Skip to content

Commit 7e2de17

Browse files
jackspieringcrypt0rr
jackspiering
and
crypt0rr
authored
Add Tailscale sidecar configuration for Configarr, Posterizarr, and Recyclarr services (#175)
* Add Tailscale sidecar configuration for Configarr, Posterizarr, and Recyclarr services * Update README.md to include Configarr, Posterizarr, and Recyclarr in service configurations. Also fixed 'MD060/table-column-style: Table column style [Table pipe does not align with header for style "aligned"]' * Update * Update service configurations in README.md and adjust volume paths in docker-compose.yml; clear SERVICEPORT in .env for recyclarr --------- Co-authored-by: crypt0rr <57799908+crypt0rr@users.noreply.github.com>
1 parent c10b773 commit 7e2de17

File tree

11 files changed

+334
-1
lines changed

11 files changed

+334
-1
lines changed

‎README.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,10 @@ If you would like to add your own config, you can use the [service-template](tem
6666
| 📡 **Sonarr** | A PVR for Usenet and BitTorrent users to manage TV series. | [Details](services/sonarr) |
6767
| 🔗 **Slink** | A fast, self-hosted alternative to ShareDrop for secure local file sharing. | [Details](services/slink) |
6868
| 📊 **Tautulli** | A monitoring and tracking tool for Plex Media Server. | [Details](services/tautulli) |
69+
| ⚙️ **Configarr** | Manage and sync configuration for Radarr, Sonarr, and related services. | [Details](services/configarr) |
70+
| 🖼️ **Posterizarr** | Automatically generates and updates posters/artwork for media libraries. | [Details](services/posterizarr) |
71+
| ♻️ **Recyclarr** | Tools for managing, migrating, and maintaining indexers and quality profiles. | [Details](services/recyclarr) |
72+
6973

7074
### 💼 Productivity and Collaboration
7175

@@ -161,7 +165,7 @@ If you would like to add your own config, you can use the [service-template](tem
161165

162166
### Tailscale Funnel vs. Tailscale Serve
163167

164-
Tailscale Funnel securely exposes services to the public internet. Tailscale Serve is for sharing content within a private Tailscale network (Tailnet). You'll need to decide how you want to expose the service, the configurations in this repository exposes the local Tailnet.
168+
Tailscale Funnel securely exposes services to the public internet. Tailscale Serve is for sharing content within a private Tailscale network (Tailnet). You'll need to decide how you want to expose the service, the configurations in this repository exposes the local Tailnet.
165169

166170
### Tailscale Funnel
167171

‎services/configarr/.env‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#version=1.0
2+
#url=https://github.com/2Tiny2Scale/tailscale-docker-sidecar-configs
3+
#COMPOSE_PROJECT_NAME= // only use in multiple deployments on the same infra
4+
SERVICE=configarr
5+
IMAGE_URL=ghcr.io/raydak-labs/configarr:latest
6+
SERVICEPORT=
7+
TS_AUTHKEY=
8+
DNS_SERVER=9.9.9.9

