Initial commit — MediaStack VM config and documentation

VM 113 on PVE1: Sonarr/Radarr/Prowlarr/qBittorrent behind WireGuard VPN.
All traffic exits through DO server, bypassing home ISP.
NFS exports movies and TV to Jellyfin (VM 112).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/dns/resolved-dns.conf

@@ -0,0 +1,3 @@
+[Resolve]
+DNS=10.48.200.90
+Domains=~.

config/jarvis-agent/config.json.example

@@ -0,0 +1,12 @@
+{
+  "server_url": "https://165.22.1.228",
+  "host_header": "jarvis.orbishosting.com",
+  "agent_id": "mediastack_5038de87",
+  "api_key": "REDACTED",
+  "agent_type": "linux",
+  "heartbeat_interval": 10,
+  "metrics_interval": 30,
+  "jarvis_url": "https://165.22.1.228",
+  "registration_key": "REDACTED",
+  "ssl_verify": false
+}

config/nfs/exports

@@ -0,0 +1,2 @@
+/media/movies  10.48.200.33(rw,sync,no_subtree_check,no_root_squash)
+/media/tv      10.48.200.33(rw,sync,no_subtree_check,no_root_squash)

config/systemd/jarvis-agent.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=JARVIS Agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/python3 /opt/jarvis-agent/jarvis-agent.py
+WorkingDirectory=/opt/jarvis-agent
+Restart=always
+RestartSec=10
+StartLimitInterval=60
+StartLimitBurst=5
+
+[Install]
+WantedBy=multi-user.target

config/systemd/prowlarr.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Prowlarr
+After=network.target wg-quick@wg0.service
+Requires=wg-quick@wg0.service
+
+[Service]
+User=prowlarr
+Group=prowlarr
+ExecStart=/opt/Prowlarr/Prowlarr -nobrowser -data=/var/lib/prowlarr
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

config/systemd/qbittorrent.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=qBittorrent-nox
+After=network.target wg-quick@wg0.service
+Requires=wg-quick@wg0.service
+
+[Service]
+User=qbittorrent
+Group=qbittorrent
+ExecStart=/usr/bin/qbittorrent-nox --webui-port=8080
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

config/systemd/radarr.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Radarr
+After=network.target wg-quick@wg0.service
+Requires=wg-quick@wg0.service
+
+[Service]
+User=radarr
+Group=radarr
+ExecStart=/opt/Radarr/Radarr -nobrowser -data=/var/lib/radarr
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

config/systemd/sonarr.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Sonarr
+After=network.target wg-quick@wg0.service
+Requires=wg-quick@wg0.service
+
+[Service]
+User=sonarr
+Group=sonarr
+ExecStart=/opt/Sonarr/Sonarr -nobrowser -data=/var/lib/sonarr
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

config/wireguard/wg0.conf

@@ -0,0 +1,13 @@
+[Interface]
+PrivateKey = REDACTED
+Address = 10.200.0.4/24
+DNS = 1.1.1.1
+
+PostUp   = iptables -A OUTPUT -d 10.48.200.0/24 -j ACCEPT; iptables -A OUTPUT ! -o wg0 -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT
+PostDown = iptables -D OUTPUT -d 10.48.200.0/24 -j ACCEPT; iptables -D OUTPUT ! -o wg0 -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT
+
+[Peer]
+PublicKey = RXxDgIAaie4n0BxBA48rlmt9BJyp2GEktENeQDlc4hA=
+Endpoint = 10.48.200.19:51821
+AllowedIPs = 0.0.0.0/0
+PersistentKeepalive = 25