App Installation Scipts

The install-media-stack script sets up a complete media automation stack on a Pulsed Media seedbox. It installs six applications in your home directory, binds them to localhost, assigns randomized ports, and configures lighttpd reverse proxy so you can access everything through your seedbox web panel.

No root access needed. Works on all PM shared and dedicated plans.

What it installs

Application	Purpose	Access
Radarr	Automated movie downloads	`https://SERVER/public-USER/radarr/`
Sonarr	Automated TV show downloads	`https://SERVER/public-USER/sonarr/`
Prowlarr	Indexer manager (feeds Radarr/Sonarr)	`https://SERVER/public-USER/prowlarr/`
Jellyfin	Media streaming server	`https://SERVER/public-USER/jellyfin/`
SABnzbd	Usenet downloader	`https://SERVER/public-USER/sabnzbd/`
Cloudplow	Cloud storage upload automation	CLI only (tmux session)

All applications run under your user account. All bind to 127.0.0.1 only, so they are not directly accessible from the internet. The lighttpd reverse proxy handles HTTPS termination and authentication.

How to install

Quick install

Download the script and run it:

wget -q https://raw.githubusercontent.com/MagnaCapax/PMSS/refs/heads/main/etc/skel/install-media-stack.sh
bash install-media-stack.sh

The script is self-updating. On interactive runs (SSH terminal), it checks GitHub for the latest version and re-executes itself if a newer version exists. You can skip this with --skip-update.

If the script is already on your server

On newer PM servers, the script may already be in your home directory:

bash ~/install-media-stack.sh

Dry run (verify before installing)

To see what the script will do without making any changes:

bash install-media-stack.sh --dry-run

This checks all download URLs, reports CPU architecture and GLIBC version, and shows the planned actions.

How it works

Installation layout

Everything goes under your home directory:

Path	Contents
`~/.bin/`	Application binaries (Radarr, Sonarr, Prowlarr, Jellyfin, .NET runtime)
`~/.config/`	Per-application configuration and databases
`~/.install-media-stack.log`	Installation log

Port assignment

Each application gets a randomized port between 10000 and 65000. The script tests that the port is free before binding. Ports are stored in each application's config file. If you reinstall, the same ports are reused from existing configs.

Reverse proxy

The script generates a lighttpd configuration snippet that maps each application to a URL path under your seedbox web panel. For example, if your seedbox URL is https://server.pulsedmedia.com/user-alice/, Radarr becomes accessible at https://server.pulsedmedia.com/public-alice/radarr/.

tmux sessions

The script creates shell aliases that launch each application in a named tmux session:

radarr     # starts Radarr in tmux session 'radarr'
sonarr     # starts Sonarr in tmux session 'sonarr'
prowlarr   # starts Prowlarr in tmux session 'prowlarr'
jellyfin   # starts Jellyfin in tmux session 'jellyfin'
sabnzbd    # starts SABnzbd in tmux session 'sabnzbd'

To view a running session: tmux attach -t radarr

To detach without stopping: Ctrl+B then D

CLI options

Option	Description
`--skip-update`	Do not check GitHub for script updates
`--dry-run`	Show planned actions without making changes
`--verify-only`	Only verify download URLs, then exit
`--sonarr-url=URL`	Use a specific Sonarr download URL
`--sonarr-branch=BR`	Sonarr branch (default: `main`)
`--radarr-url=URL`	Use a specific Radarr download URL
`--radarr-branch=BR`	Radarr branch (default: `master`)
`--radarr-version=TAG`	Pin Radarr to a specific version
`--prowlarr-url=URL`	Use a specific Prowlarr download URL
`--prowlarr-branch=BR`	Prowlarr branch (default: `master`)
`--jellyfin-url=URL`	Use a specific Jellyfin download URL
`--jellyfin-ffmpeg=PATH`	Path to custom ffmpeg binary for Jellyfin
`--sab-url=URL`	Use a specific SABnzbd download URL

Compatibility

Debian version	Status	Notes
Debian 13 (Trixie)	Supported	Full support, .NET 8
Debian 12 (Bookworm)	Supported	Full support, .NET 8
Debian 11 (Bullseye)	Supported	.NET 8, Radarr GLIBC fallback if needed
Debian 10 (Buster)	Supported	.NET 8, Radarr pinned to v5.10.4 (GLIBC 2.28)

On older systems where GLIBC is below 2.33, the script automatically pins Radarr to v5.10.4.9218 to avoid sqlite/GLIBC loader errors. All other applications work on any supported Debian version.

CPU architecture

The script detects x86_64, ARM64, and ARM architectures. On x86_64 it also checks for SSE4.2 and AVX support (Jellyfin benefits from SSE4.2 for software transcoding).

The *ARR workflow

Once installed, the typical automation flow is:

Prowlarr (indexer manager)
    |
    +-- feeds indexers to --> Radarr (movies)
    |                             |
    |                             +-- sends to torrent client (rTorrent/Deluge/qBittorrent)
    |                             |
    |                             +-- post-import --> Jellyfin library
    |
    +-- feeds indexers to --> Sonarr (TV shows)
                                  |
                                  +-- sends to torrent client
                                  |
                                  +-- post-import --> Jellyfin library

1. Prowlarr manages your indexer connections (torrent trackers, Usenet indexers) and feeds them to Radarr and Sonarr. 2. Radarr and Sonarr monitor your wanted movies/shows, search indexers via Prowlarr, and send downloads to your torrent client. 3. Your torrent client (rTorrent, Deluge, or qBittorrent) downloads the files. 4. Radarr/Sonarr detect the completed download, rename/organize the files, and update your Jellyfin library. 5. Stream from Jellyfin on any device.

Security

The installer follows these security principles:

Localhost binding only -- all applications listen on 127.0.0.1, not on public interfaces
Randomized ports -- each user gets different ports, reducing collision and enumeration risk
HTTPS via reverse proxy -- lighttpd handles TLS, so all access is encrypted
No root required -- everything runs in user space
Checksum verification -- downloaded archives are verified with SHA256

Troubleshooting

Problem	Cause	Fix
Application does not start	Port already in use	Check `ss -tlnp` for conflicts. Remove config and reinstall to get new port.
502 Bad Gateway in browser	Application not running	Start it: `radarr` (or `sonarr`, etc.). Check tmux session.
Radarr crashes on startup	GLIBC too old (Debian 10/11)	Script should auto-detect. If not, use `--radarr-version=v5.10.4.9218`.
Jellyfin transcoding fails	No hardware transcoding on shared	Software transcoding works. For hardware transcoding, use a dedicated server with iGPU.
SABnzbd fails to start	Python venv missing	Run `python3 -m venv ~/.config/sabnzbd/venv` then reinstall.
"Permission denied" errors	Quota exceeded	Check disk usage. Free space and retry.
Applications show old version	Self-update skipped	Run `bash install-media-stack.sh` (without --skip-update) to get latest.

Source code

The installer script is open source, part of PMSS:

Script: install-media-stack.sh on GitHub
Documentation: install-media-stack.md on GitHub