Files

T

Clément Désiles 5efc0b0d6e fix(nginx): make Let's Encrypt opt-in per service

certbot cannot issue for internal hostnames (*.nas.local), which made
nginx-enabled services with internal names fail on deploy.

Add a <service>_nginx_letsencrypt flag (default false) and computed
<service>_nginx_ssl_certificate/_key paths: when off the vhost uses the
shared self-signed cert (nginx_default_ssl_cert), when on it uses the
Let's Encrypt lineage. Gate the certbot include on the flag and apply the
pattern to all service roles (deluge, fdroid, gitea, grafana, immich,
metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).

2026-09-21 10:04:47 +02:00

defaults

fix(nginx): make Let's Encrypt opt-in per service

2026-09-21 10:04:47 +02:00

handlers

feat(arr): add prowlarr, radarr and seerr roles

2026-09-18 18:53:43 +02:00

README.md

Radarr Role

Deploys Radarr - a movie collection manager for Usenet and BitTorrent - using Podman with k8s files. The linuxserver/radarr image bundles Radarr and its SQLite database.

Prerequisites

The podman role must have been applied to the host first. Order it before radarr in the playbook for fresh installs.

Role Variables

See defaults/main.yml for all available variables and their default values.

Storage

radarr_config_dir - SQLite database, library and API keys. Backed up.
radarr_movies_dir - movie library, mounted read-write at /movies. Use /movies as the root folder in the Radarr UI.
radarr_downloads_dir - completed downloads, shared with Deluge. Mounted read-write at /downloads; point the download client there.

radarr_movies_dir lives on ZFS (/mnt/andromeda), radarr_downloads_dir under {{ podman_projects_dir }} - cross-filesystem imports are copies, not hardlinks.

Ports

Port	Protocol	Purpose
`radarr_port` (7878)	tcp	Web UI

Nginx Reverse Proxy

Set radarr_nginx_enabled: true and radarr_nginx_hostname to expose the web UI over HTTPS. TLS is opt-in:

radarr_nginx_letsencrypt: false (default) — use the shared self-signed cert (nginx_default_ssl_cert, generated by the nginx role). Required for internal names like *.nas.local, which Let's Encrypt cannot issue.
radarr_nginx_letsencrypt: true — provision a Let's Encrypt cert via the shared nginx role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.

Backup

The role exposes radarr_backup_paths (config only). Add a job in the host inventory to include it:

backup_jobs:
    - name: radarr
      repositories: [next_s3]
      paths: "{{ radarr_backup_paths }}"

Troubleshooting

systemctl --user status radarr
journalctl --user -u radarr -f
podman logs radarr