Gmer4Lfe
427a31cdff
Deploying first meant Authelia, Lldap, NPM and both databases initialised themselves against empty directories. The gate arming moves to Step 1d for the same reason: the provisioning sync is an rsync, and Tier 1 stops every rsync. Tier 2 now ends the onboard off rather than as-found.
640 lines
33 KiB
Bash
640 lines
33 KiB
Bash
#!/bin/bash
|
|
# ==============================================================================================
|
|
# ========================== HOSTN CONFIGURATION — (hostname) ==================================
|
|
# ==============================================================================================
|
|
# HOSTN-specific variables — credentials, container names, share paths, failover lists.
|
|
# Sourced after master.conf — values here extend shared profile arrays and add HOSTN-specific
|
|
# identity, credentials, and container configuration.
|
|
#
|
|
# Sparse checkout (git) ensures other hosts never receive this file.
|
|
#
|
|
# DO NOT put shared config here — thresholds, toggles, profiles belong in master.conf.
|
|
# DO NOT put other hosts' variables here — they belong in their own host*.conf files.
|
|
#
|
|
# ── HOW TO USE THIS TEMPLATE ──────────────────────────────────────────────────────────────────
|
|
# This file was generated by the Varaverk first-run wizard.
|
|
# Fill in the sections that apply to your setup — leave unused sections empty.
|
|
# All scripts self-guard against empty values — safe to leave sections blank until needed.
|
|
#
|
|
# ── INDEX ─────────────────────────────────────────────────────────────────────────────────────
|
|
#
|
|
# ── IDENTITY & CONNECTIVITY ────────────────────────────────────────────────────────────────
|
|
# IDENTITY hostname, SSH key, Unraid API key
|
|
# EMBY container name, URL, API key
|
|
# JELLYFIN container name, URL, API key
|
|
# GITEA API token for SSH key registration
|
|
# NOTIFICATIONS Discord webhook
|
|
#
|
|
# ── PARTNERSHIP ────────────────────────────────────────────────────────────────────────────
|
|
# PARTNERSHIP auth containers, backup paths, emby provisioning
|
|
#
|
|
# ── RSYNC ──────────────────────────────────────────────────────────────────────────────────
|
|
# DAILY SYNC SHARES media shares this host owns and pushes
|
|
# PERSONAL SHARES private encrypted shares for offsite backup
|
|
# WEEKLY SYNC SHARES appdata shares synced weekly
|
|
# INTERMEDIATE SYNC mid-day appdata propagation
|
|
# CRITICAL SYNC SHARES appdata shares synced every 30 minutes
|
|
# BACKUP VERIFY shares for checksum verification against remote
|
|
# HOSTN RSYNC PROFILE host-specific appdata sync profile
|
|
#
|
|
# ── FALLBACK ───────────────────────────────────────────────────────────────────────────────
|
|
# DDNS DDNS containers managed by this host
|
|
# INTERNET LOSS containers stopped when internet is lost
|
|
# FALLBACK TIERS what this host wants the partner to run when this host is down
|
|
# TIER DELAYS how long this host must be down before each tier activates
|
|
# RSYNC WRITEBACK appdata synced back on handback
|
|
#
|
|
# ── DOCKER ─────────────────────────────────────────────────────────────────────────────────
|
|
# DOCKER DAILY RESTART containers restarted daily
|
|
# DOCKER WEEKLY RESTART containers restarted weekly
|
|
# DOCKER WATCHDOG memory limits, health URLs, required containers
|
|
# NETWORK WATCHDOG DDNS domain, NPM URL for connectivity checks
|
|
# DOCKER NETWORK CONNECT networks and containers for array start
|
|
#
|
|
# ── MEDIA ──────────────────────────────────────────────────────────────────────────────────
|
|
# MEDIA PERMISSIONS share list for permissions script
|
|
# MEDIA CLEANER folder lists for media_cleaner.sh
|
|
#
|
|
