Sovereign Media Stack

What it is

A ready-made Docker kit that turns a home computer or Synology NAS into your own streaming service: movies, shows and music on every TV, phone and tablet in the house, a request page for the family, and tools that keep your library tidy. It is the same setup the Son of Satoshi runs at home, with every personal detail taken out so you can put in your own.

It comes with a beginner walkthrough (written so a kid with a grown-up can follow it), a one-command setup and a health check that proves your downloads really go through your VPN. Bring your own media: no download sources are included.

Features

• Jellyfin streams your library to TVs, phones and browsers, even when the internet is down.
• Seerr (the merged Jellyseerr + Overseerr) gives the family a simple request page.
• Sonarr and Radarr name and organize shows and movies; a recycling bin means upgrades never delete the old file.
• qBittorrent can only reach the internet through your VPN (gluetun): if the VPN drops, it has no internet at all. It restarts together with the VPN, so it never ends up cut off.
• check.sh compares the address your downloads use with your home address and warns you loudly if they match.
• Safe updates: Watchtower updates only this kit's helper apps, once a week. Jellyfin, the VPN and qBittorrent are pinned to tested versions you change on purpose.
• Synology fix included: a boot task that stops downloads from silently dying after the NAS restarts.
• All your secrets live in one locked .env file. Optional Cloudflare tunnel to watch from outside without opening router ports.
• Comes with a CLAUDE.md so the Claude AI assistant can guide you step by step, and never asks for your keys or passwords.

What you need

• A computer that stays on with Ubuntu (or another Linux) and Docker, or a Synology NAS with Container Manager.
• A big drive for your media (2 TB or more).
• A VPN that works with gluetun, such as ProtonVPN or Mullvad (only for the download client).
• About 1–2 hours for the first setup.

How to install

1. Download the zip, check its signature or SHA-256, and unzip it.
2. Open WALKTHROUGH.md and follow it part by part (Path A: Ubuntu, Path B: Synology).

How to use it

1. Run ./setup.sh. The first time it creates your .env; fill it in, then run it again.
2. Run ./check.sh before downloading anything: it must say ✅.
3. Set up each app in the browser (WALKTHROUGH Part 9), then install the Jellyfin app on your TVs and phones.

Outside sites it contacts

• Docker downloads each app from its own publisher (LinuxServer.io, the Seerr team, gluetun, Cloudflare).
• Seerr and the media apps look up titles, posters and episode lists online. qBittorrent only ever goes out through your VPN.
• check.sh asks ipinfo.io for your public address (once from home, once through the VPN) to compare them.
• Nothing is sent to the Son of Satoshi.

Good to know

• No download sources are included. Use it for media you own, home videos, and public-domain or freely licensed content. Downloading copyrighted movies and shows without permission is illegal in most countries, and a VPN doesn't change that.
• Tested on 2026-10-30 with a real ProtonVPN connection: 8 of 8 checks passed (downloads leave only through the VPN, port forwarding, qBittorrent survives a VPN restart, and with the VPN off qBittorrent has no internet at all). The Synology steps were checked against Synology's DSM 7.4 manuals and a DSM 7.4.1 NAS.
• Watchtower needs control of Docker to update apps. Remove it if you'd rather update by hand.
• Never open Sonarr, Radarr, Prowlarr or qBittorrent to the internet.
• Not affiliated with Jellyfin, Seerr, the *arr projects, qBittorrent, gluetun or any VPN provider.