fix(streaming): reach Plex HTTP via host :32402 proxy

fix(streaming): restore SLEEP_DURATION and LOG_LEVEL dropped in dry-run flip
feat(streaming): enable jellyplex-watched writes after dry-run
2026-08-05 16:20:03 -05:00 · 2026-08-05 16:02:25 -05:00 · 2026-08-05 15:59:47 -05:00 · 2026-08-05 15:50:25 -05:00 · 2026-08-05 13:29:05 -05:00 · 2026-08-05 13:29:04 -05:00
11 changed files with 2263 additions and 10 deletions
@@ -111,7 +111,8 @@ GITHUB_RUNNER_ACCESS_TOKEN=github_pat_11ACRHQAI0q3n1svrl9jmT_ai2bQlXWSxY8HJjEI6q
 # Used by StackCreateDockerStandaloneRepository and StackGitRedeploy.
 # Pass as RepositoryAuthorizationType:0 (Basic), RepositoryUsername=ginnoir.
 # Runner PAT above does NOT work for this — different scopes.
-GITHUB_STACKS_PAT=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
+# Gitea PAT for Portainer git stacks (env var name kept from GitHub era)
+GITHUB_STACKS_PAT=54ea93904439c2919f1d8dab1ba545e54a2a3e86

 # =============================================================
 # DEV STACK
@@ -17,6 +17,15 @@ jobs:

      - name: Push Caddyfile and reload Caddy
        run: |
+          # Job containers do NOT inherit the runner's /config/caddy bind.
+          # Docker-from-Docker with a host bind is the reliable path: the
+          # volume source is resolved on valhalla, not inside the job container.
+          # (Direct `cp /config/caddy/...` only works on the runner container
+          # itself, which is not where this step runs.)
          apt-get update -qq && apt-get install -y -qq docker.io
-          cp Caddyfile /config/caddy/Caddyfile
+          docker run --rm \
+            -v /config/caddy:/dest \
+            -v "$PWD/Caddyfile:/src/Caddyfile:ro" \
+            alpine:3.20 \
+            cp /src/Caddyfile /dest/Caddyfile
          docker exec caddy caddy reload --config /etc/caddy/Caddyfile
@@ -177,8 +177,11 @@ These run on valhalla but are managed outside of Portainer/Docker.
 - **Version:** 1.43.2 (Watchtower doesn't touch it — update via `pacman -Syu plex-media-server` or the Plex UI).
 - **Service:** `systemctl {start,stop,restart,status} plexmediaserver`
 - **Binary:** `/usr/lib/plexmediaserver/`
- **App data / metadata / DB:** `/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/`
- **Media libraries:** `/storage1/Media/{Movies,TV,Anime}` — same ZFS pool bind-mounted into the *arr containers.
+- **App data / metadata / DB:** `/var/lib/plex/Plex Media Server/` — note `/var/lib/plex` is a
+  **symlink to `/storage1/labdata/plex`**, so Plex's 383G of app data lives on the ZFS array, not
+  the root disk. (`/var/lib/plexmediaserver/` does not exist.)
+- **Media libraries:** `/storage1/{Movies,TV,Anime}` — `/storage1/Media/*` are symlinks to these.
+  Same ZFS pool bind-mounted into the *arr containers.
 - **Tautulli** (`tautulli` container in the media stack) reads PMS logs from `/storage1/Media` and connects to Plex over the LAN. It is **not** behind Authentik — Plex login is its own auth.
 - **Caddy:** Plex is not reverse-proxied through Caddy (Plex handles its own relay/direct connections). No `plex.ginnoir.com` block exists.

@@ -133,6 +133,17 @@ requests.ginnoir.com {
 	reverse_proxy seerr:5055
 }

+# =============================================================
+# STREAMING — public (replaces Plex's own remote access)
+# =============================================================
+jellyfin.ginnoir.com {
+	reverse_proxy jellyfin:8096
+}
+
+wizarr.ginnoir.com {
+	reverse_proxy wizarr:5690
+}
+
 # =============================================================
 # MEDIA MANAGEMENT — internal only
 # =============================================================
@@ -204,6 +215,17 @@ tautulli.ginnoir.com {
 	}
 }

+jellystat.ginnoir.com {
+	route {
+		import internal_gate
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy jellystat:3000
+		}
+	}
+}
+
 # =============================================================
 # DOWNLOAD CLIENTS — internal only
 # =============================================================
@@ -41,8 +41,11 @@ if ($EnvFile) {
 }

 if ($Caddy) {
+    # /config/caddy is root-owned on valhalla — scp directly fails with
+    # "Permission denied". Stage via /tmp and sudo-install.
