Playback
Plex runs as the official Synology package and uses the Quadro P2000 for hardware-accelerated transcodes.
HOMELAB BUILD · JULY 202614 MIN READ
Building a
production-ready
Plex media stack.
A complete rebuild on Synology: GPU transcoding, the modern Arr ecosystem, private torrents, safe media migration, Cloudflare routing and one clean dashboard.
media-stack.yml
platform: synology-dsm
gpu: quadro-p2000
media:
movies: 172 migrated
tv: 191 migrated
services:
- plex
- seerr
- prowlarr
- radarr
- sonarr
- bazarr
- qbittorrent
status: online ALL SYSTEMS OPERATIONAL
363media files migrated
7integrated services
P2000hardware transcoding
0direct public admin ports
THE SYSTEM
One server. Four clear layers.
The best part of this build is not any single container. It is the clean separation between playback, automation, storage and access.
Automation
Radarr, Sonarr, Prowlarr, Bazarr, qBittorrent and Seerr run as a coordinated container stack.
Storage
Libraries and downloads share one filesystem, enabling hardlinks instead of wasteful full-file copies.
Access
Admin tools stay on the LAN. Plex and Seerr use named Cloudflare routes with an explicit security trade-off.
PLEX · SONARR · RADARR · PROWLARR · BAZARR · SEERR · QBITTORRENT ·
PlexPlaybackNVIDIA P2000
SeerrRequestsPlex + Arr
RadarrMoviesHardlink imports
SonarrTVHardlink imports
ProwlarrIndexersOne source of truth
qBittorrentDownloadsPrivate tracker
BazarrSubtitlesAutomated
THE BUILD LOG
Order of operations mattered.
The rebuild succeeded because destructive steps came late—after paths, permissions and migration checks were already proven.
Inventory first
DSM, storage, containers, networking, Plex paths and GPU availability were mapped before anything changed.
Build the automation layer
The Arr stack, Seerr and qBittorrent were deployed together with consistent paths and predictable ports.
Move the library safely
172 movie files and 191 TV files were moved only after destination paths were ready, then counts were verified.
Rebuild Plex cleanly
The old package and retained metadata were removed, the official package installed, permissions repaired and scans verified.
Route and document
User-facing services received named routes, administrative apps stayed on the LAN, and Homepage became the control surface.
STORAGE DESIGNHardlinks start
Hardlinks start
with the right tree.
Permanent libraries and temporary downloads live under the same filesystem. Radarr and Sonarr can give Plex clean library paths while torrents continue seeding without storing duplicate media.
/volume1/MediaData/
├── library/
│ ├── movies/
│ └── tv/
└── torrents/
├── complete/
└── incomplete/WHAT BROKE
Three useful lessons.
“Address already in use”
qBittorrent’s default peer port was occupied. Publishing 26881 for TCP and UDP solved the collision without redesigning the stack.
One-time login loops
Container-local API requests returned 403 until the Web UI session and host validation were handled correctly. Logs were more useful than repeated guesses.
Traverse is not read
Plex initially had an ACL entry but could not enumerate the library. Every parent directory needed traverse access, inherited by the media tree.
!
REMOTE ACCESS NOTE
Private by design, with a trade-off.
Both public hostnames currently pass through Cloudflare Access. That works beautifully for browser-based Seerr, but interactive Access login can block native Plex clients—and Cloudflare Tunnel is not designed as a high-bandwidth video relay. For native remote streaming, use a media-appropriate direct or mesh-VPN path.
THE RESULT
A system that is easier to run
than it was to build.
The finished stack is automated, GPU-accelerated, recoverable and visible from one dashboard—without exposing the administration layer to the public internet.
✓ Fresh official Plex installation✓ Hardware encoding + HDR tone mapping✓ Private indexer synced once through Prowlarr✓ Movie and TV request workflow✓ Verified media migration counts✓ Unified Homepage dashboard