diff --git a/hieradata/common.yaml b/hieradata/common.yaml
index 050b95e..9021d41 100644
--- a/hieradata/common.yaml
+++ b/hieradata/common.yaml
@@ -158,6 +158,7 @@ profiles::packages::install:
   - curl
   - dstat
   - expect
+  - gcc
   - gzip
   - git
   - htop
@@ -178,8 +179,10 @@ profiles::packages::install:
   - socat
   - strace
   - sysstat
+  - tar
   - tmux
   - traceroute
+  - unar
   - unzip
   - vim
   - vnstat
diff --git a/hieradata/nodes/ausyd1nxvm1037.main.unkin.net.yaml b/hieradata/nodes/ausyd1nxvm1037.main.unkin.net.yaml
new file mode 100644
index 0000000..e12dfe1
--- /dev/null
+++ b/hieradata/nodes/ausyd1nxvm1037.main.unkin.net.yaml
@@ -0,0 +1,7 @@
+---
+networking::interfaces:
+  eth0:
+    ipaddress: 198.18.13.47
+networking::routes:
+  default:
+    gateway: 198.18.13.254
\ No newline at end of file
diff --git a/hieradata/roles/apps/media/sonarr.yaml b/hieradata/roles/apps/media/sonarr.yaml
new file mode 100644
index 0000000..683db99
--- /dev/null
+++ b/hieradata/roles/apps/media/sonarr.yaml
@@ -0,0 +1,55 @@
+---
+hiera_include:
+  - sonarr
+  - profiles::nginx::simpleproxy
+
+# manage sonarr
+sonarr:
+  user: sonarr
+  group: sonarr
+  base_path: /opt/sonarr
+  install_path: /opt/sonarr/bin
+  archive_version: 4.0.5
+  archive_name: Sonarr.main.linux-x64.tar.gz
+  service_enable: true
+  service_name: sonarr
+
+# additional altnames
+profiles::pki::vault::alt_names:
+  - sonarr.main.unkin.net
+  - sonarr.service.consul
+  - sonarr.query.consul
+  - "sonarr.service.%{facts.country}-%{facts.region}.consul"
+
+# manage a simple nginx reverse proxy
+profiles::nginx::simpleproxy::nginx_vhost: 'sonarr.query.consul'
+profiles::nginx::simpleproxy::nginx_aliases:
+  - sonarr.main.unkin.net
+  - sonarr.service.consul
+  - sonarr.query.consul
+  - "sonarr.service.%{facts.country}-%{facts.region}.consul"
+profiles::nginx::simpleproxy::proxy_port: 8989
+profiles::nginx::simpleproxy::proxy_path: '/'
+
+# configure consul service
+nginx::client_max_body_size: 10M
+consul::services:
+  sonarr:
+    service_name: 'sonarr'
+    tags:
+      - 'media'
+      - 'sonarr'
+    address: "%{facts.networking.ip}"
+    port: 443
+    checks:
+      - id: 'sonarr_http_check'
+        name: 'Sonarr HTTP Check'
+        http: "https://%{facts.networking.fqdn}:443"
+        method: 'GET'
+        tls_skip_verify: true
+        interval: '10s'
+        timeout: '1s'
+profiles::consul::client::node_rules:
+  - resource: service
+    segment: sonarr
+    disposition: write
diff --git a/modules/sonarr/manifests/init.pp b/modules/sonarr/manifests/init.pp
new file mode 100644
index 0000000..7dc312b
--- /dev/null
+++ b/modules/sonarr/manifests/init.pp
@@ -0,0 +1,21 @@
+# manage sonarr
+class sonarr (
+  $packages       = $sonarr::params::packages,
+  $user           = $sonarr::params::user,
+  $group          = $sonarr::params::user,
+  $base_path      = $sonarr::params::base_path,
+  $install_path   = $sonarr::params::install_path,
+  $config_folder  = $sonarr::params::config_folder,
+  $app_folder     = $sonarr::params::app_folder,
+  $archive_name   = $sonarr::params::archive_name,
+  $archive_url    = $sonarr::params::archive_url,
+  $executable     = $sonarr::params::executable,
+  $service_enable = $sonarr::params::service_enable,
+  $service_name   = $sonarr::params::service_name,
+) inherits sonarr::params {
+
+  include sonarr::install
+  include sonarr::service
+
+  Class['sonarr::install'] -> Class['sonarr::service']
+}
diff --git a/modules/sonarr/manifests/install.pp b/modules/sonarr/manifests/install.pp
new file mode 100644
index 0000000..0aa2b01
--- /dev/null
+++ b/modules/sonarr/manifests/install.pp
@@ -0,0 +1,58 @@
+# instsall sonarr
+class sonarr::install (
+  $packages      = $sonarr::packages,
+  $user          = $sonarr::user,
+  $group         = $sonarr::user,
+  $base_path     = $sonarr::base_path,
+  $install_path  = $sonarr::install_path,
+  $config_folder = $sonarr::config_folder,
+  $app_folder    = $sonarr::app_folder,
+  $archive_name  = $sonarr::archive_name,
+  $archive_url   = $sonarr::archive_url,
+  $executable    = $sonarr::executable,
+) {
+
+  $_packages = $packages ? {
+    Array   => true,
+    default => false,
+  }
+
+  if $_packages {