    Write-Host "Pushing Caddyfile ..."
-    scp $caddyLocal "${server}:/config/caddy/Caddyfile"
+    scp $caddyLocal "${server}:/tmp/Caddyfile.new"
+    ssh $server "sudo cp /tmp/Caddyfile.new /config/caddy/Caddyfile && sudo chown root:root /config/caddy/Caddyfile && rm -f /tmp/Caddyfile.new"
    Write-Host "Reloading Caddy ..."
    ssh $server "docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
 }
@@ -32,21 +32,28 @@
            <DT><A HREF="https://requests.ginnoir.com">requests</A>
        </DL><p>

-        <DT><H3>MEDIA MANAGEMENT (internal)</H3>
+        <DT><H3>STREAMING — public (replaces Plex's own remote access) (public)</H3>
+        <DL><p>
+            <DT><A HREF="https://jellyfin.ginnoir.com">jellyfin</A>
+            <DT><A HREF="https://wizarr.ginnoir.com">wizarr</A>
+        </DL><p>
+
+        <DT><H3>MEDIA MANAGEMENT (public)</H3>
        <DL><p>
            <DT><A HREF="https://sonarr.ginnoir.com">sonarr</A>
            <DT><A HREF="https://radarr.ginnoir.com">radarr</A>
            <DT><A HREF="https://bazarr.ginnoir.com">bazarr</A>
            <DT><A HREF="https://prowlarr.ginnoir.com">prowlarr</A>
            <DT><A HREF="https://tautulli.ginnoir.com">tautulli</A>
+            <DT><A HREF="https://jellystat.ginnoir.com">jellystat</A>
        </DL><p>

        <DT><H3>DOWNLOAD CLIENTS</H3>
        <DL><p>
-            <DT><A HREF="https://qbittorrent.ginnoir.com">qbittorrent [internal]</A>
-            <DT><A HREF="https://nzbget.ginnoir.com">nzbget [internal]</A>
-            <DT><A HREF="https://whisparr.ginnoir.com">whisparr [internal]</A>
-            <DT><A HREF="https://stash.ginnoir.com">stash [internal]</A>
+            <DT><A HREF="https://qbittorrent.ginnoir.com">qbittorrent</A>
+            <DT><A HREF="https://nzbget.ginnoir.com">nzbget</A>
+            <DT><A HREF="https://whisparr.ginnoir.com">whisparr</A>
+            <DT><A HREF="https://stash.ginnoir.com">stash</A>
            <DT><A HREF="https://roms.ginnoir.com">roms</A>
            <DT><A HREF="https://romhacks.ginnoir.com">romhacks</A>
            <DT><A HREF="https://jd.ginnoir.com">jd [internal]</A>
@@ -109,5 +109,12 @@
            <DT><A HREF="http://valhalla:8997">romm :8997</A>
        </DL><p>

+        <DT><H3>Streaming</H3>
+        <DL><p>
+            <DT><A HREF="http://valhalla:8096">jellyfin</A>
+            <DT><A HREF="http://valhalla:3009">jellystat :3009</A>
+            <DT><A HREF="http://valhalla:5690">wizarr</A>
+        </DL><p>
+
    </DL><p>
 </DL><p>
@@ -0,0 +1,327 @@
+# Jellyfin migration — design
+
+**Date:** 2026-08-05
+**Status:** approved, not yet implemented
+**Supersedes:** `plans/homelab-improvements/tasks/TB-027-jellyfin.md` (stub — resolve it to "Do it" and link here)
+
+---
+
+## 1. Why
+
+Plex now requires a Plex Pass (server owner) or a Remote Watch Pass (viewer) for remote
+playback of personal media. Enforcement began on Roku in late 2025 and reaches Fire TV,
+Android TV, Google TV, Apple TV and third-party clients through 2026. valhalla's Plex
+server has **no Plex Pass**, so every remote viewer is being pushed toward paying for
+access to a server they don't own.
+
+Jellyfin has no such gate. This spec replaces host-native Plex with containerised Jellyfin,
+managed in this repo like everything else.
