From 45ab88583425170abbe93e1fbbf43248cb0b41e8 Mon Sep 17 00:00:00 2001
From: ginnoir <ginnoir@users.noreply.github.com>
Date: Wed, 5 Aug 2026 15:50:25 -0500
Subject: [PATCH] fix(streaming): bind JF 10.11 metadata path; fix Caddy deploy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Jellyfin 10.11 writes metadata to /config/data/metadata, not
/config/metadata — the old bind left bulk artwork on the root disk.
Moved existing metadata to /storage1 and corrected the compose mount.
Also sets TranscodingTempPath=/transcode.

Caddy deploy: job containers never saw /config/caddy; write via a
host-bind docker run instead. apply-compose.ps1 -Caddy stages through
/tmp + sudo. GITHUB_STACKS_PAT updated to the live Gitea PAT.
---
 .env                                |  3 ++-
 .gitea/workflows/deploy-caddy.yml   | 11 ++++++++++-
 apply-compose.ps1                   |  5 ++++-
 stacks/streaming/docker-compose.yml |  7 ++++---
 4 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/.env b/.env
index 8670235..d84e482 100644
--- a/.env
+++ b/.env
@@ -111,7 +111,8 @@ GITHUB_RUNNER_ACCESS_TOKEN=github_pat_11ACRHQAI0q3n1svrl9jmT_ai2bQlXWSxY8HJjEI6q
 # Used by StackCreateDockerStandaloneRepository and StackGitRedeploy.
 # Pass as RepositoryAuthorizationType:0 (Basic), RepositoryUsername=ginnoir.
 # Runner PAT above does NOT work for this — different scopes.
-GITHUB_STACKS_PAT=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
+# Gitea PAT for Portainer git stacks (env var name kept from GitHub era)
+GITHUB_STACKS_PAT=54ea93904439c2919f1d8dab1ba545e54a2a3e86
 
 # =============================================================
 # DEV STACK
diff --git a/.gitea/workflows/deploy-caddy.yml b/.gitea/workflows/deploy-caddy.yml
index 51695d8..a5f6c9c 100644
--- a/.gitea/workflows/deploy-caddy.yml
+++ b/.gitea/workflows/deploy-caddy.yml
@@ -17,6 +17,15 @@ jobs:
 
       - name: Push Caddyfile and reload Caddy
         run: |
+          # Job containers do NOT inherit the runner's /config/caddy bind.
+          # Docker-from-Docker with a host bind is the reliable path: the
+          # volume source is resolved on valhalla, not inside the job container.
+          # (Direct `cp /config/caddy/...` only works on the runner container
+          # itself, which is not where this step runs.)
           apt-get update -qq && apt-get install -y -qq docker.io
-          cp Caddyfile /config/caddy/Caddyfile
+          docker run --rm \
+            -v /config/caddy:/dest \
+            -v "$PWD/Caddyfile:/src/Caddyfile:ro" \
+            alpine:3.20 \
+            cp /src/Caddyfile /dest/Caddyfile
           docker exec caddy caddy reload --config /etc/caddy/Caddyfile
diff --git a/apply-compose.ps1 b/apply-compose.ps1
index 56bff0c..57cebd7 100644
--- a/apply-compose.ps1
+++ b/apply-compose.ps1
@@ -41,8 +41,11 @@ if ($EnvFile) {
 }
 
 if ($Caddy) {
+    # /config/caddy is root-owned on valhalla — scp directly fails with
+    # "Permission denied". Stage via /tmp and sudo-install.
     Write-Host "Pushing Caddyfile ..."
-    scp $caddyLocal "${server}:/config/caddy/Caddyfile"
+    scp $caddyLocal "${server}:/tmp/Caddyfile.new"
+    ssh $server "sudo cp /tmp/Caddyfile.new /config/caddy/Caddyfile && sudo chown root:root /config/caddy/Caddyfile && rm -f /tmp/Caddyfile.new"
     Write-Host "Reloading Caddy ..."
     ssh $server "docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
 }
diff --git a/stacks/streaming/docker-compose.yml b/stacks/streaming/docker-compose.yml
index 3432e07..ab73684 100644
--- a/stacks/streaming/docker-compose.yml
+++ b/stacks/streaming/docker-compose.yml
@@ -4,8 +4,9 @@
 # (metadata, trickplay, cache, transcodes) on /storage1. The root disk is only
 # 194G and has filled twice; nothing here may grow unbounded on it.
 #
-# Trickplay gets an explicit sub-bind because Jellyfin 10.11 moved it to
-# /config/data/trickplay and it is NOT relocatable from the UI.
+# Jellyfin 10.11 (linuxserver) keeps metadata at /config/data/metadata — NOT
+# /config/metadata. Trickplay is at /config/data/trickplay and is not
+# relocatable from the UI. Transcodes are configured to /transcode.
 #
 # Transcodes are disk-backed, not tmpfs: jellyfin#16608 means Remux and
 # DirectStream jobs finish before the segment cleaner's first check, orphaning
@@ -30,7 +31,7 @@ services:
     volumes:
       - /etc/localtime:/etc/localtime:ro
       - /config/jellyfin:/config
-      - /storage1/labdata/jellyfin/metadata:/config/metadata
+      - /storage1/labdata/jellyfin/metadata:/config/data/metadata
       - /storage1/labdata/jellyfin/cache:/config/cache
       - /storage1/labdata/jellyfin/trickplay:/config/data/trickplay
       - /storage1/labdata/jellyfin/transcodes:/transcode