feat(arr): add prowlarr, radarr and seerr roles

2026-09-18 18:53:43 +02:00
parent 6ba208a455
commit a73fb2aa29
24 changed files with 970 additions and 0 deletions
@@ -0,0 +1,44 @@
+# Prowlarr Role
+
+Deploys [Prowlarr](https://prowlarr.com/) - an indexer manager/proxy for the *arr stack - using Podman with k8s files. The `linuxserver/prowlarr` image bundles Prowlarr and its SQLite database.
+
+## Prerequisites
+
+The `podman` role must have been applied to the host first (shared service, intentionally not declared in `meta/main.yml` to keep prowlarr deploys fast). Order it before `prowlarr` in the playbook for fresh installs.
+
+## Role Variables
+
+See `defaults/main.yml` for all available variables and their default values.
+
+## Storage
+
+- `prowlarr_config_dir` - SQLite database, indexer definitions and API keys. Backed up.
+
+## Ports
+
+| Port                     | Protocol | Purpose |
+| ------------------------ | -------- | ------- |
+| `prowlarr_port` (9696)   | tcp      | Web UI  |
+
+## Nginx Reverse Proxy
+
+Set `prowlarr_nginx_enabled: true` and `prowlarr_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first.
+
+## Backup
+
+The role exposes `prowlarr_backup_paths` (config only). Add a job in the host inventory to include it:
+
+```yaml
+backup_jobs:
+    - name: prowlarr
+      repositories: [next_s3]
+      paths: "{{ prowlarr_backup_paths }}"
+```
+
+## Troubleshooting
+
+```sh
+systemctl --user status prowlarr
+journalctl --user -u prowlarr -f
+podman logs prowlarr
+```
@@ -0,0 +1,21 @@
+---
+# Prowlarr container image and version
+prowlarr_image: lscr.io/linuxserver/prowlarr
+prowlarr_version: latest
+
+# Network
+prowlarr_port: 9696
+
+# Timezone
+prowlarr_timezone: UTC
+
+# Config holds the SQLite database (indexers, API keys, settings)
+prowlarr_config_dir: "{{ podman_projects_dir }}/prowlarr/config"
+
+# Backup manifest - consumed by roles/backup via inventory `backup_jobs`
+prowlarr_backup_paths:
+  - "{{ prowlarr_config_dir }}"
+
+# Nginx reverse proxy configuration
+prowlarr_nginx_enabled: false
+prowlarr_nginx_hostname: prowlarr.nas.local
@@ -0,0 +1,20 @@
+---
+- name: Reload systemd user
+  ansible.builtin.systemd:
+    daemon_reload: true
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Restart Prowlarr
+  ansible.builtin.systemd:
+    name: prowlarr.service
+    state: restarted
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Reload nginx
+  ansible.builtin.systemd:
+    name: nginx
+    state: reloaded
@@ -0,0 +1,2 @@
+---
+dependencies: []
@@ -0,0 +1,104 @@
+---
+- name: Get home directory for {{ ansible_user }}
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ ansible_user }}"
+
+- name: Set user home directory fact
+  ansible.builtin.set_fact:
+    user_home_dir: "{{ ansible_facts['getent_passwd'][ansible_user][4] }}"
+
+- name: Create Prowlarr project directory
+  ansible.builtin.file:
+    path: "{{ podman_projects_dir | default('/opt/podman') }}/prowlarr"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Create Prowlarr state directory
+  ansible.builtin.file:
+    path: "{{ prowlarr_config_dir }}"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0750"
+
+- name: Get current Prowlarr image ID
+  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ prowlarr_image }}:{{ prowlarr_version }}"
+  register: prowlarr_image_before
+  failed_when: false # image may not exist yet on first deploy
+  changed_when: false
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Pull Prowlarr container image
+  ansible.builtin.command: "podman pull --quiet {{ prowlarr_image }}:{{ prowlarr_version }}"
+  register: prowlarr_pull
+  changed_when: prowlarr_pull.stdout != prowlarr_image_before.stdout
+  become: false
+  become_user: "{{ ansible_user }}"
+  notify: Restart Prowlarr
+
+- name: Deploy Kubernetes YAML for Prowlarr
+  ansible.builtin.template:
+    src: prowlarr.yaml.j2
+    dest: "{{ podman_projects_dir | default('/opt/podman') }}/prowlarr/prowlarr.yaml"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0644"
+  notify: Restart Prowlarr
+
+- name: Create systemd user directory for Prowlarr
+  ansible.builtin.file:
+    path: "{{ user_home_dir }}/.config/systemd/user"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Create systemd service for Prowlarr (user scope)
+  ansible.builtin.template:
