initial commit

roles/container_isolation/files/group.containers

@@ -0,0 +1,45 @@
+# /etc/group.containers
+# Source of truth for container service groups. Sync to all Docker VMs
+# and the NFS server using sync-container-users.sh. Append-only — add new
+# lines here when adding containers, never renumber existing ones.
+#
+# Primary per-app groups mirror passwd.containers UIDs (2000-2099).
+# Shared groups start at 3000 for cross-container access.
+# format: name:x:GID:secondary,members
+2fauth:x:2000:
+audiobookshelf:x:2001:
+authelia:x:2002:
+bazarr:x:2003:
+cronjobs:x:2004:
+dashy:x:2005:
+dingus-archiver:x:2006:
+finance-app:x:2007:
+firefly3:x:2008:
+gitea:x:2009:
+gotify:x:2010:
+immich:x:2011:
+it-tools:x:2012:
+jellyfin:x:2013:
+joplin:x:2014:
+kiwix:x:2015:
+music-orchestrator:x:2016:
+nginxproxy:x:2017:
+ombi:x:2018:
+picoshare:x:2019:
+prowlarr:x:2020:
+qbittorrent:x:2021:
+radarr:x:2022:
+romm:x:2023:
+sonarr:x:2024:
+tandoor_recipes:x:2025:
+vault:x:2026:
+#
+# Shared groups (cross-container access, GID range 3000+)
+# mediapipeline: *arr apps + qbittorrent + jellyfin share the media/download
+# folders (e.g. /var/NFSFolder/AppData/media). Ombi is request-only (talks
+# to APIs, doesn't touch the filesystem) so it's excluded.
+mediapipeline:x:3000:bazarr,prowlarr,qbittorrent,radarr,sonarr,jellyfin
+#
+# finance-app and dingus-archiver are isolated custom apps with no shared
+# access — their primary groups above (2007, 2006) already cover them.
+# No secondary group needed unless that changes.