+
+## 2. Current state (measured 2026-08-05, not assumed)
+
+### Plex
+
+| Fact | Value |
+|---|---|
+| Install | AUR `plex-media-server` 1.43.2, systemd unit `plexmediaserver`, runs as `plex:plex` |
+| Binary | `/usr/lib/plexmediaserver/` |
+| Data dir | `/var/lib/plex` → **symlink to `/storage1/labdata/plex`** (virtiofs, *not* the root disk) |
+| Data size | **383G total** — `Media` 249G, `localhost` 116G, `Metadata` 15G, `Plug-in Support` 2.1G |
+| Reverse proxy | none — Plex handles its own relay/direct connect |
+
+> `CLAUDE.md` documents the data dir as `/var/lib/plexmediaserver/...`. **That path does not
+> exist.** Correcting it is a Phase 0 task.
+
+### Libraries
+
+Served from `/storage1`, exposed to the \*arrs through `/storage1/Media/*` symlinks:
+
+| Library | Real path | Items |
+|---|---|---|
+| Movies | `/storage1/Movies` | 1357 |
+| TV | `/storage1/TV` | 173 |
+| Anime | `/storage1/Anime` | 361 |
+
+`/storage1/Music`, `/storage1/Books` and `/storage1/LinuxISOs` (Stash's) are **out of scope**.
+
+### Usage (Tautulli, trailing 90 days / 600-play sample)
+
+| Metric | Value |
+|---|---|
+| Users | 37 registered, 29 flagged active — but **many are dormant in practice** |
+| Stream decisions | 90 direct play · 3 direct stream · **84 transcode (~48%)** |
+| Peak concurrent streams | **7** |
+| Transcode drivers | audio 23/25 · video 15/25 · **subtitle 0/25** |
+| Source content | h264 18 / hevc 7 · **100% SDR** |
+| Platforms | Android 281 · tvOS 102 · browsers 53 · Roku 39 · iOS 18 · Tizen 2 · PlayStation 1 |
+
+Two workloads that would have sunk a CPU-only plan are **absent**: no subtitle burn-in and
+no HDR tone-mapping. The residual load is 1080p SDR, which 52 Xeon threads can carry.
+
+### Host constraints
+
+| Constraint | Detail |
+|---|---|
+| 🔴 Root disk | `/dev/sda2` 194G, **179G used, 5.7G free (97%)**. `/config` lives here. Docker holds 123.5G of images, 51G reclaimable. |
+| `/storage1` | 94T, 78T used, **17T free**, virtiofs from the Proxmox host |
+| GPU | Tesla P100-PCIE-16GB. **GP100 has no NVENC** — decode-only per NVIDIA's support matrix. Currently held by llama-swap. |
+| CPU / RAM | 52 threads · 94G RAM (69G available) |
+| Docker GPU | CDI configured (`/etc/cdi/nvidia.yaml`) |
+
+## 3. Decisions
+
+| # | Decision | Rationale |
+|---|---|---|
+| D1 | New Portainer stack `stacks/streaming/` | Jellyfin config changes must not redeploy sonarr/radarr/qbittorrent. Plex-era cleanup stays contained. |
+| D2 | Public `jellyfin.ginnoir.com` via Caddy | Replaces Plex's relay. Tailscale-only or `share_gate` would break Roku/Fire TV/tvOS clients. |
+| D3 | **No SSO for Jellyfin** | `jellyfin-plugin-sso` completes OIDC only inside a browser. Roku, Android TV/Fire TV and Swiftfin cannot use it at all — and that is the entire user base. Native Jellyfin accounts. **Deliberate exception to the project auth standard.** |
+| D4 | Parallel run, then retire | Plex untouched and running through Phase 6. No failure before Phase 7 costs anything but time. |
+| D5 | Plexyfin once, then removed | Copies the curated 15G of posters/backdrops and rebuilds collections from PMS. It deletes and replaces artwork wholesale on every run, so leaving it installed would destroy later Jellyfin customisations. |
+| D6 | JellyPlex-Watched, two-way, scheduled | Users can move between servers freely during the overlap. |
+| D7 | Jellystat replaces Tautulli | Closest 1:1 equivalent. Tautulli is Plex-only and dies with Plex. |
+| D8 | CPU-only transcoding, measured | P100 cannot encode. Workload is 1080p SDR, no burn-in, no tone-mapping. Jellystat measures the truth. |
+| D9 | Escape hatch: Intel Arc A310/A380 | ~$100-150, no session limit, AV1. Only if Phase 5 data shows CPU strain. |
+| D10 | Seerr converted in place at cutover | `seerr-team/seerr` already supports Jellyfin natively. In-place conversion is unsupported upstream ([seerr#2522](https://github.com/seerr-team/seerr/issues/2522)) — mitigated by config backup and a fresh-config fallback. |
+| D11 | Transcode dir on disk, **not tmpfs** | [jellyfin#16608](https://github.com/jellyfin/jellyfin/issues/16608): the segment cleaner first checks at 20s and the throttler at 5s, but Remux/DirectStream jobs finish in 2-7s, so cleanup never fires and segments orphan. DirectStream (copy video + transcode audio) is 8 of 25 sampled sessions — routine here, not an edge case. Plex already writes transcodes to virtiofs at a 48% transcode rate without trouble. |
+| D12 | Trickplay at full quality | Plex's 365G of BIF thumbnails is **format-incompatible** with Jellyfin's tiled JPEG trickplay. None of it is reusable; Jellyfin regenerates from scratch. |
+| D13 | Wizarr invites issued **manually and selectively** | Most Plex users are dormant. No bulk invite generation, no scripted account creation, no broadcast announcement. ginnoir sends individual invites as people ask or as he chooses. |
+
+## 4. Architecture
+
+New Portainer stack `stacks/streaming/` — private `streaming` network plus `edge`, all
+config via `env_file: stack.env` per the repo convention, no Portainer UI env vars.
