Skip to content

Overview & architecture

What it does

  • Requests: Seerr lets you (and shared Plex users) request movies and shows.
  • Automation: Sonarr (TV) and Radarr (movies) search through Prowlarr (with FlareSolverr for Cloudflare-protected indexers) and send torrents to qBittorrent.
  • Downloading: qBittorrent runs only inside a gluetun WireGuard tunnel to PIA, with port forwarding and a kill switch.
  • Library: finished files are hardlinked into /data/media (no copy, no extra space). Bazarr fetches subtitles.
  • Playback: Plex serves the library, tuned for Direct Play because the NAS can't hardware-transcode. Tautulli records every stream.
  • Safety net: Btrfs snapshots of the app configs, and nightly encrypted restic backups of them to Backblaze B2.

Architecture

flowchart LR
  subgraph Internet
    PC[Plex clients]:::ext
    RQ[Request users]:::ext
    PIA[(PIA WireGuard<br/>port-forward)]:::ext
    B2[(Backblaze B2)]:::ext
  end
  subgraph LAN["Home LAN"]
    R[Router<br/>port forward 32400]
    ATV[Apple TV 4K]
    subgraph NAS["Synology NAS"]
      subgraph VPN["gluetun netns (kill switch)"]
        G[gluetun] --- Q[qBittorrent]
      end
      SO[Sonarr] & RA[Radarr] --> Q
      PR[Prowlarr] --> SO & RA
      PR --> FS[FlareSolverr]
      SE[Seerr] --> SO & RA
      BA[Bazarr]
      PL[Plex] --- TA[Tautulli]
      RS[restic]
      PO[Portainer]
      D[("/volume1/data<br/>torrents + media<br/>(hardlinks)")]
      Q --> D
      SO & RA --> D
      PL --> D
    end
  end
  PC --> R --> PL
  ATV --> PL
  RQ -. optional tunnel .-> SE
  G <--> PIA
  RS --> B2

Port map

Service Port Exposed via
Portainer 9443 (9000) LAN only
qBittorrent WebUI (published by gluetun) 8080 LAN
Sonarr / Radarr / Prowlarr / Bazarr 8989 / 7878 / 9696 / 6767 LAN
FlareSolverr 8191 LAN only
Seerr 5055 LAN, optional tunnel (see Remote access)
Plex (host network) 32400 LAN, remote via port forward
Tautulli (bound to LAN IP) 8181 LAN only