Ubuntu 20.04 – An Anonymous And Secure Seedbox With Deluge, Jackett, Sonarr, Radarr, Lidarr, Nginx, Docker And SSL/TLS

This article describes the procedure for installing an automated, anonymous, and secure seedbox on Ubuntu 20.04 using Docker and OpenVPN.

   
• Who is this tutorial for?

  If you want to automate downloading movies, TV shows, and music albums as soon as they are available and then stream them to your computer, smartphone or Smart TV, then this article is for you! Security-wise, you will be completely anonymous and protected! This procedure works for local, VM, or dedicated server installations (kimsufi, dedibox, etc.). You don’t have to have a domain name to access it externally. However, if you have one, we will see how to set up an Nginx or Traefik HTTP server and encrypt your exchanges with the SSL / TLS protocol.

• Why Docker and OpenVPN ?

  Your seedbox will be deployed in minutes! Docker allows you to install and execute all the tools you need with a few commands. Each tool is isolated and has its own Docker container. Each container contains all the dependencies (libraries, daemons, configurations, etc.) necessary to run it without interfering with other tools or services installed on your server. Finally, tool updates are simplified and can be fully automated (we’ll see). Docker images are versioned, which makes it easy to redeploy a previous version.

  Using OpenVPN is not mandatory in this tutorial but highly recommended. You should know that your true IP is revealed when you use the P2P network. It is therefore visible to certain authorities (without citing them…) and to other users on the network.

  Using OpenVPN linked to a VPN helps you to hide your IP. The two VPNs featured in the rest of the tutorial keep no record of your connections (no log retention) and allow the use of a P2P network. Also, if for some reason the VPN fails, your downloads would be automatically interrupted.

• The tools used

  To download your movies, TV shows, or audio files, the .torrent files will be added to the Deluge tool. Deluge is a free cross-platform BitTorrent client based on libtorrent. It is known for its stability, speed, and lightweight size and has a clear and intuitive interface. It also proves to be very flexible thanks to the possibility of adding numerous plugins to it.

  

  Sonarr lets you search for the .torrent files of your favorite series and automate the download. You add a series to the interface by specifying the desired quality and language. Sonarr will search for it via the configured indexers. It will then automatically add the series to Deluge. Among Sonarr’s many features is that it has daily tasks that automatically add a freshly released episode. The interface also has a calendar that lists the release dates of future episodes.

  

  Radarr and Lidarr work similarly to Sonarr but are for movies and audio files respectively.

  However, Sonarr and Radarr offer very few indexers (or trackers) today. Jackett helps fill this gap and supports more than a hundred trackers. Many trackers (The Pirate Bay, YGGtorrent) are supported, as well as private and semi-private trackers.
  Jackett works like a proxy server. When you perform a search via Sonarr or Radarr, it transforms and transmits the request to the tracker. It then analyzes the response and returns the results to the transmitting application. Jackett supports RSS feeds as well.

  

  Finally, Plex is a solution that centralizes all your media (films, series, music, photos) and broadcasts them from any device with an internet connection.

  Plex, which is based on XBMC, has a two-part architecture. The first part is the server application. It contains all of your media, facilitates the organization of your collection (by themes, seasons, albums, etc.), and completes the information about each media, by searching the main online databases (TMDb, MoviePosterDB, etc.). The app converts your media on the fly to a format compatible with the player.

  The second part is the player application (your browser, the Plex app on your mobile, SMART TV, etc.) that allows you to view your media. The quality of the stream is adjusted for the speed of your network. It also has numerous features such as synchronization, offline playback, and automatic subtitle recovery.

  Plex

  

1 – Requirements

• You must have Ubuntu 20.04.

• Your user must have access to sudo.

• The curl et software-properties-common packages must be installed on your system. If you’re not sure it’s installed, type in the following command:

  sudo apt-get install -y curl software-properties-common

2 – Docker & Docker Compose installation

1. Update the list of files available in your APT repositories:

   sudo apt-get update

2. Install Docker:

   sudo apt-get install -y docker.io

3. Make sure Docker is properly installed with the command:

   docker -v

   The command should return the installed version of Docker.

4. Download Docker Compose with the following command (changing the version if necessary with the latest release of Docker’s official repository:

   sudo curl -L https://github.com/docker/compose/releases/download/1.25.5/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose

5. Add execution rights to Docker Compose binary:

   sudo chmod +x /usr/local/bin/docker-compose

6. Check Docker Compose installation with the command:

   docker-compose -v

   If the installation has been done correctly, this command should return the Docker Compose version.

3 – Directory tree structure and files permissions

It is recommended, for security reasons, to create a user dedicated to managing Docker volumes (Deluge, Jackett, Sonarr, Radarr, Lidarr and Plex) instead of launching them under your superuser.

1. Create a media user:

   sudo adduser media

2. Add it to the docker group:

   sudo adduser media docker

The tree structure used with the filesystem will be as follows:

data
├── movies
├── music
├── torrents
└── tv

A file downloaded via Deluge will remain in the /data/torrents folder while it is being downloaded. Once completed, it will be automatically moved by Deluge to the /data/movies, /data/tv or /data/music directory depending on whether the download was added by Radarr, Sonarr or Lidarr.

