# Nook Media Stack — Operations Guide

## What's Running

| Service | Purpose | Internal URL | Public URL |
|---------|---------|-------------|------------|
| **Plex** | Streams media to family | `plex.media.svc:32400` | https://plex.nook.family |
| **Overseerr** | Family request portal | `overseerr.media.svc:5055` | https://watch.nook.family |
| **Radarr** | Movie automation | `radarr.media.svc:7878` | port-forward only |
| **Sonarr** | TV/anime automation | `sonarr.media.svc:8989` | port-forward only |
| **Prowlarr** | Indexer aggregator | `prowlarr.media.svc:9696` | port-forward only |
| **qBittorrent** | Torrent client (via ProtonVPN) | `qbittorrent.media.svc:8080` | port-forward only |
| **Bazarr** | Subtitle downloader | `bazarr.media.svc:6767` | port-forward only |
| **FlareSolverr** | Cloudflare bypass proxy | `flaresolverr.media.svc:8191` | internal only |

## Credentials

All admin passwords: `jfqb56as@@Fox`

| Service | Username | Notes |
|---------|----------|-------|
| qBittorrent | `admin` | Web UI admin |
| Radarr | API key only | See below |
| Sonarr | API key only | See below |
| Prowlarr | API key only | See below |

**API Keys** (stored in pod configs, retrieve with commands below):
```bash
# Radarr
KUBECONFIG=~/.kube/legion-config kubectl exec -n media deployment/radarr -- \
  cat /config/config.xml | grep ApiKey

# Sonarr
KUBECONFIG=~/.kube/legion-config kubectl exec -n media deployment/sonarr -- \
  cat /config/config.xml | grep ApiKey

# Prowlarr
KUBECONFIG=~/.kube/legion-config kubectl exec -n media deployment/prowlarr -- \
  cat /config/config.xml | grep ApiKey
```

## Accessing Admin UIs

None of the backend services are exposed publicly. Use `kubectl port-forward`:

```bash
export KUBECONFIG=~/.kube/legion-config

# Radarr
kubectl port-forward -n media svc/radarr 7878:7878
# → http://localhost:7878

# Sonarr
kubectl port-forward -n media svc/sonarr 8989:8989
# → http://localhost:8989

# Prowlarr
kubectl port-forward -n media svc/prowlarr 9696:9696
# → http://localhost:9696

# qBittorrent
kubectl port-forward -n media svc/qbittorrent 8080:8080
# → http://localhost:8080

# Bazarr
kubectl port-forward -n media svc/bazarr 6767:6767
# → http://localhost:6767
```

## Storage Layout

All media lives at `/media` on Legion:

```
/media/
├── movies/              ← Radarr deposits here → Plex "Movies" library
├── tv/
│   ├── shows/           ← Sonarr (TV) → Plex "TV Shows" library
│   └── anime/           ← Sonarr (anime) → Plex "Anime" library
└── downloads/
    ├── complete/        ← qBittorrent finished downloads (Radarr/Sonarr pick up from here)
    └── incomplete/      ← qBittorrent in-progress
```

## Family Accounts

### Overseerr (watch.nook.family)

| Name | Email | Role | Request Limits |
|------|-------|------|----------------|
| Will | andersonwilliam85@gmail.com | Admin | Unlimited |
| Fox | andersonfox07@gmail.com | User | Auto-approved, unlimited |
| Ben | andersonbenjamin2011@gmail.com | User | 5 movies/week, 3 shows/week, needs approval |
| Chloe | celizabeth0423@gmail.com | User | 3 movies/week, 2 shows/week, needs approval |

All family members sign in via **Google OAuth** (Cloudflare Access intercepts before the login page).

### Plex (plex.nook.family)

Set up Plex Home managed users for the kids with content rating limits:
- Go to plex.tv → Settings → Managed Users
- Create profiles for Ben and Chloe with rating caps (PG-13 for Ben, PG for Chloe)
- Enable PIN on your profile

## How Content Gets Added

### Automatic (new releases)
Radarr monitors for new theatrical releases. To add a movie to the watchlist:
```
Radarr UI → Add Movie → search → set profile to HD-720p → Add
```

### On Demand (family requests)
1. Family member opens https://watch.nook.family
2. Searches for movie/show → clicks Request
3. Ben and Chloe's requests land in your Overseerr approval queue
4. Fox's requests auto-approve
5. Download starts within minutes of approval

### Checking Download Status
```bash
# See active torrents
kubectl port-forward -n media svc/qbittorrent 8080:8080
# → http://localhost:8080

# Check what Radarr is waiting on
kubectl port-forward -n media svc/radarr 7878:7878
# → http://localhost:7878/activity/queue
```

## Indexers (Prowlarr)

| Indexer | Type | Good For |
|---------|------|----------|
| YTS | Movies | All movies, excellent quality |
| Nyaa.si | Anime | All anime, essential |
| FlareSolverr | Proxy | Bypasses Cloudflare on other indexers |

To add more indexers: Prowlarr UI → Indexers → Add

## VPN

All torrent traffic routes through **ProtonVPN WireGuard** (US-TX#253) via the gluetun sidecar in the qBittorrent pod. The VPN connection is automatic — if gluetun loses the tunnel, qBittorrent loses internet access entirely (kill switch by design).

To check VPN status:
```bash
KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/qbittorrent -c gluetun | tail -20
```

To rotate to a different ProtonVPN server:
1. Download a new WireGuard config from account.proton.me
2. `vault kv patch secret/protonvpn private_key=<new_key> endpoint=<new_endpoint> peer_public_key=<new_peer_key>`
3. `kubectl annotate externalsecret media-secrets -n media force-sync=$(date +%s) --overwrite`
4. `kubectl rollout restart deployment/qbittorrent -n media`

## Subtitles (Bazarr)

Bazarr automatically downloads subtitles for everything in your library.
- Configure subtitle providers: Bazarr UI → Settings → Providers → add OpenSubtitles.com (free account)
- Languages: English is default. Add others as needed.

## Maintenance

### Restart a service
```bash
KUBECONFIG=~/.kube/legion-config kubectl rollout restart deployment/<name> -n media
# Names: plex, radarr, sonarr, prowlarr, qbittorrent, bazarr, overseerr, flaresolverr
```

### Check all pod health
```bash
KUBECONFIG=~/.kube/legion-config kubectl get pods -n media
```

### View logs
```bash
KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/radarr --tail=50
KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/qbittorrent -c gluetun --tail=50
KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/qbittorrent -c qbittorrent --tail=50
```

### Update a service (pull latest image)
```bash
KUBECONFIG=~/.kube/legion-config kubectl rollout restart deployment/<name> -n media
```
All services use `:latest` tags — a restart pulls the newest image.

### Add disk space later
When you get a new server/drive, update the PersistentVolume in `k8s/media/pvc.yaml`:
- Change `hostPath.path` to the new mount point
- Increase `storage` capacity
- Push to git → Argo CD syncs

## Upgrading to Seerr (when ready)
Overseerr is being superseded by Seerr. To migrate:
1. Edit `k8s/media/overseerr.yaml`, change image to `seerr/seerr:latest`
2. Push to git — Argo CD will redeploy with config intact (same `/app/config` PVC)