+
+| Container | Image | Purpose |
+|---|---|---|
+| `jellyfin` | `lscr.io/linuxserver/jellyfin` | media server (PUID/PGID from `stack.env`) |
+| `jellystat` | `cyfershepard/jellystat` | Tautulli replacement |
+| `jellystat-db` | `postgres:16-alpine` | pinned + `com.centurylabs.watchtower.enable=false` per infra convention |
+| `wizarr` | `ghcr.io/wizarrrr/wizarr` | invite + guided per-device onboarding, used ad-hoc |
+| `jellyplex-watched` | `luigi311/jellyplex-watched` | scheduled two-way watch-state sync |
+
+### Ordering constraint
+
+Plexyfin and JellyPlex-Watched both read from the **live PMS API**. Everything that pulls
+from Plex must complete before Plex is decommissioned. This is the hard sequencing rule of
+the whole migration.
+
+## 5. Storage layout
+
+The root disk is the primary hazard, so Jellyfin's bulky data is split off deliberately.
+
+| Container path | Host path | Filesystem | Rationale |
+|---|---|---|---|
+| `/config` | `/config/jellyfin` | root SSD | SQLite DBs — better fsync semantics, easy to back up. A few GB. |
+| `/config/metadata` | `/storage1/labdata/jellyfin/metadata` | virtiofs | artwork + NFO, grows unbounded |
+| `/config/data/trickplay` | `/storage1/labdata/jellyfin/trickplay` | virtiofs | **~300-400G.** 10.11 moved trickplay here and it is *not* relocatable from the UI, hence an explicit sub-bind. |
+| `/config/cache` | `/storage1/labdata/jellyfin/cache` | virtiofs | image cache |
+| `/transcode` | `/storage1/labdata/jellyfin/transcodes` | virtiofs | see D11 |
+| `/data/movies` | `/storage1/Movies` | virtiofs, **`:ro`** | Jellyfin never writes to the library |
+| `/data/tv` | `/storage1/TV` | virtiofs, **`:ro`** | |
+| `/data/anime` | `/storage1/Anime` | virtiofs, **`:ro`** | |
+
+Net effect: only a few GB ever lands on the 194G root disk.
+
+### Note on SQLite and virtiofs
+
+Plex has run its SQLite library DB on virtiofs here for months without incident, so this is
+proven workable — the root-SSD placement is a preference, not a hard requirement.
+
+It carries one accepted trade-off. If `/storage1` fails to mount again (as on 2026-07-06),
+Jellyfin with its DB on root will **start up healthy against an empty library** and flag the
+entire catalogue as missing — the RomM failure mode. With the DB on `/storage1` it would
+simply fail to start, which is the louder and safer failure. `storage1-guard.service`
+already blocks guest start when `/storage1` isn't real, so root SSD stands.
+
+## 6. Caddy
+
+```caddy
+# =============================================================
+# STREAMING — public
+# =============================================================
+jellyfin.ginnoir.com {
+	reverse_proxy jellyfin:8096
+}
+
+wizarr.ginnoir.com {
+	reverse_proxy wizarr:5690
+}
+
+# =============================================================
+# STREAMING STATS — internal only
+# =============================================================
+jellystat.ginnoir.com {
+	route {
+		import internal_gate
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy jellystat:3000
+		}
+	}
+}
+```
+
+`jellyfin` and `wizarr` are public by design — remote users and invite recipients reach them
+from anywhere. `jellystat` follows the tautulli/sonarr pattern: `internal_gate` first inside
+the `route` block (an `import internal_only` above a catch-all route is dead code), then
+Authentik forward auth.
