# 30 — Stock Jellyfin rebuild on tv.s8n.ru (ground-up) Date: 2026-05-11 Scope: brand new container, brand new volumes, zero ARRFLIX customisation. Sister docs: 29 (the failed in-place dev upgrade that led here). --- ## 1. Decision After running the dev migration (10.10.3 → 10.11.8 + scyfin) on the existing `jellyfin-dev` container, the result still carried index.html shim, Cineplex remnants, and accumulated configuration drift. Owner asked for a true clean build instead. Approach: new container, new domain, no shim, no CustomCss. Stock Jellyfin. We layer ARRFLIX brand on top once the bare server is happy. --- ## 2. Deploy ```yaml # /opt/docker/jellyfin-stock/docker-compose.yml services: jellyfin-stock: image: jellyfin/jellyfin:10.11.8 container_name: jellyfin-stock restart: unless-stopped user: "1000:1000" userns_mode: "host" environment: - TZ=Europe/London - JELLYFIN_PublishedServerUrl=https://tv.s8n.ru volumes: - /home/docker/jellyfin-stock/config:/config - /home/docker/jellyfin-stock/cache:/cache - /home/user/media:/media:ro networks: [proxy] labels: - traefik.enable=true - traefik.docker.network=proxy - traefik.http.routers.jellyfin-stock.rule=Host(`tv.s8n.ru`) - traefik.http.routers.jellyfin-stock.entrypoints=websecure - traefik.http.routers.jellyfin-stock.tls=true - traefik.http.routers.jellyfin-stock.tls.certresolver=letsencrypt - traefik.http.services.jellyfin-stock.loadbalancer.server.port=8096 ``` Volumes initialised empty. No bind-mount of index.html — the stock web UI serves from the image as-is. ### DNS ``` Pi-hole local DNS: tv.s8n.ru onyx /etc/hosts: tv.s8n.ru (appended to existing pin block) Public DNS (Gandi): none — LAN-only by design ``` (LAN IP is the standard nullstone bind, see SYSTEM.md.) `/opt/docker/pihole/etc-pihole/custom.list` is owned by root; we wrote via privileged Alpine container + `--userns=host` to bypass the userns-remap. Same trick used for the `/home/docker/jellyfin-stock/` dirs. ServerId: `adbc441eb46e475c9610c3bd5258dc6e` (fresh, not migrated from prod). --- ## 3. Library scope (P1+P2) User chose P1+P2 from `tv.s8n.ru` plan: libraries + canonical-ID lock only. No user import, no watched-state transfer, no plugins, no theme. ### Libraries added via API ```bash TOKEN= curl -X POST -H "X-Emby-Token: $TOKEN" \ "https://tv.s8n.ru/Library/VirtualFolders?name=Movies&collectionType=movies&paths=%2Fmedia%2Fmovies&refreshLibrary=false" \ -H "Content-Type: application/json" \ -d '{"LibraryOptions":{"EnableInternetProviders":true,"PreferredMetadataLanguage":"en","MetadataCountryCode":"US","SubtitleDownloadLanguages":["eng"],"SaveSubtitlesWithMedia":true,"RequirePerfectSubtitleMatch":false,"EnabledMetadataFetchers":["TheMovieDb","The Open Movie Database"],"MetadataFetcherOrder":["TheMovieDb","The Open Movie Database"]}}' curl -X POST -H "X-Emby-Token: $TOKEN" \ "https://tv.s8n.ru/Library/VirtualFolders?name=TV%20Shows&collectionType=tvshows&paths=%2Fmedia%2Ftv&refreshLibrary=false" \ -H "Content-Type: application/json" \ -d '{"LibraryOptions":{...same shape, fetchers=[TheMovieDb,TheTVDB]}}' curl -X POST -H "X-Emby-Token: $TOKEN" "https://tv.s8n.ru/Library/Refresh" ``` ### Scan result ``` MovieCount 4 SeriesCount 12 EpisodeCount 230 ``` ### Auto-scrape outcome 10 / 12 series + 4 / 4 movies matched canonical IDs without intervention. Three unmatched, all expected: ``` The Big Lez Saga (2022) TMDB --- (TMDB has no entry; Australian indie) The Donny & Clarence Show TMDB --- (IMDb tt32043762 only) Star Wars: Maul - Shadow Lord [Before Upscale] no IDs (intentional dupe folder) ``` Matched IDs (sanity-checked against prod docs): ``` American Dad! TMDB 1433 Archer TMDB 10283 Futurama TMDB 615 TVDB 73871 IMDb tt0149460 The Mandalorian TMDB 82856 The Mike Nolan Show TMDB 67160 Obi-Wan Kenobi TMDB 92830 Rick and Morty TMDB 60625 Sassy the Sasquatch TMDB 321760 Star Wars: Maul TMDB 289219 Movies The Dark Knight TMDB 155 Idiocracy TMDB 7512 The Incredible Hulk TMDB 1724 Lilo & Stitch TMDB 11544 ``` No `POST /Items/{id}` lock calls needed — the auto-scrape was clean. --- ## 4. Passwords Admin `s8n` + user `guest` created via first-run wizard with throwaway passwords. Owner asked to use the same passwords as prod. Approach for that (deferred — pending owner decision): ```sql -- prod jellyfin.db Users.Password is $PBKDF2-SHA512$iterations=2100$$ -- Copy hash from prod to stock: ATTACH '/path/to/prod-jellyfin.db' AS prod; UPDATE Users SET Password = (SELECT Password FROM prod.Users WHERE Username = Users.Username) WHERE Username IN ('s8n', 'guest'); ``` Run with container stopped. Verified the PBKDF2 hash includes the salt inline so copying the column is enough — no separate salt column. --- ## 5. Explicitly NOT done - No theme (no scyfin, no Cineplex, no ElegantFin). - No `web-overrides/index.html` shim — stock Jellyfin chrome visible. - No CustomCss in `branding.xml` (file is the 225-byte default). - No plugins installed (no OpenSubtitles, no anything). - No 13-user import — only `s8n` admin + `guest`. - No home-section seed — stock defaults apply (smalllibrarytiles, resume, resumeaudio, nextup, latestmedia). Owner will iterate from here. - No backdrop pinning, no scrollbar themeing, no per-user prefs scripts. --- ## 6. State table | Instance | Domain | Image | Theme | Brand | Status | |---|---|---|---|---|---| | `jellyfin` (prod) | arrflix.s8n.ru | 10.10.3 | Cineplex v1.0.6 + INC1-7 patches | ARRFLIX | Untouched, real users on it | | `jellyfin-dev` | dev.arrflix.s8n.ru | 10.11.8 | scyfin OLED (broken brand-vs-shim mismatch) | ARRFLIX | Experimental — can be wiped | | `jellyfin-stock` | tv.s8n.ru | 10.11.8 | — | stock Jellyfin | Fresh, ready to configure | --- ## 7. Open follow-ups (none owed before owner sign-off) - Decide fate of `jellyfin-dev` (keep / wipe / repurpose). - Owner explores stock UX → identifies what to brand vs leave alone. - Eventually layer ARRFLIX skin (logo, accent, dark scrollbar) on top of stock — incrementally, documenting each step. - If migration to 10.11.8 on prod is later approved: docs/29 staged 10.10.3 → 10.10.7 → 10.11.8 path with snapshots is the playbook.