From 3511e04ae92f09d94ddae4915c93c74cd977279b Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 3 Nov 2026 03:27:48 -0800 Subject: [PATCH] docs(jellyfin): record the API-key ledger and the rotation door --- serverAppConfigs-docs/Dankserver/Jellyfin.md | 26 +++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/serverAppConfigs-docs/Dankserver/Jellyfin.md b/serverAppConfigs-docs/Dankserver/Jellyfin.md index 2aff1db..ab0851a 100644 --- a/serverAppConfigs-docs/Dankserver/Jellyfin.md +++ b/serverAppConfigs-docs/Dankserver/Jellyfin.md @@ -3,7 +3,7 @@ type: reference title: Jellyfin description: "Jellyfin on Dankserver: quadlet unit, overlay metadata view, provider keys, ports, access, transcode status." tags: [jellyfin, dankserver, media-server] -timestamp: 2026-11-02T11:00:00Z +timestamp: 2026-11-03T11:40:00Z --- # Jellyfin @@ -383,6 +383,30 @@ folder created under `/data/Movies`: it stays invisible until a recursive refres names it. So every pass that writes into a library ends by firing one, and "Jellyfin does not see the file I just moved in" is the designed answer, not a fault to chase. +## API-key ledger and rotation + +`/Auth/Keys` is the ledger. `GET` lists every key **with its `AccessToken` in +cleartext**, so an admin token in hand prints the whole fleet's keys; +`POST /Auth/Keys?app=` mints one and answers `204` **with no body** — the +new token is read back from the `GET`, never from the create response. +`DELETE /Auth/Keys/{token}` revokes **by the token string**, and a parameter that +matches nothing answers `204` too, so `204` there is not proof anything was +removed. Discover a route's verb from the `Allow` header of an `OPTIONS` (or +`GET`) response — never by firing `DELETE` at a guess. + +- `IsActive` reads `False` on rows that authenticate `200`. It is not a usability + signal; only an authenticated request is. +- `DateLastActivity` never moves off `0001-01-01` on 12.4, so "is this key in + use?" cannot be answered from the ledger. The census is repo + host credential + stores + the `Devices` table (whose `DateLastActivity` *is* real). +- Rotation order: mint → rewrite **both** stores (`~/.config/secrets/jellyfin` + and `JELLYFIN_API_KEY` in the ignored `dankserver/.env`) → prove the new key on + `/System/Info` → `DELETE` the old token → prove `401`. Revoking while a store + still holds that value breaks the scan door silently. +- Blast radius as measured 2026-11-03: no repo script reads `JELLYFIN_API_KEY`; + Seerr keeps a key of its own in its own DB (which of its two rows it uses was + never confirmed), so revoke by token and never by app name. + ## See Also - [[Plex]] — co-resident media server on the same volume