The media stack is one of those home-lab projects that sounds simple until it touches storage, networking, VPN routing, Docker Desktop, SMB, and a Windows box that is also feeding Jellyfin. The goal was not to build a perfect homelab reference architecture. It was to make the thing reliable enough that I did not have to babysit it.
The active deployment runs Prowlarr, Sonarr, Radarr, Readarr, qBittorrent, FlareSolverr, and Audiobookshelf in Docker. qBittorrent shares the AirVPN container network namespace, so torrent traffic goes through WireGuard, while the rest of the stack can still talk to the LAN and the SMB media share.
The constraint was Docker Desktop on a Mac talking to a Windows/Jellyfin host. Downloads live on a Mac host path so incomplete files do not balloon Docker Desktop's internal disk. Final media lands on an SMB-backed Docker volume. That gives me a clean separation between temporary download mess and the library Jellyfin actually serves.
The VPN piece needed to be explicit. AirVPN gets a forwarded port, qBittorrent listens on the same port, UPnP is off, and the WireGuard container has route hooks so LAN access still works. If qBittorrent is not connectable, there are only a handful of things to check: forwarded port, qBittorrent port, interface binding, and whether it is really sharing the VPN namespace.
The stack also has the boring operational pieces that make it livable: deploy script, update script, state backups, a healthcheck, SMB mount setup, and notes for the Docker Desktop edge cases. The healthcheck looks for expected containers, the wg0 tunnel, the mounted media volume, and disk usage.
Notes for next time: the hard part is not installing Sonarr. It is deciding where files live, what traffic gets routed through VPN, how the library reaches Jellyfin, and what to check when Docker restarts in the wrong order. A home lab service is still a system. It needs a diagram and a runbook.