+
+In Jellyfin → Networking, register the Caddy container as a known proxy and enable forwarded
+headers, so real client IPs reach Jellystat and the remote-vs-LAN bitrate rules.
+
+## 7. Metadata strategy
+
+1. Jellyfin scans and fetches fresh from TMDB/TVDB — the same sources Plex used, so baseline
+   quality is identical.
+2. **Plexyfin runs once**, overwriting posters/backdrops with the curated Plex artwork and
+   rebuilding collections. This is where the 15G `Metadata` investment is preserved.
+3. **Plexyfin is then removed.** See D5.
+
+Plex's 365G of `Media` + `localhost` (BIF preview thumbnails) is not reusable — see D12.
+
+## 8. Plugins
+
+**Install**
+
+| Plugin | Purpose | Note |
+|---|---|---|
+| Plexyfin | collections + curated artwork from PMS | 3rd-party repo. Temporary — remove after Phase 2. |
+| Intro Skipper | skip intros/recaps/credits | **Verify 10.11 compatibility at install.** The original is unmaintained; use the active fork. |
+| AniDB / AniList | anime metadata | Anime library only |
+| Trakt | per-user scrobbling | optional |
+
+**Deliberately skipped**
+
+| Plugin | Why |
+|---|---|
+| `jellyfin-plugin-sso` | browser-only OIDC — useless for Roku/Fire TV/tvOS (D3) |
+| Open Subtitles | Bazarr already writes subtitles to disk and does it better |
+| Playback Reporting | Jellystat supersedes it |
+
+## 9. Transcoding
+
+CPU-only on 52 threads: `veryfast` preset, per-session thread cap, throttling enabled,
+**segment deletion on with a ~360s keep window**. Measured worst case is 7 concurrent streams
+at ~48% transcode, 1080p SDR, no burn-in, no tone-mapping.
+
+Jellyfin's Android client (the heaviest platform here at 281 plays) direct-plays audio codecs
+Plex's client refuses, so the transcode rate may **fall** after migration. Jellystat confirms
+or refutes this during Phase 5.
+
+If it does strain: Intel Arc A310/A380 (D9). Needs a PCIe slot, an R730XD shutdown, and an
+IOMMU passthrough to the valhalla VM — check the new card's IOMMU group, as only the P100's
+group 7 is known clean.
+
+## 10. Phases
+
+Plex stays running and untouched through Phase 6.
+
+### Phase 0 — Disk remediation and baseline
+
+The root disk is at 97%. Nothing else may proceed until it isn't.
+
+- `docker image prune` / `builder prune` — ~51G reclaimable
+- Audit the remaining 179G on `/dev/sda2`; identify anything else structurally growing
+- Uptime Kuma monitor on root-disk free space + ntfy alert (this is the second root fill)
+- Correct the Plex paths in `CLAUDE.md` (`/var/lib/plex` → `/storage1/labdata/plex`)
+
+**Done when:** root disk has comfortable headroom and alerts before it doesn't.
+
+### Phase 1 — Deploy the stack
+
+- `stacks/streaming/docker-compose.yml` + `stack.env`, `jellyfin` only
+- Storage layout per §5; register the stack in Portainer (one-time, per the new-stack procedure)
+- Caddy site blocks; `scripts/gen-bookmarks.ps1`
+- Libraries: Movies, TV, Anime (Anime with anime metadata providers)
+- Verify `check-portainer-stack-env.ps1` before pushing
+
+**Done when:** Jellyfin reachable at `jellyfin.ginnoir.com`, libraries scanned, no users.
+**Rollback:** delete the stack.
+
+### Phase 2 — Parity
+
+- Plexyfin: sync collections + artwork from PMS, then **remove the plugin**
+- **Trickplay generation** — full quality, thread-capped (~16-24 of 52), run before any users
+  arrive. Budget ~300-400G on `/storage1` and a multi-day first pass over ~1891 items.
+  Enable NVDEC for this: trickplay is decode + JPEG encode and needs no NVENC, so the P100
+  helps here even though it's useless for live transcode. Schedule when llama-swap is idle.
+- Remaining plugins per §8
+- Sonarr/Radarr/Bazarr → add Jellyfin library-refresh connections (leave the Plex ones for now)
+
+**Done when:** Jellyfin's library visually matches Plex's, trickplay complete.
+
+### Phase 3 — Watch-state sync
+
+- `jellyplex-watched` container, two-way, every 6h
+- Plex admin token + Jellyfin API key in `stack.env`; user-mapping file where names differ
+- Verify against ginnoir's own account in both directions
+
+**Done when:** a play on either server appears on the other within one cycle.
