plex.yaml

---
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v4.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: plex
  namespace: default
spec:
  interval: 1h
  chartRef:
    kind: OCIRepository
    name: app-template
    namespace: flux-system
  values:
    controllers:
      plex:
        containers:
          app:
            image:
              repository: ghcr.io/home-operations/plex
              tag: 1.43.0.10492@sha256:8cb062f2b0660bd7811387e6c799da0ce5f18112078fe21485c11adcc83a9c1c
            env:
              TZ: "America/New_York"
              PLEX_ADVERTISE_URL: https://10.0.6.53:32400,https://plex.eviljungle.com:443
              PLEX_NO_AUTH_NETWORKS: "172.17.0.0/16,10.0.2.0/24,10.0.7.0/24,10.0.3.0/24,10.244.0.0/16"
            envFrom:
              - secretRef:
                  name: plex-secret
            probes:
              liveness: &probes
                enabled: true
                custom: true
                spec:
                  httpGet:
                    path: /identity
                    port: 32400
                  initialDelaySeconds: 0
                  periodSeconds: 10
                  timeoutSeconds: 1
                  failureThreshold: 3
              readiness: *probes
              startup:
                enabled: true
                spec:
                  failureThreshold: 30
                  periodSeconds: 10
            securityContext:
              allowPrivilegeEscalation: false
              readOnlyRootFilesystem: true
              capabilities:
                drop:
                  - ALL
            resources:
              claims:
                - name: gpu
              requests:
                cpu: 500m
                memory: 2Gi
              limits:
                memory: 5Gi

    defaultPodOptions:
      resourceClaims:
        - name: gpu
          resourceClaimTemplateName: plex
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        supplementalGroups: [44]
      affinity:
        nodeAffinity:
          # Soft preferences - scheduler tries these in order but allows fallback
          preferredDuringSchedulingIgnoredDuringExecution:
            # Tier 1: Intel N100 (Gen 12 Xe) - Best transcoding + AV1 decode
            - weight: 100
              preference:
                matchExpressions:
                  - key: intel.feature.node.kubernetes.io/gpu-gen
                    operator: In
                    values:
                      - "12"
            # Tier 2: Coffee Lake UHD 630 - Excellent transcoding
            # Includes: k8s-i (i5-8500T), k8s-a (i5-9500T via GVT-g when fixed)
            - weight: 70
              preference:
                matchExpressions:
                  - key: intel.feature.node.kubernetes.io/gpu-family
                    operator: In
                    values:
                      - "coffeelake"
            # Tier 3: Kaby Lake HD 630 - Good transcoding
            # Includes: k8s-b (i3-7100)
            - weight: 50
              preference:
                matchExpressions:
                  - key: intel.feature.node.kubernetes.io/gpu-family
                    operator: In
                    values:
                      - "kabylake"

    service:
      app:
        controller: plex
        type: LoadBalancer
        loadBalancerIP: 10.0.6.53
        externalTrafficPolicy: Local
        ports:
          http:
            port: &port 32400
      # Separate ClusterIP service for Gateway API routing
      gateway:
        controller: plex
        type: ClusterIP
        ports:
          http:
            port: *port

    persistence:
      config:
        existingClaim: plex-config
      # Separate PVC for cache to avoid backing up cache files
      # This must be commented on initial install in order to avoid permission issues in '/config/Library/Application Support/Plex Media Server'
      plex-cache:
        storageClass: "ceph-block"
        accessMode: ReadWriteOnce
        size: "55Gi"
        globalMounts:
          - path: /config/Library/Application Support/Plex Media Server/Cache
      # This must be commented on initial install in order to avoid permission issues in '/config/Library/Application Support/Plex Media Server'
      nfs-nas-media:
        type: nfs
        server: nas.home
        path: /mnt/tank/media
        globalMounts:
          - path: /data
      tmpfs:
        type: emptyDir
        advancedMounts:
          plex:
            app:
              - path: /config/Library/Application Support/Plex Media Server/Logs
                subPath: logs
              - path: /transcode
                subPath: transcode
              - path: /tmp
                subPath: tmp

    rawResources:
      gpu:
        apiVersion: resource.k8s.io/v1
        kind: ResourceClaimTemplate
        spec:
          spec:
            spec:
              devices:
                requests:
                  - name: gpu
                    exactly:
                      deviceClassName: gpu.intel.com

    route:
      app:
        annotations:
          external-dns.alpha.kubernetes.io/external: "true"
          gatus.home-operations.com/endpoint: |-
            url: https://plex.eviljungle.com/identity
        parentRefs:
          - name: public
            namespace: kube-system
            sectionName: https
        hostnames:
          - &host plex.eviljungle.com
        rules:
          - backendRefs:
              - identifier: gateway
                port: *port
            timeouts:
              backendRequest: 3600s
      internal:
        annotations:
          external-dns.alpha.kubernetes.io/internal: "true"
          gatus.home-operations.com/endpoint: |-
            url: https://plex.eviljungle.com/identity
        parentRefs:
          - name: internal
            namespace: kube-system
            sectionName: https
        hostnames:
          - *host
        rules:
          - backendRefs:
              - identifier: gateway
                port: *port
            timeouts:
              backendRequest: 3600s