Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
54 lines
2.1 KiB
Markdown
54 lines
2.1 KiB
Markdown
# Seerr Role
|
|
|
|
Deploys [Seerr](https://seerr.dev/) - the media request manager (successor of Overseerr/Jellyseerr) - using Podman with k8s files. Uses the official `ghcr.io/seerr-team/seerr` image.
|
|
|
|
## Prerequisites
|
|
|
|
The `podman` role must have been applied to the host first. Order it before `seerr` in the playbook for fresh installs.
|
|
|
|
## Role Variables
|
|
|
|
See `defaults/main.yml` for all available variables and their default values.
|
|
|
|
## First Login
|
|
|
|
The web UI listens on `http://<host>:{{ seerr_port }}`. Complete the setup wizard, then point Seerr at Jellyfin and the *arr services. Because Seerr runs in a container, reach the host-side services via the pasta gateway (`{{ podman_gw_gateway }}`, default `100.64.0.1`) or `host.containers.internal`, not `localhost`.
|
|
|
|
## Storage
|
|
|
|
- `seerr_config_dir` - SQLite database, users, requests and settings. Backed up.
|
|
|
|
The image runs as the unprivileged `node` user (UID/GID 1000). The pod maps the rootless pod user onto that UID via the `io.podman.annotations.userns` annotation, so the host-owned config directory is writable.
|
|
|
|
## Ports
|
|
|
|
| Port | Protocol | Purpose |
|
|
| --------------------- | -------- | ------- |
|
|
| `seerr_port` (5055) | tcp | Web UI |
|
|
|
|
## Nginx Reverse Proxy
|
|
|
|
Set `seerr_nginx_enabled: true` and `seerr_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in:
|
|
|
|
- `seerr_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue.
|
|
- `seerr_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.
|
|
|
|
## Backup
|
|
|
|
The role exposes `seerr_backup_paths` (config only). Add a job in the host inventory to include it:
|
|
|
|
```yaml
|
|
backup_jobs:
|
|
- name: seerr
|
|
repositories: [next_s3]
|
|
paths: "{{ seerr_backup_paths }}"
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
```sh
|
|
systemctl --user status seerr
|
|
journalctl --user -u seerr -f
|
|
podman logs seerr
|
|
```
|