Files

T

Clément Désiles 5efc0b0d6e fix(nginx): make Let's Encrypt opt-in per service

certbot cannot issue for internal hostnames (*.nas.local), which made
nginx-enabled services with internal names fail on deploy.

Add a <service>_nginx_letsencrypt flag (default false) and computed
<service>_nginx_ssl_certificate/_key paths: when off the vhost uses the
shared self-signed cert (nginx_default_ssl_cert), when on it uses the
Let's Encrypt lineage. Gate the certbot include on the flag and apply the
pattern to all service roles (deluge, fdroid, gitea, grafana, immich,
metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).

2026-09-21 10:04:47 +02:00

defaults

fix(nginx): make Let's Encrypt opt-in per service

2026-09-21 10:04:47 +02:00

handlers

feat(arr): add prowlarr, radarr and seerr roles

2026-09-18 18:53:43 +02:00

README.md

Seerr Role

Deploys Seerr - the media request manager (successor of Overseerr/Jellyseerr) - using Podman with k8s files. Uses the official ghcr.io/seerr-team/seerr image.

Prerequisites

The podman role must have been applied to the host first. Order it before seerr in the playbook for fresh installs.

Role Variables

See defaults/main.yml for all available variables and their default values.

The web UI listens on http://<host>:{{ seerr_port }}. Complete the setup wizard, then point Seerr at Jellyfin and the *arr services. Because Seerr runs in a container, reach the host-side services via the pasta gateway ({{ podman_gw_gateway }}, default 100.64.0.1) or host.containers.internal, not localhost.

Storage

seerr_config_dir - SQLite database, users, requests and settings. Backed up.

The image runs as the unprivileged node user (UID/GID 1000). The pod maps the rootless pod user onto that UID via the io.podman.annotations.userns annotation, so the host-owned config directory is writable.

Ports

Port	Protocol	Purpose
`seerr_port` (5055)	tcp	Web UI

Nginx Reverse Proxy

Set seerr_nginx_enabled: true and seerr_nginx_hostname to expose the web UI over HTTPS. TLS is opt-in:

seerr_nginx_letsencrypt: false (default) — use the shared self-signed cert (nginx_default_ssl_cert, generated by the nginx role). Required for internal names like *.nas.local, which Let's Encrypt cannot issue.
seerr_nginx_letsencrypt: true — provision a Let's Encrypt cert via the shared nginx role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.

Backup

The role exposes seerr_backup_paths (config only). Add a job in the host inventory to include it:

backup_jobs:
    - name: seerr
      repositories: [next_s3]
      paths: "{{ seerr_backup_paths }}"

Troubleshooting

systemctl --user status seerr
journalctl --user -u seerr -f
podman logs seerr