feat(arr): add prowlarr, radarr and seerr roles

roles/radarr/README.md

@@ -0,0 +1,48 @@
+# Radarr Role
+
+Deploys [Radarr](https://radarr.video/) - a movie collection manager for Usenet and BitTorrent - using Podman with k8s files. The `linuxserver/radarr` image bundles Radarr and its SQLite database.
+
+## Prerequisites
+
+The `podman` role must have been applied to the host first. Order it before `radarr` in the playbook for fresh installs.
+
+## Role Variables
+
+See `defaults/main.yml` for all available variables and their default values.
+
+## Storage
+
+- `radarr_config_dir` - SQLite database, library and API keys. Backed up.
+- `radarr_movies_dir` - movie library, mounted read-write at `/movies`. Use `/movies` as the root folder in the Radarr UI.
+- `radarr_downloads_dir` - completed downloads, shared with Deluge. Mounted read-write at `/downloads`; point the download client there.
+
+`radarr_movies_dir` lives on ZFS (`/mnt/andromeda`), `radarr_downloads_dir` under `{{ podman_projects_dir }}` - cross-filesystem imports are copies, not hardlinks.
+
+## Ports
+
+| Port                   | Protocol | Purpose |
+| ---------------------- | -------- | ------- |
+| `radarr_port` (7878)   | tcp      | Web UI  |
+
+## Nginx Reverse Proxy
+
+Set `radarr_nginx_enabled: true` and `radarr_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first.
+
+## Backup
+
+The role exposes `radarr_backup_paths` (config only). Add a job in the host inventory to include it:
+
+```yaml
+backup_jobs:
+    - name: radarr
+      repositories: [next_s3]
+      paths: "{{ radarr_backup_paths }}"
+```
+
+## Troubleshooting
+
+```sh
+systemctl --user status radarr
+journalctl --user -u radarr -f
+podman logs radarr
+```

roles/radarr/defaults/main.yml

@@ -0,0 +1,27 @@
+---
+# Radarr container image and version
+radarr_image: lscr.io/linuxserver/radarr
+radarr_version: latest
+
+# Network
+radarr_port: 7878
+
+# Timezone
+radarr_timezone: UTC
+
+# Config holds the SQLite database (library, indexers, download clients)
+radarr_config_dir: "{{ podman_projects_dir }}/radarr/config"
+
+# Movie library (root folder in the Radarr UI -> /movies)
+radarr_movies_dir: /mnt/andromeda/movies
+
+# Completed downloads, shared with the download client (-> /downloads)
+radarr_downloads_dir: "{{ podman_projects_dir }}/deluge/downloads"
+
+# Backup manifest - consumed by roles/backup via inventory `backup_jobs`
+radarr_backup_paths:
+  - "{{ radarr_config_dir }}"
+
+# Nginx reverse proxy configuration
+radarr_nginx_enabled: false
+radarr_nginx_hostname: radarr.nas.local

roles/radarr/handlers/main.yml

@@ -0,0 +1,20 @@
+---
+- name: Reload systemd user
+  ansible.builtin.systemd:
+    daemon_reload: true
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Restart Radarr
+  ansible.builtin.systemd:
+    name: radarr.service
+    state: restarted
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Reload nginx
+  ansible.builtin.systemd:
+    name: nginx
+    state: reloaded

roles/radarr/meta/main.yml

@@ -0,0 +1,2 @@
+---
+dependencies: []

roles/radarr/tasks/main.yml

@@ -0,0 +1,107 @@
+---
+- name: Get home directory for {{ ansible_user }}
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ ansible_user }}"
+
+- name: Set user home directory fact
+  ansible.builtin.set_fact:
+    user_home_dir: "{{ ansible_facts['getent_passwd'][ansible_user][4] }}"
+
+- name: Create Radarr project directory
+  ansible.builtin.file:
+    path: "{{ podman_projects_dir | default('/opt/podman') }}/radarr"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Create Radarr state directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0750"
+  loop:
+    - "{{ radarr_config_dir }}"
+    - "{{ radarr_downloads_dir }}"
+
+- name: Get current Radarr image ID
+  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ radarr_image }}:{{ radarr_version }}"
+  register: radarr_image_before
+  failed_when: false # image may not exist yet on first deploy
+  changed_when: false
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Pull Radarr container image
+  ansible.builtin.command: "podman pull --quiet {{ radarr_image }}:{{ radarr_version }}"
+  register: radarr_pull
+  changed_when: radarr_pull.stdout != radarr_image_before.stdout
+  become: false
+  become_user: "{{ ansible_user }}"
+  notify: Restart Radarr
+
+- name: Deploy Kubernetes YAML for Radarr
+  ansible.builtin.template:
+    src: radarr.yaml.j2
+    dest: "{{ podman_projects_dir | default('/opt/podman') }}/radarr/radarr.yaml"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0644"
+  notify: Restart Radarr
+
+- name: Create systemd user directory for Radarr
+  ansible.builtin.file:
+    path: "{{ user_home_dir }}/.config/systemd/user"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Create systemd service for Radarr (user scope)
+  ansible.builtin.template:
+    src: radarr.service.j2
+    dest: "{{ user_home_dir }}/.config/systemd/user/radarr.service"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0644"
+  notify: Reload systemd user
+
+- name: Enable lingering for user {{ ansible_user }}
+  ansible.builtin.command: "loginctl enable-linger {{ ansible_user }}"
+  changed_when: false
+  when: ansible_user != 'root'
+
+- name: Enable and start Radarr service (user scope)
+  ansible.builtin.systemd:
+    name: radarr.service
+    enabled: true
+    state: started
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Provision TLS certificate for Radarr
+  ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
+  vars:
+    certbot_hostname: "{{ radarr_nginx_hostname }}"
+  when: radarr_nginx_enabled
+
+- name: Deploy nginx vhost configuration for Radarr
+  ansible.builtin.template:
+    src: nginx-vhost.conf.j2
+    dest: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/radarr.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  when: radarr_nginx_enabled
+  notify: Reload nginx
+
+- name: Remove nginx vhost configuration for Radarr
+  ansible.builtin.file:
+    path: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/radarr.conf"
+    state: absent
+  when: not radarr_nginx_enabled
+  notify: Reload nginx

