docker-compose.yml

# ============================================================================
#  TorBox Media Server - Docker Compose
#
#  This file is version-controlled in the repo and copied verbatim to the
#  install directory by setup.sh. Hardware acceleration tweaks live in
#  docker-compose.override.yml (auto-generated, do not edit by hand).
#
#  It IS expected that users edit this file post-install for LAN access
#  (changing 127.0.0.1:PORT:PORT to PORT:PORT — see README "Accessing From
#  Other Devices"). Any such edits are preserved across `./manage.sh update`,
#  but will be overwritten if you re-run `./setup.sh`.
# ============================================================================

networks:
  media-network:
    driver: bridge

services:
  # ── Decypharr ──────────────────────────────────────────────────
  # Mocks qBittorrent API for Radarr/Sonarr, connects to TorBox,
  # handles WebDAV mounting via built-in rclone, and creates symlinks.
  #
  # We build a thin local image (Dockerfile.decypharr) on top of the
  # upstream release.  The only change is an `adduser` for UID 1000 so
  # that fusermount3 can resolve the username when the container runs as
  # a non-root user (fixes issue #24 / regression from #23).
  decypharr:
    build:
      context: .
      dockerfile: Dockerfile.decypharr
      args:
        DECYPHARR_VERSION: "v2.4"
    image: torbox-decypharr:v2.4
    container_name: decypharr
    user: "${PUID:-1000}:${PGID:-1000}"
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:8282:8282"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - UMASK=002
    volumes:
      - "${CONFIG_DIR}/decypharr:/app"
      - "${MOUNT_DIR}:/mnt/remote:rshared"
      - "${DATA_DIR}:/data"
    devices:
      - /dev/fuse:/dev/fuse:rwm
    cap_add:
      - SYS_ADMIN
      - SETGID
      - SETUID
      - CHOWN
      - DAC_OVERRIDE
      - DAC_READ_SEARCH
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8282 || wget -qO- http://localhost:8282 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    security_opt:
      # Harmless on systems without AppArmor (e.g. CachyOS)
      - apparmor:unconfined
    deploy:
      resources:
        limits:
          memory: 1g

  # ── Prowlarr ───────────────────────────────────────────────────
  # Indexer manager - feeds search results to Radarr & Sonarr.
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:2.4.0
    container_name: prowlarr
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:9696:9696"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    cap_add:
      - SETGID
      - SETUID
      - CHOWN
      - DAC_OVERRIDE
    cap_drop:
      - ALL
    depends_on:
      byparr:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:9696/ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - "${CONFIG_DIR}/prowlarr:/config"
    deploy:
      resources:
        limits:
          memory: 512m

  # ── Byparr ────────────────────────────────────────────────────
  # Cloudflare bypass proxy (Byparr - drop-in FlareSolverr replacement).
  byparr:
    image: ghcr.io/thephaseless/byparr:2.1.0
    container_name: byparr
    user: "${PUID:-1000}:${PGID:-1000}"
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:8191:8191"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      - LOG_LEVEL=info
      - LOG_HTML=false
      - TZ=${TZ:-UTC}
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8191"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 1g
  # ── Radarr ─────────────────────────────────────────────────────
  # Movie management - searches, grabs, and organizes movies.
  # Uses Decypharr as its download client (qBittorrent mock).
  radarr:
    image: lscr.io/linuxserver/radarr:5.27.5
    container_name: radarr
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:7878:7878"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    cap_add:
      - SETGID
      - SETUID
      - CHOWN
      - DAC_OVERRIDE
    cap_drop:
      - ALL
    depends_on:
      decypharr:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:7878/ping"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 180s
    volumes:
      - "${CONFIG_DIR}/radarr:/config"
      - "${DATA_DIR}:/data"
      - "${MOUNT_DIR}:/mnt/remote:rslave"
    deploy:
      resources:
        limits:
          memory: 1g

  # ── Sonarr ─────────────────────────────────────────────────────
  # TV show management - searches, grabs, and organizes series.
  # Uses Decypharr as its download client (qBittorrent mock).
  sonarr:
    image: lscr.io/linuxserver/sonarr:4.0.15
    container_name: sonarr
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:8989:8989"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    cap_add:
      - SETGID
      - SETUID
      - CHOWN
      - DAC_OVERRIDE
    cap_drop:
      - ALL
    depends_on:
      decypharr:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8989/ping"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 180s
    volumes:
      - "${CONFIG_DIR}/sonarr:/config"
      - "${DATA_DIR}:/data"
      - "${MOUNT_DIR}:/mnt/remote:rslave"
    deploy:
      resources:
        limits:
          memory: 1g

  # ── Seerr ───────────────────────────────────────────────────────
  # Media request & discovery frontend.
  seerr:
    image: ghcr.io/seerr-team/seerr:v3.4.0
    container_name: seerr
    user: "${PUID:-1000}:${PGID:-1000}"
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:5055:5055"
    environment:
      - TZ=${TZ:-UTC}
    depends_on:
      radarr:
        condition: service_started
      sonarr:
        condition: service_started
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:5055/api/v1/status"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    volumes:
      - "${CONFIG_DIR}/seerr:/app/config"
    deploy:
      resources:
        limits:
          memory: 1g

  # ── Plex ───────────────────────────────────────────────────────
  # Media server option 1 - streams your library to any device.
  # Activated via COMPOSE_PROFILES=plex in .env
  plex:
    image: lscr.io/linuxserver/plex:1.43.2
    profiles: ["plex"]
    container_name: plex
    user: "${PUID:-1000}:${PGID:-1000}"
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:32400:32400"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
      - VERSION=docker
      - PLEX_CLAIM=${PLEX_CLAIM:-}
    cap_add:
      - SETGID
      - SETUID
      - CHOWN
      - DAC_OVERRIDE
    cap_drop:
      - ALL
    depends_on:
      decypharr:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:32400/identity"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    volumes:
      - "${CONFIG_DIR}/plex:/config"
      - "${DATA_DIR}:/data"
      - "${MOUNT_DIR}:/mnt/remote:rslave"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      resources:
        limits:
          memory: 4g

  # ── Jellyfin ───────────────────────────────────────────────────
  # Media server option 2 (open-source) - streams your library.
  # Activated via COMPOSE_PROFILES=jellyfin in .env
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:10.11.10
    profiles: ["jellyfin"]
    container_name: jellyfin
    user: "${PUID:-1000}:${PGID:-1000}"
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:8096:8096"
      # 8920 is Jellyfin's HTTPS listener — only needed if you terminate TLS
      # inside the container (uncommon; most users use a reverse proxy instead).
      # Uncomment if you configure Jellyfin's built-in HTTPS:
      # - "127.0.0.1:8920:8920"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
      - JELLYFIN_PublishedServerUrl=${JELLYFIN_PUBLISHED_URL:-http://localhost:8096}
    cap_add:
      - SETGID
      - SETUID
      - CHOWN
      - DAC_OVERRIDE
    cap_drop:
      - ALL
    depends_on:
      decypharr:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8096/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - "${CONFIG_DIR}/jellyfin:/config"
      - "${DATA_DIR}:/data"
      - "${MOUNT_DIR}:/mnt/remote:rslave"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      resources:
        limits:
          memory: 4g