Convert servarr to steps and add TinyAuth protection for Seerr

content/en/3.serveex/5.media/3.servarr.md

@@ -5,13 +5,6 @@ description: Automate media downloads with the Servarr stack, Radarr, Sonarr, Ba
 
 
 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
-# Servarr
-
-::note
-🎯 __Goals:__
-
-Automate movie and TV show downloads using Radarr, Sonarr, Bazarr, Prowlarr, and Seerr.
-::
 
 [Servarr](https://wiki.servarr.com/) is a suite of applications developed to automate the downloading, updating, and management of media. Here, we'll focus on movies and TV shows with the goal of:
 
@@ -26,8 +19,6 @@ We’ll start by deploying the stack and then proceed to configure each app and
 
 ## Install the Apps
 
-### Docker Compose
-
 ::file-tree
 ---
 tree:
@@ -57,11 +48,12 @@ tree:
 
 ::warning
 
-__Warning:__ Make sure to follow this file structure carefully, especially the `media` folder. This folder must be mounted **exactly the same way** in both the _Qbittorrent_ compose file (`/your/path/media:/media`) and the _arr_ applications.  
+__Warning:__ Make sure to follow this file structure carefully, especially the `media` folder. This folder must be mounted **exactly the same way** in both the _Qbittorrent_ compose file (`/your/path/media:/media`) and the _arr_ applications. If not, the _arr_ apps may not recognize the path provided by Qbittorrent and will fail to create _hardlinks_. Without hardlinks, the _arr_ apps will copy the files instead, **doubling the space used** on your storage.
-If not, the _arr_ apps may not recognize the path provided by Qbittorrent and will fail to create _hardlinks_.  
-Without hardlinks, the _arr_ apps will copy the files instead, **doubling the space used** on your storage.
 ::
 
+::steps{level="3"}
+### Deploy the stack
+
 Open Docker and your `jellyfin` stack. Modify the compose file as follows:
 ```yaml [compose.yaml]
 ---
@@ -163,6 +155,8 @@ services:
 ```
 ::
 
+### Set your environment variables
+
 Set your `.env` file with the variables below:
 
 ```properties [.env]
@@ -188,6 +182,9 @@ sudo chown -R 1000:1000 /docker/seerr/config
 
 Deploy the stack.
 
+### Done !
+::
+
 ### Configure Radarr
 
 Radarr queries your torrent sources and lets you define the type of releases to prioritize. It can also upgrade your movies if a better version is available.
@@ -201,7 +198,8 @@ __If it fails:__ check your firewall rules.
 
 Create an account and choose *forms login*.
 
-##### Add a *root folder*
+::steps{level="4"}
+#### Add a *root folder*
 
 - Go to *Settings > Media Management*.
 - Add a root folder and select `/media/movies`.
@@ -211,13 +209,13 @@ Create an account and choose *forms login*.
 __Warning:__ If you already have movies in `movies` from Qbittorrent, do not let Radarr add them. Radarr might modify them, which could stop seeding in Qbittorrent.
 ::
 
-##### Configure Profiles
+#### Configure Profiles
 
 Go to *Settings > Profiles*. These are your default quality profiles. When you make a request, you're selecting one of these. For example, configure the “any” profile by unchecking everything except what is shown in the image and ordering them accordingly. This makes Radarr search for 4K REMUX first, then go down the list if unavailable.
 
 ![profiles_radarr](/img/serveex/radarr1.png)
 
-##### Add Qbittorrent
+#### Add Qbittorrent
 
 In *Settings > Download Clients*, add Qbittorrent.
 
@@ -226,7 +224,7 @@ In *Settings > Download Clients*, add Qbittorrent.
 - Click *Test*.
 - If successful, click *Save*.
 
-##### Connect to Jellyfin
+#### Connect to Jellyfin
 
 First, get an API key from Jellyfin: log in as admin, go to *Dashboard > Advanced > API Keys*, and add a new one.
 
@@ -237,10 +235,13 @@ Then, in Radarr, go to *Settings > Connect*, add a new connection and choose *Je
 - Paste the API key you generated.
 - Press *Test*, then *Save* if successful.
 
-##### Get API Key for Prowlarr and Seerr
+#### Get API Key for Prowlarr and Seerr
 
 - Go to *Settings > General* and copy your *API Key* for later use.
 
+#### Done !
+::
+
 ### Configure Sonarr
 
 Sonarr queries torrent sources and defines what kind of TV series releases to prioritize. It also upgrades series when better versions are available.
@@ -264,11 +265,12 @@ Go to `http://yourserverip:9696` and create an account, using *forms login*.
 __If it fails:__ check your firewall rules.
 ::
 
-##### Add an Indexer
+::steps{level="4"}
+#### Add an Indexer
 
 - Go to the *Indexers* section and add your torrent indexer.
 
-##### Add Radarr and Sonarr
+#### Add Radarr and Sonarr
 
 In *Settings > Apps*, add Radarr and Sonarr with the following details:
 
@@ -277,6 +279,9 @@ In *Settings > Apps*, add Radarr and Sonarr with the following details:
 - API Key: use the one copied from Radarr and Sonarr.
 - Click *Test*, then *Save* if all goes well.
 
+#### Done !
+::
+
 ### Configuring Bazarr
 Bazarr is an app that automatically searches for the correct subtitles in your preferred languages for all the movies and TV shows added by Radarr and Sonarr.
 
@@ -289,6 +294,7 @@ __If it fails:__ check your firewall rules.
 
 Go to *Settings > General* and create a username and password using *forms login*.
 
+::steps{level="4"}
 #### Add a Language Profile
 
 - In *Settings > Languages*, click the pink *Add new profile* button and name it.
@@ -318,6 +324,9 @@ Go to *Settings > General* and create a username and password using *forms login
 
 Repeat the same steps for Radarr.
 
+#### Done !
+::
+
 ### Configuring Seerr
 
 [Seerr](https://seerr.dev/) (the unified successor of Overseerr and Jellyseerr) is an app that lets you browse a movie catalog and send requests to Sonarr and Radarr. Just browse movies or series, click *Request*, and the media will automatically be downloaded according to your Radarr or Sonarr settings. If the title hasn’t been released yet, it will be downloaded automatically when available. This way, episodes of a series appear in Jellyfin without any manual intervention.
@@ -329,7 +338,8 @@ Go to `http://yourserverip:5055`, select *Jellyfin* as your media server, and si
 __If it fails:__ check your firewall rules.
 ::
 
-#### Add Radarr and Sonarr
+::steps{level="4"}
+#### Add Radarr
 
 When prompted, add a Radarr server:
 
@@ -348,6 +358,8 @@ If the test succeeds, continue filling in the fields:
 - Check all 3 boxes at the bottom.
 - Save and continue.
 
+#### Add Sonarr
+
 Now do the same for Sonarr:
 
 - Check *Default server*.
@@ -365,6 +377,9 @@ If the test succeeds, continue filling in the fields:
 - Check all 4 boxes at the bottom.
 - Save and continue.
 
+#### Done !
+::
+
 And that’s it! Just request a movie or series, then check in qBittorrent or Radarr/Sonarr. Within a few minutes, your media will be available on Jellyfin!
 
 ## Exposing Seerr with SWAG
@@ -381,6 +396,9 @@ Seerr has no built-in two-factor authentication. Only expose it if you're using
 We assume you have the subdomain `films.mydomain.com` with a `CNAME` pointing to `films.fr` in your [DNS zone](/general/networking/dns). And that [unless you’re using Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router is forwarded to port `443` on your server via [NAT rules](/general/networking/nat).
 ::
 
+::steps{level="3"}
+### Add Seerr's network to SWAG
+
 Go to Dockge, edit the SWAG compose file, and add the Seerr network, which is the same as Jellyfin (since it’s in the Jellyfin stack):
 