‎services/configarr/README.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Configarr with Tailscale Sidecar Configuration
2+
3+
This Docker Compose configuration sets up **Configarr** with a Tailscale sidecar container, enabling secure and private management of configuration files for your *Radarr*, *Sonarr*, and broader media automation stack. With this setup, Configarr is **only accessible from within your Tailscale network**, keeping your configuration workflows fully private and under your control.
4+
5+
## Configarr
6+
7+
[**Configarr**](https://github.com/raydak-labs/configarr) is a configuration management tool designed to **declaratively manage and synchronize settings** for Radarr, Sonarr, and related media services. By defining your desired state in version-controlled YAML files, Configarr ensures your media applications remain consistent, reproducible, and easy to maintain.
8+
9+
## Key Features
10+
11+
* ⚙️ **Declarative Configuration Management** – Define Radarr and Sonarr settings in YAML.
12+
* 🔁 **Idempotent Syncing** – Apply configurations safely and repeatedly without drift.
13+
* 📦 **Multi-Instance Support** – Manage multiple Radarr/Sonarr instances from a single config.
14+
* 🧩 **Profile & Root Folder Management** – Keep paths, profiles, and settings aligned.
15+
* 🛠 **Automation-Friendly** – Ideal for cron jobs, CI pipelines, or GitOps-style workflows.
16+
* 🧪 **Dry-Run Mode** – Preview configuration changes before applying them.
17+
* 🐳 **Docker-Native** – Lightweight and easy to deploy in containerized environments.
18+
19+
## Why Self-Host?
20+
21+
Configarr requires **API access to Radarr and Sonarr**, exposing configuration and library metadata that should not be publicly reachable. By self-hosting Configarr behind Tailscale, you gain:
22+
23+
* Private, encrypted access to all Radarr/Sonarr APIs
24+
* No need to expose management endpoints to the public Internet
25+
* Secure remote configuration management across locations
26+
27+
This is especially useful for homelabs, shared servers, and environments where consistent configuration and security are critical.
28+
29+
## Configuration Overview
30+
31+
In this deployment, a **Tailscale sidecar container** (for example, `tailscale-configarr`) runs the Tailscale client and joins your private Tailscale network. The Configarr service uses:
32+
33+
```plain
34+
network_mode: service:tailscale-configarr
35+
```
36+
37+
This setup ensures that **all Configarr network traffic flows exclusively through the Tailscale interface**, allowing it to securely communicate with Radarr and Sonarr instances that are also connected via Tailscale. No ports need to be exposed, and the service remains completely inaccessible from the public Internet.
38+
39+
With this configuration, Configarr can safely enforce and maintain your desired media configuration state — privately, securely, and reproducibly.

‎services/configarr/docker-compose.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
services:
2+
# Make sure you have updated/checked the .env file with the correct variables.
3+
# All the ${ xx } need to be defined there.
4+
# Tailscale Sidecar Configuration
5+
tailscale:
6+
image: tailscale/tailscale:latest # Image to be used
7+
container_name: tailscale-${SERVICE} # Name for local container management
8+
hostname: ${SERVICE} # Name used within your Tailscale environment
9+
environment:
10+
- TS_AUTHKEY=${TS_AUTHKEY}
11+
- TS_STATE_DIR=/var/lib/tailscale
12+
- TS_USERSPACE=false
13+
- TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz"
14+
- TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The <addr>:<port> for the healthz endpoint
15+
#- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS
16+
volumes:
17+
- ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path
18+
devices:
19+
- /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work
20+
cap_add:
21+
- net_admin # Tailscale requirement
22+
#ports:
23+
# - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required
24+
# If any DNS issues arise, use your preferred DNS provider by uncommenting the config below
25+
#dns:
26+
# - ${DNS_SERVER}
27+
healthcheck:
28+
test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational
29+
interval: 1m # How often to perform the check
30+
timeout: 10s # Time to wait for the check to succeed
31+
retries: 3 # Number of retries before marking as unhealthy
32+
start_period: 10s # Time to wait before starting health checks
33+
restart: always
34+
35+
# ${SERVICE}
36+
application:
37+
image: ${IMAGE_URL} # Image to be used
38+
network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale
39+
container_name: app-${SERVICE} # Name for local container management
40+
environment:
41+
- TZ=Europe/Amsterdam
42+
volumes:
43+
- ./${SERVICE}-data/config:/app/config
44+
- ${PWD}/${SERVICE}-data/dockerrepos:/app/repos
45+
depends_on:
46+
tailscale:
47+
condition: service_healthy
48+
# healthcheck:
49+
# test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running
50+
# interval: 1m # How often to perform the check
51+
# timeout: 10s # Time to wait for the check to succeed
52+
# retries: 3 # Number of retries before marking as unhealthy
53+
# start_period: 30s # Time to wait before starting health checks
54+
restart: never
55+
56+

‎services/posterizarr/.env‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#version=1.0
2+
#url=https://github.com/2Tiny2Scale/tailscale-docker-sidecar-configs
3+
#COMPOSE_PROJECT_NAME= // only use in multiple deployments on the same infra
4+
SERVICE=posterizarr
5+
IMAGE_URL=ghcr.io/fscorrupt/posterizarr:latest
6+
SERVICEPORT=8000
7+
TS_AUTHKEY=
8+
DNS_SERVER=9.9.9.9

