Track 1¶
The initial release of Charmarr. A complete media automation stack on Kubernetes.
Highlights¶
- One-command deployment via OpenTofu module
- Automatic app configuration through Juju relations
- VPN-first architecture with Gluetun and two-way killswitch
- Service mesh security with Istio ambient (opt-in, disabled by default)
- Built-in TRaSH profiles via Recyclarr integration
- Credential rotation with Juju secrets
What's Included¶
Charms¶
| Charm | Description |
|---|---|
radarr-k8s |
Movie management |
sonarr-k8s |
TV show management |
prowlarr-k8s |
Indexer management |
qbittorrent-k8s |
Torrent downloads |
sabnzbd-k8s |
Usenet downloads |
plex-k8s |
Media server |
overseerr-k8s |
Media requests |
recyclarr-k8s |
TRaSH profile sync |
flaresolverr-k8s |
Cloudflare bypass |
gluetun-k8s |
VPN gateway |
charmarr-storage-k8s |
Shared storage |
OpenTofu Modules¶
- charmarr — Full stack with single Radarr/Sonarr instances
- charmarr-plus — Full stack with HD/UHD/Anime variants for Radarr and Sonarr
Storage Backends¶
- Hostpath (local disk)
- Native NFS (existing NFS server)
- StorageClass (any CSI driver)
VPN Providers¶
Any WireGuard-compatible provider supported by Gluetun. ProtonVPN recommended.
Known Limitations¶
- Single replica only — Apps cannot scale horizontally (upstream SQLite limitation)
- Bring your own backup — No integrated backup solution; see Backup
- WireGuard only — OpenVPN not supported
- Cilium requires tweaks — Socket-level LB in host namespace mode required for Istio ambient
Acknowledgments¶
Built with Radarr, Sonarr, Prowlarr, qBittorrent, SABnzbd, Plex, Overseerr, Recyclarr, FlareSolverr, Gluetun, and LinuxServer.io containers.
Powered by Kubernetes, Juju, Istio ambient, and TRaSH Guides.
Thanks to YAMS for the inspiration that started this project, and k8s@home for being a great source of Kubernetes + arr knowledge.