docs(dankserver): document Plex (native systemd) and Tautulli (snap) as they actually run

Live-verified 2026-08-29: plexmediaserver.service is an enabled native systemd unit on Dankserver (not a quadlet; updates via apt, not deploy.sh), and tautulli runs as a snap with no auth wall on 0.0.0.0:8181. The hunt list named both; neither had a page. Index linked per the docs-completeness seam.
2026-08-29 02:12:08 -07:00
parent e006ad1f0f
commit 2523f3ed43
3 changed files with 101 additions and 0 deletions
@@ -0,0 +1,45 @@
+# Tautulli
+
+Tautulli is the statistics, monitoring, and notification companion for
+Plex Media Server. On Dankserver it runs as a **snap**
+(`snap.tautulli.tautulli.service`, verified live 2026-08-29) — a third
+runtime style on this host alongside podman quadlets and the native Plex
+unit. It listens on `8181/tcp` on all interfaces.
+
+**Host:** Dankserver — **Depends on:** [[Plex]] (it is pointless without
+it; it talks to PMS over `:32400` using the same claim token clients use).
+
+## Facts (live-verified 2026-08-29)
+
+| Item | Value |
+|------|-------|
+| Runtime | snap (`snap.tautulli.tautulli.service`) — not a quadlet, not an OS package |
+| State | running; snaps self-start at boot (no unit to enable) |
+| Port | `8181/tcp` on `0.0.0.0` |
+| Updates | `snap refresh tautulli` — the snap store channel is the update path, not `deploy.sh` |
+| Docs | https://github.com/Tautulli/Tautulli/wiki |
+
+## What it buys this fleet
+
+- Concurrent-stream dashboard and history: who is watching what, right now,
+  on which client — the only tool that answers "is the 3090 busy
+  transcoding for someone?" without SSHing in.
+- Notifications: library updates, download completions, player watch
+  sessions — wire them to whatever notifier the fleet standardizes on
+  (Discord/ntfy/Telegram are all one dropdown away).
+- Health signal for the *arr stack downstream: completed downloads that
+  never become plays, or streams failing at a fixed bitrate, show up here
+  first.
+
+## Gotchas
+
+1. **Unauthenticated on the LAN.** `0.0.0.0:8181` with no auth wall —
+   anyone on the LAN can read the whole watch history. Fine while LAN-only;
+   if a public vhost is ever pointed at it, put the Authentik + Anubis
+   chain in front first ([[Authentik]], [[Anubis]]).
+2. **Snap confinement.** Logs live under `/var/snap/tautulli/common`, not
+   the conventional `/config` path quadlet services use — Grafana/Loki
+   log-shipping paths must account for it ([[Loki]], [[Alloy]]).
+3. If Plex is ever containerized or migrated, Tautulli's claim-token
+   handling survives (it stores its own copy) but re-verify the PMS URL
+   and port in its settings immediately after the migration.