Files

T

History

Clément Désiles 5efc0b0d6e fix(nginx): make Let's Encrypt opt-in per service

certbot cannot issue for internal hostnames (*.nas.local), which made
nginx-enabled services with internal names fail on deploy.

Add a <service>_nginx_letsencrypt flag (default false) and computed
<service>_nginx_ssl_certificate/_key paths: when off the vhost uses the
shared self-signed cert (nginx_default_ssl_cert), when on it uses the
Let's Encrypt lineage. Gate the certbot include on the flag and apply the
pattern to all service roles (deluge, fdroid, gitea, grafana, immich,
metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).

2026-09-21 10:04:47 +02:00

defaults

fix(nginx): make Let's Encrypt opt-in per service

2026-09-21 10:04:47 +02:00

handlers

feat(arr): add prowlarr, radarr and seerr roles

2026-09-18 18:53:43 +02:00

README.md

Prowlarr Role

Deploys Prowlarr - an indexer manager/proxy for the *arr stack - using Podman with k8s files. The linuxserver/prowlarr image bundles Prowlarr and its SQLite database.

Prerequisites

The podman role must have been applied to the host first (shared service, intentionally not declared in meta/main.yml to keep prowlarr deploys fast). Order it before prowlarr in the playbook for fresh installs.

Role Variables

See defaults/main.yml for all available variables and their default values.

Storage

prowlarr_config_dir - SQLite database, indexer definitions and API keys. Backed up.

Ports

Port	Protocol	Purpose
`prowlarr_port` (9696)	tcp	Web UI

Nginx Reverse Proxy

Set prowlarr_nginx_enabled: true and prowlarr_nginx_hostname to expose the web UI over HTTPS. TLS is opt-in:

prowlarr_nginx_letsencrypt: false (default) — use the shared self-signed cert (nginx_default_ssl_cert, generated by the nginx role). Required for internal names like *.nas.local, which Let's Encrypt cannot issue.
prowlarr_nginx_letsencrypt: true — provision a Let's Encrypt cert via the shared nginx role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.

Backup

The role exposes prowlarr_backup_paths (config only). Add a job in the host inventory to include it:

backup_jobs:
    - name: prowlarr
      repositories: [next_s3]
      paths: "{{ prowlarr_backup_paths }}"

Troubleshooting

systemctl --user status prowlarr
journalctl --user -u prowlarr -f
podman logs prowlarr