Remove all Plex references — Jellyfin only

servers/legion/k8s/media/external-secrets.yaml

@@ -1,6 +1,4 @@
-# media-secrets — ProtonVPN WireGuard key + Plex claim token
-# PLEX_CLAIM: run `vault kv patch secret/plex claim_token=<token>` right before first deploy
-#   Get token from: https://www.plex.tv/claim (expires in 4 minutes)
+# media-secrets — ProtonVPN WireGuard credentials
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
@@ -19,7 +17,3 @@ spec:
       remoteRef:
         key: secret/data/protonvpn
         property: private_key
-    - secretKey: PLEX_CLAIM
-      remoteRef:
-        key: secret/data/plex
-        property: claim_token

servers/legion/k8s/media/ingress.yaml

@@ -156,11 +156,9 @@ spec:
                 port:
                   number: 5055
 ---
-# watch.nook.family/stream → Jellyfin (stream.nook.family also works)
-# Seerr stays at watch.nook.family for requests
-# plex.nook.family kept as alias for backwards compat
-# NOTE: Also add in Cloudflare Zero Trust:
-#   Hostname: plex.nook.family | Service: http://traefik.kube-system:80
+# jellyfin.nook.family → Jellyfin media server
+# NOTE: Add in Cloudflare Zero Trust:
+#   Hostname: jellyfin.nook.family | Service: http://traefik.kube-system:80
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -173,20 +171,9 @@ spec:
   ingressClassName: traefik
   tls:
     - hosts:
-        - plex.nook.family
         - jellyfin.nook.family
       secretName: jellyfin-tls
   rules:
-    - host: plex.nook.family
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: jellyfin
-                port:
-                  number: 8096
     - host: jellyfin.nook.family
       http:
         paths: