docker-compose.yml

# ============================================================================
#  TorBox Media Server - Docker Compose
#
#  This file is version-controlled in the repo and copied verbatim to the
#  install directory by setup.sh. Hardware acceleration tweaks live in
#  docker-compose.override.yml (auto-generated, do not edit by hand).
#
#  It IS expected that users edit this file post-install for LAN access
#  (changing 127.0.0.1:PORT:PORT to PORT:PORT — see README "Accessing From
#  Other Devices"). Any such edits are preserved across `./manage.sh update`,
#  but will be overwritten if you re-run `./setup.sh`.
# ============================================================================

networks:
  media-network:
    driver: bridge

services:
  # ── Decypharr ──────────────────────────────────────────────────
  # Mocks qBittorrent API for Radarr/Sonarr, connects to TorBox,
  # handles WebDAV mounting via built-in rclone, and creates symlinks.
  decypharr:
    image: ghcr.io/sirrobot01/decypharr:v2.0
    container_name: decypharr
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:8282:8282"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - UMASK=002
    volumes:
      - "${CONFIG_DIR}/decypharr/config.json:/app/config.json"
      - "${MOUNT_DIR}:/mnt/remote:rshared"
      - "${DATA_DIR}:/data"
    devices:
      - /dev/fuse:/dev/fuse:rwm
    cap_add:
      - SYS_ADMIN
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8282 || wget -qO- http://localhost:8282 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    security_opt:
      # Harmless on systems without AppArmor (e.g. CachyOS)
      - apparmor:unconfined
    deploy:
      resources:
        limits:
          memory: 1g

  # ── Prowlarr ───────────────────────────────────────────────────
  # Indexer manager - feeds search results to Radarr & Sonarr.
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:2.3.5
    container_name: prowlarr
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:9696:9696"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    cap_drop:
      - ALL
    depends_on:
      byparr:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:9696/ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - "${CONFIG_DIR}/prowlarr:/config"
    deploy:
      resources:
        limits:
          memory: 512m

  # ── Byparr ────────────────────────────────────────────────────
  # Cloudflare bypass proxy (Byparr - drop-in FlareSolverr replacement).
  byparr:
    image: ghcr.io/thephaseless/byparr:v1.0.0
    container_name: byparr
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:8191:8191"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      - LOG_LEVEL=info
      - LOG_HTML=false
      - TZ=${TZ:-UTC}
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8191"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 1g

  # ── Radarr ─────────────────────────────────────────────────────
  # Movie management - searches, grabs, and organizes movies.
  # Uses Decypharr as its download client (qBittorrent mock).
  radarr:
    image: lscr.io/linuxserver/radarr:5.22.4
    container_name: radarr
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:7878:7878"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    cap_drop:
      - ALL
    depends_on:
      decypharr:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:7878/ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - "${CONFIG_DIR}/radarr:/config"
      - "${DATA_DIR}:/data"
      - "${MOUNT_DIR}:/mnt/remote:rslave"
    deploy:
      resources:
        limits:
          memory: 1g

  # ── Sonarr ─────────────────────────────────────────────────────
  # TV show management - searches, grabs, and organizes series.
  # Uses Decypharr as its download client (qBittorrent mock).
  sonarr:
    image: lscr.io/linuxserver/sonarr:4.0.14
    container_name: sonarr
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:8989:8989"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    cap_drop:
      - ALL
    depends_on:
      decypharr:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8989/ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - "${CONFIG_DIR}/sonarr:/config"
      - "${DATA_DIR}:/data"
      - "${MOUNT_DIR}:/mnt/remote:rslave"
    deploy:
      resources:
        limits:
          memory: 1g

  # ── Seerr ───────────────────────────────────────────────────────
  # Media request & discovery frontend.
  seerr:
    image: ghcr.io/seerr-team/seerr:v3.2.0
    container_name: seerr
    user: "${PUID:-1000}:${PGID:-1000}"
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:5055:5055"
    environment:
      - TZ=${TZ:-UTC}
    depends_on:
      radarr:
        condition: service_healthy
      sonarr:
        condition: service_healthy
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:5055"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    volumes:
      - "${CONFIG_DIR}/seerr:/app/config"
    deploy:
      resources:
        limits:
          memory: 1g

  # ── Plex ───────────────────────────────────────────────────────
  # Media server option 1 - streams your library to any device.
  # Activated via COMPOSE_PROFILES=plex in .env
  plex:
    image: lscr.io/linuxserver/plex:1.41.5
    profiles: ["plex"]
    container_name: plex
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:32400:32400"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
      - VERSION=docker
      - PLEX_CLAIM=${PLEX_CLAIM:-}
    cap_drop:
      - ALL
    depends_on:
      decypharr:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:32400/identity"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    volumes:
      - "${CONFIG_DIR}/plex:/config"
      - "${DATA_DIR}:/data"
      - "${MOUNT_DIR}:/mnt/remote:rslave"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      resources:
        limits:
          memory: 4g

  # ── Jellyfin ───────────────────────────────────────────────────
  # Media server option 2 (open-source) - streams your library.
  # Activated via COMPOSE_PROFILES=jellyfin in .env
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:10.10.7
    profiles: ["jellyfin"]
    container_name: jellyfin
    restart: unless-stopped
    networks:
      - media-network
    ports:
      - "127.0.0.1:8096:8096"
      # 8920 is Jellyfin's HTTPS listener — only needed if you terminate TLS
      # inside the container (uncommon; most users use a reverse proxy instead).
      # Uncomment if you configure Jellyfin's built-in HTTPS:
      # - "127.0.0.1:8920:8920"
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-UTC}
      - JELLYFIN_PublishedServerUrl=${JELLYFIN_PUBLISHED_URL:-http://localhost:8096}
    cap_drop:
      - ALL
    depends_on:
      decypharr:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8096/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - "${CONFIG_DIR}/jellyfin:/config"
      - "${DATA_DIR}:/data"
      - "${MOUNT_DIR}:/mnt/remote:rslave"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      resources:
        limits:
          memory: 4g