# Quadlet unit: Seerr media request manager (rootless, boot-persistent).
#
# Install path on dankclaw: ~/.config/containers/systemd/seerr.container
# Unit name: seerr.service (container name: seerr)
#
# Seerr is the unified Overseerr/Jellyseerr successor. It fronts the
# *arr stack now living on FrankBook-Pro (192.168.0.112, resolved via the
# Pi-hole addn-hosts record frankbook-pro.lan): requests are placed here,
# routed through the arrs over the LAN, and downloads run inside the Mac's
# gluetun tunnel. SQLite lives under /home/dank/Containers/seerr/data —
# no separate database unit (decision D8).
#
# Exposure contract: the ONLY published port is loopback (127.0.0.1:5055)
# for the homepage probe and host-local checks. User traffic must traverse
# the guard chain: Caddy TLS edge → Anubis :8923 → Authentik outpost →
# Caddy :8017 post-auth listener → seerr:5055 on dankclaw_default. Never
# publish 5055 on a LAN or public address.
#
# Image pin: ghcr.io/seerr-team/seerr:v3.4.1 (manifest-verified on GHCR
# 2026-09-01; released 2026-07-30). Upgrade = bump the tag, redeploy.
#
# No secrets in this file: OIDC (Authentik) and arr API keys live in
# Seerr's own settings store inside the data volume, configured at runtime.

[Unit]
Description=Seerr media request manager container
After=network-online.target
Wants=network-online.target

[Container]
ContainerName=seerr
Image=ghcr.io/seerr-team/seerr:v3.4.1
Network=dankclaw_default
PublishPort=127.0.0.1:5055:5055
Volume=/home/dank/Containers/seerr/data:/app/config

[Service]
Restart=always
RestartSec=5
TimeoutStartSec=900

[Install]
WantedBy=default.target