The arrs, in the order they depend on each other.

# Portainer stack. Paste this as a new stack.
# /d4 holds incomplete downloads and finished downloads.
# /d1 is not mounted. It is already near full.
# A finished file is copied into the existing show or movie folder, then the torrent is removed.
# Anything still unfinished after 5 days is removed and searched for again.
name: watchmyemby

services:
  gluetun:
    image: qmcgaw/gluetun:v3
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - VPN_SERVICE_PROVIDER=windscribe
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=${WINDSCRIBE_WIREGUARD_PRIVATE_KEY}
      - WIREGUARD_PRESHARED_KEY=${WINDSCRIBE_WIREGUARD_PRESHARED_KEY}
      - WIREGUARD_ADDRESSES=${WINDSCRIBE_WIREGUARD_ADDRESSES}
      - WIREGUARD_ENDPOINT_PORT=443
      - WIREGUARD_IMPLEMENTATION=userspace
      - DNS_UPSTREAM_RESOLVER_TYPE=doh
      - OPENVPN_USER=${WINDSCRIBE_USER}
      - OPENVPN_PASSWORD=${WINDSCRIBE_PASSWORD}
      - FIREWALL_OUTBOUND_SUBNETS=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
    ports:
      - 8080:8080
    restart: unless-stopped

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: service:gluetun
    depends_on:
      - gluetun
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ}
      - WEBUI_PORT=8080
    volumes:
      - ./config/qbittorrent:/config
      - /d2:/d2
      - /d3:/d3
      - /d4:/d4
    restart: unless-stopped

  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    environment:
      - LOG_LEVEL=info
    restart: unless-stopped

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    environment: &lsio
      - PUID=1000
      - PGID=1000
      - TZ=${TZ}
    volumes:
      - ./config/prowlarr:/config
    ports:
      - 9696:9696
    restart: unless-stopped

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    environment: *lsio
    volumes:
      - ./config/sonarr:/config
      - /d2:/d2
      - /d3:/d3
      - /d4:/d4
    ports:
      - 8989:8989
    restart: unless-stopped

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    environment: *lsio
    volumes:
      - ./config/radarr:/config
      - /d2:/d2
      - /d3:/d3
      - /d4:/d4
    ports:
      - 7878:7878
    restart: unless-stopped

  bazarr:
    image: lscr.io/linuxserver/bazarr:latest
    container_name: bazarr
    environment: *lsio
    volumes:
      - ./config/bazarr:/config
      - /d2:/d2
      - /d3:/d3
      - /d4:/d4
    ports:
      - 6767:6767
    restart: unless-stopped

  jellyseerr:
    image: ghcr.io/seerr-team/seerr:latest
    container_name: jellyseerr
    environment:
      - LOG_LEVEL=info
      - TZ=${TZ}
    ports:
      - 5055:5055
    volumes:
      - ./config/jellyseerr:/app/config
    restart: unless-stopped

[BitTorrent]
Session\DefaultSavePath=/d4/downloads
Session\TempPath=/d4/downloads/incomplete
Session\TempPathEnabled=true
Session\MaxRatio=0
Session\MaxRatioEnabled=true
Session\MaxRatioAction=0
Session\MaxSeedingTime=0
Session\MaxSeedingTimeEnabled=true

[Preferences]
WebUI\Address=*
WebUI\ServerDomains=*

# MaxRatioAction 0 pauses the torrent the moment it finishes.
# It does not delete the file. Sonarr and Radarr copy first, then remove the torrent and the download.
# Incomplete and completed downloads are both on /d4.
# Unfinished after 5 days: remove, then search again.
# Categories:
# tv → /d4/downloads/tv
# movies → /d4/downloads/movies

Movies and TV only. /d1 is not used. It is 91% full.
Incomplete and completed downloads both stay on /d4 until the copy.
/d4 is almost empty, so new shows go to /d4/TV-Shows4 and new movies go to /d4/Movies.

Existing libraries, left where they are:
/d2/Movies2
/d2/TV-Shows2
/d3/Movies3
/d4/TV-Shows4
/d4/Movies

qBittorrent on /d4:
tv      /d4/downloads/tv
movies  /d4/downloads/movies
incomplete  /d4/downloads/incomplete

Sonarr root for new shows: /d4/TV-Shows4
Radarr root for new movies: /d4/Movies
Also add the existing library folders above as roots, so a show already on /d2 stays on /d2.
Sonarr download client: host gluetun, port 8080, category tv.
Radarr download client: host gluetun, port 8080, category movies.
Import as Copy. A hardlink cannot cross from /d3 to /d4.
Completed download handling: remove the torrent and its files after the copy succeeds.
qBittorrent share limit: ratio 0, pause. It must not upload, and it must not delete the file before the copy.
If a download is still unfinished after 5 days, remove it and search for another copy.
Connect Sonarr and Radarr to server1 and jserver so both libraries refresh.

TZ=America/New_York
WINDSCRIBE_WIREGUARD_PRIVATE_KEY=
WINDSCRIBE_WIREGUARD_PRESHARED_KEY=
WINDSCRIBE_WIREGUARD_ADDRESSES=
WINDSCRIBE_USER=
WINDSCRIBE_PASSWORD=

# VPN type: wireguard. No country filter. Windscribe picks the server.
# host gluetun   port 8080
# Do not give qBittorrent a published port of its own.
# NPMplus is nginx.watchmyemby.media. server1 and jserver stay off Gluetun.
# Paste this stack into Portainer at port.watchmyemby.media.
# No seeding: qBittorrent pauses at completion. Sonarr or Radarr copies, then removes the torrent.