Compose: /srv/docker/radarr/docker-compose.yml
Static configuration/source: no additional mounted configuration
Non-secret environment: UID 1000, GID 1000, and timezone Etc/UTC are declared inline in Compose; there is no project-local .env
Secrets: none separately mounted; application-generated API keys and integration credentials remain inside the protected Radarr application state
NVMe application state: /srv/appdata/radarr/config
Bulk HDD data: /data/Data1/radarr/recyclebin
Other mounts: /srv/downloads read-write for shared SABnzbd staging, /data/Data1/jellyfin/Movies read-write as the movie library, and /etc/localtime read-only

Secrets are never committed to this repository. Radarr's application-generated API key and download-client, indexer, and notification credentials remain inside the protected application-managed configuration under /srv/appdata/radarr/config.

Dependencies and recovery

Networks/dependencies: Radarr uses the external npm_proxy network at 192.168.97.11; application-level dependencies include SABnzbd, configured indexers, the shared /srv/downloads staging tree, and the Jellyfin movie library
Back up: /srv/appdata/radarr/config and /data/Data1/jellyfin/Movies; protect the application-state backup because it contains integration credentials; the recycle bin is recovery convenience rather than a backup
Re-creatable: the Radarr container image and expired recycle-bin contents