v2.0.0

⚠️ Breaking change: Transmission now runs through OpenVPN

Transmission was swapped from linuxserver/transmission to haugene/transmission-openvpn (#36). Existing v1.0.0 deployments will not start cleanly after pulling without two changes:

1. Add VPN credentials to .env (all four are now hard-required):

   OPENVPN_PROVIDER=
   OPENVPN_CONFIG=
   OPENVPN_USERNAME=
   OPENVPN_PASSWORD=
   

   See the list of supported providers.
2. Volume path changed from /config to /data (haugene's convention). The compose file now mounts ${USERDIR}/transmission/data:/data instead of ${USERDIR}/transmission:/config. Existing torrent state can be migrated by moving your old config dir's contents into ${USERDIR}/transmission/data/transmission-home/.

Optional but recommended: set LOCAL_NETWORK (default 192.168.0.0/16) to the CIDR of your LAN, or the web UI on :9091 will be unreachable from your machine.

What's new

Monitoring (#39)

• Prometheus on :9090 with persistent TSDB volume
• cAdvisor on :8080 for per-container resource metrics (runs privileged: true with several host-fs read-only mounts)
• node-exporter on :9100 for host CPU/disk/network/memory metrics
• Only cadvisor and node-exporter scrape jobs are active by default; telegraf and tautulli jobs are commented placeholders pending metrics endpoints on those containers

Media stack additions (#34, #38)

• Prowlarr (:9696), Bazarr (:6767), Portainer (:9000)
• FlareSolverr (:8191) — Cloudflare bypass proxy for Prowlarr indexers
• Maintainerr (:6246) — Rule-based Plex library cleanup
• Decluttarr — Removes stalled/failed downloads from *arr queues (pinned to v1.50.2; v2 broke the env var schema)
• Checkrr (:8585) — Media file integrity scanner

Repo / CI (#33, #35)

• Community health files (CONTRIBUTING, SECURITY, issue templates) for discoverability
• compose-validate.yml CI workflow now runs docker compose config on every PR
• .env.example pruned to match what compose actually consumes; name: autoplexx set so Compose v2 stops auto-naming the project

Notes / caveats

• Portainer mounts /var/run/docker.sock read-write, which is root-equivalent host access. Set a strong admin password on first launch and don't expose :9000 publicly.
• cAdvisor runs privileged: true and binds host port 8080. If you have something else on :8080, that's the conflict.
• Decluttarr API keys (RADARR_API_KEY / SONARR_API_KEY) are populated after first boot — the *arrs only expose their API keys via their web UIs once running. Decluttarr starts fine with both blank and skips any service whose key is empty.

Full changelog: v1.0.0...v2.0.0