From 2523f3ed431dc765b4b363dca0ae784001764021 Mon Sep 17 00:00:00 2001 From: Frank Date: Sat, 29 Aug 2026 02:12:08 -0700 Subject: [PATCH] docs(dankserver): document Plex (native systemd) and Tautulli (snap) as they actually run Live-verified 2026-08-29: plexmediaserver.service is an enabled native systemd unit on Dankserver (not a quadlet; updates via apt, not deploy.sh), and tautulli runs as a snap with no auth wall on 0.0.0.0:8181. The hunt list named both; neither had a page. Index linked per the docs-completeness seam. --- serverAppConfigs-docs/Dankserver/Plex.md | 54 ++++++++++++++++++++ serverAppConfigs-docs/Dankserver/Tautulli.md | 45 ++++++++++++++++ serverAppConfigs-docs/index.md | 2 + 3 files changed, 101 insertions(+) create mode 100644 serverAppConfigs-docs/Dankserver/Plex.md create mode 100644 serverAppConfigs-docs/Dankserver/Tautulli.md diff --git a/serverAppConfigs-docs/Dankserver/Plex.md b/serverAppConfigs-docs/Dankserver/Plex.md new file mode 100644 index 0000000..8d64ac9 --- /dev/null +++ b/serverAppConfigs-docs/Dankserver/Plex.md @@ -0,0 +1,54 @@ +# Plex + +Plex Media Server is the **native (non-container) media server running on +Dankserver**. It is the only media server actually listening on this host: +`plexmediaserver.service` is an OS-package systemd unit +(`/usr/lib/systemd/system/plexmediaserver.service`), enabled and +running — verified live 2026-08-29. Jellyfin, by contrast, is a research +brief on this host, not a running service (see [[Jellyfin]]). + +**Host:** Dankserver — **Ports:** 32400/tcp (PMS web + API), 32400 is the +only port PMS needs for client streaming; LAN clients connect directly, +public traffic can be fronted by Caddy like every other vhost. + +## Facts (live-verified 2026-08-29) + +| Item | Value | +|------|-------| +| Runtime | native systemd service (`plexmediaserver.service`), **not** a podman quadlet | +| State | enabled + running (up since 2026-08-21) | +| Port | `32400/tcp` on `0.0.0.0` | +| Updates | OS package manager (`apt`) — **not** `scripts/deploy.sh`; the deploy flow never touches this service | +| GPU | RTX 3090 present; NVENC hardware transcode needs the NVIDIA driver + Plex Pass (PMS gates HW transcoding behind the paid tier) | +| Docs | https://support.plex.tv | + +## Why it is not a quadlet + +Plex ships as a distro package with its own systemd unit and update +channel; the repo's boot-persistence rule is satisfied by the native unit +(it is `enabled`, so it survives reboot — verify with +`systemctl is-enabled plexmediaserver`). Converting it to a container later +is a migration, not a config edit: the PMS database (`/var/lib/plexmediaserver`) +and its claim-token identity would move with it. + +## Integration points + +- **Caddy:** Plex is exempt from the Anubis bot challenge + (plain-HTTP legacy clients cannot solve JS challenges) — see + [[Anubis]] "Exempt by construction". +- **Tautulli** ([[Tautulli]]) is the companion: it polls PMS on `:32400` + for statistics and notifications and makes no sense without Plex. +- **Auth wall:** if a public vhost is ever pointed at Plex, put the + Authentik outpost + Anubis chain in front of it like every other guarded + vhost ([[Authentik]], [[Caddy]]); direct `:32400` exposure to the LAN is + unauthenticated by design (Plex owns its own auth via claim tokens). + +## Gotchas + +1. **Do not benchmark on it blind.** PMS transcodes contend with the LLM + fleet for the same GPU; stop the service (or pin it to CPU + transcoding) before benchmark runs, per the Benchmarking Policy. +2. **Updates are OS-level** — `apt`/`aptly`, not `deploy.sh`; a deploy + plan that names `plex` is a bug in the plan. +3. The claim token is the identity of this server; document it in the host + `.env`, never in this repo (secret rules apply). diff --git a/serverAppConfigs-docs/Dankserver/Tautulli.md b/serverAppConfigs-docs/Dankserver/Tautulli.md new file mode 100644 index 0000000..31c08be --- /dev/null +++ b/serverAppConfigs-docs/Dankserver/Tautulli.md @@ -0,0 +1,45 @@ +# Tautulli + +Tautulli is the statistics, monitoring, and notification companion for +Plex Media Server. On Dankserver it runs as a **snap** +(`snap.tautulli.tautulli.service`, verified live 2026-08-29) — a third +runtime style on this host alongside podman quadlets and the native Plex +unit. It listens on `8181/tcp` on all interfaces. + +**Host:** Dankserver — **Depends on:** [[Plex]] (it is pointless without +it; it talks to PMS over `:32400` using the same claim token clients use). + +## Facts (live-verified 2026-08-29) + +| Item | Value | +|------|-------| +| Runtime | snap (`snap.tautulli.tautulli.service`) — not a quadlet, not an OS package | +| State | running; snaps self-start at boot (no unit to enable) | +| Port | `8181/tcp` on `0.0.0.0` | +| Updates | `snap refresh tautulli` — the snap store channel is the update path, not `deploy.sh` | +| Docs | https://github.com/Tautulli/Tautulli/wiki | + +## What it buys this fleet + +- Concurrent-stream dashboard and history: who is watching what, right now, + on which client — the only tool that answers "is the 3090 busy + transcoding for someone?" without SSHing in. +- Notifications: library updates, download completions, player watch + sessions — wire them to whatever notifier the fleet standardizes on + (Discord/ntfy/Telegram are all one dropdown away). +- Health signal for the *arr stack downstream: completed downloads that + never become plays, or streams failing at a fixed bitrate, show up here + first. + +## Gotchas + +1. **Unauthenticated on the LAN.** `0.0.0.0:8181` with no auth wall — + anyone on the LAN can read the whole watch history. Fine while LAN-only; + if a public vhost is ever pointed at it, put the Authentik + Anubis + chain in front first ([[Authentik]], [[Anubis]]). +2. **Snap confinement.** Logs live under `/var/snap/tautulli/common`, not + the conventional `/config` path quadlet services use — Grafana/Loki + log-shipping paths must account for it ([[Loki]], [[Alloy]]). +3. If Plex is ever containerized or migrated, Tautulli's claim-token + handling survives (it stores its own copy) but re-verify the PMS URL + and port in its settings immediately after the migration. diff --git a/serverAppConfigs-docs/index.md b/serverAppConfigs-docs/index.md index 28a52f2..d2683be 100644 --- a/serverAppConfigs-docs/index.md +++ b/serverAppConfigs-docs/index.md @@ -49,6 +49,8 @@ covers both workloads). - [[readarr]] — ebook/audiobook management - [[prowlarr]] — indexer management - [[qbittorrent]] — torrent download client +- [[Plex]] — native systemd media server on Dankserver (not a container) +- [[Tautulli]] — Plex statistics and notifications, snap-packaged - [[mariadb]] — RomM database backend - [[redis]] — RomM cache/queue backend