deployer: route plex and tautulli as dankserver quadlet services

- deploy_plex(): install unit, stop+mask native plexmediaserver.service on
  first cutover (mask, never disable), gate on /identity for 180s
- deploy_tautulli(): install unit, stop+disable snap on first cutover,
  seed config.ini with PMS_Web_Host=plex only if absent
- allow-lists (deploy.sh valid_service, deploy-remote.sh service_is_allowed),
  planner routing (SERVICE_ORDER, DANKSERVER_SERVICES, quadlet_services),
  test-changed cutover case, quadlet seam enumeration + new
  userns/PUID=997/PGID=984 ownership-contract test

scripts/deploy-plan.py

@@ -50,6 +50,8 @@ SERVICE_ORDER = (
     "copyparty",
     "jellyfin",
     "calibre-web",
+    "plex",
+    "tautulli",
     "prowlarr",
     "qbittorrent",
     "radarr",
@@ -99,6 +101,8 @@ DANKSERVER_SERVICES = {
     "copyparty",
     "jellyfin",
     "calibre-web",
+    "plex",
+    "tautulli",
     "prowlarr",
     "qbittorrent",
     "radarr",
@@ -329,6 +333,8 @@ def services_for_path(path: str, target: str) -> set[str]:
                 "jellyfin": {"jellyfin"},
                 "calibre-web": {"calibre-web"},
                 "copyparty": {"copyparty"},
+                "plex": {"plex"},
+                "tautulli": {"tautulli"},
             }
             _add(services, *quadlet_services.get(parts[1], set()))
         return services

scripts/deploy-remote.sh

@@ -93,7 +93,7 @@ service_is_allowed() {
         dankclaw:frank-default-large|dankclaw:frank-default-npu|\
         dankclaw:frank-default-sightsound|\
         dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
-        dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|\
+        dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:plex|dankserver:tautulli|\
         dankserver:prowlarr|dankserver:qbittorrent|dankserver:radarr|\
         dankserver:sonarr|dankserver:lidarr|dankserver:readarr|\
         dankserver:frank-default-small|\
@@ -666,6 +666,43 @@ deploy_copyparty() {
     systemctl --user restart copyparty.service
 }
 
+deploy_plex() {
+    cp "dankserver/plex/quadlet/plex.container" "$quadlet_unit_dir/"
+    systemctl --user daemon-reload
+    if ! systemctl --user is-active -q plex.service; then
+        # First cutover: retire the native package unit BEFORE starting the
+        # container — both cannot own 32400. Mask (not disable): on these hosts
+        # `systemctl disable` deletes the unit file itself; mask keeps an
+        # instant byte-safe rollback while nothing is signed off yet.
+        run_privileged systemctl stop plexmediaserver.service
+        run_privileged systemctl mask plexmediaserver.service
+    fi
+    systemctl --user restart plex.service
+    # Readiness gate: /identity answers MediaContainer XML once PMS is up;
+    # fail the deploy (pending state preserved) rather than mark it deployed blind.
+    for ((i = 1; i <= 36; i++)); do
+        curl -fsS --max-time 3 http://127.0.0.1:32400/identity >/dev/null && return 0
+        sleep 5
+    done
+    echo "FAIL: plex did not answer /identity within 180s" >&2
+    return 1
+}
+
+deploy_tautulli() {
+    cp "dankserver/tautulli/quadlet/tautulli.container" "$quadlet_unit_dir/"
+    systemctl --user daemon-reload
+    if ! systemctl --user is-active -q tautulli.service; then
+        run_privileged snap stop tautulli || true
+        run_privileged snap disable tautulli || true
+        mkdir -p /home/dank/Containers/tautulli/config
+        if [[ ! -f /home/dank/Containers/tautulli/config/config.ini ]]; then
+            printf '[General]\nPMS_Web_Host = plex\nPMS_Web_Port = 32400\nPMS_Secure = 0\n' \
+                > /home/dank/Containers/tautulli/config/config.ini
+        fi
+    fi
+    systemctl --user restart tautulli.service
+}
+
 deploy_authentik() {
     local unit
     mkdir -p "$quadlet_unit_dir"
@@ -1009,6 +1046,8 @@ deploy_service() {
         jellyfin) deploy_jellyfin ;;
         calibre-web) deploy_calibre_web ;;
         copyparty) deploy_copyparty ;;
+        plex) deploy_plex ;;
+        tautulli) deploy_tautulli ;;
         *) deploy_compose_service "$service" ;;
     esac
 }

scripts/deploy.sh

@@ -137,7 +137,7 @@ valid_service() {
         dankclaw:frank-default-large|dankclaw:frank-default-npu|\
         dankclaw:frank-default-sightsound|\
         dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
-        dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\
+        dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:plex|dankserver:tautulli|\
         dankserver:qbittorrent|dankserver:radarr|dankserver:sonarr|\
         dankserver:lidarr|dankserver:readarr|dankserver:node-exporter|\
         dankserver:frank-default-small|\

scripts/test-changed.sh

@@ -209,9 +209,9 @@ for path in "${CHANGED[@]}"; do
             add_test tests/scripts_syntax.bats
             ;;
         # Cutover-era dankserver quadlet units (romm trio, jellyfin, calibre-web,
-        # copyparty): the seam checks boot-persistence + v1-generator contract;
-        # deploy-flow seams guard the deployer routing that installs them.
-        dankserver/romm/*|dankserver/jellyfin/*|dankserver/calibre-web/*|dankserver/copyparty/*)
+        # copyparty, plex, tautulli): the seam checks boot-persistence +
+        # v1-generator contract; deploy-flow seams guard the deployer routing.
+        dankserver/romm/*|dankserver/jellyfin/*|dankserver/calibre-web/*|dankserver/copyparty/*|dankserver/plex/*|dankserver/tautulli/*)
             add_test tests/dankserver_quadlet.bats
             add_test tests/deployment_flow.bats
             add_test tests/deployment_scoping.bats