Repo: lemonfiber-media-stack

Status: Accepted

The stack’s manifest, its service files, each part’s starting configuration and the recordings its claims are proved against. TOML, Hippocratic 3.0.

Implements: the stack side of B1, the manifest contract, and F2.

---

lemonfiber writes the stack’s Compose project from stack.toml and the service files it includes (ADR-0043), and this repository holds no Compose file. The repository retires once nothing reads it (ADR-0042 §6), and what follows describes the repository as it stands.

What this repo is

The stack’s manifest, its service files, each part’s starting configuration and the recordings its claims are proved against, until each moves to its part’s plugin. What runs, with lemonfiber or without it, is the project lemonfiber writes, from the files it names and the .env beside it (F1-R1).

lemonfiber embeds this repo as a submodule pinned to a commit (ADR-0005), but the two develop and version independently.

Layout

lemonfiber-media-stack/
├── stack.toml                  the manifest's root — see contract
├── services/
│   └── <id>.toml               one file per service, named by stack.toml's `include`
├── .env.example                every variable the operator sets, documented inline
├── config/                     seeded config templates
│   ├── recyclarr/recyclarr.yml
│   ├── homepage/{services,widgets,settings}.yaml
│   ├── caddy/Caddyfile
│   └── door/Caddyfile
├── recordings/                 the answers each claim is proved against
├── scripts/                    the checks CI runs
├── README.md                   running the project lemonfiber writes, without it
└── .github/                    CI

The service inventory

23 services, all verified linux/arm64 + linux/amd64. Every one lemonfiber does not build is OSI-licensed (2026-07); the request gate and the decline service, whose images lemonfiber builds from its own code, carry Hippocratic-3.0 (F2-R5). Full descriptions in F2; the canonical data is in stack.toml.

The rules a service file must obey

These are not style preferences — each is enforced, and each has a spec requirement behind it:

The single-mount rule, concretely

A service file says only whether the service takes data; lemonfiber writes the mount, once, at /data:

# services/sonarr.toml
takes_data = true

There is no field for a second mount beneath the data root, so the split that silently turns every import into a copy cannot be written (C5-R5).

NAS mode

In NAS mode lemonfiber writes each library service’s /data as an NFS-backed volume from the operator’s export. Making the *arrs copy instead of hardlink is an application setting, written over each app’s API during seeding, not something the project does.

CI

The checks are themselves tested

A lint nobody has watched fail is a lint nobody knows works, and a green gate over a stack that already complies proves nothing — it goes on proving nothing until the first violating change merges. Each rule therefore has a negative test that breaks exactly that rule in a throwaway copy of the stack and asserts the violation is reported (REPO-R37). The same reasoning as the comment policy’s fixture tree (Q-R7), applied to configuration.

CI has the lemonfiber binary, built from the judge’s commit with this tree laid over the stack it embeds, write the project, starts the profile groups scripts/check_runs.py --plan names with plain docker compose in its directory, and checks each service answers the probe stack.toml declares. A profile that cannot start without real credentials or a real provider is named in check_runs.py with the reason and left out: torrent, whose gluetun needs a VPN tunnel and whose qbittorrent waits on gluetun.

Adding a service

Three data edits, no Rust (F1-R5):

1. A [[service]] in services/<id>.toml — its container in the service model, ports, health, api, criticality, licence.
2. Its file added to include in stack.toml.
3. Its profile added to whichever forms should carry it.

lemonfiber writes its Compose entry, and CI holds it to every rule above. This is the whole of J8’s “add a service” path.

Requirements

Affected repos (GOV-R7): lemonfiber-media-stack.

Related

• stack-manifest contract
• F2 Service catalogue
• C2 · C5
• J8 Customising