1. Create the directories dedicated to downloads:

   sudo mkdir -p /data/torrents /data/movies /data/music /data/tv

2. Assign these directories to the media user to avoid permission issues in the future:

   sudo chown media:media /data/torrents /data/movies /data/music /data/tv

4 – Creating Docker Volumes

4.1 – Deluge

There are three options for Docker volumes. The first two, which are highly recommended, are to use a Docker image composed of Deluge and OpenVPN. This image allows you to anonymously and securely download your torrents via a VPN. It also has iptables rules that ensure that your downloads will be interrupted and your real IP will not be revealed if, for some reason, the VPN fails.

This Docker image works with AirVPN and Private Internet Access (PIA). The PIA configuration is faster to set up, but AirVPN fares are unbeatable.
Whatever your choice is between these two providers, you will have a fast, stable, highly encrypted, confidential (no history), and P2P-friendly VPN. After almost 10 years of using these VPNs, I can guarantee that they leave no trace…

The last option is to get rid of the VPN and use an image that contains only Deluge. Just know that your IP will be visible to other users of the P2P network and that your downloads will not be encrypted or anonymous…

4.2 – Sonarr, Radarr, Lidarr, Jackett et Plex

Each of the tools used is optional. If you don’t want to use any of them, you can exclude it from the docker-compose.yml file.

1. Edit the /home/media/docker-compose.yml file and add the following lines after the Deluge container:

   version: '3.7'
   services:
     deluge:
     
         [ ... ]
       - ${PATH_MEDIA}:/downloads
     
     jackett:
       image: linuxserver/jackett:latest
       container_name: jackett
       restart: unless-stopped
       network_mode: "host"
       ports:
         - 9117:9117
       environment:
         - PUID=${PUID}
         - PGID=${PGID}
         - TZ=Europe/Paris
       volumes:
         - /home/media/jackett/config:/config
         - /etc/localtime:/etc/localtime:ro
   
     sonarr:
       image: linuxserver/sonarr:latest
       container_name: sonarr
       restart: unless-stopped
       network_mode: "host"
       ports:
         - 8989:8989
       environment:
         - PUID=${PUID}
         - PGID=${PGID}
         - TZ=Europe/Paris
       volumes:
         - /home/media/sonarr/config:/config
         - ${PATH_MEDIA}:/data
   
     radarr:
       image: linuxserver/radarr:latest
       container_name: radarr
       restart: unless-stopped
       network_mode: "host"
       ports:
         - 7878:7878
       environment:
         - PUID=${PUID}
         - PGID=${PGID}
         - TZ=Europe/Paris
       volumes:
         - /home/media/radarr/config:/config
         - ${PATH_MEDIA}:/data
   
     lidarr:
       image: linuxserver/lidarr:latest
       container_name: lidarr
       restart: unless-stopped
       network_mode: "host"
       ports:
         - 8686:8686
       environment:
         - PUID=${PUID}
         - PGID=${PGID}
         - TZ=Europe/Paris
       volumes:
         - /home/media/lidarr/config:/config
         - ${PATH_MEDIA}:/data
   
     plex:
       image: linuxserver/plex:latest
       container_name: plex
       restart: unless-stopped
       network_mode: "host"
       ports:
         - 32400:32400
       environment:
         - VERSION=latest
         - PUID=${PUID}
         - PGID=${PGID}
         - TZ=Europe/Paris
       volumes:
         - /home/media/config:/config
         - ${PATH_MEDIA}:/data

2. Start all your containers:

   docker-compose up -d

3. Please note, docker is a process launched as root. This means that the configuration files created when your containers start up have owner and group root. To avoid future permissions issues, the media user must be able to read and write to these configuration files.

   Return to your superuser and assign the configuration files to the media user:

   exit
   sudo chown -R media:media /home/media

4.3 – Automatic Docker Image Update

To take advantage of the latest features (Plex codecs, updated Jackett tracker URLs, etc.) and the latest security patches, it is important to have updated Docker images.

If you have several docker-compose.yml on your system, you should check out this article.

We will automate the updating of images with a crontab rule. This will be scheduled for execution every day at 11:42pm. Traces of the execution of these commands will be recorded in a file /var/log/docker-updater.log.

1. Edit the crontab:

   sudo crontab -e

2. Add the following line:

   42 23 * * * (cd /home/media && /usr/local/bin/docker-compose pull && /usr/local/bin/docker-compose up -d --remove-orphans && /usr/bin/docker image prune -f) > /var/log/docker-updater.log 2>&1

3. Save and exit.

5 – (Optional) Remote access

• If you want to remain full Docker and access your services via a URL such as https://deluge.mondomaine.com for example, I recommend using Traefik:
  Choice 1 : Remote access with Traefik

• If you already have an Nginx server (or if you are more comfortable with Nginx) and wish to access your services via a URL such as https://mondomaine.com/deluge for example, I recommend using Nginx :
  Choice 2 : Remote access Nginx

6 – Configuration and issues

We will now configure the applications so they can communicate with each other and make sure each of them has at least minimum security:

Configuration and issues