From b23f9732a41047ef8169edd49318c339a71255fe Mon Sep 17 00:00:00 2001 From: crypt0rr <57799908+crypt0rr@users.noreply.github.com> Date: Thu, 30 Jul 2026 20:17:03 +0200 Subject: [PATCH] Add ArtistTrackarr service --- README.md | 1 + services/artisttrackarr/.env | 33 ++++++++++ services/artisttrackarr/README.md | 60 +++++++++++++++++ services/artisttrackarr/compose.yaml | 98 ++++++++++++++++++++++++++++ 4 files changed, 192 insertions(+) create mode 100644 services/artisttrackarr/.env create mode 100644 services/artisttrackarr/README.md create mode 100644 services/artisttrackarr/compose.yaml diff --git a/README.md b/README.md index c9ca77b..e0fdb8b 100644 --- a/README.md +++ b/README.md @@ -92,6 +92,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🎥 Service | 📝 Description | 🔗 Link | | -------------------- | ------------------------------------------------------------------------------------------------------- | ---------------------------------- | +| 🎵 **ArtistTrackarr** | A self-hosted dashboard for tracking upcoming and newly released albums and EPs. | [Details](services/artisttrackarr) | | 🎧 **Audiobookshelf** | A self-hosted audiobook and podcast server with multi-user support and playback syncing. | [Details](services/audiobookshelf) | | 🎥 **Bazarr** | A companion tool to Radarr and Sonarr for managing subtitles. | [Details](services/bazarr) | | 📚 **BookLore** | A self-hosted application for managing and reading books. | [Details](services/booklore) | diff --git a/services/artisttrackarr/.env b/services/artisttrackarr/.env new file mode 100644 index 0000000..fa5d4d5 --- /dev/null +++ b/services/artisttrackarr/.env @@ -0,0 +1,33 @@ +#version=1.1 +#URL=https://github.com/tailscale-dev/ScaleTail +#COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. + +# Service Configuration +SERVICE=artist-trackarr # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). +IMAGE_URL=ghcr.io/crypt0rr/artist-trackarr:latest # Docker image URL from container registry (e.g., adguard/adguard-home). + +# Network Configuration +SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. + +# Tailscale Configuration +TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. + +# Optional Service variables +# PUID=1000 + +#Time Zone setting for containers +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones + +# Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ + +PUBLIC_URL=http://localhost:8080 +SETUP_TOKEN=replace-with-at-least-32-random-characters +APP_ENCRYPTION_KEY=replace-with-at-least-32-random-characters +SESSION_SECRET=replace-with-at-least-32-random-characters +MUSICBRAINZ_CONTACT=you@example.com +POLL_INTERVAL=6h +TRUST_PROXY=false +# SPOTIFY_CLIENT_ID= +# SPOTIFY_CLIENT_SECRET= +# SPOTIFY_MARKET=US \ No newline at end of file diff --git a/services/artisttrackarr/README.md b/services/artisttrackarr/README.md new file mode 100644 index 0000000..37594da --- /dev/null +++ b/services/artisttrackarr/README.md @@ -0,0 +1,60 @@ +# ArtistTrackarr with Tailscale Sidecar Configuration + +This Docker Compose configuration sets up [ArtistTrackarr](https://github.com/crypt0rr/ArtistTrackarr) with Tailscale as a sidecar container, keeping the application securely reachable over your Tailnet without exposing it directly to the public internet. + +## ArtistTrackarr + +[ArtistTrackarr](https://github.com/crypt0rr/ArtistTrackarr) is a self-hosted household dashboard that monitors MusicBrainz and, optionally, Spotify for newly announced and released albums and EPs. It can send announcement and release-day notifications through Email, Discord, Telegram, ntfy, Gotify, generic webhooks, and other services supported by Shoutrrr. + +Pairing ArtistTrackarr with Tailscale provides private access to its web interface from authorized Tailnet devices without requiring public port forwarding or a publicly accessible reverse proxy. + +## Configuration Overview + +In this setup, the `tailscale-artist-trackarr` service runs Tailscale and manages secure networking for ArtistTrackarr. The `artist-trackarr` service uses the Tailscale container's network stack through Docker's `network_mode: service:tailscale-artist-trackarr` configuration. + +ArtistTrackarr listens on port `8080`. Because both containers share the same network namespace, Tailscale Serve can forward traffic directly to `http://127.0.0.1:8080`. + +This keeps ArtistTrackarr Tailnet-only unless you intentionally publish its port on the Docker host. + +## Good to Know + +- **Container permissions:** The ArtistTrackarr image runs as UID and GID `10001`. When using a bind-mounted host directory for `/data`, create it before starting the stack and make it writable by UID and GID `10001`: + + ```console + mkdir -p ./artist-trackarr-data + sudo chown -R 10001:10001 ./artist-trackarr-data + ``` + + Incorrect ownership can prevent ArtistTrackarr from creating or opening its SQLite database. + +- **Volumes:** ArtistTrackarr stores its SQLite database, cached Cover Art Archive artwork, and other persistent application data in `/data`. The upstream deployment uses the legacy-named `artist-tracker-data` Docker volume for compatibility with existing installations. + +- **Required application configuration:** Before starting ArtistTrackarr, define the following values: + + - `SETUP_TOKEN` + - `APP_ENCRYPTION_KEY` + - `SESSION_SECRET` + - `MUSICBRAINZ_CONTACT` + - `PUBLIC_URL` + + `SETUP_TOKEN`, `APP_ENCRYPTION_KEY`, and `SESSION_SECRET` should each contain a random value of at least 32 characters. `MUSICBRAINZ_CONTACT` must contain a real email address or project URL because it is included in the MusicBrainz API User-Agent. + +- **Public URL:** Set `PUBLIC_URL` to the HTTPS address through which users will access ArtistTrackarr over Tailscale, for example: + + ```env + PUBLIC_URL=https://artist-trackarr.example-tailnet.ts.net + ``` + +- **Polling interval:** The default `POLL_INTERVAL` is `6h`. Values below one hour are rejected by the application. + +- **Spotify integration:** Spotify integration is optional. Configure `SPOTIFY_CLIENT_ID`, `SPOTIFY_CLIENT_SECRET`, and an appropriate two-letter `SPOTIFY_MARKET`, such as `NL`, to enable Spotify-first artist discovery and an additional release-observation feed. + +- **Reverse-proxy handling:** Tailscale Serve acts as the HTTPS reverse proxy in this deployment. Set `TRUST_PROXY=true` only when ArtistTrackarr should trust forwarded client-address headers from the proxy. + +- **Backups:** Stop ArtistTrackarr before backing up its persistent `/data` directory or Docker volume to ensure a consistent SQLite backup. Database migrations run automatically when the application is upgraded. + +- **Official links:** + - [ArtistTrackarr repository](https://github.com/crypt0rr/ArtistTrackarr) + - [Shoutrrr documentation](https://containrrr.dev/shoutrrr/) + - [MusicBrainz](https://musicbrainz.org/) + - [Spotify Developer Dashboard](https://developer.spotify.com/dashboard) diff --git a/services/artisttrackarr/compose.yaml b/services/artisttrackarr/compose.yaml new file mode 100644 index 0000000..472ab33 --- /dev/null +++ b/services/artisttrackarr/compose.yaml @@ -0,0 +1,98 @@ +configs: + ts-serve: + content: | + {"TCP":{"443":{"HTTPS":true}}, + "Web":{"$${TS_CERT_DOMAIN}:443": + {"Handlers":{"/": + {"Proxy":"http://127.0.0.1:8080"}}}}, + "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} + +services: +# Make sure you have updated/checked the .env file with the correct variables. +# All the ${ xx } need to be defined there. + # Tailscale Sidecar Configuration + tailscale: + image: tailscale/tailscale:latest # Image to be used + container_name: tailscale-${SERVICE} # Name for local container management + hostname: ${SERVICE} # Name used within your Tailscale environment + environment: + - TS_AUTHKEY=${TS_AUTHKEY} + - TS_STATE_DIR=/var/lib/tailscale + - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required + - TS_USERSPACE=false + - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" + - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint + #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + - TS_AUTH_ONCE=true + configs: + - source: ts-serve + target: /config/serve.json + volumes: + - ./config:/config # Config folder used to store Tailscale files - you may need to change the path + - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path + devices: + - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work + cap_add: + - net_admin # Tailscale requirement + #ports: + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below + #dns: + # - ${DNS_SERVER} + healthcheck: + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 10s # Time to wait before starting health checks + restart: always + + # ${SERVICE} + application: + image: ${IMAGE_URL} # Image to be used + network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + container_name: app-${SERVICE} # Name for local container management + environment: # Varibles are delared in .env file. + PUID: 1000 + PGI: 1000 + TZ: ${TZ} + LISTEN_ADDR: ":8080" + PUBLIC_URL: "${PUBLIC_URL:-http://localhost:8080}" + DATABASE_PATH: "/data/artist-tracker.db" + MUSICBRAINZ_CONTACT: "${MUSICBRAINZ_CONTACT:?Set MUSICBRAINZ_CONTACT in .env}" + POLL_INTERVAL: "${POLL_INTERVAL:-6h}" + TRUST_PROXY: "${TRUST_PROXY:-false}" + SETUP_TOKEN_FILE: /run/secrets/setup_token + APP_ENCRYPTION_KEY_FILE: /run/secrets/encryption_key + SESSION_SECRET_FILE: /run/secrets/session_secret + SPOTIFY_CLIENT_ID: "${SPOTIFY_CLIENT_ID:-}" + SPOTIFY_CLIENT_SECRET: "${SPOTIFY_CLIENT_SECRET:-}" + SPOTIFY_MARKET: "${SPOTIFY_MARKET:-US}" + secrets: + - setup_token + - encryption_key + - session_secret + volumes: + - ./${SERVICE}-data:/data + security_opt: + - no-new-privileges:true + cap_drop: + - ALL + depends_on: + tailscale: + condition: service_healthy + healthcheck: + test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8080/readyz"] # Check if ${SERVICE} process is running + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always + +secrets: + setup_token: + environment: SETUP_TOKEN + encryption_key: + environment: APP_ENCRYPTION_KEY + session_secret: + environment: SESSION_SECRET \ No newline at end of file