+    src: prowlarr.service.j2
+    dest: "{{ user_home_dir }}/.config/systemd/user/prowlarr.service"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0644"
+  notify: Reload systemd user
+
+- name: Enable lingering for user {{ ansible_user }}
+  ansible.builtin.command: "loginctl enable-linger {{ ansible_user }}"
+  changed_when: false
+  when: ansible_user != 'root'
+
+- name: Enable and start Prowlarr service (user scope)
+  ansible.builtin.systemd:
+    name: prowlarr.service
+    enabled: true
+    state: started
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Provision TLS certificate for Prowlarr
+  ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
+  vars:
+    certbot_hostname: "{{ prowlarr_nginx_hostname }}"
+  when: prowlarr_nginx_enabled
+
+- name: Deploy nginx vhost configuration for Prowlarr
+  ansible.builtin.template:
+    src: nginx-vhost.conf.j2
+    dest: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/prowlarr.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  when: prowlarr_nginx_enabled
+  notify: Reload nginx
+
+- name: Remove nginx vhost configuration for Prowlarr
+  ansible.builtin.file:
+    path: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/prowlarr.conf"
+    state: absent
+  when: not prowlarr_nginx_enabled
+  notify: Reload nginx
@@ -0,0 +1,58 @@
+# Prowlarr vhost with Let's Encrypt (Certbot)
+# Managed by Ansible - DO NOT EDIT MANUALLY
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ prowlarr_nginx_hostname }};
+
+    # Certbot webroot for ACME challenges
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Redirect to HTTPS
+    location / {
+        return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ prowlarr_nginx_hostname }};
+
+    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate /etc/letsencrypt/live/{{ prowlarr_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ prowlarr_nginx_hostname }}/privkey.pem;
+
+    # SSL configuration
+    ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};
+    ssl_prefer_server_ciphers on;
+
+{% if nginx_log_backend | default('journald') == 'journald' %}
+    access_log syslog:server=unix:/dev/log,nohostname,tag=nginx_prowlarr;
+    error_log syslog:server=unix:/dev/log,nohostname,tag=nginx_prowlarr;
+{% else %}
+    access_log /var/log/nginx/{{ prowlarr_nginx_hostname }}_access.log main;
+    error_log /var/log/nginx/{{ prowlarr_nginx_hostname }}_error.log;
+{% endif %}
+
+    client_max_body_size 20M;
+
+    location / {
+        proxy_pass http://127.0.0.1:{{ prowlarr_port }};
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket support for real-time UI updates
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+}
@@ -0,0 +1,15 @@
+[Unit]
+Description=Prowlarr Indexer Manager
+
+[Service]
+Type=notify
+NotifyAccess=all
+WorkingDirectory={{ podman_projects_dir | default('/opt/podman') }}/prowlarr
+ExecStart=/usr/bin/podman kube play --replace --service-container=true --network=pasta:--map-host-loopback={{ podman_gw_gateway }} prowlarr.yaml
+ExecStop=/usr/bin/podman kube down prowlarr.yaml
+Restart=on-failure
+RestartSec=10
+TimeoutStartSec=180
+
+[Install]
+WantedBy=default.target
@@ -0,0 +1,45 @@
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: prowlarr
+  labels:
+    app: prowlarr
+spec:
+  containers:
+    - name: prowlarr
+      image: {{ prowlarr_image }}:{{ prowlarr_version }}
+      ports:
+        - containerPort: {{ prowlarr_port }}
+          hostPort: {{ prowlarr_port }}
+      env:
+        - name: PUID
+          value: "{{ ansible_facts['getent_passwd'][ansible_user][1] }}"
+        - name: PGID
+          value: "{{ ansible_facts['getent_passwd'][ansible_user][2] }}"
+        - name: TZ
+          value: "{{ prowlarr_timezone }}"
+      volumeMounts:
+        - name: localtime
+          mountPath: /etc/localtime
+          readOnly: true
+        - name: config
+          mountPath: /config
+      livenessProbe:
+        tcpSocket:
+          port: {{ prowlarr_port }}
+        initialDelaySeconds: 60
+        periodSeconds: 30
+        timeoutSeconds: 10
+        failureThreshold: 3
+      restartPolicy: Never
+
+  volumes:
+    - name: localtime
+      hostPath:
+        path: /etc/localtime
+        type: File
+    - name: config
+      hostPath:
+        path: {{ prowlarr_config_dir }}
+        type: Directory