# ── ARR STACK ──────────────────────────────────────────────────────────────────────────────
|
|
# DOWNLOADERS slskd, SABnzbd, qBittorrent credentials and URLs
|
|
# LIDARR / SONARR / RADARR URL, API key, path map
|
|
# ARR RECOVERY per-arr recovery toggles
|
|
#
|
|
# ── TRANSCODES ─────────────────────────────────────────────────────────────────────────────
|
|
# TRANSCODES ramdisk size, thresholds, SSD path, server array
|
|
#
|
|
# ── MONITORS ───────────────────────────────────────────────────────────────────────────────
|
|
# CERTIFICATE MONITOR domains checked for SSL expiry
|
|
# SMART HEALTH drives to skip in SMART monitoring
|
|
# ZFS REPORT pools to exclude from ZFS health report
|
|
# PCIe AER QUIET dead PCIe devices removed at array start to stop AER log spam
|
|
#
|
|
# ── RESOURCE MANAGER ───────────────────────────────────────────────────────────────────────
|
|
# RESOURCE MANAGER containers paused/stopped under memory pressure
|
|
#
|
|
# ── SYSTEM WATCHDOG ────────────────────────────────────────────────────────────────────────
|
|
# SYSTEM WATCHDOG per-host check toggles and NIC configuration
|
|
#
|
|
# ==============================================================================================
|
|
|
|
# ==============================================================================================
|
|
# ── STORAGE MODE ──────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
# ━━━ Storage mode ━━━
|
|
# Controls where Varaverk stores scripts, conf, and state files.
|
|
# true = internal NVMe/SSD — /boot/config/plugins/varaverk (write-safe, git-direct)
|
|
# false = USB flash boot — /mnt/user/appdata/Varaverk (preserves flash lifetime)
|
|
# Auto-detected from boot device transport on first setup.
|
|
# To change: Settings → Storage → Migrate.
|
|
HOSTN_STORAGE_MODE_INTERNAL=false
|
|
|
|
# ==============================================================================================
|
|
# ── IDENTITY & CONNECTIVITY ───────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
# ━━━ Identity ━━━
|
|
# HOSTN hostname lives in master.conf (not a credential — safe for all servers).
|
|
# SSH key used for all server-to-server operations — rsync, failover, conf sync.
|
|
# Convention: /root/.ssh/<hostname-lowercase-no-unraid-prefix>_rsync_automation
|
|
# Must be in /root/.ssh/ and authorised in the partner's /root/.ssh/authorized_keys.
|
|
# Run Partnership/ssh_setup.sh to generate the key and copy it to the partner.
|
|
HOSTN_SSH_KEY="" # e.g. /root/.ssh/myserver_rsync_automation
|
|
HOSTN_STORAGE_PATH="/mnt/user"
|
|
HOSTN_OWNER="" # short identifier for this server (e.g. myserver)
|
|
HOSTN_OWNER_EMAIL=""
|
|
|
|
# ━━━ Unraid API ━━━
|
|
# Used by the Varaverk plugin to query this server's Unraid GraphQL API.
|
|
# Generate in Unraid: Settings → Management Access → API Keys → + New Key
|
|
HOSTN_UNRAID_API_KEY=""
|
|
|
|
# ━━━ Emby ━━━
|
|
HOSTN_EMBY_CONTAINER="Emby"
|
|
HOSTN_EMBY_URL="http://localhost:8096"
|
|
HOSTN_EMBY_API_KEY="" # Emby Dashboard → API Keys → + New Key
|
|
HOSTN_EMBY_PUBLIC_URL="" # e.g. https://media.example.com/emby — browser-reachable base, used
|
|
# to build image URLs that render in the WebGUI. Deliberately separate
|
|
# from HOSTN_EMBY_URL: that one is for server-side API calls and is
|
|
# usually localhost, which resolves to the wrong machine in a browser.
|
|
# Empty = features that need an image quietly go without one.
|
|
|
|
# ━━━ Jellyfin ━━━
|
|
HOSTN_JELLYFIN_CONTAINER="Jellyfin"
|
|
HOSTN_JELLYFIN_URL="http://localhost:8095"
|
|
HOSTN_JELLYFIN_API_KEY="" # Jellyfin Dashboard → Administration → API Keys
|
|
|
|
# ━━━ Gitea ━━━
|
|
# Personal access token for gitea_ssh_setup.sh.
|
|
# Create in Gitea: Settings → Applications → Generate Token → scope: write:user
|
|
HOSTN_GITEA_API_TOKEN=""
