MediaStack assembles a self hosted media server from Compose files

One Compose file, about forty services

MediaStack is not an application in the usual sense. It is a set of Docker Compose files and configuration that assemble a media server environment: a media server, the download and library management chain, single sign on with multi factor authentication, a reverse proxy with certificates, a VPN layer and monitoring. The README describes the project as a way to build a desired media stack quickly with secure outbound traffic and secure remote access using multifactor authentication.

The list of Docker applications configured in the MediaStack docker-compose.yaml file is the substance of the project, and it is long. The entries span Authentik for identity, Traefik as the reverse proxy, Prometheus and Grafana for monitoring, CrowdSec for intrusion prevention, and a wide set of media specific services including Jellyfin, Plex, Radarr, Sonarr, Lidarr, Readarr, Mylar, Whisparr, Prowlarr, qBittorrent, SABnzbd, Unpackerr, Bazarr, FileBot, Tdarr and Seerr.

Each row in that table points at the upstream documentation of the service, which tells you where the real configuration lives. MediaStack is a starting point that wires these services together, not a fork of any of them. The documentation site named in the repository is MediaStack.Guide, and the README points to a Reddit community for the project.

The audience is someone running their own hardware with Docker who does not want to hand assemble forty containers, certificates, an identity provider and a VPN configuration. What you get in exchange for that convenience is a stack you own end to end, including the parts that break.

Three network profiles decide how containers reach the internet

The repository layout is the clearest signal of how this project is organised. Alongside the README there are four configuration directories: base-working-files, full-download-vpn, mini-download-vpn and no-download-vpn, plus an archived-old-configs folder for configurations that have been retired.

The three active profiles differ in how outbound traffic is handled. The download VPN profile routes traffic through a VPN using Gluetun, which the README describes as routing network traffic through a VPN for the privacy and security of Docker containers. The no-download-vpn profile covers the same stack without that VPN layer, for people who do not want downloads tunnelled. The mini profile sits between the two.

The naming makes the choice explicit rather than leaving it buried in environment variables, and picking the wrong one is the first decision a user has to make. The three profiles are also an admission that this is not a one size stack. The same applies to archived-old-configs: keeping superseded configurations in the repository means the project expects its own network design to change, and it gives you a way to see what changed between versions of the setup.

The base-working-files directory appears to hold the shared pieces that the three profiles build on, and the README points to the docker-compose.yaml file that holds the application list. The README does not document a single command that assembles the stack, so the configuration files are the deliverable and the Compose file is what you run with your own Docker tooling.

Authentik and Headscale carry the remote access story

Remote access and identity are handled by a small group of services that appear together in the list. Authentik is the identity provider, described as an open-source identity provider for SSO, MFA and access control, which is the piece that delivers the multifactor authentication the project description promises. Chromium is included so you can browse the internet through the stack, and Guacamole provides a clientless remote desktop gateway for RDP, VNC and SSH through a browser.

For the network layer there are two options that sit next to each other. Tailscale is the hosted peer-to-peer VPN built on WireGuard, and Headscale is the self-hosted alternative to the Tailscale control server, with Headplane as a web interface for managing a Headscale deployment. The stack lists both, so the choice is yours rather than baked in.

Three further entries complete the perimeter. Traefik is the reverse proxy and load balancer, with TLS support, and Traefik-Certs-Dumper extracts certificates and private keys from Traefik for use by other services. DDNS-Updater keeps dynamic DNS records pointed at your home address when the internet connection changes, and the project topics list also names Let's Encrypt, which points at the certificate issuance path Traefik is expected to handle.

CrowdSec and Flaresolverr sit on the edge of that perimeter. CrowdSec is listed as a collaborative intrusion prevention system that detects and blocks malicious IPs, and Flaresolverr is listed as a tool that bypasses Cloudflare protection to allow automated access to sites for scripts and bots. The latter is a scraping helper, and the README does not explain which service in the stack uses it, so treat that row as an open question rather than a required component.

The download and library chain is the actual product

Most of the table describes the media automation chain, and this is where the project earns its keep. The pattern is well known in the self hosted world. Prowlarr manages and integrates indexers for the download applications, automating search and download processes. Radarr, Sonarr, Lidarr, Readarr, Mylar and Whisparr are all described in the same words, as Library Managers that automate the management and metadata for their respective media types: movies, TV shows, music, eBooks and comics, and adult media.

