Private media library — automated ingestion, community requests, VPN downloads, analytics, and zero-touch operations
A fully self-hosted media stack — Jellyfin as the media server with a custom frontend and self-registration API, Sonarr and Radarr wired to Prowlarr for automated acquisition, Jellyseerr for community content requests, Bazarr for subtitle automation, qBittorrent behind a VPN for all downloads, Jellystat for play analytics, and nightly off-site encrypted backups. All services share a private Docker network and are served over TLS.
The problem
A private community wanted a Netflix-quality library experience without ongoing subscription costs or dependency on a commercial platform. The operator needed fully automated content ingestion, a self-serve request interface for members, and zero day-to-day helpdesk overhead.
Approach
- Jellyfin media server with a custom-built React frontend for a branded viewing experience, plus a self-registration API allowing members to create accounts without administrator involvement
- Sonarr and Radarr wired to Prowlarr as the unified indexer manager — series and movies are automatically acquired, renamed according to library conventions, and organised into the correct library paths on disk
- Jellyseerr community request interface — members browse, request content, and receive an in-app and email notification when it is available; requests route automatically to Sonarr or Radarr based on media type
- qBittorrent with an OpenVPN kill-switch — all download traffic is routed through the VPN tunnel; the web UI and LAN access are preserved on the local network while the public IP remains the VPN endpoint
- Bazarr for automatic subtitle fetching and synchronisation across all library content, with per-language and per-provider configuration
- Jellystat for aggregated play history, per-user watch statistics, library growth tracking, and operational dashboards — backed by its own PostgreSQL instance
- Custom branding overlays across Jellyfin, Jellystat, and Jellyseerr (logos, favicons, splash screens) for a consistent private-label experience
- Nightly off-site encrypted backups with Restic and retention policies; all services share the external Docker network behind a TLS-terminating reverse proxy
Outcome
- Hundreds of titles acquired and organised automatically — zero manual library curation since initial setup
- Members request content through a self-serve interface, receive a notification when it is ready, and never need to contact the operator
- Fully reproducible deployment — all services are defined in Docker Compose with named volumes; full stack can be restored from backup in under 30 minutes
Got a project that's been waiting too long?
We respond to every inquiry within one business day. No funnels — just a real conversation about whether we're a fit.