+**Rollback:** stop the container.
+
+### Phase 4 — Pilot
+
+- Configure Wizarr (server connection, wizard steps per device)
+- 3-5 willing users, **at least one each on Roku, Fire TV/Android TV and tvOS**
+- Collect real feedback on playback, transcoding and the onboarding wizard
+
+**Done when:** every target platform has a confirmed working client.
+**Rollback:** pilot users return to Plex, which never stopped.
+
+### Phase 5 — Selective migration
+
+Per D13, this phase is **demand-driven, not a campaign.**
+
+- Wizarr invites issued **individually**, as people ask or as ginnoir chooses
+- Dormant accounts get nothing
+- A short written explainer exists to accompany an invite — sent with invites, not broadcast
+- Both servers live; run at least **4 weeks** to accumulate meaningful Jellystat data
+- Watch transcode load and concurrency; decide on D9
+
+**Done when:** the people who actually watch things are on Jellyfin and it's holding up.
+
+### Phase 6 — Cutover
+
+- Back up `/config/overseerr`, then reconfigure Seerr from Plex to Jellyfin (D10)
+- Jellystat live at `jellystat.ginnoir.com`
+- **Re-check Tautulli** for who is still on Plex and on what. Handle those users
+  individually — Tizen and PlayStation are the weak platforms (3 plays of 600 as of now).
+- Remove Plex connections from Sonarr/Radarr/Bazarr
+- Announce the Plex end date
+
+**Done when:** Seerr requests flow against Jellyfin and nobody depends on Plex.
+**Rollback:** restore `/config/overseerr`.
+
+### Phase 7 — Decommission
+
+- `systemctl stop plexmediaserver && systemctl disable plexmediaserver`
+- **2-week soak** with the service stopped but installed
+- `pacman -Rns plex-media-server`
+- Retire the `tautulli` container and its Caddy block
+- Tarball `/storage1/labdata/plex`, keep 30 days, then reclaim **383G**
+- Update `CLAUDE.md` (drop the external-services Plex section), bookmarks, Uptime Kuma monitors
+
+**Done when:** Plex is gone and nothing references it.
+**Rollback (until the tarball expires):** reinstall the package, restore the data dir.
+
+## 11. Risks
+
+| Risk | Severity | Mitigation |
+|---|---|---|
+| Root disk at 97% | **high** | Phase 0 exists solely for this; monitor + alert added |
+| Public Jellyfin is new attack surface Plex's relay hid | medium | Jellyfin's built-in brute-force lockout, strong admin credential, no anonymous access, monitoring |
+| CPU transcode capacity at peak | medium | measured in Phase 5 via Jellystat; Arc A380 escape hatch (D9) |
+| Seerr in-place conversion unsupported upstream | medium | config backup first, fresh-config fallback documented |
+| Plexyfin is destructive | medium | run once in Phase 2, then remove (D5) |
+| Trickplay generation starves live transcoding | low | thread-capped, runs before users arrive, NVDEC-assisted |
+| Intro Skipper 10.11 compatibility | low | verify at install; it's optional polish |
+| Holdouts on Tizen / PlayStation | low | 3 of 600 plays; handled individually at Phase 6 with fresh data |
+
+## 12. Out of scope
+
+- Music, Books and Stash content — Jellyfin serves Movies, TV and Anime only
+- SSO for Jellyfin (D3)
+- Migrating Seerr request history
+- Replacing the P100 or restructuring GPU allocation
+- The wider `/storage1` redundancy problem (tracked separately)
@@ -0,0 +1,96 @@
+# streaming stack — Jellyfin and its satellites.
+#
+# Storage split is deliberate: SQLite config on the root SSD, all bulk data
+# (metadata, trickplay, cache, transcodes) on /storage1. The root disk is only
+# 194G and has filled twice; nothing here may grow unbounded on it.
+#
+# Jellyfin 10.11 (linuxserver) keeps metadata at /config/data/metadata — NOT
+# /config/metadata. Trickplay is at /config/data/trickplay and is not
+# relocatable from the UI. Transcodes are configured to /transcode.
+#
+# Transcodes are disk-backed, not tmpfs: jellyfin#16608 means Remux and
+# DirectStream jobs finish before the segment cleaner's first check, orphaning
+# segments. Plex already writes transcodes to virtiofs at a 48% transcode rate.
+#
+# Env convention: every service gets stack.env via env_file; var names there are
+# exactly what the containers read. No ${VAR} interpolation, no Portainer UI
+# env vars.
