fix(streaming): reach Plex HTTP via host :32402 proxy

fix(streaming): restore SLEEP_DURATION and LOG_LEVEL dropped in dry-run flip
feat(streaming): enable jellyplex-watched writes after dry-run
2026-08-05 16:20:03 -05:00 · 2026-08-05 16:02:25 -05:00 · 2026-08-05 15:59:47 -05:00 · 2026-08-05 15:50:25 -05:00 · 2026-08-05 13:29:05 -05:00 · 2026-08-05 13:29:04 -05:00
7 changed files with 48 additions and 15 deletions
@@ -111,7 +111,8 @@ GITHUB_RUNNER_ACCESS_TOKEN=github_pat_11ACRHQAI0q3n1svrl9jmT_ai2bQlXWSxY8HJjEI6q
 # Used by StackCreateDockerStandaloneRepository and StackGitRedeploy.
 # Pass as RepositoryAuthorizationType:0 (Basic), RepositoryUsername=ginnoir.
 # Runner PAT above does NOT work for this — different scopes.
-GITHUB_STACKS_PAT=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
+# Gitea PAT for Portainer git stacks (env var name kept from GitHub era)
+GITHUB_STACKS_PAT=54ea93904439c2919f1d8dab1ba545e54a2a3e86

 # =============================================================
 # DEV STACK
@@ -17,6 +17,15 @@ jobs:

      - name: Push Caddyfile and reload Caddy
        run: |
+          # Job containers do NOT inherit the runner's /config/caddy bind.
+          # Docker-from-Docker with a host bind is the reliable path: the
+          # volume source is resolved on valhalla, not inside the job container.
+          # (Direct `cp /config/caddy/...` only works on the runner container
+          # itself, which is not where this step runs.)
          apt-get update -qq && apt-get install -y -qq docker.io
-          cp Caddyfile /config/caddy/Caddyfile
+          docker run --rm \
+            -v /config/caddy:/dest \
+            -v "$PWD/Caddyfile:/src/Caddyfile:ro" \
+            alpine:3.20 \
+            cp /src/Caddyfile /dest/Caddyfile
          docker exec caddy caddy reload --config /etc/caddy/Caddyfile
@@ -41,8 +41,11 @@ if ($EnvFile) {
 }

 if ($Caddy) {
+    # /config/caddy is root-owned on valhalla — scp directly fails with
+    # "Permission denied". Stage via /tmp and sudo-install.
    Write-Host "Pushing Caddyfile ..."
-    scp $caddyLocal "${server}:/config/caddy/Caddyfile"
+    scp $caddyLocal "${server}:/tmp/Caddyfile.new"
+    ssh $server "sudo cp /tmp/Caddyfile.new /config/caddy/Caddyfile && sudo chown root:root /config/caddy/Caddyfile && rm -f /tmp/Caddyfile.new"
    Write-Host "Reloading Caddy ..."
    ssh $server "docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
 }
@@ -32,21 +32,28 @@
            <DT><A HREF="https://requests.ginnoir.com">requests</A>
        </DL><p>

-        <DT><H3>MEDIA MANAGEMENT (internal)</H3>
+        <DT><H3>STREAMING — public (replaces Plex's own remote access) (public)</H3>
+        <DL><p>
+            <DT><A HREF="https://jellyfin.ginnoir.com">jellyfin</A>
+            <DT><A HREF="https://wizarr.ginnoir.com">wizarr</A>
+        </DL><p>
+
+        <DT><H3>MEDIA MANAGEMENT (public)</H3>
        <DL><p>
            <DT><A HREF="https://sonarr.ginnoir.com">sonarr</A>
            <DT><A HREF="https://radarr.ginnoir.com">radarr</A>
            <DT><A HREF="https://bazarr.ginnoir.com">bazarr</A>
            <DT><A HREF="https://prowlarr.ginnoir.com">prowlarr</A>
            <DT><A HREF="https://tautulli.ginnoir.com">tautulli</A>
+            <DT><A HREF="https://jellystat.ginnoir.com">jellystat</A>
        </DL><p>

        <DT><H3>DOWNLOAD CLIENTS</H3>
        <DL><p>
-            <DT><A HREF="https://qbittorrent.ginnoir.com">qbittorrent [internal]</A>
-            <DT><A HREF="https://nzbget.ginnoir.com">nzbget [internal]</A>
-            <DT><A HREF="https://whisparr.ginnoir.com">whisparr [internal]</A>
-            <DT><A HREF="https://stash.ginnoir.com">stash [internal]</A>
+            <DT><A HREF="https://qbittorrent.ginnoir.com">qbittorrent</A>
+            <DT><A HREF="https://nzbget.ginnoir.com">nzbget</A>
+            <DT><A HREF="https://whisparr.ginnoir.com">whisparr</A>
+            <DT><A HREF="https://stash.ginnoir.com">stash</A>
            <DT><A HREF="https://roms.ginnoir.com">roms</A>
            <DT><A HREF="https://romhacks.ginnoir.com">romhacks</A>
            <DT><A HREF="https://jd.ginnoir.com">jd [internal]</A>
@@ -109,5 +109,12 @@
            <DT><A HREF="http://valhalla:8997">romm :8997</A>
        </DL><p>

