Media & Entertainment¶

Media server, download automation, request management, and music streaming.

All services run on hoarder (Docker), managed via the Unraid UI. Download apps share a VPN network stack via PrivoxyVPN.

Media Server¶

Plex¶

hoarder · Docker

Media server. Streams movies, TV shows, and music to all devices on the network and remotely.

Documentation · ingress

plex-relay¶

k3s-oci-m3 · ingress

nginx pod running on the OCI node that SSL-proxies port 32400 from the internet to Plex on hoarder via Tailscale. Required because Plex direct play needs port 32400 which cannot go through the Cloudflare tunnel.

values.yaml

Real client IP not propagated to Tautulli

The relay correctly sets X-Real-IP and X-Forwarded-For headers, but Tautulli still shows the Tailscale IP of k3s-oci-m3 because it reads IPs from Plex's sessions API — Plex reports the relay IP, not the original client.

Attempted (both failed): Trusting the relay IP in Plex Network settings · Plex "List of IP addresses allowed without auth".

Root cause: Plex ignores X-Forwarded-For for private/Tailscale (100.x.x.x) source IPs. References: Tautulli-Issues#28 · Plex Forum — X-Forwarded-For ignored for Tailscale IPs

Tautulli¶

hoarder · Docker

Plex monitoring and analytics. Tracks play history, sends notifications, and provides usage statistics.

Documentation · ingress

Client IPs show as relay Tailscale IP

See the known issue documented under plex-relay above.

Kometa¶

hoarder · Docker

Plex metadata and collection automation tool (formerly Plex Meta Manager).

Documentation

Seerr¶

hoarder · Docker

Media request management. Lets users browse and request movies and TV shows, which are then routed to Radarr/Sonarr.

Documentation · ingress

Download Automation¶

All *arr apps and download clients run inside the PrivoxyVPN network stack.

PrivoxyVPN¶

hoarder · Docker

VPN gateway and shared network namespace for all downloader and *arr containers. All traffic from these containers is routed through the VPN.

Documentation