PlumNet 1.0

Built a mobile-first PWA with server-side Jellyfin authentication; credentials are validated upstream and never stored by PlumHome.

Wrapped Jellyfin access tokens inside encrypted, HTTP-only, SameSite session cookies and kept artwork, dashboard, and telemetry routes authenticated.

Integrated Jellyfin Resume and Latest APIs for per-user playback position, production year, ratings, parental rating, recent additions, and protected artwork proxying.

Added a least-privilege telemetry pipeline for Radarr/Sonarr queue stages and shared-storage capacity, explicitly excluding torrent hashes, peers, paths, release names, and application API keys.

Added concurrent dashboard fetching with partial-failure handling, native refresh, abortable requests, responsive shelves, installable PWA metadata, and privacy-safe service status.

Resolved recurring multi-client transcode failures on iPhone and Wholphin/Fire TV. Jellyfin's FFmpeg logs showed CUDA_ERROR_NO_DEVICE and exit code 187 whenever a title required NVIDIA transcoding after the GPU had been idle.

Enabled NVIDIA persistence mode at VM startup, recreated Jellyfin to clear its stale NVIDIA runtime attachment, and retained the pre-change Compose file as compose.yaml.pre-gpu-fix-20260725.

Added an in-container CUDA health check plus a watchdog that recreates only Jellyfin when GPU access becomes unhealthy, replacing the previous full-server-reboot recovery pattern.

After reboot, validated nvidia-smi in both the VM and Jellyfin container, successful CUDA initialization, and a real two-frame H.264 NVENC hardware encode with no new FFmpeg code-187 errors.

Diagnosed /web/ failures that returned 'Error processing request' while the container remained healthy. Logs traced the failure to ObjectDisposedException in Jellyfin.Plugin.FileTransformation.

Isolated Jellyfin Enhanced 11.12.0.0 after its transformation hooks conflicted with File Transformation 2.5.11.0, restarted Jellyfin, and restored HTTP 200 locally, over LAN, and through stream.theplummers.org.

Re-enabled Jellyfin Enhanced under observation and confirmed fresh logs contained no recurring ObjectDisposedException or request-processing errors.

After the Proxmox kernel upgrade and reboot, confirmed the GTX 1660 Ti remained bound to vfio-pci and passed through to media VM 202 via hostpci0 with x-vga enabled.

Isolated Spider-Man playback failure to a malformed MP4 rather than the Fire TV or GPU. FFmpeg reported 'Referenced QT chapter track not found', could not enumerate streams, and exited with code 234; replacement of the damaged release was recommended.

Exposed authenticated continue-watching progress, latest titles, artwork, community ratings, and official ratings in PlumHome without making the Jellyfin API public.

Traced repeated getaddrinfo EAI_AGAIN errors for TMDB, GitHub, Gravatar, and Anime-List to PLUM-ARR using the offline Pi-hole as its sole resolver.

Persistently moved PLUM-ARR netplan DNS to AdGuard, flushed the live resolver cache, and recovered the public Seerr route to HTTP 200 in roughly 0.3 seconds.

Separated the DNS fault from NGINX Proxy Manager and media storage by confirming both the public proxy path and CIFS mount were healthy during diagnosis.

Mapped Radarr/Sonarr activity into family-safe Finding, Downloading, Getting ready, and Needs attention states on PlumHome.

Added a Docker-native Seerr health check with a rollback copy of the pre-change Compose configuration.

Connected Sonarr queue data to the two-minute telemetry collector and normalized it into title, progress, ETA, and family-safe pipeline stages.

Added a Docker-native health check and included container state, disk capacity, and Compose validation in the Sunday maintenance report.

Kept the Sonarr UI and API private; only a minimized telemetry projection leaves PLUM-ARR.

Connected Radarr queue data to PlumHome with normalized progress and processing state while filtering download-client internals.

Added a Docker-native health check and weekly read-only Compose and capacity reporting.

