diff --git a/media/media.yaml b/media/media.yaml
new file mode 100644
index 0000000..761a4ca
--- /dev/null
+++ b/media/media.yaml
@@ -0,0 +1,225 @@
+services:
+  Plex-Media-Server-GPU:
+    hostname: plex
+    cap_add:
+      - SYS_MODULE
+    entrypoint:
+      - "/init"
+#      - /bin/bash #turn on for DB maintenance
+#    command: -c "sleep infinity" #turn on for DB maintenance
+    environment:
+      - "PUID=0" #1027
+      - "PGID=0" #100
+      - "VERSION=latest"
+      - "ADVERTISE_IP=https://plex.${DOMAIN}:443/"
+    networks:
+      - traefik_backend
+    image: "linuxserver/plex:latest"
+    volumes:
+      - /volume1/TV Shows:/volume1/TV
+      - /volume1/Movies:/volume1/Movies
+      - /volume1/docker/Plex Media Server:/config
+      - /volume1/Plex-Backups:/Plex-Backups
+      - /dev/dri:/dev/dri
+      - type: tmpfs
+        target: /dev/shm
+        tmpfs:
+          size: 400000000000
+    healthcheck:
+      test: curl -fsSS http://localhost:32400/identity > /dev/null || exit 1
+      start_period: 900s
+      timeout: 10s
+      interval: 5s
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.plex.rule=Host(`plex.${DOMAIN}`)
+        - traefik.http.routers.plex.tls=true
+        - traefik.http.routers.plex.tls.certresolver=letsencrypt
+        - traefik.http.routers.plex.entrypoints=websecure
+        - traefik.http.services.plex.loadbalancer.server.port=32400
+        - traefik.http.services.plex.loadbalancer.server.scheme=https
+        - traefik.http.routers.plex.middlewares=crowdsec@file
+        - traefik.swarm.network=traefik_backend
+        - autoheal=true
+      resources:
+        limits:
+          cpus: '8'
+          memory: 4G
+      placement:
+        constraints:
+          - node.labels.block != databases
+
+  Radarr:
+    entrypoint:
+      - "/init"
+    environment:
+      - "PUID=0" #1027
+      - "PGID=0" #100
+      - "TZ=PST"
+    image: "linuxserver/radarr:latest"
+    hostname: movies
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    stdin_open: true
+    tty: true
+    volumes:
+      - /volume1/docker/Radarr/config:/config
+      - /volume1/Box Office/incomplete:/incomplete
+      - /volume1/Box Office/Drop off:/dropoff
+      - /volume1/Movies:/movies
+    healthcheck:
+      test: curl -fSs http://127.0.0.1:7878 > /dev/null || exit 1
+      start_period: 90s
+      timeout: 5s
+      interval: 5s
+      retries: 3
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.radarr.rule=Host(`movies.${DOMAIN}`)
+        - traefik.http.routers.radarr.tls=true
+        - traefik.http.routers.radarr.tls.certresolver=letsencrypt
+        - traefik.http.routers.radarr.entrypoints=websecure
+        - traefik.http.services.movies.loadbalancer.server.port=7878
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.radarr.middlewares=forwardAuth-authentik@file, crowdsec@file
+        - autoheal=true
+      resources:
+        limits:
+          cpus: '2'
+          memory: 512M
+
+  Sonarr:
+    entrypoint:
+      - "/init"
+    environment:
+      - "TZ=PST"
+      - "PUID=0" #1027
+      - "PGID=0" #100
+    image: "linuxserver/sonarr:latest"
+    hostname: tv
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    volumes:
+      - /volume1/Box Office/incomplete:/incomplete
+      - /volume1/Box Office/Drop off:/dropoff
+      - /volume1/TV Shows:/tv
+      - /volume1/docker/Sonarr/config:/config
+    healthcheck:
+      test: curl -fSs http://127.0.0.1:8989 || exit 1
+      start_period: 90s
+      timeout: 5s
+      interval: 5s
