Sonarr + Radarr + Jackett + qBittorrent + ddclient cloudflare DNS update + Traefik reverse proxy with LetsEncrypt on Docker

.env

QBITTORRENT_PATH=<PATH>
QBITTORRENT_WEBUI_PORT=<PORT>
DOWNLOAD_PATH=<PATH>
MEDIA_PATH=<PATH>
JACKETT_PATH=<PATH>
SONARR_PATH=<PATH>
RADARR_PATH=<PATH>
DOMAIN=<YOUR DOMAIN>
TZ=<Timezone e.g. Europe/Budapest>
USERDIR=<HOME DIR PATH>

ddclient docker-compose.yml

version: "3.7"
services:
  ddclient:
    image: linuxserver/ddclient
    container_name: ddclient
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/docker/ddclient/:/config
    restart: unless-stopped

ddclient.conf

daemon=300 # Check every 300 sec
syslog=yes
ssl=yes
use=web
protocol=cloudflare,                            \
zone=<DOMAIN e.g. example.com>,                 \
ttl=0,                                          \
login=<CLOUDFLARE LOGIN EMAIL>,                 \
password=<CLOUDFLARE GLOBAL API KEY>            \
domain.com,otherdomain.com,sub.domain.com

download-automation docker-compose.yml

version: '3.7'
services:

  qbittorrent:
    image: linuxserver/qbittorrent
    container_name: qbittorrent
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ}
      - UMASK_SET=022
      - WEBUI_PORT=${QBITTORRENT_WEBUI_PORT}
    volumes:
      - ${QBITTORRENT_PATH}/config:/config
      - ${QBITTORRENT_PATH}/torrent-files/:/torrents
      - ${QBITTORRENT_PATH}/certs:/certs
      - ${QBITTORRENT_PATH}/local/logs:/logs
      - ${DOWNLOAD_PATH}/Completed:/downloads/Completed
      - ${DOWNLOAD_PATH}/Temp:/downloads/Temp
    ports:
      - ${QBITTORRENT_WEBUI_PORT}:${QBITTORRENT_WEBUI_PORT}
      - 6881:6881
      - 6881:6881/udp
      - 10625:10625
    restart: unless-stopped
    networks: 
      - app-net
    labels:
      - traefik.enable=true
      - traefik.http.routers.qb.rule=Host(`qbittorrent.${DOMAIN}`)
      - traefik.http.routers.qb.entrypoints=websecure
      - traefik.http.routers.qb.tls.certresolver=myresolver
      - traefik.http.services.qb.loadbalancer.server.port=${QBITTORRENT_WEBUI_PORT}
      - traefik.http.services.qb.loadbalancer.passhostheader=false

  jackett:
    image: linuxserver/jackett
    container_name: jackett
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ}
      - RUN_OPTS=run options here #optional
    volumes:
      - ${JACKETT_PATH}/config:/config
      - ${JACKETT_PATH}/blackhole:/downloads
    ports:
      - 9117:9117
    restart: unless-stopped
    networks: 
      - app-net
    labels:
      - traefik.enable=true
      - traefik.http.routers.jackett.rule=Host(`jackett.${DOMAIN}`)
      - traefik.http.routers.jackett.entrypoints=websecure
      - traefik.http.routers.jackett.tls.certresolver=myresolver

  sonarr:
    image: linuxserver/sonarr
    container_name: sonarr
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ}
      - UMASK_SET=022 #optional
    volumes:
      - ${SONARR_PATH}/config:/config
      - ${MEDIA_PATH}/Series:/tv
      - ${DOWNLOAD_PATH}/Completed:/downloads
    ports:
      - 8989:8989
    links:
      - jackett:jackett
    restart: unless-stopped
    networks: 
      - app-net
    labels:
      - traefik.enable=true
      - traefik.http.routers.sonarr.rule=Host(`sonarr.${DOMAIN}`)
      - traefik.http.routers.sonarr.entrypoints=websecure
      - traefik.http.routers.sonarr.tls.certresolver=myresolver

