Frank
1939135e4c
podman 5.7 podman-user-generator on dankserver hard-fails the whole unit on
the unknown key ('unsupported key UsernsMode in group Container'), so the
first cutover attempt masked the native unit and then found no plex.service
at all. Swap both units to UserNS=host (same --userns=host flag), update the
ownership-contract seam test to pin the exact key, and correct both docs.
Pin the seam: the v1 generator rejects unknown Container keys silently at
deploy distance — the test now pins UserNS=, not the misspelled alias.
2.9 KiB
2.9 KiB
Tautulli
Tautulli is the statistics, monitoring, and notification companion for
Plex Media Server. On Dankserver it runs as a podman quadlet
(tautulli.service) under the systemd user generator, generated from
dankserver/tautulli/quadlet/tautulli.container — migrated from the snap
(2026-09; the snap carried zero config, so the cutover was a fresh install).
Host: Dankserver — Depends on: Plex (it is pointless without
it; it talks to PMS over the appnet at http://plex:32400).
Facts
| Item | Value |
|---|---|
| Runtime | podman quadlet, tautulli.service (user manager) — migrated from snap snap.tautulli.tautulli.service |
| Image | lscr.io/linuxserver/tautulli:v2.18.1-ls242 (pinned; verified == the ghcr latest manifest digest at pin time) |
| Data root | /home/dank/Containers/tautulli bind-mounted as /config (fresh at cutover — the snap's /var/snap/tautulli/common was empty) |
| Identity | UserNS=host (quadlet key for --userns=host) + PUID=1000 PGID=1000 |
| Port | 8181/tcp published on 0.0.0.0 |
| Network | dankserver_appnet, alias tautulli |
| PMS URL | http://plex:32400 — seeded into config.ini by the deployer on first start |
| Health | in-container python3 probe of http://localhost:8181/home, 30 s interval / 3 retries |
| Deploy | ./scripts/deploy.sh dankserver --service tautulli |
| Docs | https://github.com/Tautulli/Tautulli/wiki |
What it buys this fleet
- Concurrent-stream dashboard and history: who is watching what, right now, on which client — the only tool that answers "is the CPU busy transcoding for someone?" without SSHing in.
- Notifications: library updates, download completions, player watch sessions — wire them to whatever notifier the fleet standardizes on (Discord/ntfy/Telegram are all one dropdown away).
- Health signal for the *arr stack downstream: completed downloads that never become plays, or streams failing at a fixed bitrate, show up here first.
Gotchas
- Unauthenticated on the LAN.
0.0.0.0:8181with no auth wall — anyone on the LAN can read the whole watch history. Fine while LAN-only; if a public vhost is ever pointed at it, put the Authentik + Anubis chain in front first (Authentik, Anubis). - First boot shows the setup wizard — expected pre-token behavior; the
wizard also answers 200 on
/home, so the health gate stays green before any token exists. Enter the PMS claim token through the web UI after cutover; it is stored inside the config bind, never in this repo. - Snap-era paths are gone. Logs and config live under the config bind
(
/home/dank/Containers/tautulli/...), not/var/snap/tautulli/common— Grafana/Loki log-shipping paths must account for it (Loki, Alloy). - Updates are commit-driven — pin a new
-lstag in the unit file and redeploy; never run:latest.