Frank
592a0baa35
- runtime rows: podman quadlet under the systemd user generator, pinned image digests, in-place bind mounts, identity model, appnet aliases - cutover/rollback section on Plex.md (mask-native-unit lever, decommission gate); drop the false 'updates are apt-only' and 'snap refresh' gotchas - update path is now deploy.sh dankserver --service plex|tautulli
2.8 KiB
2.8 KiB
Tautulli
Tautulli is the statistics, monitoring, and notification companion for
Plex Media Server. On Dankserver it runs as a podman quadlet
(tautulli.service) under the systemd user generator, generated from
dankserver/tautulli/quadlet/tautulli.container — migrated from the snap
(2026-09; the snap carried zero config, so the cutover was a fresh install).
Host: Dankserver — Depends on: Plex (it is pointless without
it; it talks to PMS over the appnet at http://plex:32400).
Facts
| Item | Value |
|---|---|
| Runtime | podman quadlet, tautulli.service (user manager) — migrated from snap snap.tautulli.tautulli.service |
| Image | lscr.io/linuxserver/tautulli:v2.18.1-ls242 (pinned; verified == the ghcr latest manifest digest at pin time) |
| Data root | /home/dank/Containers/tautulli bind-mounted as /config (fresh at cutover — the snap's /var/snap/tautulli/common was empty) |
| Identity | UsernsMode=host + PUID=1000 PGID=1000 |
| Port | 8181/tcp published on 0.0.0.0 |
| Network | dankserver_appnet, alias tautulli |
| PMS URL | http://plex:32400 — seeded into config.ini by the deployer on first start |
| Health | in-container python3 probe of http://localhost:8181/home, 30 s interval / 3 retries |
| Deploy | ./scripts/deploy.sh dankserver --service tautulli |
| Docs | https://github.com/Tautulli/Tautulli/wiki |
What it buys this fleet
- Concurrent-stream dashboard and history: who is watching what, right now, on which client — the only tool that answers "is the CPU busy transcoding for someone?" without SSHing in.
- Notifications: library updates, download completions, player watch sessions — wire them to whatever notifier the fleet standardizes on (Discord/ntfy/Telegram are all one dropdown away).
- Health signal for the *arr stack downstream: completed downloads that never become plays, or streams failing at a fixed bitrate, show up here first.
Gotchas
- Unauthenticated on the LAN.
0.0.0.0:8181with no auth wall — anyone on the LAN can read the whole watch history. Fine while LAN-only; if a public vhost is ever pointed at it, put the Authentik + Anubis chain in front first (Authentik, Anubis). - First boot shows the setup wizard — expected pre-token behavior; the
wizard also answers 200 on
/home, so the health gate stays green before any token exists. Enter the PMS claim token through the web UI after cutover; it is stored inside the config bind, never in this repo. - Snap-era paths are gone. Logs and config live under the config bind
(
/home/dank/Containers/tautulli/...), not/var/snap/tautulli/common— Grafana/Loki log-shipping paths must account for it (Loki, Alloy). - Updates are commit-driven — pin a new
-lstag in the unit file and redeploy; never run:latest.