Frank
58aa084d9c
Evidence from the failed first cutover: podman top shows container root maps to dank (1000) under UserNS=host rootless (subuid range 100000:65536 cannot express 997), so PUID=997 fell back to root and PMS crash-looped on write access to its 997:984-owned data root. Fleet model instead: PUID=0/ PGID=0 (container root = dank, same as jellyfin/copyparty data roots) and deploy_plex chowns /var/lib/plexmediaserver to 1000:1000 inside the first-cutover block. Zero bytes moved; rollback regains one chown -R 997:984 step, documented in Plex.md. Seam test pins PUID=0/PGID=0 and the absence of any userns key.
54 lines
2.9 KiB
Markdown
54 lines
2.9 KiB
Markdown
# Tautulli
|
|
|
|
Tautulli is the statistics, monitoring, and notification companion for
|
|
Plex Media Server. On Dankserver it runs as a **podman quadlet**
|
|
(`tautulli.service`) under the systemd **user** generator, generated from
|
|
`dankserver/tautulli/quadlet/tautulli.container` — migrated from the snap
|
|
(2026-09; the snap carried zero config, so the cutover was a fresh install).
|
|
|
|
**Host:** Dankserver — **Depends on:** [[Plex]] (it is pointless without
|
|
it; it talks to PMS over the appnet at `http://plex:32400`).
|
|
|
|
## Facts
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Runtime | podman quadlet, `tautulli.service` (user manager) — migrated from snap `snap.tautulli.tautulli.service` |
|
|
| Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls242` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
|
|
| Data root | `/home/dank/Containers/tautulli` bind-mounted as `/config` (fresh at cutover — the snap's `/var/snap/tautulli/common` was empty) |
|
|
| Identity | fleet rootless model — container root maps to the `dank` user (1000:1000) |
|
|
| Port | `8181/tcp` published on `0.0.0.0` |
|
|
| Network | `dankserver_appnet`, alias `tautulli` |
|
|
| PMS URL | `http://plex:32400` — seeded into `config.ini` by the deployer on first start |
|
|
| Health | in-container `python3` probe of `http://localhost:8181/home`, 30 s interval / 3 retries |
|
|
| Deploy | `./scripts/deploy.sh dankserver --service tautulli` |
|
|
| Docs | https://github.com/Tautulli/Tautulli/wiki |
|
|
|
|
## What it buys this fleet
|
|
|
|
- Concurrent-stream dashboard and history: who is watching what, right now,
|
|
on which client — the only tool that answers "is the CPU busy transcoding
|
|
for someone?" without SSHing in.
|
|
- Notifications: library updates, download completions, player watch
|
|
sessions — wire them to whatever notifier the fleet standardizes on
|
|
(Discord/ntfy/Telegram are all one dropdown away).
|
|
- Health signal for the *arr stack downstream: completed downloads that
|
|
never become plays, or streams failing at a fixed bitrate, show up here
|
|
first.
|
|
|
|
## Gotchas
|
|
|
|
1. **Unauthenticated on the LAN.** `0.0.0.0:8181` with no auth wall —
|
|
anyone on the LAN can read the whole watch history. Fine while LAN-only;
|
|
if a public vhost is ever pointed at it, put the Authentik + Anubis
|
|
chain in front first ([[Authentik]], [[Anubis]]).
|
|
2. **First boot shows the setup wizard** — expected pre-token behavior; the
|
|
wizard also answers 200 on `/home`, so the health gate stays green before
|
|
any token exists. Enter the PMS claim token through the web UI after
|
|
cutover; it is stored inside the config bind, never in this repo.
|
|
3. **Snap-era paths are gone.** Logs and config live under the config bind
|
|
(`/home/dank/Containers/tautulli/...`), not `/var/snap/tautulli/common` —
|
|
Grafana/Loki log-shipping paths must account for it ([[Loki]], [[Alloy]]).
|
|
4. **Updates are commit-driven** — pin a new `-ls` tag in the unit file and
|
|
redeploy; never run `:latest`.
|