Sonarr, Radarr, Lidarr, Prowlarr, Transmission¶
One combined stack ("the arr stack"): Transmission downloads into a shared
downloads volume, the arr apps import from it into a shared media
library, and each app keeps its own config volume and its own Traefik
router.
| Runtime | Container (Docker Swarm), 5 services |
| Tier | Media |
| Node | swarm-media |
| Auth | Forward-auth (authentik@swarm) on all five |
| Source | ansible/stacks/media/arr/ |
| Service | Image:tag | Internal port | URL | Volumes |
|---|---|---|---|---|
| Sonarr | lscr.io/linuxserver/sonarr:4.0.19.2979 |
8989 | sonarr.lab.riversfamily.uk |
sonarr_config, media, downloads |
| Radarr | lscr.io/linuxserver/radarr:6.3.0.10514 |
7878 | radarr.lab.riversfamily.uk |
radarr_config, media, downloads |
| Lidarr | lscr.io/linuxserver/lidarr:3.1.0.4875 |
8686 | lidarr.lab.riversfamily.uk |
lidarr_config, media, downloads |
| Prowlarr | lscr.io/linuxserver/prowlarr:2.5.2.5491 |
9696 | prowlarr.lab.riversfamily.uk |
prowlarr_config only |
| Transmission | lscr.io/linuxserver/transmission:4.1.3 |
9091 | transmission.lab.riversfamily.uk |
transmission_config, downloads |
Environment is identical across all five: PUID=1000, PGID=1000,
TZ={{ timezone | default('Etc/UTC') }}.
Volumes¶
All bare Swarm volumes, no NFS driver options.
| Volume | Shared by | Contents |
|---|---|---|
downloads |
Transmission, Sonarr, Radarr, Lidarr | In-progress and completed downloads |
media |
Sonarr, Radarr, Lidarr | The organised media library |
*_config |
Each app has its own | Per-app settings and database |
Networking¶
All five services join both the shared traefik network (each has its own
Traefik route) and this stack's private internal network. This differs
from every other multi-container stack: there, only the routed service joins
traefik and the rest are internal-only. Here every service is
individually routed, so internal is additional rather than a replacement —
it carries the apps' inter-service RPC (Prowlarr sync, arr-to-Transmission)
instead of that traffic riding the network shared with every other stack.
Secrets¶
None. No vault_* variables are consumed by this stack — first-run setup
for each app is left to its web UI, gated by forward-auth.
Gotchas¶
- Transmission has no VPN. It sits on the shared
traefikoverlay network like every other service; there is no VPN sidecar or separate egress network. Accepted, not a bug. - Transmission has no web login of its own; forward-auth is its only
gate. The arr apps reach Transmission's RPC over the private
internalnetwork by service name, not through Traefik, so the forward-auth gate does not block that inter-service traffic — only browser access to the Transmission web UI goes through Traefik+Authentik. - No
depends_on:exists anywhere (Swarm mode doesn't use it); the dependency between Transmission and the arr apps is purely volume- and network-based, not startup-ordered.