Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.

Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.

stacks/authentik/docker-compose.yml

@@ -51,6 +51,8 @@ services:
     container_name: postgres_authentik
     image: postgres:16-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [authentik]
     env_file:
       - stack.env
@@ -66,6 +68,8 @@ services:
     container_name: redis_authentik
     image: redis:7-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [authentik]
     command: --save 60 1 --loglevel warning
     volumes:

stacks/authentik/scripts/apply-forward-auth-admin.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Apply TB-006 forward_auth proxy providers (admin batch 1 + media batch 2).
+"""Apply TB-006 forward_auth proxy providers (batches 1–3).
 
 Native OAuth/OIDC apps (bookstack, gitea, portainer, minio, homarr) use
 setup-batch1-oidc.py instead. Run this via: ak shell -c exec(open(...).read())

stacks/authentik/scripts/setup-batch1-oidc.py

@@ -17,6 +17,12 @@ OIDC_APPS = [
     ("gitea", "gitea", ["https://gitea.ginnoir.com/user/oauth2/Authentik/callback"]),
     ("portainer", "portainer", ["https://portainer.ginnoir.com/"]),
     ("minio", "minio-console", ["https://minio.ginnoir.com/oauth_callback"]),
+    ("owncloud", "owncloud-web", [
+        "https://files.ginnoir.com/index.php/apps/openidconnect/redirect",
+        "https://files.ginnoir.com/apps/openidconnect/redirect",
+    ]),
+    ("resume", "reactive-resume", ["https://resume.ginnoir.com/api/auth/oauth2/callback/custom"]),
+    ("freshrss", "freshrss", ["https://freshrss.ginnoir.com/i/oidc/"]),
 ]
 
 native_slugs = []
@@ -63,6 +69,9 @@ PROXY_NAMES = {
     "gitea": "homelab-gitea",
     "portainer": "homelab-portainer",
     "minio": "homelab-minio",
+    "owncloud": "homelab-files",
+    "resume": "homelab-resume",
+    "freshrss": "homelab-freshrss",
 }
 outpost = Outpost.objects.get(name="authentik Embedded Outpost")
 for slug in native_slugs:

stacks/authentik/scripts/setup-forward-auth-trust-proxy.py

@@ -1,4 +1,4 @@
-"""Update proxy providers for forward_auth apps (admin batch 1 + media batch 2)."""
+"""Update proxy providers for forward_auth apps (batches 1–3)."""
 from authentik.core.models import Application
 from authentik.flows.models import Flow
 from authentik.outposts.models import Outpost, OutpostType

stacks/dev/docker-compose.yml

@@ -55,6 +55,8 @@ services:
     container_name: postgres_gitea
     image: postgres:16-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [dev]
     env_file:
       - stack.env
@@ -162,8 +164,10 @@ services:
 
   mariadb_bookstack:
     container_name: mariadb_bookstack
-    image: lscr.io/linuxserver/mariadb:latest
+    image: lscr.io/linuxserver/mariadb:11.4.7
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [dev]
     env_file:
       - stack.env
@@ -336,6 +340,8 @@ services:
     container_name: postgres_plane
     image: postgres:16-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [dev]
     env_file:
       - stack.env
@@ -355,6 +361,8 @@ services:
     container_name: redis_plane
     image: redis:7-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [dev]
     command: --save 60 1 --loglevel warning
     volumes:
@@ -367,8 +375,10 @@ services:
 
   plane-minio:
     container_name: plane_minio
-    image: minio/minio:latest
+    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [dev]
     command: server /data --console-address ":9001"
     env_file:

stacks/famapp/docker-compose.yml

@@ -31,6 +31,8 @@ services:
     container_name: postgres_famapp
     image: postgres:16-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [famapp]
     env_file:
       - stack.env
@@ -44,9 +46,11 @@ services:
 
   famapp-minio:
     container_name: minio_famapp
-    image: minio/minio:latest
+    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
     command: server /data --console-address ":9003"
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [famapp]
     env_file:
       - stack.env

stacks/media/docker-compose.yml

@@ -158,6 +158,17 @@ services:
     ports:
       - "6969:6969"
 
+  recyclarr:
+    image: ghcr.io/recyclarr/recyclarr:8
+    container_name: recyclarr
+    restart: unless-stopped
+    networks: [media]
+    user: 1000:1000
+    env_file:
+      - stack.env
+    volumes:
+      - ./recyclarr:/config
+
   stash:
     image: stashapp/stash:latest
     container_name: stash

stacks/media/recyclarr/recyclarr.yml

@@ -0,0 +1,25 @@
+# TRaSH Guides sync — WEB-1080p (Sonarr) + HD Bluray + WEB (Radarr).
+# Run manually: docker exec recyclarr recyclarr sync
+sonarr:
+  main:
+    base_url: http://sonarr:8989
+    api_key: !secret sonarr_api_key
+    delete_old_custom_formats: true
+    quality_definition:
+      type: series
+    quality_profiles:
+      - trash_id: 72dae194fc92bf828f32cde74482a9dde
+        reset_unmatched_scores:
+          enabled: true
+
+radarr:
+  main:
+    base_url: http://radarr:7878
+    api_key: !secret radarr_api_key
+    delete_old_custom_formats: true
+    quality_definition:
+      type: movie
+    quality_profiles:
+      - trash_id: d1d67249d3890e49bc12e275d989a7e9
+        reset_unmatched_scores:
+          enabled: true

stacks/media/recyclarr/secrets.yml

@@ -0,0 +1,2 @@
+sonarr_api_key: "383c9489253e445baf8514013a4e37a4"
+radarr_api_key: "94159a19beef48f185bd3e330f8dde3a"