roles/radarr/templates/nginx-vhost.conf.j2

@@ -0,0 +1,58 @@
+# Radarr vhost with Let's Encrypt (Certbot)
+# Managed by Ansible - DO NOT EDIT MANUALLY
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ radarr_nginx_hostname }};
+
+    # Certbot webroot for ACME challenges
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Redirect to HTTPS
+    location / {
+        return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ radarr_nginx_hostname }};
+
+    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate /etc/letsencrypt/live/{{ radarr_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ radarr_nginx_hostname }}/privkey.pem;
+
+    # SSL configuration
+    ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};
+    ssl_prefer_server_ciphers on;
+
+{% if nginx_log_backend | default('journald') == 'journald' %}
+    access_log syslog:server=unix:/dev/log,nohostname,tag=nginx_radarr;
+    error_log syslog:server=unix:/dev/log,nohostname,tag=nginx_radarr;
+{% else %}
+    access_log /var/log/nginx/{{ radarr_nginx_hostname }}_access.log main;
+    error_log /var/log/nginx/{{ radarr_nginx_hostname }}_error.log;
+{% endif %}
+
+    client_max_body_size 20M;
+
+    location / {
+        proxy_pass http://127.0.0.1:{{ radarr_port }};
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket support for real-time UI updates
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+}

roles/radarr/templates/radarr.service.j2

@@ -0,0 +1,15 @@
+[Unit]
+Description=Radarr Movie Manager
+
+[Service]
+Type=notify
+NotifyAccess=all
+WorkingDirectory={{ podman_projects_dir | default('/opt/podman') }}/radarr
+ExecStart=/usr/bin/podman kube play --replace --service-container=true --network=pasta:--map-host-loopback={{ podman_gw_gateway }} radarr.yaml
+ExecStop=/usr/bin/podman kube down radarr.yaml
+Restart=on-failure
+RestartSec=10
+TimeoutStartSec=180
+
+[Install]
+WantedBy=default.target

roles/radarr/templates/radarr.yaml.j2

@@ -0,0 +1,57 @@
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: radarr
+  labels:
+    app: radarr
+spec:
+  containers:
+    - name: radarr
+      image: {{ radarr_image }}:{{ radarr_version }}
+      ports:
+        - containerPort: {{ radarr_port }}
+          hostPort: {{ radarr_port }}
+      env:
+        - name: PUID
+          value: "{{ ansible_facts['getent_passwd'][ansible_user][1] }}"
+        - name: PGID
+          value: "{{ ansible_facts['getent_passwd'][ansible_user][2] }}"
+        - name: TZ
+          value: "{{ radarr_timezone }}"
+      volumeMounts:
+        - name: localtime
+          mountPath: /etc/localtime
+          readOnly: true
+        - name: config
+          mountPath: /config
+        - name: movies
+          mountPath: /movies
+        - name: downloads
+          mountPath: /downloads
+      livenessProbe:
+        tcpSocket:
+          port: {{ radarr_port }}
+        initialDelaySeconds: 60
+        periodSeconds: 30
+        timeoutSeconds: 10
+        failureThreshold: 3
+      restartPolicy: Never
+
+  volumes:
+    - name: localtime
+      hostPath:
+        path: /etc/localtime
+        type: File
+    - name: config
+      hostPath:
+        path: {{ radarr_config_dir }}
+        type: Directory
+    - name: movies
+      hostPath:
+        path: {{ radarr_movies_dir }}
+        type: Directory
+    - name: downloads
+      hostPath:
+        path: {{ radarr_downloads_dir }}
+        type: Directory