The services
The stack is twenty-three services. You will rarely run all of them at once — forms exist precisely so you do not have to — but it is worth knowing what each one is for, because every diagnostic and every trace names them.
Every table on this page is read from the stack manifest this site pins, which is where lemonfiber gets it too. None of it is hardcoded in the binary.
What each one does
Section titled “What each one does”The last column names the smallest form that starts each service. Broader forms
include it as well: anything in search is also started by hunt, tv,
movies, music, books, auto and full.
| Service | What it does | Without it | Smallest form |
|---|---|---|---|
| Prowlarr | Holds your indexer accounts in one place and shares them with everything else | Every app needs indexers configured separately | search |
| FlareSolverr | Gets past bot-protection on some indexers | Those indexers return nothing | search |
| NZBHydra2 | A search box across all your Usenet indexers at once | Search one indexer at a time | search |
| SABnzbd | Downloads from Usenet | No Usenet downloads | dl |
| Gluetun | Routes torrent traffic through your VPN and blocks it if the VPN drops | Your home IP is visible to every peer | dl |
| qBittorrent | Downloads the torrents everything else asks for | No torrent downloads | dl |
| Sonarr | Watches for new episodes and fetches them | Find and download episodes yourself | tv |
| Radarr | Watches for films and fetches them | Find and download films yourself | movies |
| Lidarr | Watches for music and fetches it | Find and download music yourself | music |
| Bindery | Watches for books and audiobooks and fetches them | No book automation (Readarr is discontinued) | books |
| Bazarr | Finds and downloads subtitles | No automatic subtitles | tv |
| Jellyfin | Plays your library on TVs, phones and browsers | Files on disk, no way to watch them | library |
| Door | Lets the household reach Jellyfin, and lets an item's stream or picture out only to someone allowed to see it | Jellyfin answers on this machine only, and nothing else in the house can play from it | library |
| Seerr | Where the household asks for things | Requests come to you in person | library |
| Request gate | Stands between Seerr and Sonarr, Radarr and Jellyfin, so Seerr holds none of their keys | Seerr cannot reach Sonarr, Radarr or Jellyfin: requests are not sent, and members cannot sign in to Seerr | library |
| Decline service | Lets somebody you invited turn the invitation down, and switches the account off the moment they do | An invitation carries no way to refuse it, and stays claimable until it lapses | library |
| Calibre-Web-Automated | Reading and organising your ebook library | No ebook reader | library |
| Audiobookshelf | Listening to audiobooks, with progress synced | No audiobook player | library |
| Navidrome | Plays your music library in a browser, on a phone, and in any Subsonic client | Music arrives and only the thing that fetched it ever looks at it | library |
| Recyclarr | Keeps quality settings in line with community guidance | Tune quality profiles by hand | auto |
| Unpackerr | Extracts archived releases so they can be imported | Some downloads never import | auto |
| Homepage | One page linking everything, with live status | Remember a dozen URLs and ports | full |
| Caddy | Friendly hostnames instead of ports | Use localhost:8989 and friends | proxy |
Bazarr is reached by movies as well as tv; both forms include the subs
profile.
Where each one listens
Section titled “Where each one listens”Binding is two-tier, and it is a default rather than a setting you have to find.
Administrative interfaces bind to loopback. The automation services and the
download clients answer only on 127.0.0.1, because nothing on your network has
any business reaching them. Household-facing surfaces bind to the LAN,
because they are useless if a television cannot reach them. The dashboard joins
them, since a dashboard nobody else can open is not much of a dashboard, and so
does the decline service, whose address is the one an invitation gives for
turning it down.
| Service | Port | Reached from |
|---|---|---|
| Prowlarr | 9696 | This machine only |
| FlareSolverr | 8191 | This machine only |
| NZBHydra2 | 5076 | This machine only |
| SABnzbd | 8085 | This machine only |
| Gluetun | Publishes no port | |
| qBittorrent | 8081 | This machine only |
| Sonarr | 8989 | This machine only |
| Radarr | 7878 | This machine only |
| Lidarr | 8686 | This machine only |
| Bindery | 8787 | This machine only |
| Bazarr | 6767 | This machine only |
| Jellyfin | 8095 | This machine only |
| Door | 8096 | The household's network |
| Seerr | 5055 | The household's network |
| Request gate | Publishes no port | |
| Decline service | 5056 | The household's network |
| Calibre-Web-Automated | 8083 | The household's network |
| Audiobookshelf | 13378 | The household's network |
| Navidrome | 4533 | The household's network |
| Recyclarr | Publishes no port | |
| Unpackerr | Publishes no port | |
| Homepage | 3000 | The household's network |
| Caddy | 80 | The household's network |
Nothing binds to every interface. Reaching any of this from outside the house is Remote access, which is a deliberate decision rather than a default.
Gluetun is a network namespace that qBittorrent runs inside; Recyclarr and Unpackerr are scheduled jobs with no interface; and the request gate is reached only by Seerr, across the internal networks it shares with Seerr and with the services it calls. None of them publishes a port.
The two that are not like the others
Section titled “The two that are not like the others”Gluetun is the only service granted network administration capability, and the only one marked critical rather than core. If it is unhealthy, torrent traffic is not protected — which is a different class of problem from a service being down, because the failure is invisible from inside the stack. That is what Is my VPN hiding me? exists to answer.
Bindery fills the automation role for books, but it is not one of the Servarr family and does not share their API. Prowlarr’s application sync does not cover it, so it consumes indexer endpoints directly.
How much a service failing matters
Section titled “How much a service failing matters”The manifest grades each service, and lemonfiber’s health summary uses that grading rather than counting containers:
| Grade | Meaning | Services |
|---|---|---|
| Critical | Failure has consequences outside the machine | Gluetun |
| Core | The stack cannot do its job without it | Prowlarr, SABnzbd, qBittorrent, Sonarr, Radarr, Lidarr, Bindery |
| Important | The household notices immediately | Jellyfin, Door, Seerr, Request gate |
| Enhancing | Something works less well | FlareSolverr, NZBHydra2, Bazarr, Decline service, Calibre-Web-Automated, Audiobookshelf, Navidrome, Recyclarr, Unpackerr, Homepage |
| Optional | Convenience only | Caddy |
This is why a stack with every container running and a leaking VPN does not report that everything is fine.
Versions and licences
Section titled “Versions and licences”Every image is pinned to an explicit version tag in the manifest. Nothing changes because time passed — an update happens when you decide it should. See Updating.
The manifest also records each service’s licence and upstream project. Twenty-one
are open source. The request gate and the decline service are lemonfiber’s own
images, built from lemonfiber-request-gate and lemonfiber-decline under
lemonfiber’s licence, which is separate and stricter.
Related
Section titled “Related”- Forms and slices — how these group into slices
- The stack manifest — the file this page is drawn from
- Adding a service — making the list twenty-four
- F2 Service catalogue — the requirement behind it