+
+services:
+  jellyfin:
+    container_name: jellyfin
+    image: lscr.io/linuxserver/jellyfin:latest
+    restart: unless-stopped
+    networks: [streaming, edge]
+    env_file:
+      - stack.env
+    devices:
+      - nvidia.com/gpu=0
+    environment:
+      - JELLYFIN_PublishedServerUrl=https://jellyfin.ginnoir.com
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /config/jellyfin:/config
+      - /storage1/labdata/jellyfin/metadata:/config/data/metadata
+      - /storage1/labdata/jellyfin/cache:/config/cache
+      - /storage1/labdata/jellyfin/trickplay:/config/data/trickplay
+      - /storage1/labdata/jellyfin/transcodes:/transcode
+      - /storage1/Movies:/data/movies:ro
+      - /storage1/TV:/data/tv:ro
+      - /storage1/Anime:/data/anime:ro
+    ports:
+      - "8096:8096"
+
+  jellystat-db:
+    container_name: jellystat-db
+    image: postgres:16-alpine
+    restart: unless-stopped
+    networks: [streaming]
+    env_file:
+      - stack.env
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+    volumes:
+      - /config/jellystat-db:/var/lib/postgresql/data
+
+  jellystat:
+    container_name: jellystat
+    image: cyfershepard/jellystat:latest
+    restart: unless-stopped
+    networks: [streaming, edge]
+    depends_on:
+      - jellystat-db
+    env_file:
+      - stack.env
+    volumes:
+      - /config/jellystat:/app/backend/backup-data
+    ports:
+      - "3009:3000"
+
+  wizarr:
+    container_name: wizarr
+    image: ghcr.io/wizarrrr/wizarr:latest
+    restart: unless-stopped
+    networks: [streaming, edge]
+    env_file:
+      - stack.env
+    volumes:
+      - /config/wizarr:/data/database
+    ports:
+      - "5690:5690"
+
+  jellyplex-watched:
+    container_name: jellyplex-watched
+    image: luigi311/jellyplex-watched:latest
+    restart: unless-stopped
+    networks: [streaming, edge]
+    env_file:
+      - stack.env
+
+networks:
+  streaming:
+    name: streaming
+    driver: bridge
+  edge:
+    name: edge
+    external: true
@@ -0,0 +1,34 @@
+# streaming stack config — injected into every service via env_file.
+# Var names are exactly what the containers read; no ${VAR} interpolation,
+# no Portainer UI env vars needed.
+
+# --- shared ---
+TZ=America/Chicago
+PUID=1000
+PGID=1000
+
+# --- jellystat-db (postgres:16-alpine) ---
+POSTGRES_DB=jfstat
+POSTGRES_USER=jellystat
+POSTGRES_PASSWORD=bf2d47d8e1a87baf2b4942704a5acfaf5c2aad336fdd480e
+
+# --- jellystat ---
+POSTGRES_IP=jellystat-db
+POSTGRES_PORT=5432
+JWT_SECRET=0dd9fcdb632277b76977dbada8226e547cc773e1deafc8d778d4038f8d59393b
+
+# --- jellyplex-watched ---
+# Plex is host-native. Plain HTTP on :32400 only answers on loopback; LAN HTTP
+# gets an empty reply. Temporary host socat proxy plex-http-proxy.service
+# exposes loopback Plex HTTP on :32402 for Docker clients (Plexyfin + jellyplex).
+# Tear down that unit after Plex is decommissioned / Plexyfin is done.
+PLEX_URL=http://192.168.1.69:32402
+PLEX_TOKEN=hM9aycswHKSsUrxiHqwq
+JELLYFIN_BASEURL=http://jellyfin:8096
+JELLYFIN_TOKEN=a3d9ee827d5c42298cae087a2c31d3fa
+SYNC_FROM_PLEX_TO_JELLYFIN=True
+SYNC_FROM_JELLYFIN_TO_PLEX=True
+# Start in dry-run. Task 16 flips this to False after the mapping is verified.