|
|
|
|
# ━━━ Bug Reports ━━━
|
|
# Only used when BUG_REPORT_LOCAL_ENABLED=true in master.conf. Reports then go to this Gitea
|
|
# instead of GitHub — and stay there, so they do not reach the Varaverk maintainer.
|
|
#
|
|
# Reached locally or over Tailscale, so the token never crosses the public proxy and no Authelia
|
|
# bypass is needed. It is a credential and lives here rather than master.conf for that reason;
|
|
# it is never shipped, and the settings UI masks it.
|
|
HOSTN_BUG_REPORT_URL="" # e.g. http://gitea:3000 or the tailnet name
|
|
HOSTN_BUG_REPORT_REPO="" # owner/repo
|
|
HOSTN_BUG_REPORT_TOKEN="" # Gitea API token with issue-write on that repo
|
|
|
|
# ━━━ Notifications ━━━
|
|
# Discord webhook — leave blank to disable.
|
|
HOSTN_DISCORD_WEBHOOK=""
|
|
|
|
# ==============================================================================================
|
|
# ── PARTNERSHIP ───────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
# Auth containers reconfigured on onboard/offboard.
|
|
# Format: "ContainerName|WebUIPort"
|
|
HOSTN_PARTNERSHIP_AUTH_WEBUIS=(
|
|
# "NginxProxyManager|81"
|
|
# "Authelia|9091"
|
|
)
|
|
|
|
# Shares rsynced to the mirror during onboard Step 1e, BEFORE the auth containers are created.
|
|
# This is the only rsync an onboard performs — media is never seeded here.
|
|
# Profile is inferred from the directory basename, so Critical-Data resolves to critical-data:
|
|
# a clean copy with the auth containers stopped on both sides. Do not point this at a share
|
|
# whose profile keeps databases running; a dirty copy of MariaDB or Redis is worse than none,
|
|
# because the container starts, reads Up, and restarts a dead database behind it.
|
|
HOSTN_PARTNERSHIP_PROVISION_SHARES=(
|
|
"/mnt/user/appdata-Fallback/Critical-Data" # critical-data profile — the auth stack
|
|
)
|
|
|
|
# XML templates pushed to mirror during onboard — auth stack.
|
|
# Dependencies (databases) must come before apps that depend on them.
|
|
HOSTN_PARTNERSHIP_AUTH_STACK=(
|
|
# "my-Authelia.xml"
|
|
# "my-NginxProxyManager.xml"
|
|
)
|
|
|
|
# XML templates pushed to mirror during onboard — arr stack.
|
|
HOSTN_PARTNERSHIP_ARR_STACK=(
|
|
# "my-Sonarr.xml"
|
|
# "my-Radarr.xml"
|
|
)
|
|
|
|
# XML templates pushed to mirror during onboard — other services (not auth, not arr).
|
|
HOSTN_PARTNERSHIP_SERVICES_STACK=(
|
|
# "my-Lidarr.xml"
|
|
)
|
|
|
|
# Paths the partner should collect during the grace window after offboard.
|
|
HOSTN_PARTNERSHIP_MIRROR_BACKUPS=(
|
|
# "/mnt/user/appdata-Fallback/Partner-Emby"
|
|
)
|
|
|
|
# Containers parked on this server when partnership is active.
|
|
HOSTN_PARTNERSHIP_OWN_CONTAINERS=(
|
|
# "Emby"
|
|
)
|
|
|
|
# Containers stopped on THIS server before deploying the mirror's stack on onboard.
|
|
HOSTN_PARTNERSHIP_REPLACE_CONTAINERS=(
|
|
)
|
|
|
|
# Arr containers stopped on this server when mirror's arr stack is deployed.
|
|
HOSTN_PARTNERSHIP_ARR_REPLACE_CONTAINERS=(
|
|
)
|
|
|
|
# Emby admin provisioning — owner controls whether Emby is shared.
|
|
HOSTN_PARTNERSHIP_PROVISION_EMBY_ADMIN=false
|
|
HOSTN_PARTNERSHIP_EMBY_PORT=8096
|
|
HOSTN_PARTNERSHIP_EMBY_ADMIN_USER=""
|
|
HOSTN_PARTNERSHIP_EMBY_ADMIN_PASS=""
|
|
|
|
# ==============================================================================================
|
|
# ── RSYNC ─────────────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
# ━━━ Daily Sync Shares ━━━
|
|
# Media shares this host pushes to all other nodes every night.
|
|
# Uses DEFAULT_RSYNC_OPTS from master.conf — no profile needed.
|
|
HOSTN_DAILY_SYNC_SHARES=(
|
|
# /mnt/user/Movies
|
|
# /mnt/user/Tv_Shows
|
|
# /mnt/user/Music
|
|
)
