Anonymous Streaming Guide

# Update system packages
sudo apt update && sudo apt full-upgrade -y

# Essential tools
sudo apt install -y curl git htop tree unzip unattended-upgrades

# Timezone (list options with: timedatectl list-timezones)
sudo timedatectl set-timezone America/New_York

# Firewall: allow SSH BEFORE enabling or you lock yourself out
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable

# Automatic security updates
sudo dpkg-reconfigure -plow unattended-upgrades

Use a single /data tree (the layout popularized by the TRaSH Guides). When downloads and library share one filesystem and one mount, Sonarr and Radarr can hardlink files: instant imports, no duplicate disk usage, and you keep seeding.

# One shared /data tree so hardlinks and instant moves work
sudo mkdir -p /data/torrents/{movies,tv,music}
sudo mkdir -p /data/media/{movies,tv,music}

# App configs live separately from media
sudo mkdir -p /opt/mediaserver/config/{jellyfin,sonarr,radarr,prowlarr,qbittorrent,gluetun}

# Owned by your media user (check your IDs with: id)
sudo chown -R $USER:$USER /data /opt/mediaserver
sudo chmod -R a=,a+rX,u+w,g+w /data

/data
├── torrents/        <- qBittorrent downloads here
│   ├── movies/
│   ├── tv/
│   └── music/
└── media/           <- Sonarr/Radarr hardlink finished files here
    ├── movies/
    ├── tv/
    └── music/

/opt/mediaserver
├── compose.yaml
├── .env
└── config/
    ├── jellyfin/  sonarr/  radarr/
    └── prowlarr/  qbittorrent/  gluetun/

# Remove distro-packaged Docker if present
for pkg in docker.io docker-compose docker-compose-v2 podman-docker containerd runc; do
  sudo apt-get remove -y $pkg
done

# Install Docker Engine + Compose plugin from Docker's script
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

# Run docker without sudo (log out and back in afterwards)
sudo usermod -aG docker $USER

# Verify: Engine 29.x and Compose v5.x as of October 2026
docker --version
docker compose version
docker run --rm hello-world

# /opt/mediaserver/.env  (chmod 600, never commit it)
PUID=1000
PGID=1000
TZ=America/New_York

CONFIG_ROOT=/opt/mediaserver/config
DATA_ROOT=/data

# VPN (from your provider's WireGuard config generator)
VPN_SERVICE_PROVIDER=protonvpn
WIREGUARD_PRIVATE_KEY=replace-with-your-private-key
SERVER_COUNTRIES=Switzerland

Generate the WireGuard key in your VPN provider's account dashboard. Protect the file with chmod 600 .env since it holds your VPN credentials.

Save as /opt/mediaserver/compose.yaml. qBittorrent has no ports of its own: it lives inside gluetun's network, so if the VPN drops, it has no route to the internet at all.

services:
  gluetun:
    image: qmcgaw/gluetun:v3.41.3
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - "8080:8080"          # qBittorrent Web UI (published here, not on qbittorrent)
    volumes:
      - ${CONFIG_ROOT}/gluetun:/gluetun
    environment:
      - VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
      - SERVER_COUNTRIES=${SERVER_COUNTRIES}
      - VPN_PORT_FORWARDING=on     # Proton VPN / PIA only
      - TZ=${TZ}
    restart: unless-stopped

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: "service:gluetun"   # all traffic goes through the VPN tunnel
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - WEBUI_PORT=8080
    volumes:
      - ${CONFIG_ROOT}/qbittorrent:/config
      - ${DATA_ROOT}/torrents:/data/torrents
    restart: unless-stopped

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${CONFIG_ROOT}/prowlarr:/config
    ports:
      - "9696:9696"
    restart: unless-stopped

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${CONFIG_ROOT}/sonarr:/config
      - ${DATA_ROOT}:/data
    ports:
      - "8989:8989"
    restart: unless-stopped

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${CONFIG_ROOT}/radarr:/config
      - ${DATA_ROOT}:/data
    ports:
      - "7878:7878"
    restart: unless-stopped

  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    user: ${PUID}:${PGID}
    volumes:
      - ${CONFIG_ROOT}/jellyfin:/config
      - ${DATA_ROOT}/media:/data/media:ro
    devices:
      - /dev/dri:/dev/dri      # Intel/AMD hardware transcoding (remove if unused)
    ports:
      - "8096:8096"
    restart: unless-stopped

cd /opt/mediaserver
docker compose up -d

# Status and logs
docker compose ps
docker compose logs -f gluetun qbittorrent

# Categories (right-click Categories > Add category)
movies  -> /data/torrents/movies
tv      -> /data/torrents/tv
music   -> /data/torrents/music

# Options > Downloads
Default Torrent Management Mode:   Automatic
Default Save Path:                 /data/torrents
When Category Save Path changed:   Relocate torrent

Automatic mode lets Sonarr and Radarr assign a category and have qBittorrent place the files correctly. Do not enable "move completed" style options; the *arr apps import from the category folder and hardlink into /data/media.

