1 files changed, 75 insertions, 0 deletions
diff --git a/jellyfin/setup-media-user.sh b/jellyfin/setup-media-user.sh
new file mode 100755
index 0000000..d470c16
--- /dev/null
+++ b/jellyfin/setup-media-user.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+set -e
+
+echo "=== Creating dedicated media user (UID 1001) and group (GID 1001) ==="
+
+# Create the media group
+sudo groupadd -g 1001 media
+
+# Create the media user (no home dir, no login shell)
+sudo useradd -u 1001 -g media -s /usr/sbin/nologin -M media
+
+# Add tyler to media group so tyler can access files created by the media user
+sudo usermod -aG media tyler
+
+# Add media user to video and render groups for hardware transcoding access
+sudo usermod -aG video,render media
+
+echo "=== Fixing Jellyfin config/cache ownership ==="
+sudo chown -R 1001:1001 /home/tyler/docker/jellyfin/config
+sudo chown -R 1001:1001 /home/tyler/docker/jellyfin/cache
+
+echo "=== Creating config directories for Sonarr and Radarr ==="
+sudo mkdir -p /home/tyler/docker/jellyfin/sonarr-config
+sudo mkdir -p /home/tyler/docker/jellyfin/radarr-config
+sudo chown -R 1001:1001 /home/tyler/docker/jellyfin/sonarr-config
+sudo chown -R 1001:1001 /home/tyler/docker/jellyfin/radarr-config
+
+echo "=== Setting media group ownership on /srv/ directories ==="
+# Change group to media on all media directories
+sudo chown -R :media /srv/vids /srv/mus /srv/books /srv/photos /srv/roms /srv/torrents
+
+echo "=== Clearing conflicting POSIX ACLs (if any) ==="
+# ACLs from NAS/Samba can override Unix group permissions.
+# Strip them so our chmod/chown rules actually take effect.
+if command -v setfacl &>/dev/null; then
+  sudo setfacl -R -b /srv/vids /srv/mus /srv/books /srv/photos /srv/roms /srv/torrents 2>/dev/null || true
+else
+  echo "Warning: setfacl not found. Install the 'acl' package if you have ACL issues."
+fi
+
+echo "=== Setting directory sticky bit (g+s) so new files inherit media group ==="
+sudo find /srv/vids /srv/mus /srv/books /srv/photos /srv/roms /srv/torrents -type d -exec chmod g+s {} +
+
+echo "=== Setting base permissions ==="
+# Group read+execute on all directories
+sudo find /srv/vids /srv/mus /srv/books /srv/photos /srv/roms /srv/torrents -type d -exec chmod g+rx {} +
+
+# Group read on all files
+sudo find /srv/vids /srv/mus /srv/books /srv/photos /srv/roms /srv/torrents -type f -exec chmod g+r {} +
+
+echo "=== Setting write permissions for Sonarr/Radarr managed directories ==="
+# Allow group write on top-level dirs and recursively within them
+sudo chmod g+w /srv/vids/movies /srv/vids/shows /srv/torrents
+sudo find /srv/vids/movies /srv/vids/shows /srv/torrents -type d -exec chmod g+w {} +
+sudo find /srv/vids/movies /srv/vids/shows /srv/torrents -type f -exec chmod g+w {} +
+
+echo "=== Done! ==="
+echo ""
+echo "You will need to log out and back in (or run 'newgrp media') for the"
+echo "group changes to take effect in your current shell."
+echo ""
+echo "Start the stack with: docker compose up -d"
+echo ""
+echo "=== Web UI Configuration ==="
+echo "Sonarr (http://<host>:8989):"
+echo "  - Root folder: /data/vids/shows"
+echo "  - Download client path: /data/torrents"
+echo ""
+echo "Radarr (http://<host>:7878):"
+echo "  - Root folder: /data/vids/movies"
+echo "  - Download client path: /data/torrents"
+echo ""
+echo "If you add a download client later, mount it with /srv:/data too"
+echo "and set its download directory to /data/torrents."
+echo "This ensures paths match and hard links / fast moves work correctly."