diff --git a/nixos/boxes/colony/vms/shill/containers/jackflix/default.nix b/nixos/boxes/colony/vms/shill/containers/jackflix/default.nix
index fed08cc..7c6b330 100644
--- a/nixos/boxes/colony/vms/shill/containers/jackflix/default.nix
+++ b/nixos/boxes/colony/vms/shill/containers/jackflix/default.nix
@@ -32,11 +32,37 @@
               key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzzAqa4821NlYfALYOlvR7YlOgxNuulTWo9Vm5L1mNU";
             };
           };
+
+          users = {
+            groups.media = {};
+            users = {
+              radarr.extraGroups = [ "media" ];
+            };
+          };
+
+          systemd = {
+            services = {
+              radarr.serviceConfig.UMask = "0002";
+            };
+          };
+
+          services = {
+            jackett = {
+              enable = true;
+              openFirewall = true;
+            };
+            radarr = {
+              enable = true;
+              openFirewall = true;
+            };
+          };
         }
         (mkIf config.my.build.isDevVM {
           virtualisation = {
             forwardPorts = [
-              { from = "host"; host.port = 8080; guest.port = 80; }
+              { from = "host"; host.port = 9117; guest.port = 9117; }
+              { from = "host"; host.port = 7878; guest.port = 7878; }
+              { from = "host"; host.port = 8989; guest.port = 8989; }
             ];
           };
         })
diff --git a/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix b/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
index f3cf3d2..dfb5d0a 100644
--- a/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
+++ b/nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix
@@ -152,6 +152,32 @@ in
         ];
         useACMEHost = lib.my.pubDomain;
       };
+
+      "jackett.${lib.my.pubDomain}" = mkMerge [
+        {
+          locations."/" = mkMerge [
+            {
+              proxyPass = "http://jackflix-ctr.${config.networking.domain}:9117";
+            }
+            (ssoLoc "generic")
+          ];
+          useACMEHost = lib.my.pubDomain;
+        }
+        (ssoServer "generic")
+      ];
+      "radarr-test.${lib.my.pubDomain}" = mkMerge [
+        {
+          locations."/" = mkMerge [
+            {
+              proxyPass = "http://jackflix-ctr.${config.networking.domain}:7878";
+              proxyWebsockets = true;
+            }
+            (ssoLoc "generic")
+          ];
+          useACMEHost = lib.my.pubDomain;
+        }
+        (ssoServer "generic")
+      ];
     };
   in
   mkMerge [
diff --git a/nixos/modules/tmproot.nix b/nixos/modules/tmproot.nix
index 5644962..d5ef8d0 100644
--- a/nixos/modules/tmproot.nix
+++ b/nixos/modules/tmproot.nix
@@ -267,6 +267,22 @@ in
           }
         ];
       })
+      (mkIf config.services.radarr.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/var/lib/radarr";
+            inherit (config.services.radarr) user group;
+          }
+        ];
+      })
+      (mkIf config.services.sonarr.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/var/lib/sonarr";
+            inherit (config.services.sonarr) user group;
+          }
+        ];
+      })
       (mkIf config.my.build.isDevVM {
         fileSystems = mkVMOverride {
           # Hijack the "root" device for persistence in the VM