|
|
|
|
# ━━━ Personal Shares ━━━
|
|
# Private encrypted shares synced for offsite backup, independent of media shares.
|
|
HOSTN_PERSONAL_SHARES=(
|
|
# /mnt/user/Personal # e.g. ZFS-encrypted dataset
|
|
)
|
|
|
|
# ━━━ Weekly Sync Shares ━━━
|
|
# Appdata shares synced during the weekly maintenance window.
|
|
# Profiles (emby, critical-data) drive container stops — define in master.conf.
|
|
HOSTN_WEEKLY_SYNC_SHARES=(
|
|
# "/mnt/user/Media_Server/Emby" # emby profile
|
|
# "/mnt/user/appdata-Fallback/Critical-Data" # critical-data profile
|
|
)
|
|
|
|
# ━━━ Monthly Sync Shares ━━━
|
|
# Shares synced by monthly_maintenance.sh. Add here when ready.
|
|
HOSTN_MONTHLY_SYNC_SHARES=(
|
|
# Add shares here
|
|
)
|
|
|
|
# ━━━ Intermediate Sync Shares ━━━
|
|
# Shares synced every 4 hours. Leave empty to skip mid-day rsync.
|
|
HOSTN_INTERMEDIATE_SYNC_SHARES=(
|
|
# Add shares here to enable mid-day rsync
|
|
)
|
|
|
|
# ━━━ Critical Sync Shares ━━━
|
|
# Appdata shares synced every 30 minutes.
|
|
# Format: "/path/to/share" or "/path/to/share|profile-name"
|
|
HOSTN_CRITICAL_SYNC_SHARES=(
|
|
# "/mnt/user/appdata-Fallback/Critical-Data|critical-fallback"
|
|
)
|
|
|
|
# ━━━ Backup Verify ━━━
|
|
# Leave empty to use HOSTN_DAILY_SYNC_SHARES automatically.
|
|
HOSTN_BACKUP_VERIFY_SHARES=(
|
|
# leave empty to use HOSTN_DAILY_SYNC_SHARES automatically
|
|
)
|
|
|
|
# ━━━ HOSTN Rsync Profile — hostn-appdata ━━━
|
|
# Host-specific appdata sync profile.
|
|
# Retry/sleep/container-delay omitted — this profile uses the master.conf defaults for all three.
|
|
PROFILE_RSYNC_OPTS[hostn-appdata]="-av --info=progress2 --bwlimit=${PROFILE_BW_LIMIT[hostn-appdata]:-8000}"
|
|
PROFILE_BW_LIMIT[hostn-appdata]=8000
|
|
PROFILE_CRITICAL_CONTAINER_NAMES[hostn-appdata]=""
|
|
PROFILE_DELAYED_CONTAINERS[hostn-appdata]=""
|
|
PROFILE_EXCLUDE_DIRS[hostn-appdata]="logs *.tmp"
|
|
|
|
# ==============================================================================================
|
|
# ── FALLBACK ──────────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
# ━━━ DDNS ━━━
|
|
# DDNS containers this host manages.
|
|
HOSTN_DDNS_CONTAINERS=(
|
|
# "MyServer.com"
|
|
)
|
|
|
|
# ━━━ Internet Loss ━━━
|
|
# Containers stopped immediately when internet is lost.
|
|
FALLBACK_HOSTN_STOP_ON_NO_NET=(
|
|
# "MyServer.com"
|
|
)
|
|
|
|
# ━━━ Fallback Tiers — What HOSTN Wants Covered When Down ━━━
|
|
# Containers the partner starts for HOSTN when HOSTN goes down.
|
|
# Tier 1 is always immediate. Higher tiers activate after HOSTN_TIER*_DELAY minutes.
|
|
FALLBACK_HOSTN_TIER1=(
|
|
# "MyServer-DDNS-Container"
|
|
)
|
|
|
|
FALLBACK_HOSTN_TIER2=(
|
|
# "container-placeholder"
|
|
)
|
|
|
|
FALLBACK_HOSTN_TIER3=(
|
|
# "container-placeholder"
|
|
)
|
|
|
|
FALLBACK_HOSTN_TIER4=(
|
|
# "container-placeholder"
|
|
)