+    ensure_packages($packages, {ensure => 'installed'})
+  }
+
+  group { $group:
+    ensure => present,
+  }
+
+  user { $user:
+    ensure     => present,
+    shell      => '/sbin/nologin',
+    groups     => $group,
+    managehome => true,
+  }
+
+  file { [ $base_path, $install_path, $config_folder, $app_folder ]:
+    ensure => directory,
+    owner  => $user,
+    group  => $group,
+  }
+
+  archive { $archive_name:
+    path         => "/tmp/${archive_name}",
+    source       => "${archive_url}${archive_name}",
+    extract      => true,
+    extract_path => $install_path,
+    creates      => "${install_path}/${executable}",
+    cleanup      => true,
+    require      => File[$install_path],
+    user         => $user,
+    group        => $group,
+    notify       => Exec['move_sonarr_files'],
+  }
+
+  exec { 'move_sonarr_files':
+    command => "/usr/bin/mv ${install_path}/NzbDrone/* ${install_path}",
+    creates => "${install_path}/${executable}",
+  }
+}
diff --git a/modules/sonarr/manifests/params.pp b/modules/sonarr/manifests/params.pp
new file mode 100644
index 0000000..339e71d
--- /dev/null
+++ b/modules/sonarr/manifests/params.pp
@@ -0,0 +1,27 @@
+# sonarr params
+class sonarr::params (
+  $packages        = [
+    'mediainfo',
+    'libzen',
+    'libmediainfo',
+    'gettext',
+    'sqlite.x86_64',
+    'par2cmdline',
+    'python3-feedparser',
+    'python3-configobj',
+    'python3-cheetah',
+    'python3-dbus',
+    'libxslt-devel'
+  ],
+  $user            = 'sonarr',
+  $base_path       = '/opt/sonarr',
+  $install_path    = '/opt/sonarr/bin',
+  $config_folder   = "/home/${user}/.config",
+  $app_folder      = "/home/${user}/.config/Sonarr",
+  $archive_version = '4.0.5',
+  $archive_name    = 'Sonarr.main.linux-x64.tar.gz',
+  $archive_url     = "https://git.query.consul/api/packages/unkinben/generic/sonarr/${archive_version}/",
+  $executable      = 'Sonarr/Sonarr',
+  $service_enable  = true,
+  $service_name    = 'sonarr',
+){}
diff --git a/modules/sonarr/manifests/service.pp b/modules/sonarr/manifests/service.pp
new file mode 100644
index 0000000..875440a
--- /dev/null
+++ b/modules/sonarr/manifests/service.pp
@@ -0,0 +1,20 @@
+# manage sonarr service
+class sonarr::service (
+  $service_enable = $sonarr::service_enable,
+  $service_name   = $sonarr::service_name,
+  $user           = $sonarr::user,
+  $group          = $sonarr::user,
+  $install_path   = $sonarr::install_path,
+  $executable     = $sonarr::executable,
+  $base_path      = $sonarr::base_path,
+) {
+  if $service_enable {
+    include ::systemd
+
+    systemd::unit_file { "${service_name}.service":
+      content => template('sonarr/sonarr.service.erb'),
+      enable  => true,
+      active  => true,
+    }
+  }
+}
diff --git a/modules/sonarr/templates/sonarr.service.erb b/modules/sonarr/templates/sonarr.service.erb
new file mode 100644
index 0000000..fa79541
--- /dev/null
+++ b/modules/sonarr/templates/sonarr.service.erb
@@ -0,0 +1,14 @@
+[Unit]
+Description=<%= @service_name %> Daemon
+After=syslog.target network.target
+
+[Service]
+User=<%= @user %>
+Group=<%= @group %>
+Type=simple
+ExecStart=<%= @install_path %>/<%= @executable %> -nobrowser -data=<%= @base_path %>
+KillMode=process
+Restart=on-failure
+TimeoutStopSec=20
+[Install]
+WantedBy=multi-user.target
diff --git a/site/profiles/manifests/base.pp b/site/profiles/manifests/base.pp
index 13d18dd..7eec9ab 100644
--- a/site/profiles/manifests/base.pp
+++ b/site/profiles/manifests/base.pp
@@ -63,7 +63,8 @@ class profiles::base (
     ($hiera_include - $hiera_exclude).include
 
     # specifc ordering constraints
-    Class['profiles::pki::vaultca']
+    Class['profiles::defaults']
+    -> Class['profiles::pki::vaultca']
     -> Class['profiles::base::repos']
     -> Class['profiles::packages']
   }
diff --git a/site/roles/manifests/apps/media/sonarr.pp b/site/roles/manifests/apps/media/sonarr.pp
new file mode 100644
index 0000000..0ceab35
--- /dev/null
+++ b/site/roles/manifests/apps/media/sonarr.pp
@@ -0,0 +1,10 @@
+# sonarr server role
+class roles::apps::media::sonarr {
+  if $facts['firstrun'] {
+    include profiles::defaults
+    include profiles::firstrun::init
+  }else{
+    include profiles::defaults
+    include profiles::base
+  }
+}