Self-Hosted Infrastructure
Documentation & Setup Guide

Complete media automation suite. Plex serves the library to LAN and remote clients; the *arr stack (Sonarr / Radarr / Bazarr / Prowlarr) handles indexer search, downloads, and subtitle acquisition. Notifiarr is the notification fan-out for events across the suite.

version: "3.9"

services:
  plex:
    image: plexinc/pms-docker
    container_name: plex
    # Plex needs host networking for DLNA / GDM discovery — direct-play to LAN clients with no NAT overhead.
    network_mode: host
    environment:
      - PUID=1000
      - PGID=1000
      - VERSION=docker
      # Claim token placeholder — replace with one from plex.tv/claim before first boot, or remove if already claimed via UI.
      - PLEX_CLAIM=Redacted
    volumes:
      - /srv/user/docker/plex/config:/config
      - /srv/user/Desktop/MoviesAndShows/Movies:/movies
      - /srv/user/Desktop/MoviesAndShows/Shows:/shows
      - /mnt/storage/BulkStore/Movies:/bulkstoremovies
      - /mnt/storage/BulkStore/Shows:/bulkstoreshows
      - /srv/user/Desktop/MoviesAndShows/Downloads:/downloads
      - /mnt/storage/BulkStore/Downloads:/bulkstoredownload
    restart: unless-stopped
    tmpfs:
      - "/transcode:size=8g"
    # https://plex.example.com

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    ports:
      - "8989:8989"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/sonarr/config:/config
      - /srv/user/Desktop/MoviesAndShows/Shows:/tv
      - /mnt/storage/BulkStore/Shows:/bulkstoreshows
      - /srv/user/Desktop/MoviesAndShows/Downloads:/downloads
      - /mnt/storage/BulkStore/Downloads:/bulkstoredownload
    restart: unless-stopped
    # https://sonarr.example.com

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    ports:
      - "7878:7878"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/radarr/config:/config
      - /srv/user/Desktop/MoviesAndShows/Movies:/movies
      - /mnt/storage/BulkStore/Movies:/bulkstoremovies
      - /srv/user/Desktop/MoviesAndShows/Downloads:/downloads
      - /mnt/storage/BulkStore/Downloads:/bulkstoredownload
    restart: unless-stopped
    # https://radarr.example.com

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    ports:
      - "9696:9696"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/prowlarr/config:/config
    restart: unless-stopped
    # https://prowlarr.example.com

  bazarr:
    image: lscr.io/linuxserver/bazarr:latest
    container_name: bazarr
    ports:
      - "6767:6767"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/bazarr/config:/config
      - /srv/user/Desktop/MoviesAndShows/Movies:/movies
      - /srv/user/Desktop/MoviesAndShows/Shows:/tv
      - /mnt/storage/BulkStore/Movies:/bulkstoremovies
      - /mnt/storage/BulkStore/Shows:/bulkstoreshows
    restart: unless-stopped
    # https://bazarr.example.com
    
  notifiarr:
    image: golift/notifiarr:latest
    container_name: notifiarr
    ports:
      - "5454:5454"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
      - NOTIFIARR_API_KEY=Redacted
    volumes:
      - /srv/user/docker/notifiarr/config:/config
    restart: unless-stopped
    # https://notifiarr.example.com

Downloader routed exclusively through a ProtonVPN tunnel via gluetun. Downloader has no direct network interface — it inherits gluetun's namespace. If the VPN drops or gluetun crashes, Downloader loses internet entirely. The canonical Docker VPN kill-switch pattern.

version: "3.8"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    # NET_ADMIN is required so gluetun can bring up the VPN tunnel interface.
    cap_add:
      - NET_ADMIN
    environment:
      # gluetun handles provider-specific quirks — server lists, credentials format, kill-switch rules.
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=openvpn
      # ProtonVPN port forwarding is required for inbound peer connections through the VPN's NAT.
      - VPN_PORT_FORWARDING=on

      - OPENVPN_USER=Redacted #Also don't forget to add +pmp
      - OPENVPN_PASSWORD=Redacted

      - SERVER_COUNTRIES=United States  # Or Switzerland, USA, etc.

