Media Stack Overview

The media stack downloads from Usenet and serves the result through Jellyfin. It spans two halves that share one /data filesystem:

• media-nas VM (Proxmox, Terraform + Ansible) — runs NZBGet behind a Proton WireGuard full tunnel and an NFSv4.1 server that exports /data.
• Kubernetes (tenant-0 k8s.services.homelab.muehlena.de, Flux) — Prowlarr, Sonarr, Radarr, Bazarr, Jellyfin, Seerr, all mounting the VM’s export at /data.

The two golden rules

1. One /data mount, same path everywhere. NZBGet writes to the VM’s local /data; the pods mount that same export at /data. Identical paths + one filesystem let Sonarr/Radarr hardlink-import (instant, no extra space) with no remote path mapping. On the VM, usenet/ and media/ are one ext4 filesystem on a dedicated disk (Terraform attaches it, the data_disk role formats + mounts it).
2. Config off NFS. The *arr apps use SQLite, and SQLite over NFS corrupts. Every /config (and Jellyfin’s transcode temp) is a Rook-Ceph RBD PVC (ceph-block, RWO). Only /data is NFS (RWX).

Streaming path

Jellyfin always proxies the bytes: VM disk → NFS (LAN) → Jellyfin pod → HTTP → client. Clients never touch NFS. Direct Play range-serves the file with near-zero CPU; transcodes run ffmpeg in the pod with the temp dir on the Ceph /config PVC, never on NFS.

What’s exposed

Jellyfin (jellyfin.services.homelab.muehlena.de), Seerr (jellyfin-requests.services.homelab.muehlena.de), Radarr (radarr.services.homelab.muehlena.de), Sonarr (sonarr.services.homelab.muehlena.de) and Bazarr (bazarr.services.homelab.muehlena.de) are exposed. They share one Cilium Gateway (media-gateway, one HTTPS listener + cert per hostname) with a per-app HTTPRoute. Radarr/Sonarr/Bazarr sit behind an oauth2-proxy sidecar (Authentik SSO, gated to the homelab__media group); Jellyfin/Seerr do their own auth. Prowlarr/NZBGet stay internal. See External access & SSO.

Where things live

Piece	Path
VM (Terraform)	tf/infrastructure/media-nas.services.homelab.muehlena.de/
VM (Ansible)	ansible/media-nas.services.homelab.muehlena.de/
k8s base manifests	k8s/manifests/base/appliations/{media-data,prowlarr,sonarr,radarr,bazarr,jellyfin,seerr}/
k8s tenant overlay	tenants/k8s.services.homelab.muehlena.de/k8s/manifests/applications/media/
Flux wiring	.../kustomize-entrypoint/prod/applications/media.yaml

See The media-nas VM and The Kubernetes stack.