‎services/posterizarr/README.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Posterizarr with Tailscale Sidecar Configuration
2+
3+
This Docker Compose configuration sets up **Posterizarr** with a Tailscale sidecar container, enabling secure and private access to your automated poster and artwork management service for *Radarr* and *Sonarr*. With this setup, Posterizarr is **only accessible from within your Tailscale network**, keeping your media automation environment clean, private, and secure.
4+
5+
## Posterizarr
6+
7+
[**Posterizarr**](https://github.com/fscorrupt/Posterizarr) is a companion tool for Radarr and Sonarr that **automatically manages posters, backgrounds, and other artwork** based on predefined rules. It ensures a consistent visual style across your media library by automatically applying selected poster sources, resolutions, languages, and artwork types.
8+
9+
## Key Features
10+
11+
* 🖼 **Automated Poster Management** – Automatically updates posters and artwork for movies and series.
12+
* 🎨 **Consistent Library Aesthetics** – Enforce a uniform look across Radarr and Sonarr.
13+
* 🔧 **Rule-Based Configuration** – Define poster sources, languages, resolutions, and priorities.
14+
* 🔄 **Scheduled Syncing** – Periodically checks and updates artwork automatically.
15+
* 📡 **Radarr & Sonarr Integration** – Uses official APIs to manage media artwork.
16+
* 🐳 **Docker-Native** – Lightweight container designed for easy self-hosting.
17+
* 🧩 **Multi-Instance Support** – Manage artwork across multiple Radarr/Sonarr instances.
18+
19+
## Why Self-Host?
20+
21+
Posterizarr requires **API access to Radarr and Sonarr**, which exposes metadata and library structure details. Self-hosting Posterizarr behind Tailscale ensures:
22+
23+
* Radarr and Sonarr APIs are not publicly exposed
24+
* Poster and artwork management stays inside your private network
25+
* Secure remote management without opening firewall ports
26+
27+
This approach is ideal for homelabs, media servers, and multi-location setups where privacy and security matter.
28+
29+
## Configuration Overview
30+
31+
In this deployment, a **Tailscale sidecar container** (for example, `tailscale-posterizarr`) runs the Tailscale client and connects to your private Tailscale network. The Posterizarr service uses:
32+
33+
```plain
34+
network_mode: service:tailscale-posterizarr
35+
```
36+
37+
This configuration ensures that **all Posterizarr traffic is routed exclusively through the Tailscale interface**, allowing it to securely communicate with Radarr and Sonarr instances over your private network. No ports are exposed to the public Internet, and the service remains fully isolated.
38+
39+
With this setup, Posterizarr can reliably enforce consistent artwork standards across your media library — securely, privately, and automatically.

‎services/posterizarr/config/serve.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"TCP": {
3+
"443": {
4+
"HTTPS": true
5+
}
6+
},
7+
"Web": {
8+
"${TS_CERT_DOMAIN}:443": {
9+
"Handlers": {
10+
"/": {
11+
"Proxy": "http://127.0.0.1:8000"
12+
}
13+
}
14+
}
15+
}
16+
}

‎services/posterizarr/docker-compose.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
services:
2+
# Make sure you have updated/checked the .env file with the correct variables.
3+
# All the ${ xx } need to be defined there.
4+
# Tailscale Sidecar Configuration
5+
tailscale:
6+
image: tailscale/tailscale:latest # Image to be used
7+
container_name: tailscale-${SERVICE} # Name for local container management
8+
hostname: ${SERVICE} # Name used within your Tailscale environment
9+
environment:
10+
- TS_AUTHKEY=${TS_AUTHKEY}
11+
- TS_STATE_DIR=/var/lib/tailscale
12+
- TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required
13+
- TS_USERSPACE=false
14+
- TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz"
15+
- TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The <addr>:<port> for the healthz endpoint
16+
#- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS
17+
volumes:
18+
- ./config:/config # Config folder used to store Tailscale files - you may need to change the path
19+
- ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path
20+
devices:
21+
- /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work
22+
cap_add:
23+
- net_admin # Tailscale requirement
24+
#ports:
25+
# - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required
26+
# If any DNS issues arise, use your preferred DNS provider by uncommenting the config below
27+
#dns:
28+
# - ${DNS_SERVER}
29+
healthcheck:
30+
test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational
31+
interval: 1m # How often to perform the check
32+
timeout: 10s # Time to wait for the check to succeed
33+
retries: 3 # Number of retries before marking as unhealthy
34+
start_period: 10s # Time to wait before starting health checks
35+
restart: always
36+
37+
# ${SERVICE}
38+
application:
39+
image: ${IMAGE_URL} # Image to be used
40+
network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale
41+
container_name: app-${SERVICE} # Name for local container management
42+
environment:
43+
- TZ=Europe/Amsterdam
44+
- TERM=xterm
45+
- RUN_TIME=disabled
46+
user: "1000:1000"
47+
volumes:
48+
- ./${SERVICE}-data/config:/config:rw
49+
- ./${SERVICE}-data/assets:/assets:rw
50+
- ./${SERVICE}-data/assetsbackup:/assetsbackup:rw
51+
- ./${SERVICE}-data/manualassets:/manualassets:rw
52+
depends_on:
53+
tailscale:
54+
condition: service_healthy
55+
healthcheck:
56+
test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running
57+
interval: 1m # How often to perform the check
58+
timeout: 10s # Time to wait for the check to succeed
59+
retries: 3 # Number of retries before marking as unhealthy
60+
start_period: 30s # Time to wait before starting health checks
61+
restart: always

