From 003512c01ff04cdf9865c56389102452eb290fff Mon Sep 17 00:00:00 2001
From: Myron Blair <myronblair@gmail.com>
Date: Thu, 23 Jul 2026 22:20:26 -0500
Subject: [PATCH] Add *arr stack + qBittorrent (VPN'd via gluetun) + Portainer
 to compose

---
 docker-compose.yml | 103 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 103 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 2faa32e..bfc9602 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -44,6 +44,8 @@ services:
     volumes:
       # Host media directory (movies, HLS, subtitles) — point at your NAS/ZFS mount
       - ${MEDIA_ROOT_HOST:-./media}:/media
+      # Radarr/Sonarr report absolute file paths under this same path — must match exactly
+      - ${MEDIA_NAS_ROOT:-/mnt/nas/video}:/mnt/nas/video:ro
     networks:
       - streamhoard
     # No direct host port — frontend container reverse-proxies /api → backend:8001
@@ -62,6 +64,105 @@ services:
     networks:
       - streamhoard
 
+  # ============ *arr stack + qBittorrent, all routed through gluetun (NordVPN) ============
+  gluetun:
+    image: qmcgaw/gluetun
+    container_name: streamhoard-gluetun
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      VPN_SERVICE_PROVIDER: custom
+      VPN_TYPE: wireguard
+      WIREGUARD_ENDPOINT_IP: ${VPN_ENDPOINT_IP:?set VPN_ENDPOINT_IP in .env}
+      WIREGUARD_ENDPOINT_PORT: ${VPN_ENDPOINT_PORT:-51820}
+      WIREGUARD_PUBLIC_KEY: ${VPN_PUBLIC_KEY:?set VPN_PUBLIC_KEY in .env}
+      WIREGUARD_PRIVATE_KEY: ${VPN_PRIVATE_KEY:?set VPN_PRIVATE_KEY in .env}
+      WIREGUARD_ADDRESSES: ${VPN_ADDRESSES:-10.5.0.2/16}
+      FIREWALL_OUTBOUND_SUBNETS: 10.48.200.0/24
+    ports:
+      - "8082:8080"   # qBittorrent WebUI
+      - "8989:8989"   # Sonarr
+      - "7878:7878"   # Radarr
+      - "9696:9696"   # Prowlarr
+    networks:
+      - streamhoard
+
+  qbittorrent:
+    image: lscr.io/linuxserver/qbittorrent:latest
+    container_name: streamhoard-qbittorrent
+    restart: unless-stopped
+    network_mode: "service:gluetun"
+    depends_on:
+      - gluetun
+    environment:
+      PUID: 999
+      PGID: 988
+      TZ: ${TZ:-America/Chicago}
+      WEBUI_PORT: 8080
+    volumes:
+      - ${STACK_CONFIG_ROOT:-/opt/streamhoard-config}/qbittorrent/qBittorrent:/config/qBittorrent
+      - ${MEDIA_NAS_ROOT:-/mnt/nas/video}:/mnt/nas/video
+
+  radarr:
+    image: lscr.io/linuxserver/radarr:latest
+    container_name: streamhoard-radarr
+    restart: unless-stopped
+    network_mode: "service:gluetun"
+    depends_on:
+      - gluetun
+    environment:
+      PUID: 999
+      PGID: 988
+      TZ: ${TZ:-America/Chicago}
+    volumes:
+      - ${STACK_CONFIG_ROOT:-/opt/streamhoard-config}/radarr:/config
+      - ${MEDIA_NAS_ROOT:-/mnt/nas/video}:/mnt/nas/video
+
+  sonarr:
+    image: lscr.io/linuxserver/sonarr:latest
+    container_name: streamhoard-sonarr
+    restart: unless-stopped
+    network_mode: "service:gluetun"
+    depends_on:
+      - gluetun
+    environment:
+      PUID: 999
+      PGID: 988
+      TZ: ${TZ:-America/Chicago}
+    volumes:
+      - ${STACK_CONFIG_ROOT:-/opt/streamhoard-config}/sonarr:/config
+      - ${MEDIA_NAS_ROOT:-/mnt/nas/video}:/mnt/nas/video
+
+  prowlarr:
+    image: lscr.io/linuxserver/prowlarr:latest
+    container_name: streamhoard-prowlarr
+    restart: unless-stopped
+    network_mode: "service:gluetun"
+    depends_on:
+      - gluetun
+    environment:
+      PUID: 999
+      PGID: 988
+      TZ: ${TZ:-America/Chicago}
+    volumes:
+      - ${STACK_CONFIG_ROOT:-/opt/streamhoard-config}/prowlarr:/config
+
+  # ============ Docker management GUI ============
+  portainer:
+    image: portainer/portainer-ce:latest
+    container_name: streamhoard-portainer
+    restart: unless-stopped
+    ports:
+      - "9443:9443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - portainer-data:/data
+    networks:
+      - streamhoard
+
 networks:
   streamhoard:
     driver: bridge
@@ -69,3 +170,5 @@ networks:
 volumes:
   mongo-data:
     driver: local
+  portainer-data:
+    driver: local