# 05-nzbget.md

kstack:
  book: Centerpoint Home Lab
  chapter: Media Management
  page: NZBGet
  tags: [nzbget, usenet, download-client, arr, media-management]
---

## Overview

NZBGet is the Usenet download client for the homelab. It receives download jobs
from Sonarr, Radarr, Whisparr, and LazyLibrarian, downloads from configured Usenet
providers, unpacks archives, and notifies the requesting *arr application when
complete.

Downloads are staged to the Ceph OSD volume (`1TB_Vol2`) for high-speed local
writes before being processed and moved to UnRAID.

## Access

| Type      | URL                                  | Notes                                           |
|-----------|--------------------------------------|-------------------------------------------------|
| Internal  | `https://nzbget.home.local`          | LAN access via Step-CA TLS                      |
| External  | `https://nzb.jeeves5454.ddns.net`    | Authentik SSO + GeoBlock + CrowdSec             |

## Configuration

**Image:** `lscr.io/linuxserver/nzbget:latest`
**Compose project:** `arr` stack

### Traefik Labels

```yaml
# External route
traefik.http.routers.nzbget-external.rule: Host(`nzb.jeeves5454.ddns.net`)
traefik.http.routers.nzbget-external.entrypoints: websecure
traefik.http.routers.nzbget-external.tls.certresolver: letsencrypt
traefik.http.routers.nzbget-external.middlewares: authentik-auth@docker,plex-geoblock@file,crowdsec-bouncer@file
traefik.http.routers.nzbget-external.service: nzbget-svc

# Internal route
traefik.http.routers.nzbget-internal.rule: Host(`nzbget.home.local`)
traefik.http.routers.nzbget-internal.entrypoints: websecure
traefik.http.routers.nzbget-internal.tls.certresolver: step-ca
traefik.http.routers.nzbget-internal.service: nzbget-svc

traefik.http.services.nzbget-svc.loadbalancer.server.port: 6789
```

## Volumes / Bind Mounts

| Host Path                              | Container Path  | Purpose                                          |
|----------------------------------------|-----------------|--------------------------------------------------|
| `/home/jeeves/docker/arr/NZBGet/config`| `/config`       | NZBGet settings and queue database               |
| `/media/jeeves/1TB_Vol2/downloads`     | `/downloads`    | Download staging directory (Ceph OSD)            |
| `/mnt/Multimedia`                      | `/media`        | Media library (used by post-process scripts)     |

### Download Directory Layout

NZBGet organises downloads under `/downloads` with category subdirectories:

```
/media/jeeves/1TB_Vol2/downloads/
├── usenet/
│   ├── intermediate/    ← In-progress downloads
│   └── complete/
│       ├── tv/          ← Completed TV episodes → Sonarr picks up
│       ├── movies/      ← Completed movies → Radarr picks up
│       ├── books/       ← Completed books → LazyLibrarian picks up
│       └── adult/       ← Completed adult content → Whisparr picks up
```

## Notes / Gotchas

- Usenet provider credentials (server address, port, username, password) are stored
  in NZBGet's settings — these are **REDACTED** in all documentation.
- NZBGet's built-in web UI has its own username/password in addition to the Authentik
  ForwardAuth layer on the external route. Both must be configured.
- The Ceph OSD download volume provides fast local NVMe performance for downloads
  before they are moved to the slower NFS path. Ensure adequate free space is
  maintained on `1TB_Vol2`.
- Each *arr app connects to NZBGet via `http://nzbget:6789` on the `media-network`
  using the NZBGet API credentials configured in the *arr download client settings.

---
*Last Updated: 2026-06-16*