docs: add migration guide (#2069)

.gitignore

@@ -71,3 +71,6 @@ tsconfig.tsbuildinfo
 
 # Config Cache Directory
 config/cache
+
+# Docker compose
+compose.override.yaml

charts/seerr-chart/README.md

@@ -28,7 +28,7 @@ Refer to [https://docs.seerr.dev/getting-started/kubernetes](Seerr kubernetes do
 
 ### Updating to 3.0.0
 
-Nothing has changed; we just rebranded the `jellyseerr` Helm chart to `seerr` 🥳.
+Nothing has changed; we just rebranded the `jellyseerr` Helm chart to `seerr` 🥳 refer to our [Migration guide](https://docs.seerr.dev/migration-guide).
 
 ### Updating to 2.7.0
 
@@ -70,12 +70,20 @@ If `replicaCount` value was used - remove it. Helm update should work fine after
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |
 | podLabels | object | `{}` |  |
-| podSecurityContext | object | `{}` |  |
+| podSecurityContext.fsGroup | int | `1000` |  |
+| podSecurityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` |  |
 | probes.livenessProbe | object | `{}` | Configure liveness probe |
 | probes.readinessProbe | object | `{}` | Configure readiness probe |
 | probes.startupProbe | string | `nil` | Configure startup probe |
 | resources | object | `{}` |  |
-| securityContext | object | `{}` |  |
+| securityContext.allowPrivilegeEscalation | bool | `false` |  |
+| securityContext.capabilities.drop[0] | string | `"ALL"` |  |
+| securityContext.privileged | bool | `false` |  |
+| securityContext.readOnlyRootFilesystem | bool | `false` |  |
+| securityContext.runAsGroup | int | `1000` |  |
+| securityContext.runAsNonRoot | bool | `true` |  |
+| securityContext.runAsUser | int | `1000` |  |
+| securityContext.seccompProfile.type | string | `"RuntimeDefault"` |  |
 | service.port | int | `80` |  |
 | service.type | string | `"ClusterIP"` |  |
 | serviceAccount.annotations | object | `{}` | Annotations to add to the service account |

charts/seerr-chart/README.md.gotmpl

@@ -22,7 +22,7 @@ Refer to [https://docs.seerr.dev/getting-started/kubernetes](Seerr kubernetes do
 
 ### Updating to 3.0.0
 
-Nothing has changed; we just rebranded the `jellyseerr` Helm chart to `seerr` 🥳.
+Nothing has changed; we just rebranded the `jellyseerr` Helm chart to `seerr` 🥳 refer to our [Migration guide](https://docs.seerr.dev/migration-guide).
 
 ### Updating to 2.7.0
 

charts/seerr-chart/values.yaml

@@ -50,16 +50,22 @@ serviceAccount:
 podAnnotations: {}
 podLabels: {}
 
-podSecurityContext: {}
+podSecurityContext:
-# fsGroup: 2000
+  fsGroup: 1000
+  fsGroupChangePolicy: OnRootMismatch
 
-securityContext: {}
+securityContext:
-# capabilities:
+  allowPrivilegeEscalation: false
-#   drop:
+  capabilities:
-#   - ALL
+    drop:
-# readOnlyRootFilesystem: true
+      - ALL
-# runAsNonRoot: true
+  readOnlyRootFilesystem: false
-# runAsUser: 1000
+  runAsNonRoot: true
+  privileged: false
+  runAsUser: 1000
+  runAsGroup: 1000
+  seccompProfile:
+    type: RuntimeDefault
 
