From d835a27875f0117c55458703a62916437e7baf69 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Thu, 27 Aug 2026 18:53:46 -0500 Subject: [PATCH] fix(plex): mount config PVC at /config (image's real config dir) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The plexinc/pms-docker image writes its identity/claim token and the Library metadata DB under /config, but the config PVC was mounted at the renderer default /data/config. Plex therefore wrote all state to the container's EPHEMERAL layer: the server stayed UNCLAIMED (servers.plex.tv returns 401 with an empty X-Plex-Token) and lost everything on restart, which is why seerr's "add Plex" failed even with SSL off. Set the config volume mountPath to /config in catalog/plex.yaml and re-render apps/wave-0/plex.yaml (only the mountPath line changes; all other services byte-identical). No fsGroup/securityContext needed: verified in-cluster the image inits as root (s6-svscan PID 1), chowns /config to the plex user, then drops privileges (the "Plex Media Server" process runs as plex) — root can chown the mounted PVC regardless of fsGroup. PLEX_CLAIM auto-claim is intentionally NOT wired: the env secretKeyRef schema has no `optional`, so a placeholder/absent claim Secret would crashloop the pod. The claim is an operator step (UI sign-in after the roll, or add a PLEX_CLAIM env from a fresh https://plex.tv/claim token). Co-Authored-By: Claude Opus 4.8 --- apps/wave-0/plex.yaml | 2 +- catalog/plex.yaml | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/apps/wave-0/plex.yaml b/apps/wave-0/plex.yaml index dfffcb2..94cf3e7 100644 --- a/apps/wave-0/plex.yaml +++ b/apps/wave-0/plex.yaml @@ -80,7 +80,7 @@ spec: - containerPort: 32400 volumeMounts: - name: config - mountPath: /data/config + mountPath: /config volumes: - name: config persistentVolumeClaim: diff --git a/catalog/plex.yaml b/catalog/plex.yaml index 1fec967..e4a6f44 100644 --- a/catalog/plex.yaml +++ b/catalog/plex.yaml @@ -29,6 +29,15 @@ storage: - name: config size: 8Gi class: longhorn # Plex DB/metadata: replicated app state on the 3-replica tier (docs/04; R-STATE-01/02) + mountPath: /config # plexinc/pms-docker writes its identity/claim + "Library" DB under /config, NOT the + # renderer default /data/config. Without this the PVC sat unused and Plex wrote to the + # container's EPHEMERAL layer -> unclaimed + all state lost on restart. The image inits as + # root (s6-svscan PID 1), chowns /config to the plex user, then drops -> no fsGroup needed + # (verified in-cluster: PID1=root, "Plex Media Server"=plex). Persisting /config here also + # makes the claim survive restarts once claimed. To auto-claim on first boot instead of the + # UI sign-in, the operator adds a PLEX_CLAIM env from a fresh https://plex.tv/claim token + # (4-min TTL) — deliberately NOT wired here: the env secretKeyRef pattern has no `optional`, + # so a placeholder/absent claim Secret would crashloop the pod. See operator hand-off. dependencies: [] # default-deny: reaches only DNS; clients/Seerr reach IT (docs/03; R-NET-01/02) ingressRoutes: - host: plex.home.keithjackson.dev