Add arr stack (Sonarr, Radarr, Prowlarr, qBittorrent + gluetun VPN)

[riccjohn]

Summary

Add automated media acquisition stack: qBittorrent routed through gluetun VPN, with Prowlarr (indexer manager), Sonarr (TV), and Radarr (movies) all wired together and integrated with the existing Jellyfin library.

Architecture note: gluetun network sharing

qBittorrent uses network_mode: service:gluetun to share gluetun's network namespace. As a result:

• Traefik labels live on gluetun, not qbittorrent
• qBittorrent's WebUI is reached through gluetun's proxy network IP

Changes

docker-compose.yml

• Add gluetun service with Traefik labels for qbittorrent.woggles.work
• Add qbittorrent service with network_mode: service:gluetun
• Add prowlarr service (port 9696, prowlarr.woggles.work)
• Add sonarr service (port 8989, sonarr.woggles.work)
• Add radarr service (port 7878, radarr.woggles.work)
• Add HOMEPAGE_VAR_QBITTORRENT_USERNAME/PASSWORD, HOMEPAGE_VAR_PROWLARR/SONARR/RADARR_API_KEY to homepage environment block

homepage/config/services.yaml

• Add Media Downloads section with cards for qBittorrent, Prowlarr, Sonarr, Radarr

.env.example

• Add VPN vars: VPN_PROVIDER, VPN_TYPE, WIREGUARD_PRIVATE_KEY, WIREGUARD_ADDRESSES, VPN_SERVER_COUNTRIES
• Add DOWNLOADS_PATH
• Add QBITTORRENT_USERNAME, QBITTORRENT_PASSWORD
• Add PROWLARR_API_KEY, SONARR_API_KEY, RADARR_API_KEY

scripts/setup.sh

• Add mkdir -p qbittorrent/config prowlarr/config sonarr/config radarr/config

Post-deploy steps

1. Visit https://qbittorrent.woggles.work — verify VPN IP differs from server IP
2. Grab API keys from each service's Settings > General and populate .env
3. Restart homepage to pick up new API keys

Acceptance

• ./scripts/lint-config.sh exits 0
• All four services reachable at their respective subdomains
• qBittorrent traffic exits through VPN (confirmed via IP leak check)
• Homepage widgets show live data for all four services