‎services/recyclarr/.env‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#version=1.0
2+
#url=https://github.com/2Tiny2Scale/tailscale-docker-sidecar-configs
3+
#COMPOSE_PROJECT_NAME= // only use in multiple deployments on the same infra
4+
SERVICE=recyclarr
5+
IMAGE_URL=ghcr.io/recyclarr/recyclarr
6+
SERVICEPORT=
7+
TS_AUTHKEY=
8+
DNS_SERVER=9.9.9.9

‎services/recyclarr/README.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Recyclarr with Tailscale Sidecar Configuration
2+
3+
This Docker Compose configuration sets up **Recyclarr** with a Tailscale sidecar container, allowing secure and private synchronization of quality profiles, custom formats, and media settings across your *Radarr* and *Sonarr* instances. With this setup, Recyclarr is **only reachable from within your Tailscale network**, keeping your media automation infrastructure fully private and protected.
4+
5+
## Recyclarr
6+
7+
[**Recyclarr**](https://github.com/recyclarr/recyclarr) is an automation tool designed to **synchronize TRaSH-Guides–based quality profiles and custom formats** to Radarr and Sonarr. Instead of manually configuring and maintaining complex quality rules, Recyclarr allows you to define everything declaratively in YAML and keep your media stack consistent and reproducible.
8+
9+
## Key Features
10+
11+
* ♻️ **TRaSH-Guides Integration** – Automatically syncs recommended quality profiles and custom formats.
12+
* 📐 **Declarative Configuration** – Manage Radarr and Sonarr settings using simple YAML files.
13+
* 🔄 **Consistent Media Rules** – Keep multiple Radarr/Sonarr instances aligned.
14+
* 🧩 **Custom Format Management** – Automatically create, update, and score custom formats.
15+
* 🧪 **Dry-Run Support** – Preview changes before applying them.
16+
* 🐳 **Docker-Friendly** – Lightweight container designed for scheduled or on-demand runs.
17+
* 🛠 **Automation-First** – Ideal for cron jobs, CI pipelines, or homelab orchestration.
18+
19+
## Why Self-Host?
20+
21+
Recyclarr requires **API access to Radarr and Sonarr**, which often exposes sensitive configuration details about your media infrastructure. By self-hosting Recyclarr and restricting access via Tailscale, you ensure:
22+
23+
* Your Radarr/Sonarr APIs are never exposed publicly
24+
* All synchronization traffic stays inside your private network
25+
* Remote management remains secure, even when traveling or managing multiple sites
26+
27+
This is especially valuable in homelabs, seedbox setups, or multi-location media deployments.
28+
29+
## Configuration Overview
30+
31+
In this deployment, a **Tailscale sidecar container** (for example, `tailscale-recyclarr`) runs the Tailscale client and joins your private Tailscale network. The Recyclarr service uses:
32+
33+
```plain
34+
network_mode: service:tailscale-recyclarr
35+
```
36+
37+
This setup ensures that **all Recyclarr traffic flows exclusively through the Tailscale interface**, allowing it to securely reach Radarr and Sonarr instances that are also on your Tailscale network. No ports need to be exposed, and the container remains completely inaccessible from the public Internet.
38+
39+
With this configuration, Recyclarr can safely automate and enforce your media quality standards across your entire media stack — privately, securely, and reproducibly.

0 commit comments

Comments
 (0)