# Nargothrond

Named after the legendary hidden fortress of the First Age from *The Silmarillion*, Nargothrond is the quiet powerhouse of my home network. It secures my devices, backs up my photos, and serves up movie nights and music streaming — all from a single box tucked away in a closet.

Think of this document as the master blueprint for my favorite home server.

## Table of Contents

1. [Hardware](#hardware)
2. [Software Stack](#software-stack)
3. [Network Segmentation](#network-segmentation)
4. [Traffic Flow](#traffic-flow)
5. [Plugins](#plugins)
6. [On-Demand Sleepers](#on-demand-sleepers)

---

## Hardware

Nargothrond runs on modern, power-efficient hardware that keeps things snappy without blowing up the electric bill.

 Component | What's Inside | Why It Matters |
| --- | --- | --- |
| **Operating System** | UNRAID Server v7.3.1 | Foundation for managing the docker stack and mixed drive array. |
| **Case** | Jonsbo N6 | A compact NAS-style enclosure with room for a full HDD array in a small footprint. |
| **Motherboard** | ASUS Prime Z890M-Plus (LGA 1851, Micro-ATX) | Provides the platform for Arrow Lake, plus enough PCIe lanes for the 10GbE NIC and NVMe pool. |
| **CPU** | Intel Core Ultra 5 225 | Arrow Lake architecture delivers strong power efficiency, and the built-in iGPU handles media transcoding. |
| **CPU Cooler** | Noctua NH-U12A | A quiet, high-airflow tower cooler that keeps thermals in check under transcoding loads. |
| **Case Fans** | 2x Noctua NF-A12x25 (120mm) | Low-noise airflow tuned for a mixed CPU and HDD-cooling setup. |
| **Power Supply** | Seasonic Focus SGX-750 (750W, SFX) | An 80+ Gold efficient SFX unit sized for the CPU, HDD array, and NVMe pool combined. |
| **RAM** | 2x ADATA 24GB DDR5 5600MHz (48GB total) | Headroom for databases, caches, and concurrent user sessions. |
| **Array Storage** | 1x WD Gold 14TB + 2x WD 12TB (used) in a parity array | The main vault — a failed drive doesn't mean lost data. |
| **Cache Storage** | 2TB NVMe pool + 1TB NVME boot drive | Absorbs raw file writes and keeps app configurations flying. |
| **Network** | Realtek RTL8127 10GbE NIC + 1Gbps LAN, split into VLANs | High-speed backbone for large file transfers, segmented so smart home devices stay away from sensitive data. |
---


## Software Stack

The application ecosystem is organized into functional groups, mirroring how UNRAID's Docker tab lays them out.

```mermaid
graph TD
    subgraph Net ["Security & Routing"]
        T[Traefik Proxy]
        AG[AdGuard + Unbound]
        CS[CrowdSec]
        GT[Gluetun VPN]
        PG[Pangolin Tunnel]
        CF[Cloudflared Tunnel]
    end

    subgraph Media ["Media Automation & Streaming"]
        JF[Jellyfin]
        ND[Navidrome]
        SE[Seerr]
        QB[qBittorrent + VPN]
        SO[Sonarr]
        RA[Radarr]
        LI[Lidarr]
        JK[Jackett]
        BY[Byparr]
        SL[slskd]
    end

    subgraph Core ["Storage, Data & Dashboards"]
        IM[Immich Photos]
        PSQL[Immich PostgreSQL]
        RD[Redis]
        VW[Vaultwarden]
        GL[Glance Dashboard]
    end

    PG --> T
    CF --> T
    T --> SE
    T --> JF
    T --> IM
    GT --> QB
    IM --> PSQL
    IM --> RD
```

### Network Gatekeepers & Security

* **Traefik**  — the traffic cop of the stack. Routes incoming requests to the correct container and manages SSL certificates automatically.
* **AdGuard Home + Unbound**  — network-wide DNS filtering. Blocks ads and trackers for every device on the LAN while keeping DNS queries private.
* **CrowdSec**  — a collaborative intrusion-detection system. Watches server logs for malicious behavior and bans offenders in real time.
* **Gluetun**  — a VPN gateway container. Routes specific applications (like the download client) through an encrypted tunnel so they never touch the network directly.
* **Pangolin**  — a self-hosted, identity-aware tunneled reverse proxy built on WireGuard. It works alongside Traefik to publish services to the outside world without opening inbound ports, and adds access control on top.

### Remote Access & Secrets

* **Unraid Cloudflared Tunnel**  — an outbound tunnel to Cloudflare, used for exposing select services without opening router ports.
* **Vaultwarden**  — a self-hosted password vault, syncing credentials across phones and computers.

### Media Automation (The *Arr Stack)

* **Jellyfin**  — the media server. Organizes the movie and TV library and streams to any screen in the house.
* **Navidrome**  — a self-hosted Spotify-style client for a lossless personal music library.
* **Seerr**  — a request dashboard where family and friends can ask for new movies or shows, which then flow automatically into the download pipeline.
* **Sonarr / Radarr**  — automated scouts that monitor for new TV episodes and movies, then fetch and sort them.
* **Lidarr**  — the same idea, tuned for music releases and favorite artists.
* **qBittorrent (binhex, VPN-locked)**  — the download engine, hardwired to run only through Gluetun's kill-switch so downloads stay private.
* **Jackett & Byparr**  — indexer proxies that help Sonarr, Radarr, and Lidarr search across trackers for the best-quality releases.
* **slskd**  — a web client for the Soulseek network, useful for rare or indie music finds.