 ```yaml [compose.yaml]
@@ -407,6 +425,8 @@ Restart the stack by clicking “Deploy” and wait until SWAG is fully operatio
 Here we assume the Jellyfin network is named `jellyfin_default`. You can verify the connection works by visiting the SWAG dashboard at `http://yourserverip:81`.
 ::
 
+### Create the subdomain.conf file
+
 Create and edit the file `films.subdomain.conf`:
 
 ::tip{icon=""}
@@ -482,9 +502,100 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 
 Wait a few minutes, then visit `http://films.mydomain.com` in your browser.
 
+### Done !
+::
+
 ::caution
 
 __If it fails:__ check your firewall rules.
 ::
 
 And there you go, Seerr is now publicly accessible!
+
+## Protecting Seerr with TinyAuth
+Add [TinyAuth](/serveex/security/tinyauth)'s forward-auth check directly to `films.subdomain.conf`, the same way as [the TinyAuth guide](/serveex/security/tinyauth#protecting-an-app-via-reverse-proxy). The web UI (`/`) gets the check; `/api` is left out, since Seerr's own API calls (and anything integrating with it) can't do an interactive browser login:
+
+```nginx [films.subdomain.conf]{24-36,39-40}
+## Version 2024/07/16
+# make sure that your seerr container is named seerr
+# make sure that your dns has a cname set for seerr
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name films.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    # enable for ldap auth (requires ldap-location.conf in the location block)
+    #include /config/nginx/ldap-server.conf;
+
+    # enable for Authelia (requires authelia-location.conf in the location block)
+    #include /config/nginx/authelia-server.conf;
+
+    # enable for Authentik (requires authentik-location.conf in the location block)
+    #include /config/nginx/authentik-server.conf;
+
+    location /tinyauth {
+        internal;
+        proxy_pass http://tinyauth:3000/api/auth/nginx;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+    }
+
+    location @tinyauth_login {
+        return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri;
+    }
+
+    location / {
+        auth_request /tinyauth;
+        error_page 401 = @tinyauth_login;
+
+        # enable the next two lines for http auth
+        #auth_basic "Restricted";
+        #auth_basic_user_file /config/nginx/.htpasswd;
+
+        # enable for ldap auth (requires ldap-server.conf in the server block)
+        #include /config/nginx/ldap-location.conf;
+
+        # enable for Authelia (requires authelia-server.conf in the server block)
+        #include /config/nginx/authelia-location.conf;
+
+        # enable for Authentik (requires authentik-server.conf in the server block)
+        #include /config/nginx/authentik-location.conf;
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app seerr;
+        set $upstream_port 5055;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    }
+
+    location ~ (/seerr)?/api {
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app seerr;
+        set $upstream_port 5055;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    }
+}
+```
+
+::note
+
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+::
+
+::tip
+✨ You can protect this app with [Authentik](/serveex/advanced/authentik) instead of TinyAuth by opening `films.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don't forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
+::