|
|
|
|
# ━━━ Tier Delays — HOSTN Outage Timers ━━━
|
|
# How long HOSTN must be down before each tier activates on the partner.
|
|
HOSTN_TIER2_DELAY=240 # 4 hours
|
|
HOSTN_TIER3_DELAY=720 # 12 hours
|
|
HOSTN_TIER4_DELAY=1440 # 24 hours
|
|
|
|
# ━━━ Rsync Writeback ━━━
|
|
HOSTN_TIER1_WRITEBACK_DELAY=60 # minimum outage minutes before Tier 1 writeback runs
|
|
|
|
FALLBACK_HOSTN_WRITEBACK_TIER1=(
|
|
# "/mnt/user/Media_Server/Emby"
|
|
)
|
|
|
|
FALLBACK_HOSTN_WRITEBACK_TIER2=(
|
|
# "/mnt/user/appdata-Fallback/Important-Data"
|
|
)
|
|
|
|
FALLBACK_HOSTN_WRITEBACK_TIER3=(
|
|
# "location-placeholder"
|
|
)
|
|
|
|
FALLBACK_HOSTN_WRITEBACK_TIER4=(
|
|
# "/mnt/user/appdata-Fallback/Arrs_Stack"
|
|
)
|
|
|
|
# ==============================================================================================
|
|
# ── DOCKER ────────────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
# ━━━ Docker Daily Restart ━━━
|
|
HOSTN_DAILY_RESTART_CONTAINERS=(
|
|
# "NginxProxyManager"
|
|
# "Authelia"
|
|
)
|
|
|
|
# ━━━ Docker Weekly Restart ━━━
|
|
HOSTN_WEEKLY_RESTART_CONTAINERS=(
|
|
# "NextCloud"
|
|
# "AdGuard-Home"
|
|
)
|
|
|
|
# ━━━ Docker Watchdog ━━━
|
|
|
|
# Memory hard limits in MB — immediate restart if exceeded.
|
|
# 20GB=20480 16GB=16384 8GB=8192 4GB=4096 2GB=2048 1GB=1024
|
|
declare -A HOSTN_WATCHDOG_CONTAINERS=(
|
|
# ["Emby"]=18432
|
|
)
|
|
|
|
# HTTP health check URLs — checked every cycle.
|
|
declare -A HOSTN_WATCHDOG_CONTAINER_URLS=(
|
|
# ["Emby"]="http://localhost:8096"
|
|
# ["Jellyfin"]="http://localhost:8095"
|
|
# ["NginxProxyManager"]="http://localhost:7818"
|
|
# ["Authelia"]="http://localhost:9091/api/health"
|
|
# ["Authelia-Secondary"]="http://localhost:9092/api/health"
|
|
# ["Lldap"]="http://localhost:17170"
|
|
)
|
|
|
|
# API-level health checks — catches HTTP-200-but-internally-frozen containers (DB lock,
|
|
# deadlocked thread, etc.) that a basic HTTP check above would miss. Pick an endpoint that
|
|
# forces a real DB round-trip — a lightweight status endpoint may stay 200 even while the
|
|
# rest of the app is locked up. Format: ["ContainerName"]="url|APIKey"
|
|
declare -A HOSTN_WATCHDOG_CONTAINER_API_CHECKS=(
|
|
# ["Emby"]="${HOSTN_EMBY_URL}/Users|${HOSTN_EMBY_API_KEY}"
|
|
# ["Jellyfin"]="${HOSTN_JELLYFIN_URL}/Users|${HOSTN_JELLYFIN_API_KEY}"
|
|
)
|
|
|
|
# Required containers — must always be running.
|
|
HOSTN_WATCHDOG_REQUIRED_CONTAINERS=(
|
|
# "NginxProxyManager"
|
|
# "Authelia"
|
|
)
|
|
|
|
# Containers to skip in Tier 2 global scan.
|
|
HOSTN_WATCHDOG_SCAN_IGNORE=(
|
|
# "my-occasional-container"
|
|
)
|
|
|
|
# Dependency ordering — skip restarting a container if its dependency is also down.
|
|
declare -A HOSTN_WATCHDOG_DEPENDENCIES=(
|
|
# ["Authelia"]="Mariadb Redis-Authelia"
|
|
)
