed publicly for optimal seeding performance. Ensure your firewall/router allows this port.
 ## Troubleshooting
 ```bash
 # Check logs
 docker logs transmission
 # Check Tailscale sidecar
 docker exec ts-transmission tailscale status
 # Restart stack
 cd /srv/seedbox/stacks/transmission
 docker compose restart
 # Check WebUI is responding
 docker exec ts-transmission curl -s http://127.0.0.1:9091
 ```
--- a/seedbox/stacks/transmission/docker-compose.yml
+++ b/seedbox/stacks/transmission/docker-compose.yml
@@ -1,45 +0,0 @@
 services:
  ts-transmission:
    image: tailscale/tailscale:latest
    hostname: transmission
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_EXTRA_ARGS=--advertise-tags=tag:container
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_USERSPACE=false
    volumes:
      - ts-state:/var/lib/tailscale
      - ./serve.json:/config/serve.json:ro
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
    ports:
      # BitTorrent peer port - exposed publicly for seeding
      - "51413:51413"
      - "51413:51413/udp"
    restart: unless-stopped
  transmission:
    image: linuxserver/transmission:latest
    container_name: transmission
    network_mode: service:ts-transmission
    depends_on:
      - ts-transmission
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
      - USER=${TRANSMISSION_USER:-admin}
      - PASS=${TRANSMISSION_PASS}
      - PEERPORT=51413
    volumes:
      - config:/config
      - /downloads:/downloads
      - /mnt/media:/media
    restart: unless-stopped
 volumes:
  ts-state:
  config:
--- a/seedbox/stacks/transmission/serve.json
+++ b/seedbox/stacks/transmission/serve.json
@@ -1,16 +0,0 @@
 {
  "TCP": {
    "443": {
      "HTTPS": true
    }
  },
  "Web": {
    "transmission.taila5ad8.ts.net:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://127.0.0.1:9091"
        }
      }
    }
  }
 }