docs(dankserver): document Plex (native systemd) and Tautulli (snap) as they actually run

Live-verified 2026-08-29: plexmediaserver.service is an enabled native systemd unit on Dankserver (not a quadlet; updates via apt, not deploy.sh), and tautulli runs as a snap with no auth wall on 0.0.0.0:8181. The hunt list named both; neither had a page. Index linked per the docs-completeness seam.
2026-08-29 02:12:08 -07:00
parent e006ad1f0f
commit 2523f3ed43
3 changed files with 101 additions and 0 deletions
@@ -0,0 +1,54 @@
+# Plex
+
+Plex Media Server is the **native (non-container) media server running on
+Dankserver**. It is the only media server actually listening on this host:
+`plexmediaserver.service` is an OS-package systemd unit
+(`/usr/lib/systemd/system/plexmediaserver.service`), enabled and
+running — verified live 2026-08-29. Jellyfin, by contrast, is a research
+brief on this host, not a running service (see [[Jellyfin]]).
+
+**Host:** Dankserver — **Ports:** 32400/tcp (PMS web + API), 32400 is the
+only port PMS needs for client streaming; LAN clients connect directly,
+public traffic can be fronted by Caddy like every other vhost.
+
+## Facts (live-verified 2026-08-29)
+
+| Item | Value |
+|------|-------|
+| Runtime | native systemd service (`plexmediaserver.service`), **not** a podman quadlet |
+| State | enabled + running (up since 2026-08-21) |
+| Port | `32400/tcp` on `0.0.0.0` |
+| Updates | OS package manager (`apt`) — **not** `scripts/deploy.sh`; the deploy flow never touches this service |
+| GPU | RTX 3090 present; NVENC hardware transcode needs the NVIDIA driver + Plex Pass (PMS gates HW transcoding behind the paid tier) |
+| Docs | https://support.plex.tv |
+
+## Why it is not a quadlet
+
+Plex ships as a distro package with its own systemd unit and update
+channel; the repo's boot-persistence rule is satisfied by the native unit
+(it is `enabled`, so it survives reboot — verify with
+`systemctl is-enabled plexmediaserver`). Converting it to a container later
+is a migration, not a config edit: the PMS database (`/var/lib/plexmediaserver`)
+and its claim-token identity would move with it.
+
+## Integration points
+
+- **Caddy:** Plex is exempt from the Anubis bot challenge
+  (plain-HTTP legacy clients cannot solve JS challenges) — see
+  [[Anubis]] "Exempt by construction".
+- **Tautulli** ([[Tautulli]]) is the companion: it polls PMS on `:32400`
+  for statistics and notifications and makes no sense without Plex.
+- **Auth wall:** if a public vhost is ever pointed at Plex, put the
+  Authentik outpost + Anubis chain in front of it like every other guarded
+  vhost ([[Authentik]], [[Caddy]]); direct `:32400` exposure to the LAN is
+  unauthenticated by design (Plex owns its own auth via claim tokens).
+
+## Gotchas
+
+1. **Do not benchmark on it blind.** PMS transcodes contend with the LLM
+   fleet for the same GPU; stop the service (or pin it to CPU
+   transcoding) before benchmark runs, per the Benchmarking Policy.
+2. **Updates are OS-level** — `apt`/`aptly`, not `deploy.sh`; a deploy
+   plan that names `plex` is a bug in the plan.
+3. The claim token is the identity of this server; document it in the host
+   `.env`, never in this repo (secret rules apply).
@@ -0,0 +1,45 @@
+# Tautulli
+
+Tautulli is the statistics, monitoring, and notification companion for
+Plex Media Server. On Dankserver it runs as a **snap**
+(`snap.tautulli.tautulli.service`, verified live 2026-08-29) — a third
+runtime style on this host alongside podman quadlets and the native Plex
+unit. It listens on `8181/tcp` on all interfaces.
+
+**Host:** Dankserver — **Depends on:** [[Plex]] (it is pointless without
+it; it talks to PMS over `:32400` using the same claim token clients use).
+
+## Facts (live-verified 2026-08-29)
+
+| Item | Value |
+|------|-------|
+| Runtime | snap (`snap.tautulli.tautulli.service`) — not a quadlet, not an OS package |
+| State | running; snaps self-start at boot (no unit to enable) |
+| Port | `8181/tcp` on `0.0.0.0` |
+| Updates | `snap refresh tautulli` — the snap store channel is the update path, not `deploy.sh` |
+| Docs | https://github.com/Tautulli/Tautulli/wiki |
+
+## What it buys this fleet
+
+- Concurrent-stream dashboard and history: who is watching what, right now,
+  on which client — the only tool that answers "is the 3090 busy
+  transcoding for someone?" without SSHing in.
+- Notifications: library updates, download completions, player watch
+  sessions — wire them to whatever notifier the fleet standardizes on
+  (Discord/ntfy/Telegram are all one dropdown away).
+- Health signal for the *arr stack downstream: completed downloads that
+  never become plays, or streams failing at a fixed bitrate, show up here
+  first.
+
+## Gotchas
+
+1. **Unauthenticated on the LAN.** `0.0.0.0:8181` with no auth wall —
+   anyone on the LAN can read the whole watch history. Fine while LAN-only;
+   if a public vhost is ever pointed at it, put the Authentik + Anubis
+   chain in front first ([[Authentik]], [[Anubis]]).
+2. **Snap confinement.** Logs live under `/var/snap/tautulli/common`, not
+   the conventional `/config` path quadlet services use — Grafana/Loki
+   log-shipping paths must account for it ([[Loki]], [[Alloy]]).
+3. If Plex is ever containerized or migrated, Tautulli's claim-token
+   handling survives (it stores its own copy) but re-verify the PMS URL
+   and port in its settings immediately after the migration.