Adds IMMICH_EXTERNAL_LIBRARY volume (mounted read-only at /mnt/external
in the container) so existing photos stored outside the upload folder
can be imported as an external library without triggering Immich's
upload-folder restriction.
Documents the API-based external library creation workflow in README.
- qbittorrent memory limit 1G → 3G: piece-verification buffers for 25 GB+
torrents exceed 1G and trigger cgroup OOM kill mid-download
- bazarr, prowlarr, seerr limits 512M → 1G: all three were at 40-67% at
idle with insufficient headroom for subtitle batch events, RSS floods,
and Emby library syncs respectively
- Add *media-data-mount and storage-guard dependency to decluttarr so
detect_deletions can access /data/media paths
- Fix decluttarr auth ban loop: add Docker bridge 172.18.0.0/16 to
qBittorrent WebUI auth subnet whitelist (applied live via API)
- Update README mount table (Decluttarr now gets /data/media), memory
limit table with per-service rationale sized for 25 GB average files
- Add TROUBLESHOOTING sections 5e-5j covering qBittorrent path issues,
OOM kill pattern, and decluttarr auth ban loop with fixes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
UniFi devices validate the Origin header on WebSocket upgrades and reject
connections where it doesn't match their own hostname, causing real-time
dashboard stats to show N/A. Add unifi-upstream snippet that strips Origin
before forwarding, and apply it to both udm and unas proxy blocks.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Both use self-signed TLS backends so they get the office-admin-upstream
snippet (tls_insecure_skip_verify). Update firewall backend policy table
in network docs to match.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- switchlite8poe moved to 10.0.1.6
- tplink16de removed (device no longer exists)
- speedtest removed (no longer needed)
- Update firewall backend policy table in network docs to match
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Four issues encountered during the arr-stack LXC 101 deployment that were not
covered or not clear enough in existing docs:
PROXMOX-NVIDIA-LXC.md — expanded Section 4 into four explicit sub-steps:
4a: copy installer into LXC via pct push (it lives on the Proxmox host)
4b: install userspace libs with --no-kernel-module then run ldconfig
4c: install Container Toolkit (must come after libs, not before)
4d: switch runtime mode auto→legacy with clear explanation of why CDI fails
in an LXC even after the libraries are installed
TROUBLESHOOTING.md — new section 5c for the stale gluetun namespace error:
"joining network namespace of container: No such container"
Cause: gluetun recreated with new container ID, qbittorrent holds old ID
Fix: docker rm -f qbittorrent && docker compose up -d qbittorrent
Renumbered old 5c (HTTPS 502) to 5d
arr-stack README.md — AirVPN preshared key warning in the Installation section:
AirVPN generates per-server preshared keys; the built-in airvpn provider
selects a server dynamically so the key never matches → silent VPN failure.
Documents when and how to use VPN_SERVICE_PROVIDER=custom with a pinned server.
DEPLOYMENT.md — two new sections:
Section 9: Set a Static IP — via Proxmox .conf net0 line, not inside the LXC
Section 10: Rename a Container (VMID change) — lvrename + conf file swap
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add optional WIREGUARD_PUBLIC_KEY, WIREGUARD_ENDPOINT_IP, WIREGUARD_ENDPOINT_PORT
to gluetun template so custom provider renders cleanly without manual patching
- Make SERVER_COUNTRIES optional (:-) so re-renders don't fail for custom provider
- Document the required mode = "legacy" change in /etc/nvidia-container-runtime/config.toml
for NVIDIA Container Toolkit in a privileged LXC; the default "auto" CDI mode fails
until userspace libraries are installed and the mode is explicitly set to legacy
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Correct DEPLOYMENT.md fstab entry (vers=3, UUID path, 10.0.10.25) and
add No Root Squash requirement note to the chown step. Fix arr-stack
README to document host-side chown from a privileged LXC instead of
the incorrect unprivileged-LXC warning. Also carries forward nfs-mounts.md
from the previous session.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add exact UniFi 9.x NAT panel steps for DNS DNAT redirect (FAMILY, MEDIA,
IOT, GUEST) and verification procedure to the zone migration guide. Add
Client VLAN Access section to the Caddy README with firewall rules for
FAMILY and MEDIA to reach Caddy over HTTPS.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace GENERATE placeholders with actual pan_id/network_key values
- Add known devices with friendly names to template
- Setup script now skips zigbee2mqtt config copy if file already exists,
preventing configuration-adapter mismatch on redeploy
The compose file is generated one level above the repo, so a relative
path like ./docker-compose-files/node-red resolves to the wrong directory.
The setup script now injects the absolute path to the Dockerfile directory
as NODE_RED_BUILD_CONTEXT at generation time.
The gitignore pattern for docker-compose-files excluded all files except
templates and config dirs — Dockerfile was silently ignored. Added
!docker-compose-files/**/Dockerfile exception so custom images are tracked.
- Custom Dockerfile installs node-red-contrib-home-assistant-websocket
into the base image (not /data) to avoid volume mount conflicts
- Joins ha-network so Node-RED reaches homeassistant:8123 by container name
- HA_URL and HA_TOKEN passed as env vars so the token stays out of flow files;
use $(HA_URL) and $(HA_TOKEN) when configuring the server node in the editor
- credentialSecret substituted at setup time via setup-node-red.sh, consistent
with the rest of the project; auto-generates NODE_RED_CREDENTIAL_SECRET if absent
- appdata/node-red owned by uid 1000 to match the container user
- README updated with stack docs, env vars, and deployment steps
