# Plex Media Server
# BEFORE FIRST DEPLOY: add claim token to Vault
#   1. Go to https://www.plex.tv/claim (token expires in 4 minutes)
#   2. vault kv put secret/plex claim_token=<token>
#   3. Then push and let Argo CD deploy
# After first startup the token is stored in config and can be left as-is
#
# Post-deploy setup:
#   1. Access via plex.nook.family or port-forward :32400
#   2. Add libraries:
#      - Movies → /media/movies
#      - TV Shows → /media/tv/shows
#      - Anime (TV Shows) → /media/tv/anime
#   3. Settings > Manage > Users & Sharing → create Plex Home managed users
#   4. Set content rating limits per child profile (G/PG/PG-13)
#   5. Enable PIN on adult profiles
apiVersion: apps/v1
kind: Deployment
metadata:
  name: plex
  namespace: media
  labels:
    app: plex
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: plex
  template:
    metadata:
      labels:
        app: plex
    spec:
      containers:
        - name: plex
          image: lscr.io/linuxserver/plex:latest
          env:
            - name: PUID
              value: "1000"
            - name: PGID
              value: "1000"
            - name: TZ
              value: "America/Chicago"
            - name: VERSION
              value: "docker"
            - name: PLEX_CLAIM
              valueFrom:
                secretKeyRef:
                  name: media-secrets
                  key: PLEX_CLAIM
                  optional: true  # safe after first boot
            - name: ADVERTISE_IP
              value: "https://plex.nook.family:443"
          ports:
            - containerPort: 32400
              name: plex
          volumeMounts:
            - name: config
              mountPath: /config
            - name: media
              mountPath: /media
          resources:
            requests:
              memory: 1Gi
              cpu: 500m
            limits:
              memory: 4Gi
              cpu: 2000m
          livenessProbe:
            httpGet:
              path: /identity
              port: 32400
            initialDelaySeconds: 60
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /identity
              port: 32400
            initialDelaySeconds: 30
            periodSeconds: 10
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: plex-config
        - name: media
          persistentVolumeClaim:
            claimName: media-data
---
apiVersion: v1
kind: Service
metadata:
  name: plex
  namespace: media
spec:
  selector:
    app: plex
  ports:
    - name: plex
      port: 32400
      targetPort: 32400
  type: ClusterIP