From 07fff8804bb92878cc0781d1c48efd6e9b8860d3 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sat, 11 Apr 2026 00:15:28 -0500
Subject: [PATCH] =?UTF-8?q?Remove=20all=20Plex=20references=20=E2=80=94=20?=
 =?UTF-8?q?Jellyfin=20only?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../legion/k8s/media/external-secrets.yaml    |  8 +-------
 servers/legion/k8s/media/ingress.yaml         | 19 +++----------------
 2 files changed, 4 insertions(+), 23 deletions(-)

diff --git a/servers/legion/k8s/media/external-secrets.yaml b/servers/legion/k8s/media/external-secrets.yaml
index 1d28f57..be5be5b 100644
--- a/servers/legion/k8s/media/external-secrets.yaml
+++ b/servers/legion/k8s/media/external-secrets.yaml
@@ -1,6 +1,4 @@
-# media-secrets — ProtonVPN WireGuard key + Plex claim token
-# PLEX_CLAIM: run `vault kv patch secret/plex claim_token=<token>` right before first deploy
-#   Get token from: https://www.plex.tv/claim (expires in 4 minutes)
+# media-secrets — ProtonVPN WireGuard credentials
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
@@ -19,7 +17,3 @@ spec:
       remoteRef:
         key: secret/data/protonvpn
         property: private_key
-    - secretKey: PLEX_CLAIM
-      remoteRef:
-        key: secret/data/plex
-        property: claim_token
diff --git a/servers/legion/k8s/media/ingress.yaml b/servers/legion/k8s/media/ingress.yaml
index 18d3abe..e47903f 100644
--- a/servers/legion/k8s/media/ingress.yaml
+++ b/servers/legion/k8s/media/ingress.yaml
@@ -156,11 +156,9 @@ spec:
                 port:
                   number: 5055
 ---
-# watch.nook.family/stream → Jellyfin (stream.nook.family also works)
-# Seerr stays at watch.nook.family for requests
-# plex.nook.family kept as alias for backwards compat
-# NOTE: Also add in Cloudflare Zero Trust:
-#   Hostname: plex.nook.family | Service: http://traefik.kube-system:80
+# jellyfin.nook.family → Jellyfin media server
+# NOTE: Add in Cloudflare Zero Trust:
+#   Hostname: jellyfin.nook.family | Service: http://traefik.kube-system:80
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -173,20 +171,9 @@ spec:
   ingressClassName: traefik
   tls:
     - hosts:
-        - plex.nook.family
         - jellyfin.nook.family
       secretName: jellyfin-tls
   rules:
-    - host: plex.nook.family
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: jellyfin
-                port:
-                  number: 8096
     - host: jellyfin.nook.family
       http:
         paths: