infrastructure/servers/legion/k8s/media/README.md

Nook Media Stack — Operations Guide

What's Running

Service	Purpose	Internal URL	Public URL
Plex	Streams media to family	plex.media.svc:32400	https://plex.nook.family
Overseerr	Family request portal	overseerr.media.svc:5055	https://watch.nook.family
Radarr	Movie automation	radarr.media.svc:7878	port-forward only
Sonarr	TV/anime automation	sonarr.media.svc:8989	port-forward only
Prowlarr	Indexer aggregator	prowlarr.media.svc:9696	port-forward only
qBittorrent	Torrent client (via ProtonVPN)	qbittorrent.media.svc:8080	port-forward only
Bazarr	Subtitle downloader	bazarr.media.svc:6767	port-forward only
FlareSolverr	Cloudflare bypass proxy	flaresolverr.media.svc:8191	internal only

Credentials

All admin passwords: jfqb56as@@Fox

Service	Username	Notes
qBittorrent	admin	Web UI admin
Radarr	API key only	See below
Sonarr	API key only	See below
Prowlarr	API key only	See below

API Keys (stored in pod configs, retrieve with commands below):

# Radarr
KUBECONFIG=~/.kube/legion-config kubectl exec -n media deployment/radarr -- \
  cat /config/config.xml | grep ApiKey

# Sonarr
KUBECONFIG=~/.kube/legion-config kubectl exec -n media deployment/sonarr -- \
  cat /config/config.xml | grep ApiKey

# Prowlarr
KUBECONFIG=~/.kube/legion-config kubectl exec -n media deployment/prowlarr -- \
  cat /config/config.xml | grep ApiKey

Accessing Admin UIs

None of the backend services are exposed publicly. Use kubectl port-forward:

export KUBECONFIG=~/.kube/legion-config

# Radarr
kubectl port-forward -n media svc/radarr 7878:7878
# → http://localhost:7878

# Sonarr
kubectl port-forward -n media svc/sonarr 8989:8989
# → http://localhost:8989

# Prowlarr
kubectl port-forward -n media svc/prowlarr 9696:9696
# → http://localhost:9696

# qBittorrent
kubectl port-forward -n media svc/qbittorrent 8080:8080
# → http://localhost:8080

# Bazarr
kubectl port-forward -n media svc/bazarr 6767:6767
# → http://localhost:6767

Storage Layout

All media lives at /media on Legion:

/media/
├── movies/              ← Radarr deposits here → Plex "Movies" library
├── tv/
│   ├── shows/           ← Sonarr (TV) → Plex "TV Shows" library
│   └── anime/           ← Sonarr (anime) → Plex "Anime" library
└── downloads/
    ├── complete/        ← qBittorrent finished downloads (Radarr/Sonarr pick up from here)
    └── incomplete/      ← qBittorrent in-progress

Family Accounts

Overseerr (watch.nook.family)

Name	Email	Role	Request Limits
Will	andersonwilliam85@gmail.com	Admin	Unlimited
Fox	andersonfox07@gmail.com	User	Auto-approved, unlimited
Ben	andersonbenjamin2011@gmail.com	User	5 movies/week, 3 shows/week, needs approval
Chloe	celizabeth0423@gmail.com	User	3 movies/week, 2 shows/week, needs approval

All family members sign in via Google OAuth (Cloudflare Access intercepts before the login page).

Plex (plex.nook.family)

Set up Plex Home managed users for the kids with content rating limits:

• Go to plex.tv → Settings → Managed Users
• Create profiles for Ben and Chloe with rating caps (PG-13 for Ben, PG for Chloe)
• Enable PIN on your profile

How Content Gets Added

Automatic (new releases)

Radarr monitors for new theatrical releases. To add a movie to the watchlist:

Radarr UI → Add Movie → search → set profile to HD-720p → Add

On Demand (family requests)

1. Family member opens https://watch.nook.family
2. Searches for movie/show → clicks Request
3. Ben and Chloe's requests land in your Overseerr approval queue
4. Fox's requests auto-approve
5. Download starts within minutes of approval

Checking Download Status

# See active torrents
kubectl port-forward -n media svc/qbittorrent 8080:8080
# → http://localhost:8080

# Check what Radarr is waiting on
kubectl port-forward -n media svc/radarr 7878:7878
# → http://localhost:7878/activity/queue

Indexers (Prowlarr)

Indexer	Type	Good For
YTS	Movies	All movies, excellent quality
Nyaa.si	Anime	All anime, essential
FlareSolverr	Proxy	Bypasses Cloudflare on other indexers

To add more indexers: Prowlarr UI → Indexers → Add

VPN

All torrent traffic routes through ProtonVPN WireGuard (US-TX#253) via the gluetun sidecar in the qBittorrent pod. The VPN connection is automatic — if gluetun loses the tunnel, qBittorrent loses internet access entirely (kill switch by design).

To check VPN status:

KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/qbittorrent -c gluetun | tail -20

To rotate to a different ProtonVPN server:

1. Download a new WireGuard config from account.proton.me
2. vault kv patch secret/protonvpn private_key=<new_key> endpoint=<new_endpoint> peer_public_key=<new_peer_key>
3. kubectl annotate externalsecret media-secrets -n media force-sync=$(date +%s) --overwrite
4. kubectl rollout restart deployment/qbittorrent -n media

Subtitles (Bazarr)

Bazarr automatically downloads subtitles for everything in your library.

• Configure subtitle providers: Bazarr UI → Settings → Providers → add OpenSubtitles.com (free account)
• Languages: English is default. Add others as needed.

Maintenance

Restart a service

KUBECONFIG=~/.kube/legion-config kubectl rollout restart deployment/<name> -n media
# Names: plex, radarr, sonarr, prowlarr, qbittorrent, bazarr, overseerr, flaresolverr

Check all pod health

KUBECONFIG=~/.kube/legion-config kubectl get pods -n media

View logs

KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/radarr --tail=50
KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/qbittorrent -c gluetun --tail=50
KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/qbittorrent -c qbittorrent --tail=50

Update a service (pull latest image)

KUBECONFIG=~/.kube/legion-config kubectl rollout restart deployment/<name> -n media

All services use :latest tags — a restart pulls the newest image.

Add disk space later

When you get a new server/drive, update the PersistentVolume in k8s/media/pvc.yaml:

• Change hostPath.path to the new mount point
• Increase storage capacity
• Push to git → Argo CD syncs

Upgrading to Seerr (when ready)

Overseerr is being superseded by Seerr. To migrate:

1. Edit k8s/media/overseerr.yaml, change image to seerr/seerr:latest
2. Push to git — Argo CD will redeploy with config intact (same /app/config PVC)