WATCHMYEMBY

Command

No one signed in on the bridge.

Access EmbyAccess Jellyfin

Sign in on Bridge first. Until then these open server1.watchmyemby.media and jserver.watchmyemby.media at the normal login.

07 Edge

NPMplus stays. New names only.

nginx.watchmyemby.media is NPMplus. port.watchmyemby.media is Portainer. Neither is recreated. Command is this floor: add command.watchmyemby.media on the NPMplus you already have. The arr names go there too, after the stack is in Portainer.

Existing hosts lockedNew host only

Add this

command.watchmyemby.media

Keep, do not edit

Current proxy hosts

A reminder list only. Command never writes to NPMplus. Add the names you already have so this floor doesn't pretend they should move.

  • server1.watchmyemby.media

    Emby. Leave the host. Add only the /enter/emby location.

  • jserver.watchmyemby.media

    Jellyfin. Leave the host. Add only the /enter/jellyfin location.

  • nginx.watchmyemby.media

    NPMplus. Do not recreate this host.

  • port.watchmyemby.media

    Portainer. The arr stack is pasted here.

Proxy host to create

Same certificate style you already use for the rest of the domain. Request the certificate for this host only. Point DNS for command the same way your other names already resolve.

NPMplus fields

Domain: command.watchmyemby.media
Scheme: https
Forward hostname: (published Command address)
Forward port: 443
Websockets: on
Block common exploits: on
Cache assets: off
Certificate: request a new one for this host only

Leave every existing proxy host untouched.
DNS: command should resolve the same way the rest of watchmyemby.media already does.

Namecheap CNAMEs

Zone: watchmyemby.media
Type: CNAME
Target: gateway.watchmyemby.media.
TTL: 5 min

Host
command
sonarr
radarr
prowlarr
bazarr
jellyseerr
qbittorrent

server1, jserver, port, and nginx already exist. Do not change them.
port.watchmyemby.media is Portainer. nginx.watchmyemby.media is NPMplus.
FlareSolverr stays on the machine. It does not get a public name.

NPMplus hosts for the stack

New hosts on nginx.watchmyemby.media. That is NPMplus. Do not recreate it.
Leave server1, jserver, port.watchmyemby.media, and nginx.watchmyemby.media as they are.
Scheme http, websockets on, a certificate for that host only.
Forward hostname: the machine running Portainer.

sonarr.watchmyemby.media → port 8989  (TV)
radarr.watchmyemby.media → port 7878  (Movies)
prowlarr.watchmyemby.media → port 9696  (Indexers)
bazarr.watchmyemby.media → port 6767  (Subtitles)
jellyseerr.watchmyemby.media → port 5055  (Requests)
qbittorrent.watchmyemby.media → port 8080  (Downloads through the tunnel)

command.watchmyemby.media is this floor. Forward it to the published address, not to a Portainer port.
The arr stack itself is pasted into Portainer at port.watchmyemby.media.

Enter paths on the two hosts you already have

Leave the main forward on server1 and jserver exactly as it is.

server1.watchmyemby.media → custom location
Location: /enter/emby
Forward hostname: (published Command address)
Forward port: 443
Scheme: https

jserver.watchmyemby.media → custom location
Location: /enter/jellyfin
Forward hostname: (published Command address)
Forward port: 443
Scheme: https

Access Emby and Access Jellyfin use those paths.
The sign-in key is in the fragment, after #, so this proxy does not log it.
The password is never in the address.

Namecheap

Same idea as an API key in NPMplus: the key stays in this browser and is sent only to Namecheap. A new name is a CNAME, host only, value gateway.watchmyemby.media., TTL 5 min. Existing records are sent back with it. Namecheap allows one address to call the API. That address is Command's, not the browser's, so it has to be the one you allowed.