Media automation: Sonarr, Radarr, Prowlarr, qBittorrent, FlareSolverr, Pinchflat — with qBittorrent + FlareSolverr forced through Mullvad WireGuard via gluetun.
| Guest | LXC 110 "Arr-Stack" on M910q |
| IP | 192.168.86.207 |
| Tailscale | arr-stack / 100.65.69.124 |
| Resources | 4 vCPU / 6.3 GB |
| Rootfs | 50G ceph-storage |
| Media | mp0 cephfs/media → /media; mp1 cephfs/downloads → /downloads |
| ⚠️ | privileged LXC, root SSH password login enabled |
Kill-switch by construction: qBittorrent has no network of its own — if gluetun/VPN dies, torrent traffic stops.
8080 qBittorrent · 8191 FlareSolverr · 6881 BT (all via gluetun) · 8989 Sonarr · 7878 Radarr · 9696 Prowlarr · 8945 Pinchflat
/opt/arr-stack/docker-compose.yml — ⚠️ contains the Mullvad WireGuard private key inline (findings #7); app configs under /data/appdata/<app> on rootfs, except Pinchflat (./pinchflat/config — inconsistent)LXC 110 is in vzdump ✅ (app configs on rootfs are covered; media/downloads on cephfs excluded — correct).
cd /opt/arr-stack && docker compose pull && docker compose up -d && docker image prune -f
gluetun/Mullvad note: if VPN breaks after an update, check WIREGUARD_* values against a fresh Mullvad config.
Kuma: Arr-Stack ping/tailscale + per-app keyword monitors (Sonarr/Radarr/Prowlarr/qBittorrent).