      # Open this port on gluetun's internal firewall. (Known drift: ProtonVPN assigns a dynamic port — see Cross-cutting · VPN isolation.)
      - FIREWALL_VPN_INPUT_PORTS=8090 
    ports:
      - "8080:8080"        # Downloader Web UI
      - "8090:8090"        # download peer port (TCP)
      - "8090:8090/udp"    # download peer port (UDP)

      - "8888:8888/tcp"  # Gluetun Web UI (uncomment if you want it)

    restart: unless-stopped

  downloader:
    image: lscr.io/linuxserver/sabnzbd:latest
    container_name: downloader
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
      - WEBUI_PORT=8080
    volumes:
      - /srv/user/docker/downloader/config:/config
      - /srv/user/Desktop/MoviesAndShows/Downloads:/downloads
      - /mnt/storage/BulkStore/Downloads:/bulkstoredownload
      - /mnt/storage/BulkStore/ManualDownload:/manualdownload
    
    # Kill-switch pattern — downloader shares gluetun's network namespace. If gluetun stops, downloader loses ALL internet.
    network_mode: "service:gluetun"
    
    # Ensures gluetun starts first so its namespace exists when downloader attaches.
    depends_on:
      - gluetun
      
    restart: unless-stopped

Self-service media request portal. Users browse what is available on Plex, request what is not, and Jellyseerr forwards approved requests to Sonarr/Radarr for automatic acquisition.

version: '3.8'

services:
  jellyseerr:
    image: fallenbagel/jellyseerr:latest
    container_name: jellyseerr
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      # Per-service config convention: /srv/user/docker/<service>/config.
      - /srv/user/docker/jellyseerr/config:/app/config
    ports:
      - "5055:5055"
    restart: unless-stopped

Plex observability. Tracks watch history, currently-playing sessions, transcoding load, library growth, per-user activity. Pushes notifications on configured events.

version: '3.3'
services:
  tautulli:
    image: tautulli/tautulli
    container_name: tautulli
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      # Holds Plex history DB — primary long-term value is the historical record.
      - /srv/user/docker/tautulli:/config

    ports:
      - 8181:8181

Self-hosted file sync, calendar, contacts, and office collaboration. Replaces Google Drive / iCloud for personal files. Sync clients on every platform push files into the homelab.

version: "3.8"

services:
  db:
    image: mariadb:11
    container_name: nextcloud_db
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: Redacted
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: Redacted
    volumes:
      - /mnt/storage/NAS/NextCloud/db:/var/lib/mysql
    # Dedicated bridge network — only nextcloud_app can reach the database.
    networks:
      - nextcloud-net

  app:
    image: nextcloud:33-apache
    container_name: nextcloud_app
    restart: unless-stopped
    depends_on:
      - db
    ports:
      - 8083:80
    environment:
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: Redacted
      # Resolves via Docker's internal DNS to the 'db' service on the bridge network.
      MYSQL_HOST: db
    volumes:
      - /mnt/storage/NAS/NextCloud/app:/var/www/html
      - /mnt/storage/NAS/NextCloud/data:/var/www/html/data
    networks:
      - nextcloud-net

networks:
  nextcloud-net:
    driver: bridge

Self-hosted Notion-style wiki and collaborative document editor. Used for personal notes, project documentation, and longer-form content.

version: "3"

services:
  docmost:
    image: docmost/docmost:latest
    depends_on:
      - db
      - redis
    environment:
      APP_URL: "http://localhost:3000"
      # Used to sign sessions / JWTs. Rotation invalidates all active sessions.
      APP_SECRET: Redacted
      DATABASE_URL: Redacted
      # Redis is queue + cache; opaque to the host (no port exposed).
      REDIS_URL: "redis://redis:6379"
    ports:
      - "3000:3000"
    restart: unless-stopped
    volumes:
      - docmost:/app/data/storage

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: docmost
      POSTGRES_USER: docmost
      POSTGRES_PASSWORD: Redacted
    restart: unless-stopped
    volumes:
      - db_data:/var/lib/postgresql/data

  redis:
    image: redis:7.2-alpine
    restart: unless-stopped
    volumes:
      - redis_data:/data

volumes:
  docmost:
  db_data:
  redis_data:

Self-hosted Bitwarden-compatible password manager. Primary credential store for all personal accounts. A sidecar container produces daily encrypted backups to the NAS for off-host shipping by Duplicati.

version: '3.8'

services:
  vaultwarden:
    image: vaultwarden/server:1.36.0-alpine
    container_name: vaultwarden
    restart: unless-stopped
    ports:
      - "8087:80"
    volumes:
      - vaultwarden_data:/data
    environment:
      # Must match the public URL exactly — required for WebAuthn / passkey 2FA origin validation.
      - DOMAIN=https://vaultwarden.example.com

      # Upstream default is TRUE — explicitly disabled to prevent unauthorized account creation.
      - SIGNUPS_ALLOWED=false
      # Closes the secondary path: even existing users cannot invite new ones.
      - INVITATIONS_ALLOWED=false
      - SHOW_PASSWORD_HINT=false