+      retries: 3
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.sonarr.rule=Host(`tv.${DOMAIN}`)
+        - traefik.http.routers.sonarr.tls=true
+        - traefik.http.routers.sonarr.tls.certresolver=letsencrypt
+        - traefik.http.routers.sonarr.entrypoints=websecure
+        - traefik.http.services.tv.loadbalancer.server.port=8989
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.sonarr.middlewares=forwardAuth-authentik@file, crowdsec@file
+        - autoheal=true
+      resources:
+        limits:
+          cpus: '2' # Limit to 0.5 CPU core
+          memory: 512M
+
+  TicketBox:
+    cap_add:
+      - NET_ADMIN
+    environment:
+      - "ENABLE_PRIVOXY=no"
+      - "STRICT_PORT_FORWARD=yes"
+      - "PGID=0"
+      - "PUID=0"
+      - "UMASK=000"
+      - "DEBUG=false"
+      - "NAME_SERVERS=1.1.1.1"
+      - "LAN_NETWORK=192.168.0.0/16,10.0.0.0/8,127.0.0.1/32"
+      - "VPN_PROV=custom"
+      - "VPN_ENABLED=yes"
+      - "DELUGE_ENABLE_WEBUI_PASSWORD=no"
+    image: "binhex/arch-delugevpn:latest"
+    hostname: ticketbox
+    networks:
+      - traefik_backend
+    volumes:
+      - /volume1/Box Office/Pick up:/pickup
+      - /volume1/docker/Deluge/config:/config
+      - /volume1/Box Office/incomplete:/incomplete
+      - /volume1/Box Office/Drop off:/dropoff
+      - /dev/net/tun:/dev/net/tun
+    healthcheck:
+      test: curl -fSs http://127.0.0.1:8112 || exit 1
+      start_period: 120s
+      timeout: 5s
+      interval: 5s
+      retries: 3
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.ticketbox.rule=Host(`ticketbox.${DOMAIN}`)
+        - traefik.http.routers.ticketbox.tls=true
+        - traefik.http.routers.ticketbox.tls.certresolver=letsencrypt
+        - traefik.http.routers.ticketbox.entrypoints=websecure
+        - traefik.http.services.ticketbox.loadbalancer.server.port=8112
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.ticketbox.middlewares=forwardAuth-authentik@file, crowdsec@file
+        - autoheal=true
+      resources:
+        limits:
+          cpus: '2'
+          memory: 1G
+
+  Jackett:
+    entrypoint:
+      - "/init"
+    environment:
+      - "TZ=PST"
+      - "PUID=0" #1027
+      - "PGID=0" #100
+    image: "linuxserver/jackett:latest"
+    hostname: jackett
+    networks:
+      - traefik_backend
+    stdin_open: true
+    tty: true
+    volumes:
+      - /volume1/docker/Jackett/config:/config
+      - /volume1/docker/Jackett/downloads:/downloads
+    deploy:
+      endpoint_mode: dnsrr
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.jackett-ip.rule=Host(`jackett.${DOMAIN}`) && ClientIP(`10.0.1.0/16`)
+        - traefik.http.routers.jackett-auth.rule=Host(`jackett.${DOMAIN}`)
+        - traefik.http.routers.jackett-ip.tls=true
+        - traefik.http.routers.jackett-auth.tls=true
+        - traefik.http.routers.jackett-ip.tls.certresolver=letsencrypt
+        - traefik.http.routers.jackett-auth.tls.certresolver=letsencrypt
+        - traefik.http.routers.jackett-ip.entrypoints=websecure
+        - traefik.http.routers.jackett-auth.entrypoints=websecure
+        - traefik.http.services.jackett.loadbalancer.server.port=9117
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.jackett-auth.middlewares=forwardAuth-authentik@file, crowdsec@file
+        - autoheal=true
+      placement:
+         constraints: [node.role == manager]
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 512M
+
+networks:
+  postgresql_db-backend:
+    external: true
+  traefik_backend:
+    external: true
+  host:
+    external: true