arrstack/.env.example at main · abarbarich/arrstack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
##############################################################################
# ArrStack configuration. Copy to .env and edit:   cp .env.example .env
##############################################################################

# ─── Identity / permissions ────────────────────────────────────────────────
# Run `id <your-user>` on the host to get these. All apps read/write the media
# tree as this UID:GID, so it must own ${DATA_ROOT}.
PUID=1000
PGID=1000
# umask 002 => new files are group-writable (needed for the shared media user).
UMASK=002
# IANA timezone, e.g. Pacific/Auckland, Europe/London, America/New_York.
TZ=Etc/UTC

# ─── Storage ────────────────────────────────────────────────────────────────
# DATA_ROOT is the ONE tree that holds both downloads and the media library.
# It must be a single filesystem so hardlinks work:
#     ${DATA_ROOT}/torrents          <- qBittorrent saves here
#     ${DATA_ROOT}/media/{movies,tv,music}  <- Sonarr/Radarr/Lidarr import here
# On Proxmox this is typically the ext4 disk bind-mounted into the CT
# (see scripts/setup-storage.sh). Locally it can be any path.
DATA_ROOT=./data

# Where each app keeps its own config/database. Small; fine on the CT rootfs.
CONFIG_ROOT=./config

# ─── FlareSolverr / Jellyseerr log levels (optional) ────────────────────────
FLARESOLVERR_LOG_LEVEL=info
JELLYSEERR_LOG_LEVEL=info

##############################################################################
# Jellyfin (optional) — only used with the Jellyfin overlay,
# docker-compose.jellyfin.yml
#
# Runs the media server in this stack, reading the library off the local disk
# instead of a network share. Enable it via COMPOSE_FILE (see the VPN block
# below — the same variable turns on either overlay, or both).
##############################################################################

# The URL LAN clients should use when they find the server by auto-discovery.
# Leave blank to let Jellyfin guess; set it if discovery hands out the wrong
# address, e.g. http://192.168.1.50:8096 or http://jellyfin.home
JELLYFIN_PUBLISHED_URL=

# Size of the in-RAM transcoding scratch area. Must fit in the host's RAM —
# lower it to 1g on a small box, raise it if you transcode 4K.
JELLYFIN_TRANSCODE_TMPFS_SIZE=2g

##############################################################################
# VPN (optional) — only used with the gluetun overlay, docker-compose.vpn.yml
#
# Leave this whole block alone if you don't want a VPN. To enable, uncomment
# the COMPOSE_FILE line below (or pass -f docker-compose.vpn.yml) and fill in
# your provider details. Only qBittorrent is routed through the tunnel.
#
# Full provider list + exact values: https://github.com/qdm12/gluetun-wiki
##############################################################################
# COMPOSE_FILE is how you turn on ANY overlay — list every file you want, in
# order, separated by colons. Pick the one line that matches your setup:
#
#   VPN only:       COMPOSE_FILE=docker-compose.yml:docker-compose.vpn.yml
#   Jellyfin only:  COMPOSE_FILE=docker-compose.yml:docker-compose.jellyfin.yml
#   Both:           COMPOSE_FILE=docker-compose.yml:docker-compose.vpn.yml:docker-compose.jellyfin.yml
# COMPOSE_FILE=docker-compose.yml:docker-compose.vpn.yml

# Provider name as gluetun expects it, e.g. mullvad, protonvpn, pia, nordvpn…
VPN_SERVICE_PROVIDER=mullvad
# wireguard (recommended) or openvpn
VPN_TYPE=wireguard

# --- WireGuard (VPN_TYPE=wireguard) ---
WIREGUARD_PRIVATE_KEY=
WIREGUARD_ADDRESSES=10.64.0.2/32

# --- OpenVPN (VPN_TYPE=openvpn) ---
OPENVPN_USER=
OPENVPN_PASSWORD=

# Optional server pin, e.g. "Netherlands" or "Switzerland,Sweden".
VPN_SERVER_COUNTRIES=

# Your LAN subnet — lets local machines reach the qBittorrent WebUI while the
# rest of qBittorrent's traffic stays inside the tunnel.
LAN_SUBNET=192.168.0.0/16