 service:
   type: ClusterIP

docs/migration-guide.mdx

@@ -0,0 +1,168 @@
+---
+title: Migration guide
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+Whether you come from Overseerr or Jellyseerr, you don't need to perform any manual migration steps, your instance will automatically be migrated to Seerr.
+This migration will run automatically the first time you start your instance using the Seerr codebase (Docker image or source build or Kubernetes, etc.).
+An additional migration will happen for Overseerr users, to migrate their configuration to the new codebase.
+
+:::warning
+Before doing anything you should backup your existing instance so that you can rollback in case something goes wrong.
+See [Backups](/using-seerr/backups) for details on how to properly backup your instance.
+:::
+
+## Docker
+Refer to [Seerr Docker Documentation](/getting-started/docker), all of our examples have been updated to reflect the below change.
+
+Changes :
+- Renamed all references from `overseerr` or `jellyseerr` to `seerr`.
+- The container image reference has been updated.
+- The container can now be run as a non-root user (`node` user); remove the `user` directive if you have configured it.
+- The container no longer provides an init process, so you must configure it by adding `init: true` for Docker Compose or `--init` for the Docker CLI.
+
+:::info
+**Config folder permissions**: Since the container now runs as the `node` user (UID 1000), you must ensure your config folder has the correct permissions. The `node` user must have read and write access to the `/app/config` directory.
+
+If you're migrating from a previous installation, you may need to update the ownership of your config folder:
+```bash
+sudo chown -R 1000:1000 /path/to/appdata/config
+```
+
+This ensures the `node` user (UID 1000) owns the config directory and can read and write to it.
+:::
+
+### Unix
+
+Summary of changes :
+<Tabs groupId="docker-methods" queryString>
+  <TabItem value="docker-compose" label="Docker compose">
+  ```yaml {3-6}
+  ---
+  services:
+    seerr:
+      image: ghcr.io/seerr-team/seerr:latest
+      init: true
+      container_name: seerr
+      environment:
+        - LOG_LEVEL=debug
+        - TZ=Asia/Tashkent
+        - PORT=5055 #optional
+      ports:
+        - 5055:5055
+      volumes:
+        - /path/to/appdata/config:/app/config
+      healthcheck:
+        test: wget --no-verbose --tries=1 --spider http://localhost:5055/api/v1/status || exit 1
+        start_period: 20s
+        timeout: 3s
+        interval: 15s
+        retries: 3
+      restart: unless-stopped
+  ```
+  </TabItem>
+  <TabItem value="docker-cli" label="Docker CLI">
+  ```bash {2-3,10}
+  docker run -d \
+    --name seerr \
+    --init \
+    -e LOG_LEVEL=debug \
+    -e TZ=Asia/Tashkent \
+    -e PORT=5055 \
+    -p 5055:5055 \
+    -v /path/to/appdata/config:/app/config \
+    --restart unless-stopped \
+    ghcr.io/seerr-team/seerr:latest
+  ```
+  </TabItem>
+</Tabs>
+
+### Windows
+Summary of changes :
+<Tabs groupId="docker-methods" queryString>
+  <TabItem value="docker-compose" label="Docker compose">
+  ```yaml {3-6,13,23}
+  ---
+  services:
+    seerr:
+      image: ghcr.io/seerr-team/seerr:latest
+      init: true
+      container_name: seerr
+      environment:
+        - LOG_LEVEL=debug
+        - TZ=Asia/Tashkent
+      ports:
+        - 5055:5055
+      volumes:
+        - seerr-data:/app/config
+      healthcheck:
+        test: wget --no-verbose --tries=1 --spider http://localhost:5055/api/v1/status || exit 1
+        start_period: 20s
+        timeout: 3s
+        interval: 15s
+        retries: 3
+      restart: unless-stopped
+
+  volumes:
+    seerr-data:
+      external: true
+  ```
+  </TabItem>
+  <TabItem value="docker-cli" label="Docker CLI">
+  ```bash {2-3,8,10}
+  docker run -d \
+    --name seerr \
+    --init \
+    -e LOG_LEVEL=debug \
+    -e TZ=Asia/Tashkent \
+    -e PORT=5055 \
+    -p 5055:5055 \
+    -v seerr-data:/app/config \
+    --restart unless-stopped \
+    ghcr.io/seerr-team/seerr:latest
+  ```
+  </TabItem>
+</Tabs>
+
+## Kubernetes
+Refer to [Seerr Kubernetes Documentation](/getting-started/kubernetes), all of our examples have been updated to reflect the below change.
+
+Changes :
+- All references to `jellyseerr` have been renamed to `seerr` in the manifests.
+- The container image reference has been updated.
+- The default `securityContext` and `podSecurityContext` have been updated to support running the container without root permissions.
+
+Summary of changes :
+<Tabs groupId="kubernetes-values" queryString>
+  <TabItem value="old" label="Old values">
+  ```yaml
+  image:
+    repository: fallenbagel/jellyseerr
+  podSecurityContext: {}
+  securityContext: {}
+  ```
+  </TabItem>
+  <TabItem value="new" label="New values">
+  ```yaml
+  image:
+    repository: seerr-team/seerr
+  podSecurityContext:
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    readOnlyRootFilesystem: false
+    runAsNonRoot: true
+    privileged: false
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: RuntimeDefault
+  ```
+  </TabItem>
+</Tabs>