- Add compose stacks for apps already proxied by Caddy: bento-pdf,
it-tools, paperless-ngx, and beszel-hub (with Makefile targets)
- Remove the unused Vault stack and the drawio Caddyfile block
- Fix Caddyfile gramps upstream to port 80 to match the compose file
- Bring immich and gramps-web up to the shared template pattern
(no-new-privileges, log rotation, memory limits, healthchecks)
- Single-quote vaultwarden SSO_AUDIENCE_TRUSTED so regex values like
^\d{18}$ render as valid YAML
- Move root docs into kebab-case topic folders, rebuild the docs index
to cover every doc, and fix all broken links
- qbittorrent memory limit 1G → 3G: piece-verification buffers for 25 GB+
torrents exceed 1G and trigger cgroup OOM kill mid-download
- bazarr, prowlarr, seerr limits 512M → 1G: all three were at 40-67% at
idle with insufficient headroom for subtitle batch events, RSS floods,
and Emby library syncs respectively
- Add *media-data-mount and storage-guard dependency to decluttarr so
detect_deletions can access /data/media paths
- Fix decluttarr auth ban loop: add Docker bridge 172.18.0.0/16 to
qBittorrent WebUI auth subnet whitelist (applied live via API)
- Update README mount table (Decluttarr now gets /data/media), memory
limit table with per-service rationale sized for 25 GB average files
- Add TROUBLESHOOTING sections 5e-5j covering qBittorrent path issues,
OOM kill pattern, and decluttarr auth ban loop with fixes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Four issues encountered during the arr-stack LXC 101 deployment that were not
covered or not clear enough in existing docs:
PROXMOX-NVIDIA-LXC.md — expanded Section 4 into four explicit sub-steps:
4a: copy installer into LXC via pct push (it lives on the Proxmox host)
4b: install userspace libs with --no-kernel-module then run ldconfig
4c: install Container Toolkit (must come after libs, not before)
4d: switch runtime mode auto→legacy with clear explanation of why CDI fails
in an LXC even after the libraries are installed
TROUBLESHOOTING.md — new section 5c for the stale gluetun namespace error:
"joining network namespace of container: No such container"
Cause: gluetun recreated with new container ID, qbittorrent holds old ID
Fix: docker rm -f qbittorrent && docker compose up -d qbittorrent
Renumbered old 5c (HTTPS 502) to 5d
arr-stack README.md — AirVPN preshared key warning in the Installation section:
AirVPN generates per-server preshared keys; the built-in airvpn provider
selects a server dynamically so the key never matches → silent VPN failure.
Documents when and how to use VPN_SERVICE_PROVIDER=custom with a pinned server.
DEPLOYMENT.md — two new sections:
Section 9: Set a Static IP — via Proxmox .conf net0 line, not inside the LXC
Section 10: Rename a Container (VMID change) — lvrename + conf file swap
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add optional WIREGUARD_PUBLIC_KEY, WIREGUARD_ENDPOINT_IP, WIREGUARD_ENDPOINT_PORT
to gluetun template so custom provider renders cleanly without manual patching
- Make SERVER_COUNTRIES optional (:-) so re-renders don't fail for custom provider
- Document the required mode = "legacy" change in /etc/nvidia-container-runtime/config.toml
for NVIDIA Container Toolkit in a privileged LXC; the default "auto" CDI mode fails
until userspace libraries are installed and the mode is explicitly set to legacy
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Correct DEPLOYMENT.md fstab entry (vers=3, UUID path, 10.0.10.25) and
add No Root Squash requirement note to the chown step. Fix arr-stack
README to document host-side chown from a privileged LXC instead of
the incorrect unprivileged-LXC warning. Also carries forward nfs-mounts.md
from the previous session.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes .gitignore to track the new folder-per-stack layout introduced in
the previous refactor commit. The old rule only whitelisted *_template.*
filenames; templates named template.yaml and config/ files were silently
ignored, leaving the repository missing most of its content.
.gitignore
- Whitelist docker-compose-files/**/template.* so the canonical
template.yaml / template.yml naming is tracked
- Whitelist docker-compose-files/**/config/** so per-stack config
templates (mosquitto.conf, zigbee2mqtt_configuration.yaml, etc.)
are tracked alongside their compose template
New stack templates (all migrated from *_template.yaml flat files)
- arr-stack/template.yaml
- beszel-agent/template.yaml
- gramps-web/template.yaml
- postgres/template.yaml — volumes switched from {{DOCKERCONFDIR}} to
relative ./appdata/ paths (DOCKERCONFDIR reserved for arr-stack only)
- socket-proxy/template.yaml
- technitium/template.yaml
- vault/template.yaml — same DOCKERCONFDIR → ./appdata/ migration
New homeassistant stack
- homeassistant/template.yaml — Home Assistant + Eclipse Mosquitto 2.x +
Zigbee2MQTT on a shared bridge network (ha-network) so all services
are reachable by container name (mqtt:1883, zigbee2mqtt:8080)
- homeassistant/config/mosquitto.conf — Mosquitto 2.x config with
explicit listener declarations (required since 2.0), persistence, and
WebSocket listener on 9001
- homeassistant/config/zigbee2mqtt_configuration.yaml — Zigbee2MQTT 2.x
config for SMLIGHT SLZB-06U over PoE+ (TCP socket via {{SLZB06_HOST}}:6638,
adapter: ember for Silicon Labs EFR32, MQTT via container name mqtt:1883)
