r/MediaStack

Hi All,

Huntarr has recently been detected to have a significant security vulnerability, which can expose all of your API keys in a data exposure leak, as there is no authentication in the API stack, moreso if people have exposed their Huntarr instance to the Internet, and solely relying on the security provided by Huntarr.

MediaStack integrates Huntarr as one of the many applications within the project, however MediaStack has been developed with many security layers, to help provide an in-depth approach to protecting your media stack.

In order to get to Huntarr in the MediaStack architecture, Internet users need to pass through Cloudflare WAF, Traefik Reverse Proxy, CrowdSec AppSec rules

I am looking at the high RAM plans on virtarix for my Jellyfin and Arr stack. The NVMe storage is the main draw for me because my current setup struggles with I/O wait when I am unpacking files. I do not care about fancy features I just need raw performance for the price.

Does anyone have benchmarks or real world experience with their disk speeds? I want to know if it is actually fast enough for multiple streams or if it is just marketing numbers. I am also curious where their servers are physically located because latency matters for me. Let me know if you think they are worth the migration effort.

The MediaStack development work has just been pushed to production, with a major update to stack applications, but moreso the network architecture for remotely accessing the environment.

MediaStack at GitHub: https://github.com/geekau/mediastack

• Secure Reverse Proxy: Traefik, Authentik, and CrowdSec provides a full reverse proxy solution with free Let's Encrypt digital certificates, including SSO / OAuth2 / OpenID / SAML / Radius / LDAP identity providers and MFA. Traefik Certs Dumper extracts the Let's Encrypt cetificates so you can install them on other systems.
• Secure Tailscale Meshed Network: Headscale is an open source Tailscale Coor

I wanted to share my issues with installing MediaStack in hopes of helping others.

I used to have MediaStack on Synology, but with the latest version that includes Authentik and Traefik my DS923+ couldn't keep up - it would crash every ~30 minutes.

So now I have an old OptiPlex running Ubuntu that uses Synology NAS for storing media files. And since I am not using torrents, just usenet, I went with the no vpn config.

Here are my observations:

• The documentation is fractured, I needed the GitHub README and mediastack.guide . If you have a similar configuration these are the steps to follow:
  • Start with this section of the GitHub README - [https://github.

No updates on github for over 6 months now. Has the developer abandoned the project?

We've heard many people are having issues setting up SWAG reverse proxy and Authelia, so we have created a test configuration which is fully integrated with Traefik reverse proxy, as it handles the integration differently to SWAG - We've removed SWAG and Authelia from this version.

https://github.com/geekau/mediastack/tree/master/testing-traefik

This test version connects all outbound ARR / Downloaders to Gluetun and forces VPN connecations, and also implements full TLS v1.2 and v1.3 encryption on all inbound HTTPS connections to your application management portals.

This means ARR / Downloaders are protected for all outbo

We've done some more work on remote access for MediaStack Project and have now added:

• Authentik (opensource Authentication & Authorisation Identity Manager)
• Redis (Real-time Data Platform)
• Postgresql (Postgresql Database Server)
• CrowdSec (Cyber Security Threat Intelligence)

You can now set up Tailscale on your mobile device or remote computer, and connect to your own Tailnet, and access all of your systems / services within your home network - not just limited to MediaStack applications.

https://github.com/geekau/mediastack/tree/master/testing-traefik

KNOWN ISSUES:

CrowdSec is installed / working, but doesn't

Hey Team,

As I've had a few queries about running MediaStack on TrueNAS, I can confirm I've now had time to test and successfully deploy MediaStack using the docker compose YAML / ENV files, on TrueNAS 24.10 Beta; without any jail containers and additional addons.

MediaStack on GitHub: https://github.com/geekau/mediastack

These are the configurations I used to get MediaStack installed on TrueNAS 24.10 Beta.

• Create Storage Pool = storage
• Create Datasets
  • docker <- where docker apps will store configs
  • media <- location for media / torrent / usenet
• Group called "docker" already exists with PGID=999
• Create user "docker

The guide and github use a different technology stack (in particular crowdsec vs. cloudflare zero trust as entrypoint). Why? What should one prefer for a small setup with up to 3 parallel users? I have experience with docker, docker-compose, openvpn and wireguard but not with that crowdsec/cloudflare stuff, so I don't know about the subtle differences that might come with the decision.

My priorities are:

• Security
• Maintainability
• User Experience (that's why I would prefer to not use a VPN as entrypoint)

Basically the title. I love the idea of MediaStack but I notice a ton of stuff that I don’t think I’ll need because I don’t need to make this available anywhere outside my own home.

However, I’m a total beginner and I don’t wanna mess anything up by removing stuff improperly or whatever. That would defeat the whole purpose of this.

So I was just wondering what parts of MediaStack I could just comment out or disable in order to make the setup both A: simpler and B: more closely fit to my needs. The only people who are gonna use the server are all in my house, so I don’t care about security and authentication and stuff.

I’d greatly appreciate if anyone could help me strip things down a bit

We've done some more work on remote access for MediaStack Project and have now added:

• Headscale (opensource Tailscale coordination server)
• Tailscale (Meshed network wireguard client - operating as exit node)
• Headplane (WebUI for managing Headscale)

You can now set up Tailscale on your mobile device or remote computer, and connect to your own Tailnet, and access all of your systems / services within your home network - not just limited to MediaStack applications.

https://github.com/geekau/mediastack/tree/master/testing-traefik

We've already added the Traefik labels to all of the Docker containers, so you just need t

https://preview.redd.it/cbiwnf2pe6qd1.png?width=765&format=png&auto=webp&s=2308fc53112cde0522c397f108c762039e346c27

Hi All, just a quick heads up, I've pushed the latest update to the document portal, covering the secure remote access for your MediaStack docker deployment.

Start on the Remote Access menu, then work down the pages in order (top to bottom).

https://mediastack.guide/remote/dns/

The bottom of the SWAG page needs a little tidy up, however it should be in order and structured enough for people to give it a crack.

Welcome and feedback.

Hi

Great project and am keen to get going with it!

I now have a Ubuntu 26.04 VM up and running and have mapped with a couple of SMB mounts to my NAS via fstab.

I have installed the basic docker packaged required also and tested with the hello-world container.

I came across your solution and wanted to give it a try but wanted to know how customisable is it in terms of only deploying what you need

In particular,

• can you select what applications in the list you deploy?
• I already have a VPN setup running and dont want to expose to the internet, is there any point in me having any of the crowdsec, trafik etc installed?
• Would you keep Traefik as the ingress pathway for my LAN and VPN d

There are some breaking changes involving the database or redis I think, has anyone successfully migrated and updated?

Hi, i'm currently trying to get mediastack running (the full vpn version), everything seems to work locally, even if i only have radarr, both downloader, portainer, prowlarrset-up yet. I wanted to make sure that i would word with my domain before setting up everything else.

But I can't find out why I have nothing on my domain name.
I know I must be missing something, but can't figure out what :(

So far I have added the cloudfare api token for creating all A and CNAME entries, configured DDNS-updater. Created a Authentik account, edited "authentic brand" to "MediaStack - Authentik" and force MFA.
Added Authentik application "Provider for Authentik" and for [https://auth.exampl