Add media stack: Plex, Radarr, Sonarr, Prowlarr, qBittorrent, Bazarr, Overseerr

- Namespace: media (created via Terraform)
- Storage: hostPath PV at /media on Legion (movies, tv/shows, tv/anime, downloads)
- VPN: gluetun sidecar with ProtonVPN WireGuard (US-TX#253), all torrent traffic tunneled
- Radarr: movie automation with /media/movies root
- Sonarr: TV/anime automation with /media/tv/{shows,anime} roots
- Prowlarr: indexer aggregator (YTS, 1337x, Nyaa for anime)
- qBittorrent: torrent client, network namespaced behind gluetun VPN
- Bazarr: automatic subtitle downloads (connects to Radarr + Sonarr)
- Overseerr: family request portal at watch.nook.family
- Plex: media server at plex.nook.family

servers/legion/k8s/media/plex.yaml

@@ -0,0 +1,103 @@
+# Plex Media Server
+# BEFORE FIRST DEPLOY: add claim token to Vault
+#   1. Go to https://www.plex.tv/claim (token expires in 4 minutes)
+#   2. vault kv put secret/plex claim_token=<token>
+#   3. Then push and let Argo CD deploy
+# After first startup the token is stored in config and can be left as-is
+#
+# Post-deploy setup:
+#   1. Access via plex.nook.family or port-forward :32400
+#   2. Add libraries:
+#      - Movies → /media/movies
+#      - TV Shows → /media/tv/shows
+#      - Anime (TV Shows) → /media/tv/anime
+#   3. Settings > Manage > Users & Sharing → create Plex Home managed users
+#   4. Set content rating limits per child profile (G/PG/PG-13)
+#   5. Enable PIN on adult profiles
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plex
+  namespace: media
+  labels:
+    app: plex
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: plex
+  template:
+    metadata:
+      labels:
+        app: plex
+    spec:
+      containers:
+        - name: plex
+          image: lscr.io/linuxserver/plex:latest
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: "America/Chicago"
+            - name: VERSION
+              value: "docker"
+            - name: PLEX_CLAIM
+              valueFrom:
+                secretKeyRef:
+                  name: media-secrets
+                  key: PLEX_CLAIM
+                  optional: true  # safe after first boot
+            - name: ADVERTISE_IP
+              value: "https://plex.nook.family:443"
+          ports:
+            - containerPort: 32400
+              name: plex
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: media
+              mountPath: /media
+          resources:
+            requests:
+              memory: 1Gi
+              cpu: 500m
+            limits:
+              memory: 4Gi
+              cpu: 2000m
+          livenessProbe:
+            httpGet:
+              path: /identity
+              port: 32400
+            initialDelaySeconds: 60
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /identity
+              port: 32400
+            initialDelaySeconds: 30
+            periodSeconds: 10
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: plex-config
+        - name: media
+          persistentVolumeClaim:
+            claimName: media-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: plex
+  namespace: media
+spec:
+  selector:
+    app: plex
+  ports:
+    - name: plex
+      port: 32400
+      targetPort: 32400
+  type: ClusterIP