|
|
|
|
# Per-container appdata growth suppress ceilings in MB.
|
|
declare -A HOSTN_WATCHDOG_APPDATA_SIZES=(
|
|
# ["Tdarr"]="25600"
|
|
)
|
|
|
|
# ━━━ Network Watchdog ━━━
|
|
HOSTN_NETWORK_WATCHDOG_DDNS_DOMAIN="" # e.g. myserver.com
|
|
HOSTN_NETWORK_WATCHDOG_DDNS_CONTAINER="" # e.g. MyServer.com
|
|
HOSTN_NETWORK_WATCHDOG_NPM_URL="" # e.g. https://myserver.com
|
|
|
|
# ━━━ Docker Network Connect ━━━
|
|
HOSTN_NETWORK_CONNECT_CONTAINERS=(
|
|
# "memcached"
|
|
)
|
|
|
|
HOSTN_NETWORK_CONNECT_NETWORKS=(
|
|
# "high-availability"
|
|
)
|
|
|
|
# ==============================================================================================
|
|
# ── MEDIA ─────────────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
# ━━━ Media Permissions ━━━
|
|
HOSTN_MEDIA_PERMISSION_SHARES=(
|
|
# /mnt/user/Movies
|
|
# /mnt/user/Tv_Shows
|
|
# /mnt/user/Music
|
|
# /mnt/user/Downloads
|
|
)
|
|
|
|
# ━━━ Media Cleaner ━━━
|
|
HOSTN_ANIME_CLEAN_FOLDERS=(
|
|
# /mnt/user/Anime_Movies
|
|
# /mnt/user/Anime_Shows
|
|
)
|
|
|
|
HOSTN_MEDIA_CLEAN_FOLDERS=(
|
|
# /mnt/user/Movies
|
|
# /mnt/user/Tv_Shows
|
|
)
|
|
|
|
# ==============================================================================================
|
|
# ── ARR STACK ─────────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
# ━━━ Downloaders ━━━
|
|
HOSTN_SLSKD_URL="http://localhost:8980"
|
|
HOSTN_SLSKD_API_KEY=""
|
|
HOSTN_SLSKD_FAILED_IMPORTS_DIR=""
|
|
|
|
HOSTN_SABNZBD_URL="http://localhost:8180"
|
|
HOSTN_SABNZBD_API_KEY=""
|
|
|
|
HOSTN_QBIT_URL="http://localhost:8080"
|
|
HOSTN_QBIT_USERNAME="admin"
|
|
HOSTN_QBIT_PASSWORD=""
|
|
|
|
# ━━━ Lidarr ━━━
|
|
HOSTN_LIDARR_URL="http://localhost:8686"
|
|
HOSTN_LIDARR_API_KEY=""
|
|
HOSTN_LIDARR_MUSIC_ROOT="/mnt/user/Music"
|
|
HOSTN_FANART_API_KEY=""
|
|
HOSTN_LASTFM_API_KEY=""
|
|
|
|
declare -A HOSTN_LIDARR_PATH_MAP=(
|
|
# ["/music"]="/mnt/user/Music"
|
|
)
|
|
|
|
# ━━━ Sonarr ━━━
|
|
HOSTN_SONARR_URL="http://localhost:8989"
|
|
HOSTN_SONARR_API_KEY=""
|
|
HOSTN_SONARR_TV_ROOT="/mnt/user/Tv_Shows"
|
|
HOSTN_SONARR_GENERAL_ROOT="" # rootFolderPath literal for the general root (e.g. "/tv") — target for reverse-kids-leak moves; leave blank to disable
|
|
HOSTN_SONARR_KIDS_ROOT="" # rootFolderPath literal, as reported by Sonarr API — leave blank if no dedicated kids root
|
|
HOSTN_SONARR_ANIME_ROOT="" # rootFolderPath literal, as reported by Sonarr API — leave blank if no dedicated anime root
|
|
HOSTN_SONARR_DOWNLOAD_DIR="" # host path of the completed-downloads folder Sonarr imports from (e.g. "/mnt/cache/Temp_Storage/SABnzbd/Completed/Tv Shows") — blank disables the download orphan cleaner for Sonarr
|
|
HOSTN_SONARR_DOWNLOAD_CONTAINER_DIR="" # same folder as Sonarr's container sees it (e.g. "/downloads/Completed/Tv Shows") — needed to trigger import scans on held folders
|
|
|
|
declare -A HOSTN_SONARR_PATH_MAP=(
|
|
# ["/tv"]="/mnt/user/Tv_Shows"
|
|
)
|
|
|
|
# ━━━ Radarr ━━━
|
|
HOSTN_RADARR_URL="http://localhost:7878"
|
|
HOSTN_RADARR_API_KEY=""
|
|
HOSTN_TMDB_API_KEY=""
|
|
HOSTN_RADARR_MOVIES_ROOT="/mnt/user/Movies"
|
|
HOSTN_RADARR_GENERAL_ROOT="" # rootFolderPath literal for the general root (e.g. "/movies") — target for reverse-kids-leak moves; leave blank to disable
|
|
HOSTN_RADARR_KIDS_ROOT="" # rootFolderPath literal, as reported by Radarr API — leave blank if no dedicated kids root
|
|
HOSTN_RADARR_ANIME_ROOT="" # rootFolderPath literal, as reported by Radarr API — leave blank if no dedicated anime root
|
|
HOSTN_RADARR_DOWNLOAD_DIR="" # host path of the completed-downloads folder Radarr imports from (e.g. "/mnt/cache/Temp_Storage/SABnzbd/Completed/Movies") — blank disables the download orphan cleaner for Radarr
|
|
HOSTN_RADARR_DOWNLOAD_CONTAINER_DIR="" # same folder as Radarr's container sees it (e.g. "/downloads/Completed/Movies") — needed to trigger import scans on held folders
|
|
|
|
declare -A HOSTN_RADARR_PATH_MAP=(
|
|
# ["/movies"]="/mnt/user/Movies"
|
|
)