stacks/notes/docker-compose.yml

@@ -22,8 +22,10 @@
 services:
   couchdb:
     container_name: couchdb
-    image: couchdb:3
+    image: couchdb:3.4
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [notes, edge]
     env_file:
       - stack.env

stacks/notify/docker-compose.yml

@@ -62,6 +62,11 @@ services:
       - CRON_MIN=3,33
       - TRUSTED_PROXY=172.16.0.1/12 192.168.0.1/16
       - FRESHRSS_INSTALL=--default-user ginnoir --api-enabled --base-url https://freshrss.ginnoir.com
+      - OIDC_ENABLED=1
+      - OIDC_PROVIDER_METADATA_URL=https://auth.ginnoir.com/application/o/freshrss/.well-known/openid-configuration
+      - OIDC_REMOTE_USER_CLAIM=preferred_username
+      - OIDC_SCOPES=openid profile email
+      - OIDC_X_FORWARDED_HEADERS=X-Forwarded-Host X-Forwarded-Proto
 
   vigilant:
     container_name: vigilant

stacks/notify/stack.env

@@ -3,3 +3,6 @@ TZ=America/Chicago
 # FreshRSS first-run user bootstrap (the container reads FRESHRSS_USER as the
 # full CLI argument string for its install script).
 FRESHRSS_USER=--api-password d0fet0th3x --email 3nigma.matt@gmail.com --password d0fet0th3x --user ginnoir
+OIDC_CLIENT_ID=5DYeBheXidDAErkLTTMFBB4xdC734MoHQ2xNyVWp
+OIDC_CLIENT_SECRET=4s9uiOgTla9euoVlvEgYNpqSGLOaxm0WG4tchUhzHYCjNyOeYQ2s426OaBAwV0YtXDXplCUhkCKNm6q0GCfpSZADhJo2L6nkRuCqFtuA3454Wpjf8ArRVYKwJqdGQePH
+OIDC_CLIENT_CRYPTO_KEY=7f3a9c2e1b8d4f6a0e5c8b2d9f1a4e7

stacks/owncloud/docker-compose.yml

@@ -37,9 +37,11 @@ services:
       - /storage1/ROMs:/mnt/roms
 
   mariadb:
-    image: mariadb:latest
+    image: mariadb:12.3
     container_name: owncloud_mariadb
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [owncloud]
     env_file:
       - stack.env
@@ -56,9 +58,11 @@ services:
       - /config/mysql:/var/lib/mysql
 
   redis:
-    image: redis:latest
+    image: redis:7-alpine
     container_name: owncloud_redis
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [owncloud]
     command: ["--databases", "1"]
     healthcheck:

stacks/owncloud/stack.env

@@ -9,3 +9,5 @@ OWNCLOUD_ADMIN_PASSWORD=d0fet0th3x
 MYSQL_ROOT_PASSWORD=d0fet0th3x
 MYSQL_USER=ginnoir
 MYSQL_PASSWORD=d0fet0th3x
+OWNCLOUD_OIDC_CLIENT_ID=kVTZzTn4ho1lfD8ghtYHYsW84jLBzVQJBzZ7klHB
+OWNCLOUD_OIDC_CLIENT_SECRET=ZvNY4bLkBsbSfo1rUBnX9nSwPzcP5R2Ya18z7IND45KmoPwUOMjnTOI6QjtQuLrzoSJ8ym03rLQLZoNb7Cdp4PtVlPPTMZYKwJBtK7DNWt8zllHLT97gbqWKQGTMxqKF

stacks/proxy/docker-compose.yml

@@ -15,8 +15,10 @@
 services:
   caddy:
     container_name: caddy
-    image: serfriz/caddy-cloudflare-ddns:latest
+    image: serfriz/caddy-cloudflare-ddns:2.11.3
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks:
       - edge
     ports:

stacks/resume/docker-compose.yml

@@ -11,6 +11,8 @@ services:
     container_name: postgres_resume
     image: postgres:16-alpine
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [resume]
     volumes:
       - /config/resume/postgres:/var/lib/postgresql/data
@@ -27,8 +29,10 @@ services:
 
   resume-minio:
     container_name: minio_resume
-    image: minio/minio:latest
+    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [resume, edge]
     command: server /data --console-address :9001
     ports:
@@ -93,6 +97,10 @@ services:
       - STORAGE_BUCKET=default
       - STORAGE_USE_SSL=false
       - STORAGE_SKIP_BUCKET_CHECK=false
+      - OAUTH_PROVIDER_NAME=Authentik
+      - OAUTH_DISCOVERY_URL=https://auth.ginnoir.com/application/o/resume/.well-known/openid-configuration
+      - FLAG_DISABLE_EMAIL_AUTH=true
+      - FLAG_DISABLE_SIGNUPS=true
 
 networks:
   resume:

stacks/resume/stack.env

@@ -24,3 +24,5 @@ STORAGE_SECRET_KEY=minioadmin
 # Pinned to the running value so recreating the container keeps sessions valid.
 # Rotate with: openssl rand -hex 64
 AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f
+OAUTH_CLIENT_ID=YpMFNp9q5mGbN8ADM5rUol0ERHmSiTDClJKIVOxK
+OAUTH_CLIENT_SECRET=mzwjSt0Xtibo156km61T7VYerT48K6ZTa79cEek4mgdky6t1Sjaddlshw2QcJL8727N6qWzddi2ihxNGSpUVMXUBbjNgx4jtkHAy5xtmvqdk9ouIFclyhCgXh9fzjMCA

stacks/roms/docker-compose.yml

@@ -46,9 +46,11 @@ services:
       - "8997:8080"
 
   romm-db:
-    image: mariadb:latest
+    image: mariadb:12.3
     container_name: romm-db
     restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
     networks: [roms]
     env_file:
       - stack.env