Seerr

Seerr is the unified request manager for the *arr stack (the maintained seerr-team/seerr successor to the archived Overseerr/Jellyseerr line). Frank's household uses it to request movies/TV/music; Seerr routes approvals to Sonarr/Radarr/Lidarr/Readarr on FrankBook-Pro and pushes downloads to qBittorrent.

Host: Dankclaw — Hostname: seerr.franksdank.cloud (Caddy, guarded) — Docs: https://github.com/seerr-team/seerr

Facts (verified live, 2026-09-01)

Item	Value
Image	`ghcr.io/seerr-team/seerr:v3.4.1` (runs as in-image `node`, uid 1000)
Port	5055 (container), published `127.0.0.1:5055` on the host (loopback-only)
Data	`/home/dank/Containers/seerr/data` → `/app/config` (SQLite settings store)
Unit	`dankclaw/seerr/quadlet/seerr.container` → `seerr.service`
Network	`dankclaw_default` (post-auth listener reachability)
Guard	Caddy TLS edge → Anubis :8923 → Authentik outpost provider `seerr-proxy` → Caddy :8017 `@seerr` handler → `seerr:5055`
DNS	Pi-hole addn-hosts + Porkbun public A `seerr.franksdank.cloud → 192.168.0.143`

Why loopback-only publishing

Seerr is browser-facing; the only sanctioned user path is the guard chain (Caddy → Anubis → Authentik SSO). PublishPort=127.0.0.1:5055:5055 keeps the app off the LAN entirely while still letting the homepage probe agent and host-local checks reach it — the same loopback convention as other guarded hosts (see Homepage Design Grilling).

*arr wiring

Seerr reaches the *arr services on FrankBook-Pro (192.168.0.112, gluetun-NetNS stack inside the Mac's podman machine VM) by IP-based base URLs (http://192.168.0.112:<port>), configured inside Seerr's own web settings — not in env or quadlet. The .lan hostname variant was deliberately dropped: addn-hosts records are for fleet public-domain hosts, and IP bases match the Mac stack's verified LAN reachability. API keys live in each arr's config.xml on the Mac and are entered through Seerr's settings store.

OIDC single-sign-on for Seerr (Authentik OIDC provider + Seerr OIDC config) remains an open option; the guard chain already authenticates the front door, so this is an in-app setting deferred to Frank's first-run session.

UID mapping gotcha

The container runs as node (uid 1000 in-image). Rootless podman's continuous mapping is container uid N → host uid 100000 + N - 1, so uid 1000 → 100999. The first deploy chowned the data dir to 100999 + 1 (= 101000) and crash-looped with EACCES mkdir /app/config/logs. Rule: read the real mapping from any container's /proc/self/uid_map before chowning bind roots for non-root images.

Deployment

./scripts/deploy.sh dankclaw --service seerr. The deployer pre-creates the bind-source dir, installs the unit, and restarts. First visit after deploy: complete the Seerr local-admin setup wizard (the guard chain bounces through Authentik first). TLS issuance for a new vhost fires at Caddy reload (dns-01) — allow ~15 s before the first HTTPS probe.

Citations

Seerr image and volume contract: https://github.com/seerr-team/seerr (official docs recommend /app/config persistence)

3.1 KiB Raw Blame History