On the download side, qBittorrent handles peer-to-peer transfers and SABnzbd is a Usenet newsreader that automates downloading binaries from Usenet. Unpackerr extracts and moves downloaded files into their proper directories, and Bazarr automates subtitle downloading for films and shows. FileBot is included for renaming and organising media files from online metadata sources, and Tdarr automates transcoding to optimise storage and playback compatibility.

Two entries sit above the chain. Jellyfin and Plex are both listed as media servers that organise, stream and manage multimedia content, so the stack serves the same library through two different front ends. Seerr is described as a request management tool for Jellyfin, letting users request and manage content, which is the piece that turns a private server into something other people in the household use.

One row is marked deprecated. Huntarr, which automated finding missing and upgrading media in ARR libraries, carries a DEPRECATED tag in the table, so the project itself flags it as no longer the recommended route for that job. That is a useful signal about how the maintainer treats the other entries: not every container in the file has the same standing.

Dashboards and metrics sit next to the services they watch

The stack includes the operational layer. Prometheus collects and queries metrics into a time-series database, and Grafana is the analytics platform for visualising metrics, logs and time-series data. Portainer provides a graphical interface for managing Docker environments, simplifying container deployment and monitoring. PostgreSQL and Valkey are present as the database and cache, with Valkey described as an open-source in-memory key-value datastore serving as a drop-in replacement for Redis.

Three dashboard applications are listed, which is a hint about the audience. Heimdall provides a dashboard to reach and organise web applications and services, Homepage is described as an alternative to Heimdall doing something similar, and Homarr is a self-hosted customisable dashboard for managing and monitoring server applications. Picking one is on you.

There is also a point worth making about the scale. Running roughly forty containers on one host is not a lightweight arrangement, and the stack does not document hardware requirements or a minimum configuration. The operational picture is also self-referential in an interesting way: the same stack that serves your media also exposes a reverse proxy, an identity provider, a browser and a remote desktop gateway, each of which needs hardening, updates and certificates. The single Compose file makes the first deployment simple. The second deployment, after an image changes behaviour, is where the value of a curated stack is less obvious.

The documentation is thin where adopters need it most

There are real gaps in what the README provides, and they cluster exactly where a new user would look first. There is no install command, no prerequisite list, no hardware guidance and no step by step for producing a working stack. The README is essentially an application table, and the configuration directories carry the weight instead.

The licence is another gap. The repository does not state a licence identifier, and the files listed at the top level are the README, the configuration directories and the project assets, with no LICENSE file among them. That is not unusual for a configuration collection where each service carries its own licence, but it means you have to work out the terms for the Compose files and the configuration text yourself rather than reading a single file that says so.

The release picture is thin too. There is one listed release, MediaStack 26.0.0, dated 2026-03-21, and the last push to the repository was on 2026-04-23. Between a release and a repository of this kind, the Compose file is the thing that changes, and the gap between those two dates is where the state of your deployment quietly drifts from the state of the project. Whether a given upstream image behaves as it did when the file was written is outside the control of the project, and the Compose file pins image names, not the behaviour behind them.

The one thing you can check before installing is the application list itself, and it is worth doing. A stack that includes both Jellyfin and Plex, three dashboards, and a deprecated tool is telling you it is a catalogue of possibilities rather than a curated opinion. Expect to delete a good part of it.

Editorial conclusion

MediaStack fits a hobbyist or small team that wants a complete self hosted media stack with single sign on and remote access already configured, and who is comfortable editing Compose files by hand. It does not fit anyone who wants a single container, a managed product, or a configuration that stays current without attention: the README does not document an install command, the licence is not stated in the repository, and the only listed release is MediaStack 26.0.0 from 2026-03-21 with the last push on 2026-04-23. Before adopting it, read the files under no-download-vpn, mini-download-vpn and full-download-vpn to see which network profile matches your own, and check the container list for services you do not intend to run, since the stack ships around forty of them.

Frequently asked questions

Official sources

1. geekau/mediastack on GitHub
2. Issues
3. Project website
4. README
5. Releases