Files

T

Frank 2523f3ed43 docs(dankserver): document Plex (native systemd) and Tautulli (snap) as they actually run

Live-verified 2026-08-29: plexmediaserver.service is an enabled native
systemd unit on Dankserver (not a quadlet; updates via apt, not deploy.sh),
and tautulli runs as a snap with no auth wall on 0.0.0.0:8181. The hunt list
named both; neither had a page. Index linked per the docs-completeness seam.

2026-08-29 02:12:08 -07:00

2.6 KiB

Raw Blame History

Plex

Plex Media Server is the native (non-container) media server running on Dankserver. It is the only media server actually listening on this host: plexmediaserver.service is an OS-package systemd unit (/usr/lib/systemd/system/plexmediaserver.service), enabled and running — verified live 2026-08-29. Jellyfin, by contrast, is a research brief on this host, not a running service (see Jellyfin).

Host: Dankserver — Ports: 32400/tcp (PMS web + API), 32400 is the only port PMS needs for client streaming; LAN clients connect directly, public traffic can be fronted by Caddy like every other vhost.

Facts (live-verified 2026-08-29)

Item	Value
Runtime	native systemd service (`plexmediaserver.service`), not a podman quadlet
State	enabled + running (up since 2026-08-21)
Port	`32400/tcp` on `0.0.0.0`
Updates	OS package manager (`apt`) — not `scripts/deploy.sh`; the deploy flow never touches this service
GPU	RTX 3090 present; NVENC hardware transcode needs the NVIDIA driver + Plex Pass (PMS gates HW transcoding behind the paid tier)
Docs	https://support.plex.tv

Why it is not a quadlet

Plex ships as a distro package with its own systemd unit and update channel; the repo's boot-persistence rule is satisfied by the native unit (it is enabled, so it survives reboot — verify with systemctl is-enabled plexmediaserver). Converting it to a container later is a migration, not a config edit: the PMS database (/var/lib/plexmediaserver) and its claim-token identity would move with it.

Integration points

Caddy: Plex is exempt from the Anubis bot challenge (plain-HTTP legacy clients cannot solve JS challenges) — see Anubis "Exempt by construction".
Tautulli (Tautulli) is the companion: it polls PMS on :32400 for statistics and notifications and makes no sense without Plex.
Auth wall: if a public vhost is ever pointed at Plex, put the Authentik outpost + Anubis chain in front of it like every other guarded vhost (Authentik, Caddy); direct :32400 exposure to the LAN is unauthenticated by design (Plex owns its own auth via claim tokens).

Gotchas

Do not benchmark on it blind. PMS transcodes contend with the LLM fleet for the same GPU; stop the service (or pin it to CPU transcoding) before benchmark runs, per the Benchmarking Policy.
Updates are OS-level — apt/aptly, not deploy.sh; a deploy plan that names plex is a bug in the plan.
The claim token is the identity of this server; document it in the host .env, never in this repo (secret rules apply).

2.6 KiB Raw Blame History