Servarr stack for a Synology NAS, using VPN

.env.example

# create a file named .env replacing this with your own vars
# NOTE: Install Container Manager from Synology Package Center, otherwise the system won't give user access to docker
# Container Manager App will create the shared folder /volume1/docker/

# --- Synology Host Paths ---
CONFIG_BASE_PATH=/volume1/docker/servarr # Create this folder and upload .env and docker-compose.yaml
DOWNLOADS_PATH=${CONFIG_BASE_PATH}/downloads/qbittorrent

# You MUST create this Shared Folder in Synology DSM Control Panel >> Shared Folder
# Then give read/write access to your user and user group
MOVIES_PATH=/volume1/Movies
TV_PATH=/volume1/TV

# --- Common Container Configuration ---
DEFAULT_PUID=1026
DEFAULT_PGID=100
DEFAULT_TZ=Europe/Amsterdam
DEFAULT_UMASK=002

# --- VPN Credentials ---
OPENVPN_USER=your_vpn_username
OPENVPN_PASSWORD=your_vpn_password

# --- qBittorrent WebUI Credentials ---
QBT_WEBUI_USERNAME=your_qbittorrent_webui_username
QBT_WEBUI_PASSWORD=your_qbittorrent_webui_password

docker-compose.yaml

version: "3.8"

services:
  # VPN manager: creates VPN network from NordVPN
  # used for torrents and servarr apps
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    ports:
      - 8080:8080 # qBittorrent Web UI (exposed by gluetun)
      - 9000:9000 # optional
      - 8989:8989 # Sonarr Web UI
      - 7878:7878 # Radarr Web UI
      - 9696:9696 # Prowlarr Web UI
      - 6767:6767 # Bazarr Web UI
    environment:
      - VPN_SERVICE_PROVIDER=nordvpn
      - OPENVPN_USER=${OPENVPN_USER}
      - OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
      - SERVER_COUNTRIES=Netherlands
      - TZ=${DEFAULT_TZ}
    volumes:
      - ${CONFIG_BASE_PATH}/gluetun:/gluetun
    restart: unless-stopped

  # Torrent client
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent
    container_name: qbittorrent
    depends_on:
      - gluetun
    network_mode: "service:gluetun"
    environment:
      - PUID=${DEFAULT_PUID}
      - PGID=${DEFAULT_PGID}
      - TZ=${DEFAULT_TZ}
      - UMASK=${DEFAULT_UMASK}
      - WEBUI_PORT=8080
      - WEBUI_USERNAME=${QBT_WEBUI_USERNAME}
      - WEBUI_PASSWORD=${QBT_WEBUI_PASSWORD}
    volumes:
      - ${CONFIG_BASE_PATH}/qbittorrent:/config
      - ${DOWNLOADS_PATH}:/downloads
    restart: unless-stopped

  # Servarr stack apps
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    network_mode: "service:gluetun"
    environment:
      - PUID=${DEFAULT_PUID}
      - PGID=${DEFAULT_PGID}
      - UMASK=${DEFAULT_UMASK}
      - TZ=${DEFAULT_TZ}
    volumes:
      - ${CONFIG_BASE_PATH}/prowlarr:/config
    restart: unless-stopped

  sonarr:
    image: lscr.io/linuxserver/sonarr
    container_name: sonarr
    network_mode: "service:gluetun"
    environment:
      - PUID=${DEFAULT_PUID}
      - PGID=${DEFAULT_PGID}
      - UMASK=${DEFAULT_UMASK}
      - TZ=${DEFAULT_TZ}
    volumes:
      - ${CONFIG_BASE_PATH}/sonarr:/config
      - ${TV_PATH}:/tv
      - ${DOWNLOADS_PATH}:/downloads
    restart: unless-stopped

  radarr:
    image: lscr.io/linuxserver/radarr
    container_name: radarr
    network_mode: "service:gluetun"
    environment:
      - PUID=${DEFAULT_PUID}
      - PGID=${DEFAULT_PGID}
      - UMASK=${DEFAULT_UMASK}
      - TZ=${DEFAULT_TZ}
    volumes:
      - ${CONFIG_BASE_PATH}/radarr:/config
      - ${MOVIES_PATH}:/movies
      - ${DOWNLOADS_PATH}:/downloads
    restart: unless-stopped

  bazarr:
    image: lscr.io/linuxserver/bazarr:latest
    container_name: bazarr
    environment:
      - PUID=${DEFAULT_PUID}
      - PGID=${DEFAULT_PGID}
      - UMASK=${DEFAULT_UMASK}
      - TZ=${DEFAULT_TZ}
    volumes:
      - ${CONFIG_BASE_PATH}/bazarr:/config
      - ${TV_PATH}:/tv
      - ${MOVIES_PATH}:/movies
    restart: unless-stopped
    network_mode: "service:gluetun"
    depends_on:
      - gluetun
      - sonarr
      - radarr

  # Media streaming
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    environment:
      - PUID=${DEFAULT_PUID}
      - PGID=${DEFAULT_PGID}
      - TZ=${DEFAULT_TZ}
      - UMASK=${DEFAULT_UMASK}
    volumes:
      - ${CONFIG_BASE_PATH}/jellyfin:/config
      - ${MOVIES_PATH}:/data/movies
      - ${TV_PATH}:/data/tvshows
    ports:
      - 8096:8096 # Jellyfin Web UI Port
    network_mode: bridge # local streaming and Chromecast
    restart: unless-stopped

  # Auto update docker images
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # Essential: Allows Watchtower to control Docker
    environment:
      - TZ=${DEFAULT_TZ}
      # Schedule updates (e.g., every day at 3:00 AM)
      # Uses cron syntax. Here: 0 minutes, 3 hours, * day of month, * month, * day of week
      - WATCHTOWER_SCHEDULE=0 0 3 * * *
      # What to do after updating:
      - WATCHTOWER_CLEANUP=true # Remove old images after updating (recommended)
    restart: unless-stopped