Declarative side-by-side rebuild of the *arr media fleet as homelab/v1 shapes,
deployed via community-scripts LXCs and fronted by a dedicated Cloudflare tunnel.
Design: ADR-0006 · scope/cutover detail: plan #105. Built alongside the live legacy 5000-block fleet, verified, then cut over — the old fleet keeps running until the switch.
CTID block 5100–5199 (declared in stack.yaml; members inherit its defaults).
| CTID | Member | <svc>.chrison.dev |
Auth | /data |
Status |
|---|---|---|---|---|---|
| 5100 | prowlarr | prowlarr |
CF Access OTP† | — | ✅ |
| 5101 | sonarr | sonarr |
CF Access OTP† | ✅ | ✅ |
| 5102 | radarr | radarr |
CF Access OTP† | ✅ | ✅ |
| 5103 | bazarr | bazarr |
CF Access OTP† | ✅ | ✅ |
| 5104 | qbittorrent | qbittorrent |
CF Access OTP† | ✅ | ✅ |
| 5105 | seerr | seerr |
CF Access OTP† | — | ✅ |
| 5106 | cross-seed | (not exposed) | — | ✅ | ✅ |
| 5107 | flaresolverr | (not exposed) | — | — | ✅ |
| 5108 | cloudflared | (serves the tunnel) | — | — | ✅ |
| 5109 | tracearr | (internal-only) | — | — | ✅ |
| 5110 | romm | (internal-only) | — | roms‡ |
✅ |
| 5111 | shelfmark | (internal-only) | — | books‡ |
✅ |
| 5112 | audiobookshelf | audiobookshelf |
direct (own auth) | audiobooks‡ |
✅ |
| — | — | — | retired¶ | ||
| 5008 | plex | plex (direct) |
direct (own auth) | data/media + youtube (ro)§ |
adopted |
† Auth is deferred to stage 2 (CF Access OTP vs Pangolin/ADR-0007 — decided later); the shapes/tunnel ship first.
Post-#192 the tunnel routes only seerr + audiobookshelf; the *arr admin UIs are internal-only.
‡ Binds a non-/data volume4 subpath (e.g. roms/books/audiobooks/youtube) at its own library path, not the shared /data export.
§ plex (5008) is ADOPTED, not rebuilt — the pre-existing legacy CT (5000-block, outside the 5100 range on purpose). Its shape is update-only: converge no-ops creation and only adds read-only binds of the data/media subtree (/data/media, the shared *arr library) and the youtube subpath (/data/youtube, Youtarr's downloads, now produced on CT 5114) so Plex serves both. See plex.lxc.yaml.
¶ 5113 (youtarr) is RETIRED — Youtarr runs on CT 5114, the Media podman host, as a quadlet
(#302). Its shape stays as the rollback record for the Podman migration (ADR-0009) and carries
manage: retired, so converge refuses to re-create it. That marker is load-bearing: the shape
previously carried only a retired tag plus a comment, neither of which the engine reads, so a
Media deploy rebuilt CT 5113 months after retirement — an empty Docker host with the youtube NFS
share mounted into it (#362).
seerr.chrison.dev is the admin view; the family keeps the untouched
seerr.tao-simon.family. Plex stays as-is (not rebuilt); if published it gets a
direct plex.chrison.dev (native clients can't SSO).
Every file-touching member (sonarr/radarr/bazarr/qbittorrent) mounts the same single
NFS export (volume4) at the same path /data, with torrents/ + media/ as
subfolders — so *arr hardlinks + instant-moves instead of copy+delete.
NAS-safety wiring (layered, from the 2026-06-20 bind-mount spike — see memory
nas-drop-failure-modes): rootfs-fill is a boot-state hazard, prevented structurally by an
immutable underlying mountpoint + the pre-start ensure-data-mount.sh
hookscript (no NAS → CT won't start, can't write to rootfs). Runtime NAS loss can't leak but
hangs the app, so each file-touching CT also runs the per-CT
nas-watchdog (drop → stop the app; return → restart). volume4's
export is provisioned via SynoSharp (reproducible IaC); register it as the Proxmox storage
ds1813-nfs-volume-4 (task #1). Wiring all of this at converge/deploy time = task #13.
/data <- one NFS export, identical mount in every *arr CT
├── torrents/{movies,tv,prowlarr} <- qBittorrent writes here (prowlarr/ = manual Search-tab grabs)
└── media/{movies,tv} <- *arr import here; Plex reads here
These are LXC shapes for the homelab/v1 contract — render/deploy from the parent repo:
# from the Homelab checkout — dry-run by default:
./Infrastructure/deploy/Deploy-Shape.ps1 -ShapePath ./stacks/Media/cloudflared.lxc.yaml
# add -Apply to deploy over SSHOrder: volume4 export (task #1) → connector + tunnel → prowlarr → sonarr/radarr/ bazarr/qbittorrent → seerr → flaresolverr → DNS + CF Access → cutover. See the task list.
Notes:
- Schema:
Infrastructure/schema/shape.schema.json. - ADD-ONLY on Cloudflare: the
Homelab.Stacks.Mediatunnel is new; never touches CT 2001. - Cutover (#105): carry over Prowlarr's indexer DB; fresh profiles via Recyclarr; curate the library down to the watchlist (no bulk copy); verify; retire the old 5000s CTs.