Docker and environment¶

# Example Coldarr deployment. Copy to docker-compose.yml and adjust paths.
#
# Coldarr's default command is `serve` - a persistent web GUI on port 8478 for
# configuring connections/tiers, previewing plans, and applying them by
# hand. If you'd rather script it, override `command` to a one-shot CLI
# call instead (see the commented block below) and drive it from the
# host's own scheduler (cron/systemd timer):
#   0 4 * * * docker compose run --rm coldarr apply --yes
#
# The GUI can view connection status and trigger real moves, so it's
# never reachable unauthenticated: with no OIDC configured (the default),
# it falls back to a single shared password instead - see COLDARR_PASSWORD
# below. Enable OIDC in Settings -> Auth (or with COLDARR_OIDC_* env vars)
# for real identity-provider-backed login and group-based access instead.
#
# Connections (Radarr/Sonarr/Jellyfin URL + API key) can be configured
# either through the GUI (stored encrypted in ./config) or via env vars
# below - env vars always win if both are set. Secrets here come from a
# .env file next to this compose file - see .env.example.
services:
  coldarr:
    image: ghcr.io/voc0der/coldarr:latest
    container_name: coldarr
    ports:
      - "8478:8478"
    # Optional - start the container already as a specific uid:gid instead
    # of the default root-then-drop-to-PUID/PGID flow (useful for rootless
    # runtimes or policies that forbid containers starting as root, e.g. a
    # Kubernetes securityContext). When set, PUID/PGID below are ignored -
    # make sure this uid:gid already owns ./config.
    # user: "1000:1000"
    environment:
      PUID: "1000"
      PGID: "1000"
      TZ: ${TZ:-Etc/UTC}
      # Optional - serve HTTPS directly from Coldarr instead of plain HTTP.
      # COLDARR_TLS_CERT_FILE: /certs/fullchain.pem
      # COLDARR_TLS_KEY_FILE: /certs/privkey.pem
      # Optional - trust X-Forwarded-Proto/Host only from these proxy CIDRs.
      # COLDARR_TRUSTED_REVERSE_PROXIES_CIDR: 172.18.0.0/16,10.0.0.0/8
      # Optional - fixed password for when OIDC is disabled (below). Left
      # unset, one is generated and printed to `docker logs coldarr` on
      # every start, but won't survive a restart. COLDARR_PASSWORD_FILE
      # (path to a Docker secret or bind-mounted file, inside the
      # container) overrides this if both are set.
      # COLDARR_PASSWORD: ${COLDARR_PASSWORD}
      # COLDARR_PASSWORD_FILE: /run/secrets/coldarr_password
      # Optional - OIDC auth. These env vars override GUI-saved auth values.
      # COLDARR_OIDC_ENABLED: "true"
      # COLDARR_OIDC_ISSUER_URL: https://auth.example.com
      # COLDARR_OIDC_CLIENT_ID: coldarr
      # COLDARR_OIDC_CLIENT_SECRET: ${COLDARR_OIDC_CLIENT_SECRET}
      # COLDARR_OIDC_REDIRECT_URL: https://coldarr.example.com/auth/callback
      # COLDARR_OIDC_REQUIRED_GROUP: coldarr
      # COLDARR_OIDC_GROUPS_CLAIM: groups
      # COLDARR_OIDC_CLIENT_SECRET_POST: "true" # Authelia often wants this.
      # COLDARR_OIDC_AUTO_LOGIN: "false"
      # Optional - omit these and use the GUI's Connections page instead.
      # RADARR_URL: http://radarr:7878
      # RADARR_API_KEY: ${RADARR_API_KEY}
      # SONARR_URL: http://sonarr:8989
      # SONARR_API_KEY: ${SONARR_API_KEY}
      # JELLYFIN_URL: http://jellyfin:8096
      # JELLYFIN_API_KEY: ${JELLYFIN_API_KEY}
      # Optional - download tiering (see the docs' "Downloads and seeding").
      # The URL alone works if qBittorrent's WebUI skips authentication for
      # Coldarr's address; otherwise an API key (qBittorrent 5.2+) or a login.
      # QBITTORRENT_URL: http://qbittorrent:8080
      # QBITTORRENT_API_KEY: ${QBITTORRENT_API_KEY}
      # QBITTORRENT_USERNAME: admin
      # QBITTORRENT_PASSWORD: ${QBITTORRENT_PASSWORD}
      # LIDARR_URL: http://lidarr:8686
      # LIDARR_API_KEY: ${LIDARR_API_KEY}
    volumes:
      # Everything Coldarr persists lives here: coldarr.yaml, the
      # encrypted connection store + its key, and the move-history log.
      - ./config:/config
      # Optional - if COLDARR_TLS_CERT_FILE / COLDARR_TLS_KEY_FILE point here.
      # - ./certs:/certs:ro
      # Tier paths: mount at the SAME path Radarr/Sonarr use internally,
      # not just the same host path - Coldarr matches Arr API root folder
      # paths against these mounts literally. Coldarr only ever reads them
      # (disk usage checks, sizing candidates for a plan) - the actual
      # move is a moveFiles: true call to Radarr/Sonarr's own API, executed
      # by their containers against their own (separate, read-write) mount
      # of the same paths. :ro here costs Coldarr nothing and guarantees
      # it can't touch your media even if it tried.
      - /data/media:/data/media:ro
      - /mnt/sat1:/mnt/sat1:ro
      - /mnt/sat2:/mnt/sat2:ro
      # Optional - download tiering: the download drive and seed storage, at
      # the SAME paths qBittorrent uses. qBittorrent does the moving, so :ro
      # is fine - unless you mark a downloads tier as not read-only to delete
      # orphaned files from the Orphaned Storage page.
      # - /mnt/ssd/downloads:/downloads:ro
      # - /mnt/seed:/seed:ro
    restart: unless-stopped
    # If radarr/sonarr/jellyfin are containers in this same compose
    # project, put coldarr on their network instead of using service
    # names that only resolve there:
    # networks:
    #   - arr-stack

    # To run Coldarr as a one-shot CLI instead of the GUI, override the
    # command (and drop `ports`/`restart` above, or leave them - they're
    # harmless on a short-lived `run`):
    # command: ["apply", "--yes"]