### Storage, Data & Dashboards

* **Immich**  — a self-hosted alternative to Google Photos, backing up phone photos and organizing them locally.
* **Immich PostgreSQL & Redis**  — the database and cache layer that keep Immich fast when browsing large photo libraries.
* **Glance**  — a clean landing-page dashboard showing the time, weather, system status, and favorite links.

---

## Network Segmentation

UNRAID's Docker network assignments double as a security boundary. Each container only talks to what it needs to.

```mermaid
graph LR
    subgraph bridge ["bridge"]
        SFTP[sftp-server]
        CFT[Cloudflared Tunnel]
        GLANCE[Glance]
        FF[FileFlows]
        SAT[Satisfactory]
    end

    subgraph tunnel ["tunnel"]
        NAV[Navidrome]
        QBIT[qBittorrent VPN]
        SONARR[Sonarr]
        RADARR[Radarr]
    end

    subgraph explo_net ["explo_default"]
        EXPLO[explo]
        BYPARR[Byparr]
        GLUETUN[Gluetun]
        JACKETT[Jackett]
        LIDARR2[Lidarr]
    end

    subgraph pangolin_net ["pangolin"]
        VW2[Vaultwarden]
        TRAEFIK2[Traefik]
        CROWDSEC2[CrowdSec]
        PANGOLIN2[Pangolin]
        REDIS2[Redis]
        PSQL2[Immich PostgreSQL]
        IMMICH2[Immich]
    end

    subgraph br0_net ["br0"]
        ADG[AdGuard Home]
    end

    subgraph tailscale_net ["Tailscale"]
        JF2[Jellyfin]
        IMMICH3[Immich]
    end
```

* **bridge** — general-purpose, low-sensitivity containers with no need for isolation.
* **tunnel** — services that route through the Cloudflare or VPN egress path.
* **explo_default** — the indexer and VPN-adjacent tooling that supports the *arr stack.
* **pangolin** — the security-critical core: reverse proxy, intrusion detection, secrets, and the photo library database, all kept on a dedicated network.
* **br0** — macvlan bridge, giving AdGuard Home its own LAN-visible IP so it can serve DNS to every device.
* **Tailscale** — an overlay mesh network for Jellyfin and Immich, allowing secure remote access without a public tunnel.

---

## Traffic Flow

To keep Nargothrond secure, inbound traffic from the outside world is handled differently than traffic from inside the house.

```mermaid
sequenceDiagram
    actor Me as Phone (outside)
    participant CF as Cloudflare / Pangolin Tunnel
    participant TF as Traefik
    participant APP as Target App (e.g. Immich)

    Note over Me, CF: Outside the house
    Me->>CF: Request photo backup
    CF->>TF: Passes through tunnel

    Note over TF, APP: Inside the server
    TF->>APP: Forwards to local app
    APP-->>Me: Photos loaded
```

1. **From the outside** — requests pass through the Cloudflare or Pangolin tunnel into Traefik. Traefik inspects the hostname and routes it to the correct container, with no inbound ports opened on the router.
2. **From the couch** — local devices query AdGuard Home first, which strips trackers and ad domains, then hit Traefik directly over the LAN without touching the public internet.
3. **VLAN isolation** — if a smart bulb or IoT device is compromised, it cannot reach the containers holding photos or passwords, because VLANs keep those devices on a separate network island.

---

## Plugins

Beyond the Docker containers, a set of UNRAID plugins keeps the server itself healthy, tuned, and easy to manage.

| Category | Plugin | Purpose |
| --- | --- | --- |
| Management | Community Applications | The app-store front end for installing new Docker containers. |
| Management | Compose Manager Plus | Adds Docker Compose support and a management UI. |
| Management | User Scripts / User Scripts Enhanced | Run and schedule custom scripts from the web UI. |
| Backup | Appdata Backup | Backs up Docker container configs and app data. |
| Backup | Appdata Cleanup Plus | Finds orphaned app-data folders left behind by removed containers. |
| Storage | Unassigned Devices / Plus / Preclear | Mounts drives outside the main array and preps new disks before adding them. |
| Storage | Disk Location | Maps drives to their physical bay for easy identification. |
| Storage | Parity Check Tuning | Runs parity checks and rebuilds in scheduled increments instead of all at once. |
| Storage | Dynamix Cache Directories | Keeps folder metadata in memory to reduce unnecessary disk spin-up. |
| Monitoring | Dynamix System Info / Statistics / Temperature | Real-time hardware, performance, and thermal monitoring. |
| Monitoring | GPU Statistics / Intel GPU TOP | Dashboard stats and CLI tooling for the iGPU used in transcoding. |
| Monitoring | Dynamix Active Streams | Shows live SMB, AFS, and Plex streams in use. |
| Monitoring | File Activity v2 | Tracks recent read/write activity per disk. |
| Maintenance | Fix Common Problems | Scans for and flags common configuration issues. |
| Maintenance | CA Auto Update Applications | Keeps installed apps and plugins current automatically. |
| Tuning | AutoTweak / Tips and Tweaks | Power profile and network stack tuning for performance or efficiency. |
| Tuning | ASPM Helper | Enables proper power-management states on supported devices. |
| Networking | RTL8125 / RTL8126 Drivers | Out-of-tree Realtek NIC drivers for hardware not natively supported. |
| Appearance | Dynamix System Buttons | One-click sleep, reboot, and shutdown buttons in the header. |
| Appearance | Custom WebUI CSS | Custom styling and theming for the UNRAID web interface. |

---

## On-Demand Sleepers

These containers are fully configured but kept stopped until needed for a specific project or game night.

* **satisfactory-server** — a dedicated game server, spun up for factory-building sessions.
* **FileFlows** — automated re-encoding and file-size optimization for the media library.
* **sftp-server** — a secure portal for manually moving large files onto the array.

---

*Long live the hidden fortress Nargothrond.*