initial commit

roles/container_isolation/files/group.containers

@@ -0,0 +1,45 @@
+# /etc/group.containers
+# Source of truth for container service groups. Sync to all Docker VMs
+# and the NFS server using sync-container-users.sh. Append-only — add new
+# lines here when adding containers, never renumber existing ones.
+#
+# Primary per-app groups mirror passwd.containers UIDs (2000-2099).
+# Shared groups start at 3000 for cross-container access.
+# format: name:x:GID:secondary,members
+2fauth:x:2000:
+audiobookshelf:x:2001:
+authelia:x:2002:
+bazarr:x:2003:
+cronjobs:x:2004:
+dashy:x:2005:
+dingus-archiver:x:2006:
+finance-app:x:2007:
+firefly3:x:2008:
+gitea:x:2009:
+gotify:x:2010:
+immich:x:2011:
+it-tools:x:2012:
+jellyfin:x:2013:
+joplin:x:2014:
+kiwix:x:2015:
+music-orchestrator:x:2016:
+nginxproxy:x:2017:
+ombi:x:2018:
+picoshare:x:2019:
+prowlarr:x:2020:
+qbittorrent:x:2021:
+radarr:x:2022:
+romm:x:2023:
+sonarr:x:2024:
+tandoor_recipes:x:2025:
+vault:x:2026:
+#
+# Shared groups (cross-container access, GID range 3000+)
+# mediapipeline: *arr apps + qbittorrent + jellyfin share the media/download
+# folders (e.g. /var/NFSFolder/AppData/media). Ombi is request-only (talks
+# to APIs, doesn't touch the filesystem) so it's excluded.
+mediapipeline:x:3000:bazarr,prowlarr,qbittorrent,radarr,sonarr,jellyfin
+#
+# finance-app and dingus-archiver are isolated custom apps with no shared
+# access — their primary groups above (2007, 2006) already cover them.
+# No secondary group needed unless that changes.

roles/container_isolation/files/passwd.containers

@@ -0,0 +1,34 @@
+# /etc/passwd.containers
+# Source of truth for container service accounts. Sync to all Docker VMs
+# and the NFS server using sync-container-users.sh. Append-only — add new
+# lines here when adding containers, never renumber existing ones.
+#
+# UID range reserved: 2000-2099 (container service accounts)
+# format: name:x:UID:GID::/nonexistent:/usr/sbin/nologin
+2fauth:x:2000:2000::/nonexistent:/usr/sbin/nologin
+audiobookshelf:x:2001:2001::/nonexistent:/usr/sbin/nologin
+authelia:x:2002:2002::/nonexistent:/usr/sbin/nologin
+bazarr:x:2003:2003::/nonexistent:/usr/sbin/nologin
+cronjobs:x:2004:2004::/nonexistent:/usr/sbin/nologin
+dashy:x:2005:2005::/nonexistent:/usr/sbin/nologin
+dingus-archiver:x:2006:2006::/nonexistent:/usr/sbin/nologin
+finance-app:x:2007:2007::/nonexistent:/usr/sbin/nologin
+firefly3:x:2008:2008::/nonexistent:/usr/sbin/nologin
+gitea:x:2009:2009::/nonexistent:/usr/sbin/nologin
+gotify:x:2010:2010::/nonexistent:/usr/sbin/nologin
+immich:x:2011:2011::/nonexistent:/usr/sbin/nologin
+it-tools:x:2012:2012::/nonexistent:/usr/sbin/nologin
+jellyfin:x:2013:2013::/nonexistent:/usr/sbin/nologin
+joplin:x:2014:2014::/nonexistent:/usr/sbin/nologin
+kiwix:x:2015:2015::/nonexistent:/usr/sbin/nologin
+music-orchestrator:x:2016:2016::/nonexistent:/usr/sbin/nologin
+nginxproxy:x:2017:2017::/nonexistent:/usr/sbin/nologin
+ombi:x:2018:2018::/nonexistent:/usr/sbin/nologin
+picoshare:x:2019:2019::/nonexistent:/usr/sbin/nologin
+prowlarr:x:2020:2020::/nonexistent:/usr/sbin/nologin
+qbittorrent:x:2021:2021::/nonexistent:/usr/sbin/nologin
+radarr:x:2022:2022::/nonexistent:/usr/sbin/nologin
+romm:x:2023:2023::/nonexistent:/usr/sbin/nologin
+sonarr:x:2024:2024::/nonexistent:/usr/sbin/nologin
+tandoor_recipes:x:2025:2025::/nonexistent:/usr/sbin/nologin
+vault:x:2026:2026::/nonexistent:/usr/sbin/nologin