feat(arr): add prowlarr, radarr and seerr roles

2026-09-18 18:53:43 +02:00
parent 6ba208a455
commit a73fb2aa29
24 changed files with 970 additions and 0 deletions
@@ -0,0 +1,50 @@
+# Seerr Role
+
+Deploys [Seerr](https://seerr.dev/) - the media request manager (successor of Overseerr/Jellyseerr) - using Podman with k8s files. Uses the official `ghcr.io/seerr-team/seerr` image.
+
+## Prerequisites
+
+The `podman` role must have been applied to the host first. Order it before `seerr` in the playbook for fresh installs.
+
+## Role Variables
+
+See `defaults/main.yml` for all available variables and their default values.
+
+## First Login
+
+The web UI listens on `http://<host>:{{ seerr_port }}`. Complete the setup wizard, then point Seerr at Jellyfin and the *arr services. Because Seerr runs in a container, reach the host-side services via the pasta gateway (`{{ podman_gw_gateway }}`, default `100.64.0.1`) or `host.containers.internal`, not `localhost`.
+
+## Storage
+
+- `seerr_config_dir` - SQLite database, users, requests and settings. Backed up.
+
+The image runs as the unprivileged `node` user (UID/GID 1000). The pod maps the rootless pod user onto that UID via the `io.podman.annotations.userns` annotation, so the host-owned config directory is writable.
+
+## Ports
+
+| Port                  | Protocol | Purpose |
+| --------------------- | -------- | ------- |
+| `seerr_port` (5055)   | tcp      | Web UI  |
+
+## Nginx Reverse Proxy
+
+Set `seerr_nginx_enabled: true` and `seerr_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first.
+
+## Backup
+
+The role exposes `seerr_backup_paths` (config only). Add a job in the host inventory to include it:
+
+```yaml
+backup_jobs:
+    - name: seerr
+      repositories: [next_s3]
+      paths: "{{ seerr_backup_paths }}"
+```
+
+## Troubleshooting
+
+```sh
+systemctl --user status seerr
+journalctl --user -u seerr -f
+podman logs seerr
+```
@@ -0,0 +1,28 @@
+---
+# Seerr container image and version
+seerr_image: ghcr.io/seerr-team/seerr
+seerr_version: latest
+
+# Network
+seerr_port: 5055
+
+# Timezone and log level (error/warn/info/debug)
+seerr_timezone: UTC
+seerr_log_level: info
+
+# Config holds the SQLite database (users, requests, settings)
+seerr_config_dir: "{{ podman_projects_dir }}/seerr/config"
+
+# The image runs as the unprivileged `node` user (UID/GID 1000). Rootless
+# podman maps the pod user onto that UID so the container can write the
+# host-owned config directory.
+seerr_container_uid: 1000
+seerr_container_gid: 1000
+
+# Backup manifest - consumed by roles/backup via inventory `backup_jobs`
+seerr_backup_paths:
+  - "{{ seerr_config_dir }}"
+
+# Nginx reverse proxy configuration
+seerr_nginx_enabled: false
+seerr_nginx_hostname: seerr.nas.local
@@ -0,0 +1,20 @@
+---
+- name: Reload systemd user
+  ansible.builtin.systemd:
+    daemon_reload: true
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Restart Seerr
+  ansible.builtin.systemd:
+    name: seerr.service
+    state: restarted
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Reload nginx
+  ansible.builtin.systemd:
+    name: nginx
+    state: reloaded
@@ -0,0 +1,2 @@
+---
+dependencies: []
@@ -0,0 +1,104 @@
+---
+- name: Get home directory for {{ ansible_user }}
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ ansible_user }}"
+
+- name: Set user home directory fact
+  ansible.builtin.set_fact:
+    user_home_dir: "{{ ansible_facts['getent_passwd'][ansible_user][4] }}"
+
+- name: Create Seerr project directory
+  ansible.builtin.file:
+    path: "{{ podman_projects_dir | default('/opt/podman') }}/seerr"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Create Seerr state directory
+  ansible.builtin.file:
+    path: "{{ seerr_config_dir }}"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0750"
+
+- name: Get current Seerr image ID
+  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ seerr_image }}:{{ seerr_version }}"
+  register: seerr_image_before
+  failed_when: false # image may not exist yet on first deploy
+  changed_when: false
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Pull Seerr container image
+  ansible.builtin.command: "podman pull --quiet {{ seerr_image }}:{{ seerr_version }}"
+  register: seerr_pull
+  changed_when: seerr_pull.stdout != seerr_image_before.stdout
+  become: false
+  become_user: "{{ ansible_user }}"
+  notify: Restart Seerr
+
+- name: Deploy Kubernetes YAML for Seerr
+  ansible.builtin.template:
+    src: seerr.yaml.j2
+    dest: "{{ podman_projects_dir | default('/opt/podman') }}/seerr/seerr.yaml"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0644"
+  notify: Restart Seerr
+
+- name: Create systemd user directory for Seerr