  radarr:
    image: linuxserver/radarr
    container_name: radarr
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ}
      - UMASK_SET=022 #optional
    volumes:
      - ${RADARR_PATH}/config:/config
      - ${MEDIA_PATH}/Movies:/movies
      - ${DOWNLOAD_PATH}/Completed:/downloads
    ports:
      - 7878:7878
    links:
      - jackett:jackett
    restart: unless-stopped
    networks: 
      - app-net
    labels:
      - traefik.enable=true
      - traefik.http.routers.radarr.rule=Host(`radarr.${DOMAIN}`)
      - traefik.http.routers.radarr.entrypoints=websecure
      - traefik.http.routers.radarr.tls.certresolver=myresolver

networks: 
  app-net:
    external: true

example.service

[Unit]
Description=Example systemd service unit using docker-compose, change to your apps description
Requires=docker.service
After=docker.service

[Service]
WorkingDirectory=<PATH TO docker-compose.yml>
Type=oneshot
RemainAfterExit=yes

# You can't read logs using journalctl this way, instead use
# docker-compose logs -f
ExecStart=/usr/bin/docker-compose up -d --build
ExecStop=/usr/bin/docker-compose down
ExecReload=/usr/bin/docker-compose restart

[Install]
WantedBy=multi-user.target

traefik docker-compose.yml

version: '3.7'

services:
  traefik:
    image: traefik:v2.1
    container_name: traefik
    ports:
      # Also open these ports on your router
      - 80:80 # For HTTP Acme challenge, if you use DNS challange, it's not necessary
      - 443:443
    volumes:
      - ${USERDIR}/docker/traefik/traefik.toml:/etc/traefik/traefik.toml
      # Create acme.json before launching
      # touch acme.json && chmod 600 acme.json
      - ${USERDIR}/docker/letsencrypt/acme.json:/acme.json:rw
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks: 
      - app-net
    labels:
      - traefik.enable=true
      - traefik.http.routers.api.rule=Host(`traefik.${DOMAIN}`)
      - traefik.http.routers.api.service=api@internal
      - traefik.http.routers.api.entrypoints=websecure
      - traefik.http.routers.api.tls.certresolver=myresolver
      # If you want auth, but there will not be any login form
      # - traefik.http.routers.api.middlewares=auth
      # - traefik.http.middlewares.auth.basicauth.users=<USERNAME>:<htpasswd generated password>
networks: 
  app-net:
    external: true

traefik.toml

[log]
  # DEBUG, PANIC, FATAL, ERROR, WARN, and INFO
  level = "DEBUG" # Should change this after setup

[api]
  dashboard = true
  debug = true
  insecure = false # If true, you can access dashboard on 8080 port (open 8080 first..)

[providers.docker]
  endpoint = "unix:///var/run/docker.sock"
  exposedByDefault = false # traefik.enable=true is needed
  network = "app-net"

[entryPoints]
  [entryPoints.web]
    address = ":80"

  [entryPoints.websecure]
    address = ":443"

[certificatesResolvers.myresolver.acme]
  email = "<EMAIL>"
  storage = "acme.json"
  # For testing, use staging server - uses production by default
  # caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
  [certificatesResolvers.myresolver.acme.httpChallenge]
    # Port 80 needs to be open
    entryPoint = "web"

[ping]
  entryPoint = "web"

[http]
  [http.routers]
     # Define a connection between requests and services
     [http.routers.to-dashboard]
      rule = "Host(`traefik.${DOMAIN}`)"
      service = "traefik"

I'm looking around for examples of a setup like this. What I wanted to ask: is there a reason why you split the containers across multiple docker-compose files? And do you have multiple systemd service files as well, for each docker-compose file?

@khongi - hoping you can answer this question. I've got a similar set up to this, and am having problems with the subcontainers attached to QBT stopping. They stop, then I have to restart them manually. It's easy enough but far from the automated set up I want. I've got the restart set to always for example on my Jackett container.