Frank
1939135e4c
podman 5.7 podman-user-generator on dankserver hard-fails the whole unit on
the unknown key ('unsupported key UsernsMode in group Container'), so the
first cutover attempt masked the native unit and then found no plex.service
at all. Swap both units to UserNS=host (same --userns=host flag), update the
ownership-contract seam test to pin the exact key, and correct both docs.
Pin the seam: the v1 generator rejects unknown Container keys silently at
deploy distance — the test now pins UserNS=, not the misspelled alias.
54 lines
2.9 KiB
Markdown
54 lines
2.9 KiB
Markdown
# Tautulli
|
|
|
|
Tautulli is the statistics, monitoring, and notification companion for
|
|
Plex Media Server. On Dankserver it runs as a **podman quadlet**
|
|
(`tautulli.service`) under the systemd **user** generator, generated from
|
|
`dankserver/tautulli/quadlet/tautulli.container` — migrated from the snap
|
|
(2026-09; the snap carried zero config, so the cutover was a fresh install).
|
|
|
|
**Host:** Dankserver — **Depends on:** [[Plex]] (it is pointless without
|
|
it; it talks to PMS over the appnet at `http://plex:32400`).
|
|
|
|
## Facts
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Runtime | podman quadlet, `tautulli.service` (user manager) — migrated from snap `snap.tautulli.tautulli.service` |
|
|
| Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls242` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
|
|
| Data root | `/home/dank/Containers/tautulli` bind-mounted as `/config` (fresh at cutover — the snap's `/var/snap/tautulli/common` was empty) |
|
|
| Identity | `UserNS=host` (quadlet key for `--userns=host`) + `PUID=1000 PGID=1000` |
|
|
| Port | `8181/tcp` published on `0.0.0.0` |
|
|
| Network | `dankserver_appnet`, alias `tautulli` |
|
|
| PMS URL | `http://plex:32400` — seeded into `config.ini` by the deployer on first start |
|
|
| Health | in-container `python3` probe of `http://localhost:8181/home`, 30 s interval / 3 retries |
|
|
| Deploy | `./scripts/deploy.sh dankserver --service tautulli` |
|
|
| Docs | https://github.com/Tautulli/Tautulli/wiki |
|
|
|
|
## What it buys this fleet
|
|
|
|
- Concurrent-stream dashboard and history: who is watching what, right now,
|
|
on which client — the only tool that answers "is the CPU busy transcoding
|
|
for someone?" without SSHing in.
|
|
- Notifications: library updates, download completions, player watch
|
|
sessions — wire them to whatever notifier the fleet standardizes on
|
|
(Discord/ntfy/Telegram are all one dropdown away).
|
|
- Health signal for the *arr stack downstream: completed downloads that
|
|
never become plays, or streams failing at a fixed bitrate, show up here
|
|
first.
|
|
|
|
## Gotchas
|
|
|
|
1. **Unauthenticated on the LAN.** `0.0.0.0:8181` with no auth wall —
|
|
anyone on the LAN can read the whole watch history. Fine while LAN-only;
|
|
if a public vhost is ever pointed at it, put the Authentik + Anubis
|
|
chain in front first ([[Authentik]], [[Anubis]]).
|
|
2. **First boot shows the setup wizard** — expected pre-token behavior; the
|
|
wizard also answers 200 on `/home`, so the health gate stays green before
|
|
any token exists. Enter the PMS claim token through the web UI after
|
|
cutover; it is stored inside the config bind, never in this repo.
|
|
3. **Snap-era paths are gone.** Logs and config live under the config bind
|
|
(`/home/dank/Containers/tautulli/...`), not `/var/snap/tautulli/common` —
|
|
Grafana/Loki log-shipping paths must account for it ([[Loki]], [[Alloy]]).
|
|
4. **Updates are commit-driven** — pin a new `-ls` tag in the unit file and
|
|
redeploy; never run `:latest`.
|