# Quadlet media migration notes

Use this when migrating or repairing media services on Dankserver or standardizing remaining compose services.

General rules:
- Prefer Quadlet .container units for boot persistence.
- Use bind mounts only for durable state.
- Linux data root standard: /home/dank/Containers/<svc>, unless a service intentionally uses an in-place legacy root.
- Use UserNS=host in Quadlet when host UID/GID behavior matters; do not use compose-style UsernsMode=.
- Stop/mask old native units or disable old snaps only after verifying rollback path.

Plex/Tautulli known-good design:
- Plex image: lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322.
- Tautulli image: lscr.io/linuxserver/tautulli:v2.18.1-ls242.
- Network: dankserver_appnet, aliases plex and tautulli.
- Ports: Plex 32400:32400, Tautulli 8181:8181.
- Plex volumes: /var/lib/plexmediaserver:/config rw and /mnt/entropy:/mnt/entropy:ro.
- Tautulli volume: /home/dank/Containers/tautulli:/config.
- Plex rootless mapping: UserNS=host, PUID=0, PGID=0, data root chowned to 1000:1000. Rollback chown is 997:984.
- Tautulli: PUID=1000, PGID=1000.
- Tautulli seed: PMS_Web_Host=plex, PMS_Web_Port=32400, PMS_Secure=0.
- Plex health gate should be generous, around 600 seconds, because large DB migrations can cold-load slowly.

Copyparty/Jellyfin caution:
- User directive after verification: stop touching Jellyfin/Copyparty unless explicitly asked.
- Jellyfin mount verified: /mnt/entropy:/data:ro. DB table is BaseItems.
- Copyparty must be read-only for broad web/LAN access. Bare A in copyparty means everyone full access. Read-only permission shape is r for anonymous and ra,dank for admin browsing, without write/move/delete perms.

Before decommission:
- Do not apt purge plexmediaserver or snap remove tautulli without explicit sign-off.
- Keep rollback steps documented before deleting old service data or packages.