+  ansible.builtin.file:
+    path: "{{ user_home_dir }}/.config/systemd/user"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Create systemd service for Seerr (user scope)
+  ansible.builtin.template:
+    src: seerr.service.j2
+    dest: "{{ user_home_dir }}/.config/systemd/user/seerr.service"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0644"
+  notify: Reload systemd user
+
+- name: Enable lingering for user {{ ansible_user }}
+  ansible.builtin.command: "loginctl enable-linger {{ ansible_user }}"
+  changed_when: false
+  when: ansible_user != 'root'
+
+- name: Enable and start Seerr service (user scope)
+  ansible.builtin.systemd:
+    name: seerr.service
+    enabled: true
+    state: started
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Provision TLS certificate for Seerr
+  ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
+  vars:
+    certbot_hostname: "{{ seerr_nginx_hostname }}"
+  when: seerr_nginx_enabled
+
+- name: Deploy nginx vhost configuration for Seerr
+  ansible.builtin.template:
+    src: nginx-vhost.conf.j2
+    dest: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/seerr.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  when: seerr_nginx_enabled
+  notify: Reload nginx
+
+- name: Remove nginx vhost configuration for Seerr
+  ansible.builtin.file:
+    path: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/seerr.conf"
+    state: absent
+  when: not seerr_nginx_enabled
+  notify: Reload nginx
@@ -0,0 +1,58 @@
+# Seerr vhost with Let's Encrypt (Certbot)
+# Managed by Ansible - DO NOT EDIT MANUALLY
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ seerr_nginx_hostname }};
+
+    # Certbot webroot for ACME challenges
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Redirect to HTTPS
+    location / {
+        return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ seerr_nginx_hostname }};
+
+    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate /etc/letsencrypt/live/{{ seerr_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ seerr_nginx_hostname }}/privkey.pem;
+
+    # SSL configuration
+    ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};
+    ssl_prefer_server_ciphers on;
+
+{% if nginx_log_backend | default('journald') == 'journald' %}
+    access_log syslog:server=unix:/dev/log,nohostname,tag=nginx_seerr;
+    error_log syslog:server=unix:/dev/log,nohostname,tag=nginx_seerr;
+{% else %}
+    access_log /var/log/nginx/{{ seerr_nginx_hostname }}_access.log main;
+    error_log /var/log/nginx/{{ seerr_nginx_hostname }}_error.log;
+{% endif %}
+
+    client_max_body_size 20M;
+
+    location / {
+        proxy_pass http://127.0.0.1:{{ seerr_port }};
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket support for real-time UI updates
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+}
@@ -0,0 +1,15 @@
+[Unit]
+Description=Seerr Media Request Manager
+
+[Service]
+Type=notify
+NotifyAccess=all
+WorkingDirectory={{ podman_projects_dir | default('/opt/podman') }}/seerr
+ExecStart=/usr/bin/podman kube play --replace --service-container=true --network=pasta:--map-host-loopback={{ podman_gw_gateway }} seerr.yaml
+ExecStop=/usr/bin/podman kube down seerr.yaml
+Restart=on-failure
+RestartSec=10
+TimeoutStartSec=180
+
+[Install]
+WantedBy=default.target
@@ -0,0 +1,50 @@
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: seerr
+  labels:
+    app: seerr
+  annotations:
+    # Map the rootless pod user onto the image's `node` UID/GID so it can
+    # write the host-owned config directory.
+    io.podman.annotations.userns: "keep-id:uid={{ seerr_container_uid }},gid={{ seerr_container_gid }}"
+spec:
+  containers:
+    - name: seerr
+      image: {{ seerr_image }}:{{ seerr_version }}
+      ports:
+        - containerPort: {{ seerr_port }}
+          hostPort: {{ seerr_port }}
+      env:
+        - name: TZ
+          value: "{{ seerr_timezone }}"
+        - name: LOG_LEVEL
+          value: "{{ seerr_log_level }}"
+        - name: PORT
+          value: "{{ seerr_port }}"
+      volumeMounts:
+        - name: localtime
+          mountPath: /etc/localtime
+          readOnly: true
+        - name: config
+          mountPath: /app/config
+      livenessProbe:
+        httpGet:
+          path: /api/v1/settings/public
+          port: {{ seerr_port }}
+        initialDelaySeconds: 60
+        periodSeconds: 30
+        timeoutSeconds: 10
+        failureThreshold: 3
+      restartPolicy: Never
+
+  volumes:
+    - name: localtime
+      hostPath:
+        path: /etc/localtime
+        type: File
+    - name: config
+      hostPath:
+        path: {{ seerr_config_dir }}
+        type: Directory