Fix critical discrepancies found during validation audit

- Fix cert resolver name (cloudflare -> letsencrypt)
- Fix volume paths (/mnt/nas -> /data)
- Add missing custom port mappings
- Add privileged/capability flags
- Add 8 new roles: portainer, n8n, nodered, influxdb, guacamole, watchtower, rtlamr2mqtt, telegraf
- Fix Traefik template (ports, ACME path, wildcard cert)
- Add extra volume mounts for media services

roles/media/defaults/main.yml

@@ -4,7 +4,7 @@ jellyfin_data_dir: /data/jellyfin
 sonarr_data_dir: /data/sonarr
 radarr_data_dir: /data/radarr
 sabnzbd_data_dir: /data/sabnzbd
-nzbhydra_data_dir: /data/nzbhydra2
+nzbhydra_data_dir: /data/hydra
 jellyseerr_data_dir: /data/jellyseerr
 
 jellyfin_image: "jellyfin/jellyfin:latest"
@@ -14,8 +14,8 @@ sabnzbd_image: "lscr.io/linuxserver/sabnzbd:latest"
 nzbhydra_image: "lscr.io/linuxserver/nzbhydra2:latest"
 jellyseerr_image: "fallenbagel/jellyseerr:latest"
 
-media_path: /mnt/nas/media
-downloads_path: /mnt/nas/downloads
+media_path: /data/media
+downloads_path: /data/media/downloads
 
 jellyfin_host: "jellyfin.{{ domain }}"
 sonarr_host: "sonarr.{{ domain }}"

roles/media/templates/docker-compose.yml.j2

@@ -13,7 +13,7 @@ services:
       traefik.enable: "true"
       traefik.http.routers.jellyfin.rule: "Host(`{{ jellyfin_host }}`)"
       traefik.http.routers.jellyfin.entrypoints: websecure
-      traefik.http.routers.jellyfin.tls.certresolver: cloudflare
+      traefik.http.routers.jellyfin.tls.certresolver: letsencrypt
       traefik.http.services.jellyfin.loadbalancer.server.port: "8096"
     networks:
       - {{ docker_network_name }}
@@ -27,14 +27,15 @@ services:
       PGID: "{{ pgid }}"
       TZ: {{ timezone }}
     volumes:
-      - {{ sonarr_data_dir }}:/config
+      - /data/sonarr/config:/config
       - {{ media_path }}/tv:/tv
       - {{ downloads_path }}:/downloads
+      - /data/media/ssd/tv_down:/tv_down
     labels:
       traefik.enable: "true"
       traefik.http.routers.sonarr.rule: "Host(`{{ sonarr_host }}`)"
       traefik.http.routers.sonarr.entrypoints: websecure
-      traefik.http.routers.sonarr.tls.certresolver: cloudflare
+      traefik.http.routers.sonarr.tls.certresolver: letsencrypt
       traefik.http.services.sonarr.loadbalancer.server.port: "8989"
     networks:
       - {{ docker_network_name }}
@@ -48,14 +49,16 @@ services:
       PGID: "{{ pgid }}"
       TZ: {{ timezone }}
     volumes:
-      - {{ radarr_data_dir }}:/config
+      - /data/radarr/config:/config
       - {{ media_path }}/movies:/movies
-      - {{ downloads_path }}:/downloads
+      - /data/media:/media
+      - /data/media/ssd/movies_down:/movies_down
+      - /data:/data
     labels:
       traefik.enable: "true"
       traefik.http.routers.radarr.rule: "Host(`{{ radarr_host }}`)"
       traefik.http.routers.radarr.entrypoints: websecure
-      traefik.http.routers.radarr.tls.certresolver: cloudflare
+      traefik.http.routers.radarr.tls.certresolver: letsencrypt
       traefik.http.services.radarr.loadbalancer.server.port: "7878"
     networks:
       - {{ docker_network_name }}
@@ -68,14 +71,19 @@ services:
       PUID: "{{ puid }}"
       PGID: "{{ pgid }}"
       TZ: {{ timezone }}
+    ports:
+      - "8082:8080"
+      - "9092:9090"
     volumes:
       - {{ sabnzbd_data_dir }}:/config
       - {{ downloads_path }}:/downloads
+      - /data/media/ssd/movies_down:/movies_down
+      - /data/media/ssd/tv_down:/tv_down
     labels:
       traefik.enable: "true"
       traefik.http.routers.sabnzbd.rule: "Host(`{{ sabnzbd_host }}`)"
       traefik.http.routers.sabnzbd.entrypoints: websecure
-      traefik.http.routers.sabnzbd.tls.certresolver: cloudflare
+      traefik.http.routers.sabnzbd.tls.certresolver: letsencrypt
       traefik.http.services.sabnzbd.loadbalancer.server.port: "8080"
     networks:
       - {{ docker_network_name }}
@@ -106,7 +114,7 @@ services:
       traefik.enable: "true"
       traefik.http.routers.jellyseerr.rule: "Host(`{{ jellyseerr_host }}`)"
       traefik.http.routers.jellyseerr.entrypoints: websecure
-      traefik.http.routers.jellyseerr.tls.certresolver: cloudflare
+      traefik.http.routers.jellyseerr.tls.certresolver: letsencrypt
       traefik.http.services.jellyseerr.loadbalancer.server.port: "5055"
     networks:
       - {{ docker_network_name }}