Frank
2523f3ed43
Live-verified 2026-08-29: plexmediaserver.service is an enabled native systemd unit on Dankserver (not a quadlet; updates via apt, not deploy.sh), and tautulli runs as a snap with no auth wall on 0.0.0.0:8181. The hunt list named both; neither had a page. Index linked per the docs-completeness seam.
55 lines
2.6 KiB
Markdown
55 lines
2.6 KiB
Markdown
# Plex
|
|
|
|
Plex Media Server is the **native (non-container) media server running on
|
|
Dankserver**. It is the only media server actually listening on this host:
|
|
`plexmediaserver.service` is an OS-package systemd unit
|
|
(`/usr/lib/systemd/system/plexmediaserver.service`), enabled and
|
|
running — verified live 2026-08-29. Jellyfin, by contrast, is a research
|
|
brief on this host, not a running service (see [[Jellyfin]]).
|
|
|
|
**Host:** Dankserver — **Ports:** 32400/tcp (PMS web + API), 32400 is the
|
|
only port PMS needs for client streaming; LAN clients connect directly,
|
|
public traffic can be fronted by Caddy like every other vhost.
|
|
|
|
## Facts (live-verified 2026-08-29)
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Runtime | native systemd service (`plexmediaserver.service`), **not** a podman quadlet |
|
|
| State | enabled + running (up since 2026-08-21) |
|
|
| Port | `32400/tcp` on `0.0.0.0` |
|
|
| Updates | OS package manager (`apt`) — **not** `scripts/deploy.sh`; the deploy flow never touches this service |
|
|
| GPU | RTX 3090 present; NVENC hardware transcode needs the NVIDIA driver + Plex Pass (PMS gates HW transcoding behind the paid tier) |
|
|
| Docs | https://support.plex.tv |
|
|
|
|
## Why it is not a quadlet
|
|
|
|
Plex ships as a distro package with its own systemd unit and update
|
|
channel; the repo's boot-persistence rule is satisfied by the native unit
|
|
(it is `enabled`, so it survives reboot — verify with
|
|
`systemctl is-enabled plexmediaserver`). Converting it to a container later
|
|
is a migration, not a config edit: the PMS database (`/var/lib/plexmediaserver`)
|
|
and its claim-token identity would move with it.
|
|
|
|
## Integration points
|
|
|
|
- **Caddy:** Plex is exempt from the Anubis bot challenge
|
|
(plain-HTTP legacy clients cannot solve JS challenges) — see
|
|
[[Anubis]] "Exempt by construction".
|
|
- **Tautulli** ([[Tautulli]]) is the companion: it polls PMS on `:32400`
|
|
for statistics and notifications and makes no sense without Plex.
|
|
- **Auth wall:** if a public vhost is ever pointed at Plex, put the
|
|
Authentik outpost + Anubis chain in front of it like every other guarded
|
|
vhost ([[Authentik]], [[Caddy]]); direct `:32400` exposure to the LAN is
|
|
unauthenticated by design (Plex owns its own auth via claim tokens).
|
|
|
|
## Gotchas
|
|
|
|
1. **Do not benchmark on it blind.** PMS transcodes contend with the LLM
|
|
fleet for the same GPU; stop the service (or pin it to CPU
|
|
transcoding) before benchmark runs, per the Benchmarking Policy.
|
|
2. **Updates are OS-level** — `apt`/`aptly`, not `deploy.sh`; a deploy
|
|
plan that names `plex` is a bug in the plan.
|
|
3. The claim token is the identity of this server; document it in the host
|
|
`.env`, never in this repo (secret rules apply).
|