Kept Radarr administration LAN/VPN-only and restricted telemetry collection to the fields required by the family dashboard.

Added Docker-native health checks for both clients and retained timestamped pre-change Compose files for rollback.

Included health and filesystem capacity in a non-mutating weekly report that does not pull images, prune data, recreate containers, or trigger upgrades.

Excluded torrent hashes, peers, filenames, release names, credentials, and download paths from the PlumHome telemetry payload.

Added native health checks to Prowlarr and FlareSolverr; verified existing health coverage for Byparr and deunhealth.

Documented the Docker namespace failure mode where services using network_mode: service:gluetun retain a reference to a removed Gluetun container.

Established a targeted force-recreate procedure for Prowlarr and a full dependent-stack recovery path when Gluetun's network namespace changes.

Confirmed the active Byparr services belong to the primary Servarr project despite a separate legacy ByparrProxy Compose path.

Added Docker-native health checks to both applications with pre-change Compose backups.

Included both services in weekly container-health, filesystem-capacity, and Compose-validation reporting.

Confirmed the existing Gluetun health check and documented the Servarr network layout, including its fixed protected-network role.

Added an operational recovery sequence for stale container namespace references after Gluetun recreation, avoiding misdiagnosis as an application-level outage.

Preserved the rule that Gluetun-dependent services are recreated deliberately and verified together rather than unattended.

Replaced CIFS-through-plum-apps with direct NFSv4.2 access to the Proxmox-hosted ZFS dataset, removing an unnecessary storage hop.

Configured a hard systemd automount with negotiated 1 MiB read/write sizes for the media data path.

Removed the ignored x-systemd.device-timeout option from PLUM-ARR's fstab after validating the active NFS mount.

Confirmed shared media capacity, mount availability, container access, and the intended exclusion of replaceable media from system backups.

Deployed Uptime Kuma 2.4.0 in unprivileged CT 103 with 1 vCPU, 512 MB RAM, an 8 GB root disk, no Docker socket, and no-new-privileges enabled.

Created 60-second checks with two retries for four public services and private checks for the proxy, RMM, Proxmox, UniFi, SMB, Pi-hole, and AdGuard.

Corrected three false-down states caused by DNS monitor conditions serialized as JSON null; Kuma 2.4 requires an empty array.

Changed the RMM monitor from a blocked direct-VM probe to its working published HTTPS route, matching the actual network policy.

Attached priority-1, device-scoped Pushover alerts with a 3600-second TTL to 11 leaf monitors while excluding parent groups to prevent duplicate notifications.

Deployed PBS 4.2.3 on separate downstairs hardware with an ext4 NVMe datastore and a least-privilege DatastoreBackup API token.

Enabled client-side encryption with the recovery material retained separately from the backup datastore.

Scheduled a 03:00 backup for seven production guests, daily pruning at 06:00, Sunday verification at 08:00, and garbage collection at 12:00.

Applied retention of 3 daily, 4 weekly, and 2 monthly snapshots; explicitly included plum-apps /docker and excluded its 2.5 TB replaceable /data dataset.

Restored the CT 103 snapshot as isolated CT 104 with no network interface, booted its recovered LVM disk, started Uptime Kuma, and verified Compose plus persistent kuma.db before removing the test guest.

Deployed AdGuard Home with Unbound bound only to 127.0.0.1:5335; AdGuard forwards exclusively to the local recursive resolver.

Validated normal recursion, authenticated DNSSEC answers, and SERVFAIL for the deliberately broken dnssec-failed.org test domain.

Removed active references to the offline Pi-hole from Proxmox, PlumRMM, Uptime Kuma, plum-apps, plum-proxy, and PLUM-ARR; PBS already used AdGuard.

Kept the Unbound recursion port off the LAN and preserved pre-change AdGuard configuration under a dedicated backup path.

Updated Pi-hole Core, Web, and FTL along with the Ubuntu host, installed the newer 6.8.0-136 kernel, and verified zero immediately applicable updates after reboot.

