Media module won't start — gluetun private key not being passed / ghost networks
Posted by Rolen09
SparkBox version: latest Platform: VPS (debian 13 , hostname: matrix) Install root: /opt/sparkbox What's broken: - sb-gluetun, sb-qbittorrent, sb-radarr, sb-sonarr, sb-prowlarr, sb-sabnzbd all stopped - gluetun was reporting private key is not set despite the key being correctly set in .env What we found and fixed: 1. The compose file at modules/media/docker-compose.yml had a duplicate label: key inside the VPNPASSWORD x-sparkbox block (lines 58 + 65) — leftover orphaned lines from a previous edit. YAML refused to parse the whole file. Fixed by removing the orphaned block in nano. 2. After fixing the YAML, docker compose config confirmed the key resolves correctly. 3. Ghost Docker networks mediasbmedia and mediasbmediainternal were squatting on 172.20.4.0/24 and 172.20.5.0/24 — the exact subnets SparkBox needs for the media module. These were from an old compose run under project name media instead of sparkbox. 4. sb-seerr, sb-jellyfin-media, and sb-bazarr were still attached to the ghost network, blocking removal. Disconnected them manually. 5. mediasbmedia removed successfully. mediasbmediainternal threw "not found" — may have already been cleaned up. Current state: - Ghost networks cleared - YAML parses clean - Media module not yet restarted — stopping here to report before proceeding Question for Tom: - What caused the duplicate label: in the compose file — was this a bad update/write from the dashboard config editor? - Should sparkbox up media now bring everything up cleanly, or is there anything else to check first?
4 replies
Rolen09 wrote:
I can not figure out why the vpn will not work, after two hours of working with the Tom AI and it not working I figured I would ask it for a summary and post it her for help. Thanks.
tomspark wrote:
Genuinely impressive debugging — you found all of it. Two answers: Your second question first: yes — with the YAML now parsing and those ghost networks cleared, sudo sparkbox up media should bring the whole stack up cleanly and gluetun will read its key. Watch sb-gluetun go healthy first, then the arr follow. If gluetun STILL says 'private key is not set' after that, the only thing to recheck is the WIREGUARDPRIVATEKEY line in your .env — it should be a single 44-character value ending in '=' (just that one line from the WireGuard config, not the whole file). On what caused the duplicate label: good news, it's NOT the dashboard config editor — that only writes your values into .env, it never touches the structure of the compose file. Our shipped compose doesn't have that duplicate either, so something rewrote yours on-box, most likely a hiccup during an update/migration that edits that file. That shouldn't happen, and I'm flagging it to get to the root and make those edits safe so it can't recur. The ghost media networks were left by an older version that ran the media stack under a different project name; current versions run everything under one project, so once cleared (as you did) they won't come back. Go ahead and bring it up — and thank you for the forensic write-up, it's exactly what helps us harden this.
Rolen09 wrote:
Thank you so much for the quick reply, I think I was able to get it working. I found another bug and I accidentally posted it under the tech forum and I can't figure out how to go back and edit the forum.
tomspark wrote:
That's great — glad it's up! And no worries at all about the other post: I found it (your 'Jellyfin Issue' one over in the Tech community), so you don't need to move or edit it — I'll pick it up there. Quick note on that one: Jellyfin working for you now is the main thing. The '10.11.8 broken on fresh DB init' is something we're keeping an eye on — it actually runs fine on most setups (including our own test box), but on certain environments it can hang on that very first startup with a brand-new database, which looks to be what you hit. Since yours came up cleanly you're sorted, and I'll pin Jellyfin back if it turns out to bite more people. Thanks for the sharp reports today — you've basically been a one-person QA team.