|
|
|
|
# ━━━ Corruption Scan ━━━
|
|
# Container that has a working ffprobe binary AND mounts the same shares as the arrs'
|
|
# roots — check `docker inspect <container>` for its mounts before filling this in.
|
|
HOSTN_FFPROBE_CONTAINER=""
|
|
HOSTN_FFPROBE_BIN=""
|
|
|
|
declare -A HOSTN_FFPROBE_PATH_MAP=(
|
|
# ["/mnt/user/Tv_Shows"]="/ext-tv-shows"
|
|
# ["/mnt/user/Movies"]="/ext-movies"
|
|
# Prefixes should match what Sonarr/Radarr actually track (HOSTN_SONARR_PATH_MAP /
|
|
# HOSTN_RADARR_PATH_MAP) — extend coverage here as more shares get mounted into the
|
|
# ffprobe container, e.g.:
|
|
# ["/mnt/user/Kids_Tv_Shows"]="/ext-kids-tv"
|
|
# ["/mnt/user/Kids_Movies"]="/ext-kids-movies"
|
|
# ["/mnt/user/Anime_Shows"]="/ext-anime-shows"
|
|
# ["/mnt/user/Anime_Movies"]="/ext-anime-movies"
|
|
# ["/mnt/user/stand-up_comedy"]="/ext-standup"
|
|
)
|
|
|
|
# ━━━ Arr Recovery Toggles ━━━
|
|
HOSTN_LIDARR_RECOVERY=false
|
|
HOSTN_SONARR_RECOVERY=true
|
|
HOSTN_RADARR_RECOVERY=true
|
|
|
|
# ==============================================================================================
|
|
# ── TRANSCODES ────────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
HOSTN_RAMDISK_SIZE="10G"
|
|
HOSTN_RAMDISK_WARN_GB=8.5
|
|
HOSTN_RAMDISK_LOW_GB=7
|
|
HOSTN_TRANSCODE_SSD="/mnt/cache/Temp_Storage/Emby/Transcodes/"
|
|
|
|
HOSTN_TRANSCODE_SERVERS=(
|
|
"${HOSTN_EMBY_CONTAINER}|${HOSTN_EMBY_URL}|${HOSTN_EMBY_API_KEY}|emby"
|
|
"${HOSTN_JELLYFIN_CONTAINER}|${HOSTN_JELLYFIN_URL}|${HOSTN_JELLYFIN_API_KEY}|jellyfin"
|
|
)
|
|
|
|
# ==============================================================================================
|
|
# ── MONITORS ──────────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
# ━━━ Certificate Monitor ━━━
|
|
HOSTN_CERT_MONITOR_DOMAINS=(
|
|
# "myserver.com"
|
|
)
|
|
|
|
# ━━━ SMART Health ━━━
|
|
HOSTN_SMART_IGNORE_DRIVES=(
|
|
"sda" # boot USB — SMART not meaningful on flash drives
|
|
)
