Skip to content

media stack — Radarr, Sonarr, Prowlarr, Bazarr, qBittorrent behind gluetun

The media automation slice of torrentvpn-stack. Read that card's seed-limit interlock before touching anything here.

Shape

  • Apps: radarr, sonarr (anime merged in, sonarr-anime retired 2026-10-20), prowlarr, bazarr, recyclarr, overseerr, tautulli, plex, jellyfin, tdarr. qBittorrent runs in gluetun's namespace; recreate gluetun and qbittorrent together, never a bare docker compose up -d.
  • API access: arr APIs answer at the container IP (radarr 172.18.0.23:7878, sonarr 172.18.0.27:8989, prowlarr 172.18.0.22:9696) and need a Host: <app> header (Allowed Hosts). v3 API for the arrs, v1 for Prowlarr. Keys are in each app's config.xml. qBittorrent: http://127.0.0.1:8080, login in ~/.config/qbittorrent/env (0600), v5.3.0 since 2026-10-20.
  • Quality profiles: Radarr 8 Kids, 9 "HD Bluray + WEB" (161 monitored movies since 2026-10-20; also accepts WEB 720p, HDTV-1080p, HDTV-720p as fallback since 2026-10-20, cutoff Bluray-1080p, upgrades on; old profile in pre-seedlimit-20261020/radarr-profile9-before-fallback.json), 7 "HD - Spanish" (kept); Sonarr 7 WEB-1080p, 8 [Anime] Remux-1080p.
  • Root folders: Radarr /data/movies, /data/workout, /data/kids-movies; Sonarr /data/tv, /data/kids-shows, /data/anime. Hardlinks on (copyUsingHardlinks), so deleting a torrent copy never harms the library.
  • Dashboard: Homepage (~/homepage) shows widgets for qBittorrent (HOMEPAGE_VAR_QBT_*), Radarr, Sonarr, Prowlarr, Bazarr.

VPN status and kill switch (2026-10-20)

  • VPN tile: gluetun 3.40+ answers 401 on its control server without a key, which made vpn-check write DOWN while the tunnel was fine. Fix (~/torrentvpn/scripts/vpn-fix.sh): one auth role vpn-check in ~/torrentvpn/gluetun/auth/config.toml (root-owned volume, read at gluetun start) allowing only GET /v1/publicip/ip with an API key kept in ~/.config/gluetun/env (0600). Never add an open (auth = "none") route. vpn-check sends the key; tile verified UP (PacketHub, Phoenix).
  • Kill switch: ~/.local/bin/qbit-killswitch (cron every minute). stop halts and holds qBittorrent until start; watch trips automatically (see alerting) and status shows holds. It only ever stops the container named qbittorrent (docker stop, because the WebUI API dies with the VPN); start runs docker compose up -d gluetun qbittorrent. State and log: ~/.local/state/qbit-killswitch/.
  • Homepage qBittorrent tile: totals only (leech, download, seed, upload); no per-torrent list.

Invariants (do not break)

  1. qBittorrent global share limits stay off (-1).
  2. Radarr/Sonarr download client removeCompletedDownloads and removeFailedDownloads stay false. Verify through the API (GET downloadclient), not the DB: on 2026-10-20 the DB fix script ~/fix-arr-remove-completed.sh ran but the API still reported removeCompletedDownloads: true until it was PUT through the API.
  3. Both were broken on 2026-10-20 (~77 torrents deleted, library intact) — see the project note INCIDENT line.

Open items (owner unless noted)

  • IPTorrents hit-and-run: rules in reference/iptorrents-rules.md (1:1 or 336 h per torrent; warning only if >40 fail for >5 days). 2026-10-20 clean; re-check the site from 2026-10-26.
  • ntfy push on Radarr/Sonarr/Prowlarr (topic in alerting); Overseerr and Tautulli notifications.
  • Overseerr: re-sign-in to Plex (stale token since the 10-19 re-claim).
  • OpenSubtitles.com account + API key for Bazarr.
  • Plex Pass (hardware transcoding) vs Jellyfin QSV on the i5-7500T.
  • Dead Nginx Proxy Manager host sonarr-anime.lan.
  • Series with gaps (Raising Hope, Blue Mountain State, Parasyte → anime profile; Flintstones stays), then a rename preview before any bulk rename.

See

Process: media-upgrade-and-cleanup. Scripts: ~/torrentvpn/scripts/. Backups: ~/torrentvpn/pre-seedlimit-20261020/.

Upload surge prevention — 2026-11-03

Owner approved a conservative 1 MiB/s (~8.39 Mbps) aggregate torrent upload cap after the household/Plex network incident. Both normal and alternative upload limits are now 1,048,576 bytes/s (1024 KiB/s in the on-disk Qt config). limit_utp_rate=true and limit_tcp_overhead=true; download and peer limits unchanged. Share ratio/time/inactive limits remain disabled (-1), confirmed through the live API. Torrents continue seeding.

Only qbittorrent was briefly stopped/restarted to apply the persisted config; Gluetun and Pi-hole were not restarted. Full before config backup is private: ~/.local/state/plex-network-incident-20261103/qBittorrent.conf.before-upload-cap (0600, parent 0700); change record upload-cap-change.json contains only changed rate keys. Live app/preferences and transfer/uploadLimit confirm both caps and the effective cap. Gateway/DNS/external HTTPS remained working afterwards.

API compatibility: qBittorrent 5.3.0 here returns an empty body on successful auth/login, with a valid SID cookie. Do not require literal Ok.; establish success by a successful authenticated preferences request. Saved credentials in ~/.config/qbittorrent/env are valid. The setup script writes raw env values; do not reinterpret password characters as shell quoting.

Actual internet plan upload rate is not yet supplied; tune the cap when known. This mitigates the observed VPN/torrent traffic surge, not proof of original root cause. Keep household DNS independent of Plex (owner enabled router DNS for recovery). No router settings changed here. See machine incident.