+DRYRUN=False
+SLEEP_DURATION=21600
+LOG_LEVEL=INFO
Author	SHA1	Message	Date
ginnoir	53d99c7cd1	fix(streaming): reach Plex HTTP via host :32402 proxy	2026-08-05 16:20:03 -05:00
ginnoir	f7c30c0962	fix(streaming): restore SLEEP_DURATION and LOG_LEVEL dropped in dry-run flip	2026-08-05 16:02:25 -05:00
ginnoir	7f3c275516	feat(streaming): enable jellyplex-watched writes after dry-run Dry-run connected to both servers with matching ginnoir usernames. Library counts already at/above Plex baseline while the rescan finishes.	2026-08-05 15:59:47 -05:00
ginnoir	45ab885834	fix(streaming): bind JF 10.11 metadata path; fix Caddy deploy Deploy Caddyfile to valhalla / deploy (push) Failing after 44s Details Jellyfin 10.11 writes metadata to /config/data/metadata, not /config/metadata — the old bind left bulk artwork on the root disk. Moved existing metadata to /storage1 and corrected the compose mount. Also sets TranscodingTempPath=/transcode. Caddy deploy: job containers never saw /config/caddy; write via a host-bind docker run instead. apply-compose.ps1 -Caddy stages through /tmp + sudo. GITHUB_STACKS_PAT updated to the live Gitea PAT.	2026-08-05 15:50:25 -05:00
ginnoir	966063d34d	chore: regenerate bookmarks for streaming stack	2026-08-05 13:29:05 -05:00
ginnoir	18f26634b6	feat(streaming): jellyfin GPU CDI access and jellyplex token Decode-only P100 access for trickplay. Gives jellyplex-watched its Jellyfin API key (still DRYRUN=True until mapping verified).	2026-08-05 13:29:04 -05:00
ginnoir	ccbce57ab9	feat(caddy): add jellyfin, wizarr and jellystat sites Deploy Caddyfile to valhalla / deploy (push) Failing after 1m37s Details jellyfin and wizarr are public by design — they replace Plex's own remote access. jellystat is internal_gate + forward_auth, matching the tautulli pattern.	2026-08-05 13:17:48 -05:00
ginnoir	de759345ec	feat(streaming): add jellyfin stack New Portainer stack: jellyfin, jellystat + postgres, wizarr and jellyplex-watched. Bulk data (metadata, trickplay, cache, transcodes) binds to /storage1; only SQLite config lands on the root disk. Trickplay gets an explicit sub-bind because 10.11 moved it to /config/data/trickplay, which is not relocatable from the UI. Transcodes are disk-backed rather than tmpfs because jellyfin#16608 orphans segments on the Remux/DirectStream jobs that are routine on this server.	2026-08-05 13:17:48 -05:00
ginnoir	fea3a6b29f	docs: correct Plex data and library paths in CLAUDE.md /var/lib/plexmediaserver does not exist; the real path is /var/lib/plex, itself a symlink to /storage1/labdata/plex. Media libraries are /storage1/{Movies,TV,Anime} with /storage1/Media/* as symlinks to them.	2026-08-05 13:15:49 -05:00
ginnoir	942fefacb8	docs(plan): record root disk audit findings	2026-08-05 13:13:41 -05:00
ginnoirandClaude Opus 5	d028fb4e1b	docs: add Jellyfin migration implementation plan 25 tasks across 7 phases, written to be executed in Cursor rather than Claude Code — every action is a literal shell command, file edit or named UI step, with no dependency on this repo's Claude Code skills or MCP servers. Phase 0 is a hard gate: the root disk is at 97% with /config on it, so nothing deploys until space is reclaimed and free-space alerting exists. Plex runs untouched through Task 22, and rollback stays a single command until the 30-day archive expires. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-05 13:05:31 -05:00
ginnoirandClaude Opus 5	d24498e440	docs: add Jellyfin-replaces-Plex migration design Plex now gates remote playback behind Plex Pass / Remote Watch Pass and valhalla has no Plex Pass, so remote viewers are being pushed to pay for access to a server they don't own. Design covers a new stacks/streaming Portainer stack (jellyfin, jellystat + postgres, wizarr, jellyplex-watched), a storage layout that keeps bulk data off the 97%-full root disk, and eight phases with Plex left running and untouched through Phase 6. Findings that shaped it, measured rather than assumed: - root disk is at 97% (5.7G free) and /config lives on it — Phase 0 - Tesla P100 is GP100: no NVENC, decode only, so transcoding is CPU-bound - 48% of streams transcode, peak 7 concurrent, but 1080p SDR with no subtitle burn-in and no HDR tone-mapping, which 52 threads can carry - /var/lib/plex is a symlink to /storage1/labdata/plex holding 383G; the 15G Metadata dir is reusable via Plexyfin, the 365G of BIF preview thumbnails is not (format-incompatible with Jellyfin trickplay) - jellyfin-plugin-sso is browser-only, so Roku/Fire TV/tvOS cannot use it — native Jellyfin accounts, a deliberate exception to the auth standard Also notes that CLAUDE.md documents a Plex data path that does not exist. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-05 12:53:29 -05:00