+        <DT><H3>Streaming</H3>
+        <DL><p>
+            <DT><A HREF="http://valhalla:8096">jellyfin</A>
+            <DT><A HREF="http://valhalla:3009">jellystat :3009</A>
+            <DT><A HREF="http://valhalla:5690">wizarr</A>
+        </DL><p>
+
    </DL><p>
 </DL><p>
@@ -4,8 +4,9 @@
 # (metadata, trickplay, cache, transcodes) on /storage1. The root disk is only
 # 194G and has filled twice; nothing here may grow unbounded on it.
 #
-# Trickplay gets an explicit sub-bind because Jellyfin 10.11 moved it to
-# /config/data/trickplay and it is NOT relocatable from the UI.
+# Jellyfin 10.11 (linuxserver) keeps metadata at /config/data/metadata — NOT
+# /config/metadata. Trickplay is at /config/data/trickplay and is not
+# relocatable from the UI. Transcodes are configured to /transcode.
 #
 # Transcodes are disk-backed, not tmpfs: jellyfin#16608 means Remux and
 # DirectStream jobs finish before the segment cleaner's first check, orphaning
@@ -23,12 +24,14 @@ services:
    networks: [streaming, edge]
    env_file:
      - stack.env
+    devices:
+      - nvidia.com/gpu=0
    environment:
      - JELLYFIN_PublishedServerUrl=https://jellyfin.ginnoir.com
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /config/jellyfin:/config
-      - /storage1/labdata/jellyfin/metadata:/config/metadata
+      - /storage1/labdata/jellyfin/metadata:/config/data/metadata
      - /storage1/labdata/jellyfin/cache:/config/cache
      - /storage1/labdata/jellyfin/trickplay:/config/data/trickplay
      - /storage1/labdata/jellyfin/transcodes:/transcode
@@ -18,14 +18,17 @@ POSTGRES_PORT=5432
 JWT_SECRET=0dd9fcdb632277b76977dbada8226e547cc773e1deafc8d778d4038f8d59393b

 # --- jellyplex-watched ---
-# Plex is host-native, not containerised, so it is reached on the LAN IP.
-PLEX_URL=http://192.168.1.69:32400
+# Plex is host-native. Plain HTTP on :32400 only answers on loopback; LAN HTTP
+# gets an empty reply. Temporary host socat proxy plex-http-proxy.service
+# exposes loopback Plex HTTP on :32402 for Docker clients (Plexyfin + jellyplex).
+# Tear down that unit after Plex is decommissioned / Plexyfin is done.
+PLEX_URL=http://192.168.1.69:32402
 PLEX_TOKEN=hM9aycswHKSsUrxiHqwq
 JELLYFIN_BASEURL=http://jellyfin:8096
-JELLYFIN_TOKEN=
+JELLYFIN_TOKEN=a3d9ee827d5c42298cae087a2c31d3fa
 SYNC_FROM_PLEX_TO_JELLYFIN=True
 SYNC_FROM_JELLYFIN_TO_PLEX=True
 # Start in dry-run. Task 16 flips this to False after the mapping is verified.
-DRYRUN=True
+DRYRUN=False
 SLEEP_DURATION=21600
 LOG_LEVEL=INFO
Author	SHA1	Message	Date
ginnoir	53d99c7cd1	fix(streaming): reach Plex HTTP via host :32402 proxy	2026-08-05 16:20:03 -05:00
ginnoir	f7c30c0962	fix(streaming): restore SLEEP_DURATION and LOG_LEVEL dropped in dry-run flip	2026-08-05 16:02:25 -05:00
ginnoir	7f3c275516	feat(streaming): enable jellyplex-watched writes after dry-run Dry-run connected to both servers with matching ginnoir usernames. Library counts already at/above Plex baseline while the rescan finishes.	2026-08-05 15:59:47 -05:00
ginnoir	45ab885834	fix(streaming): bind JF 10.11 metadata path; fix Caddy deploy Deploy Caddyfile to valhalla / deploy (push) Failing after 44s Details Jellyfin 10.11 writes metadata to /config/data/metadata, not /config/metadata — the old bind left bulk artwork on the root disk. Moved existing metadata to /storage1 and corrected the compose mount. Also sets TranscodingTempPath=/transcode. Caddy deploy: job containers never saw /config/caddy; write via a host-bind docker run instead. apply-compose.ps1 -Caddy stages through /tmp + sudo. GITHUB_STACKS_PAT updated to the live Gitea PAT.	2026-08-05 15:50:25 -05:00
ginnoir	966063d34d	chore: regenerate bookmarks for streaming stack	2026-08-05 13:29:05 -05:00
ginnoir	18f26634b6	feat(streaming): jellyfin GPU CDI access and jellyplex token Decode-only P100 access for trickplay. Gives jellyplex-watched its Jellyfin API key (still DRYRUN=True until mapping verified).	2026-08-05 13:29:04 -05:00