      - WEBSOCKET_ENABLED=true
      - TZ=America/New_York

  vaultwarden-backup:
    image: bruceforce/vaultwarden-backup:latest
    container_name: vaultwarden_backup_tool
    restart: unless-stopped

    volumes:
      - vaultwarden_data:/data:ro
      - /mnt/storage/NAS/Vaultwarden_Backup_Cache:/backup

    environment:
      - TIMESTAMP=true
      - PUID=1000
      - PGID=1000
      - CRON_TIME=30 2 * * *
      - TZ=America/New_York
      - BACKUP_DIR=/backup
      - DOCKER_CONTAINER_NAME=vaultwarden
      - BACKUP_ON_STARTUP=true
      - DELETE_AFTER=30

volumes:
  vaultwarden_data:

Exposes the NAS over SMB so Windows / macOS / Linux clients on the LAN can mount it as a network drive.

version: "3.8"

services:
  samba:
    image: dperson/samba
    container_name: samba
    restart: unless-stopped
    # Host networking so SMB broadcast and NetBIOS discovery work without bridge gymnastics.
    network_mode: host
    environment:
      - USERID=1000
      - GROUPID=1000
    volumes:
      - /mnt/storage/NAS:/media/NAS
    # Single share 'NAS' backed by the bulk mount, single user.
    command: >
      -s "NAS;/media/NAS;yes;no;yes;all"
      -u "user;Redacted"

Encrypted, deduplicated, scheduled backups. Picks up the Vaultwarden tarball cache and ships it to long-term backup storage. Configured to back up other critical config paths on the host.

version: '3.8'

services:
  duplicati:
    image: lscr.io/linuxserver/duplicati:latest
    container_name: duplicati
    restart: unless-stopped

    volumes:
      # Holds Duplicati's internal DB and retention rules — back this up separately or you lose backup history.
      - /opt/duplicati/config:/config

      # Destination is a separate NAS path from any source — backup-set corruption cannot take out source data.
      - /mnt/storage/NAS/Duplicati_Backups:/destination

      # Source mounted READ-ONLY — the backup process cannot accidentally damage source data.
      - /mnt/storage/NAS/Vaultwarden_Backup_Cache:/vaultwarden:ro

    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
      - SETTINGS_ENCRYPTION_KEY=Redacted

    ports:
      - 8200:8200

Outbound-only tunnel to Cloudflare's edge. Exposes lab services on the public internet without opening any inbound ports on the home router.

version: '3.7'

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared-connector
    restart: unless-stopped
    # Outbound-only persistent connection to Cloudflare edge. No inbound port required on the home router.
    command: tunnel run --token Redacted
    networks:
      - cloudflare-net
    # Custom DNS (1.1.1.1) bypasses the AdGuard container during tunnel registration to avoid a boot-order deadlock.
    dns:
      - 1.1.1.1
      - 1.0.0.1

networks:
  cloudflare-net:
    # This tells Docker Compose that the network was created externally in Portainer
    # Network is created in Portainer separately so other stacks can attach for inbound routing.
    external: true

Network-wide DNS sinkhole. Blocks ads, trackers, and malware domains for every device on the LAN that uses it as a resolver.

version: "3.8"

services:
  adguard:
    image: adguard/adguardhome:latest
    container_name: adguard
    restart: unless-stopped
    # Host networking required to bind port 53 directly and serve as the LAN's primary DNS.
    network_mode: host
    volumes:
      # Query logs and runtime state — survives container recreate.
      - /opt/adguard/work:/opt/adguardhome/work
      - /opt/adguard/conf:/opt/adguardhome/conf
    environment:
      - TZ=America/New_York

Personal homepage / app launcher. Customizable tile grid linking to every service in the lab.

services:
  flame:
    image: pawelmalak/flame:latest
    container_name: flame
    volumes:
      - /opt/flame/data:/app/data
      # Read-only socket mount for container auto-discovery. Consider docker-socket-proxy for additional safety.
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /opt/flame/secrets/password:/run/secrets/password:ro
    ports:
      - "5005:5005"
    environment:
      - PASSWORD_FILE=Redacted
    restart: unless-stopped

Self-hosted status page and uptime monitor. Pings every service in the lab; sends notifications on failure.

services:
  uptime-kuma:
    image: louislam/uptime-kuma:latest
    container_name: uptime-kuma
    restart: always
    volumes:
      - /opt/uptime-kuma/data:/app/data
      # Read-only socket mount enables container-state monitoring beyond HTTP checks.
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "3001:3001"
    environment:
      - TZ=America/New_York

Browser-based VS Code, accessible from any device on the LAN. Useful for editing configs and writing scripts from a tablet or borrowed PC without an SSH client.

services:
  code-server:
    image: lscr.io/linuxserver/code-server:latest
    container_name: code-server
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
    volumes:
      # Per-service config convention: /srv/user/docker/<service>/config.
      - /srv/user/docker/code-server/config:/config
    ports:
      - 8443:8443
    restart: unless-stopped