|
|
|
|
# ━━━ PCIe AER Quiet ━━━
|
|
# PCI addresses removed from the bus at array start so dead hardware stops spamming
|
|
# correctable AER errors into syslog. Full DDDD:BB:DD.F form — find them with:
|
|
# grep -o "from [0-9a-f:.]*" /var/log/syslog | sort | uniq -c | sort -rn
|
|
#
|
|
# Only devices bound to vfio-pci or to no driver at all are eligible. Anything with a
|
|
# live driver is refused, so a mistyped address cannot pull an HBA or NIC out from
|
|
# under a running system. Devices claimed by a running VM are refused too.
|
|
# Gated by PCIE_QUIET_ENABLED in master.conf. Empty list = no-op.
|
|
HOSTN_PCIE_QUIET_DEVICES=(
|
|
# "0000:03:00.0"
|
|
)
|
|
|
|
# ━━━ ZFS Report ━━━
|
|
HOSTN_ZFS_REPORT_IGNORE_POOLS=(
|
|
# "disk5"
|
|
)
|
|
|
|
# ==============================================================================================
|
|
# ── RESOURCE MANAGER ──────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
HOSTN_RW_PAUSE_CONTAINERS=(
|
|
# "Tdarr"
|
|
# "LidaTube"
|
|
)
|
|
|
|
HOSTN_RW_STOP_CONTAINERS=(
|
|
# "Tdarr"
|
|
)
|
|
|
|
# ==============================================================================================
|
|
# ── SYSTEM WATCHDOG ───────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
|
|
HOSTN_SYS_WATCHDOG_NIC="" # e.g. eth0 — for network monitoring
|
|
|
|
HOSTN_SYS_WATCHDOG_CHECK_DOCKER_DAEMON=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_ROOTFS=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_KERNEL_OOPS=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_FD=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_BOOT=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_OOM=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_RAM=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_LOG=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_ARC=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_CPU_TEMP=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_LOAD=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_ZOMBIES=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_CONTAINERS=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_TMP=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_MDSTAT=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_NETWORK=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_SSHD=true
|
|
HOSTN_SYS_WATCHDOG_CHECK_RUNAWAY=false
|
|
|
|
# ==============================================================================================
|
|
# ── AUTH STACK ────────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
# Credentials for the Varaverk Auth Stack page (NPM, lldap, Authelia).
|
|
|
|
# ━━━ NginxProxyManager ━━━
|
|
# Admin API runs on 7818 (not 81 — 81 is the partnership WebUI port).
|
|
HOSTN_NPM_URL="http://localhost:7818"
|
|
HOSTN_NPM_USER="" # NPM admin email
|
|
HOSTN_NPM_PASS="" # NPM admin password
|
|
|
|
# ━━━ lldap ━━━
|
|
HOSTN_LLDAP_URL="http://localhost:17170"
|
|
HOSTN_LLDAP_USER="admin" # lldap admin username
|
|
HOSTN_LLDAP_PASS="" # lldap admin password
|
|
|
|
|
|
# ==============================================================================================
|
|
# ── Ollama / AI ───────────────────────────────────────────────────────────────────────────────
|
|
# ==============================================================================================
|
|
# Per-host because only some nodes actually have a GPU. A node with an empty OLLAMA_URL is not
|
|
# an error — it falls through to the resolver and uses another node's Ollama over Tailscale.
|
|
|
|
# ━━━ Ollama ━━━
|
|
HOSTN_OLLAMA_URL="" # e.g. http://localhost:11434 — empty if no local Ollama
|
|
HOSTN_OLLAMA_GPU_UUID="" # pins Ollama to one card on multi-GPU hosts
|
|
HOSTN_OLLAMA_MODEL="hf.co/unsloth/Qwen3-14B-GGUF:IQ4_XS" # generation — must fully offload; see README-AI.md
|
|
|
|
# ━━━ Web search ━━━
|
|
# Per-host because one is an address on this network and the other is a credential. Only the
|
|
# General Chat profile can use these — it is the profile that cannot change anything, which is
|
|
# why it is the one allowed to look outside. Off until AI_WEB_SEARCH_ENABLED says otherwise.
|
|
HOSTN_DEGOOG_URL="" # e.g. http://localhost:4444 — self-hosted, no key, /api/search
|
|
HOSTN_SEARXNG_URL="" # e.g. http://localhost:8888 — needs format: [json] in its settings.yml
|
|
HOSTN_WEB_SEARCH_API_KEY="" # brave or tavily; unused when the provider is searxng
|
|
HOSTN_OLLAMA_EMBED_MODEL="nomic-embed-text" # embeddings — the generation model cannot embed
|
|
|
|
# ━━━ Authelia ━━━
|
|
HOSTN_AUTHELIA_CONFIG="/mnt/user/appdata-Fallback/Critical-Data/Authelia/configuration.yml"
|
|
HOSTN_AUTHELIA_CONTAINER="Authelia"
|
|
|
|
# ==============================================================================================
|
|
# ──────────────────────── End Of HOSTn Variables ──────────────────────────────────────────────
|
|
# ==============================================================================================
|