Running qBittorrent directly on a desktop with a VPN app instead? Bind it to the VPN interface so it cannot fall back to your real connection.

# Find the VPN interface name
ip -brief link

# Typical names
wg0         # WireGuard (most providers in 2026)
tun0        # OpenVPN (where still offered)
proton0     # Proton VPN app on Linux

1. 1. Options > Advanced > Network Interface: pick the VPN interface (not "Any interface")
2. 2. Optional IP address to bind to: All addresses
3. 3. Test: start a legal test torrent, disconnect the VPN, confirm transfers drop to zero

1. 1. In Sonarr: Settings > General, copy the API Key (do the same in Radarr)
2. 2. In Prowlarr: Settings > Apps > + > Sonarr
3. 3. Prowlarr Server: http://prowlarr:9696, Sonarr Server: http://sonarr:8989, paste the API key
4. 4. Sync Level: Full Sync, Test, Save. Repeat for Radarr with http://radarr:7878
5. 5. Sonarr/Radarr > Settings > Download Clients > qBittorrent: host gluetun, port 8080, category tv / movies

Containers on the same compose network reach each other by service name. qBittorrent is reached through gluetun because it shares that container's network.

Some sites sit behind Cloudflare challenges. FlareSolverr runs a headless browser to solve them. Only add it if an indexer actually needs it.

  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    ports:
      - "8191:8191"
    restart: unless-stopped

Then in Prowlarr: Settings > Indexers > + > FlareSolverr, host http://flaresolverr:8191, add a tag, and apply that tag only to indexers that need it.

# Gluetun's built-in health check (should print "healthy")
docker inspect --format '{{.State.Health.Status}}' gluetun

# Public IP seen through the tunnel (must be the VPN's IP, not yours)
docker exec gluetun wget -qO- https://ipinfo.io/ip

# qBittorrent shares gluetun's network stack, so this matches the line above.
# Kill switch test: stop the VPN and confirm qBittorrent loses all connectivity
docker stop gluetun
docker exec qbittorrent curl -s --max-time 5 https://ipinfo.io/ip || echo "blocked: kill switch works"
docker start gluetun && docker restart qbittorrent

Reach Jellyfin from anywhere without exposing anything to the internet. Tailscale is the easiest; Headscale is a self-hosted control server for Tailscale clients; plain WireGuard (for example wg-easy) works if you can forward one UDP port on your router.

# Install Tailscale on the server
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

# Install the Tailscale app on your phone/laptop, sign in to the same tailnet,
# then open Jellyfin at http://<server-tailscale-name>:8096
tailscale status

# /etc/caddy/Caddyfile  (Caddy fetches and renews HTTPS certs automatically)
jellyfin.example.com {
    reverse_proxy localhost:8096
}

• • Caddy gets Let's Encrypt certificates automatically; Traefik and Nginx Proxy Manager are alternatives
• • Forward only 443 on your router to the proxy
• • Expose Jellyfin only. Never expose qBittorrent, Prowlarr, Sonarr or Radarr
• • Your home IP becomes visible to anyone who looks up the domain

Uptime Kuma checks every service and alerts you (ntfy, email, Telegram and more) when something goes down. Add it to compose.yaml:

  uptime-kuma:
    image: louislam/uptime-kuma:latest
    container_name: uptime-kuma
    volumes:
      - ${CONFIG_ROOT}/uptime-kuma:/app/data
    ports:
      - "3001:3001"
    restart: unless-stopped

cd /opt/mediaserver

# Pull new images and recreate only containers that changed
docker compose pull
docker compose up -d

# Clean up old image layers
docker image prune -f

# Nightly config backup (media is too big; back it up separately or re-acquire)
cd /opt/mediaserver
docker compose stop
tar -czf ~/backups/mediaserver-config-$(date +%F).tar.gz config compose.yaml .env
docker compose start

# Keep the 14 most recent archives
ls -1t ~/backups/mediaserver-config-*.tar.gz | tail -n +15 | xargs -r rm

Sonarr, Radarr and Prowlarr also make their own scheduled backups (System > Backup). Copy archives off the server, ideally encrypted (restic or Borg).