Confirmed Pi-hole FTL, Unbound, and SSH services; documented TCP/UDP 53, web ports, and the local Unbound listener.

Captured hardware, storage, temperature, virtualization, firmware, and CPU-security state for future maintenance and failover planning.

Installed 178 upgrades and five new packages across Proxmox, QEMU, ZFS, firmware, OpenSSH, OpenSSL, systemd, firewall components, and backup clients.

Rebooted into Proxmox 9.2.5 on kernel 7.0.14-6-pve and verified all intended VMs/LXCs autostarted.

Confirmed both ZFS pools remained ONLINE, PBS reconnected, public ingress returned, RMM SNI routing worked, and the GTX 1660 Ti remained attached to vfio-pci for VM 202.

Enabled the Proxmox firewall with default-deny host ingress, default-allow egress, and a temporary current-LAN management allowance pending VLAN migration.

Patched 113 packages on plum-proxy, including 90 security updates covering OpenSSH, OpenSSL, Docker, containerd, AppArmor, systemd, libc, Git, and curl.

Rebooted the proxy and confirmed the landing page, status page, PlumStream, PlumRequests, and RMM routes returned successfully.

Configured HAProxy TLS-SNI routing for rmm, api, and mesh hostnames while passing other HTTPS traffic to NGINX Proxy Manager.

Published the status hostname through NPM with the existing wildcard certificate and a DNS-only Cloudflare record.

Enabled UFW default-deny ingress with explicit public TCP 80/443 and a temporary LAN management allowance.

Removed the obsolete helloworld service on TCP 8888 and retired a Twingate connector restart loop caused by its placeholder tenant configuration.

Redesigned the landing page around PlumStream, PlumRequests, invitation-only PlumSupport, onboarding, privacy, and device-specific Jellyfin setup.

Removed public Proxmox and third-party stream links and excluded internal addresses, hostnames, software versions, and device inventory from public content.

Added a systemd timer that refreshes a minimal health.json every minute with only online/degraded states for media, requests, and support.

Added accessible keyboard navigation, mobile layouts, install guidance for TV, iOS, Android, desktop, and browser clients, plus low-profile community privacy resources.

Applied a reversible PlumRMM presentation layer with PlumIT Remote Operations naming, custom plum/slate login styling, favicon, mark, accent colors, and a persistent family-site link.

Routed TacticalRMM frontend, API, and MeshCentral hostnames through HAProxy using TLS SNI without exposing unrelated proxy administration.

Kept remote operations behind the VM's existing network policy and monitored the working published HTTPS endpoint instead of bypassing policy with a direct probe.

Created a repeatable deployment helper with timestamped server-side backups because TacticalRMM frontend upgrades can replace the customized index.

Enabled default-deny UFW on plum-proxy and plum-apps while retaining the exact public web, SMB, and current-LAN administration paths required for service continuity.

Enabled Proxmox datacenter firewall enforcement and verified management, guest startup, storage, backup, and proxy reachability after the change.

Documented VLAN 50 Guest, VLAN 100 Work, and VLAN 150 IoT behavior plus a staged Management/Server/Trusted/Voice segmentation plan.

Removed the unused Homarr container after confirmation, reducing retained attack surface and abandoned service state.

Created a complete host, VM/LXC, storage, Docker, network, DNS, public-routing, and service inventory with security audit and quick-reference handoff documents.

Installed a Sunday 10:15 read-only PLUM-ARR maintenance report covering filesystem capacity, Docker usage, container health, and Compose validation.

Removed PLUM-ARR's recurring cron EXTRA_OPTS warning by explicitly defining the option as empty and retaining the original file for rollback.

Standardized pre-change backups, Compose validation, targeted recreation, post-change logs, and rollback notes for live household infrastructure changes.

Audited ZFS and sampled SMART health, documented the spare-disk iCloud replacement pilot, and tabled deployment until redundancy and cable health are addressed.