feat(media): rootless Podman + quadlet host CT 5114, youtarr migrated (ADR-0009 Phase 2a)

[ChrisonSimtian]

Closes #302. Phase 2a of #283, on the platform from #294 and the pattern proven in #285.

Adds the Media stack's generic container host (not a youtarr box) and migrates youtarr + its bundled MariaDB onto it as three quadlets. CT 5113 is left STOPPED, not destroyed.

First multi-container quadlet deployment — the pattern #303 needs

youtarr.network gives youtarr DNS resolution of youtarr-db via aardvark-dns. Compose gave that for free; quadlets do not. Verified live:

youtarr-db.dns.podman → 10.89.0.2

That's the main de-risking for #303 (ten containers, all needing name resolution) — Phase 1 was a single container with no peers, so this had never been exercised.

userns: the decision is per stack member, not per host

Member	Mapping	Why
youtarr	none — no :U, no UserNS=	writes to NFS; runs as container-root, which the default rootless mapping already sends to the podman user
youtarr-db	keep-id:uid=999,gid=999	fixed uid 999 on local disk, data dir owned by podman

:U on the NFS volume would chown recursively — 879 GB across NFS. Never.

My ownership prediction was wrong, and reality is better

I expected rootless writes to land under a different host uid than Docker's (101000 vs 100000), leaving two owner uids on the share. They don't: the NAS export already squashes every incoming uid to 1024:100.

A probe written by the podman container landed as 1024:100 — byte-identical to files the old Docker setup wrote — and Plex (CT 5008, same share) read it back. So the three userns layers are irrelevant to NFS ownership, and the NAS-side squashing that #208 would have added as "the real fix" is already in place. Docs corrected rather than left as written.

Two more findings, documented

depends_on: condition: service_healthy has no quadlet/systemd equivalent. After= waits for started, not ready, and a host-side ExecStartPre wait can't work either — youtarr-db is a podman-network DNS name, unresolvable from the CT. Covered the systemd way: Restart=always + RestartSec=10, so youtarr crash-retries until MariaDB accepts connections.

A healthcheck IS expressible here, unlike Mate's in #285 — this image ships curl, so the command needs no quotes and survives systemd's parser. That confirms gotcha #10 is specifically about quoted commands, not healthchecks generally. MariaDB's own check stays dropped: it needs quoting and would put the root password in the unit file.

One preserved oddity: YOUTUBE_OUTPUT_DIR is passed as the host path (/mnt/youtube) while data mounts at /usr/src/app/data. It looks wrong, it's exactly how CT 5113 runs, and I verified that against the live container before converting — deliberately not "fixed".

Verified on CT 5114 (hpe-01)

• NFS mp0 + ensure-data-mount.sh hookscript applied by converge (3 applied, 0 failed)
• Both units active; youtarr healthy
• Migrated DB intact: channels=8, videos=95, jobs=645 — and the app log flipped from Auto-downloads disabled (fresh DB) to enabled (migrated), proving it reads the real config
• NFS write → Plex read proven end to end
• Boot survival 5s after an LXC restart, podman-auto-update.timer active

Three secrets registered in Bitwarden SM + secrets.env.template, consumed as podman secrets.

Note on applying

Applied from an isolated single-member stack dir, since the engine still has no per-member converge filter and converge stacks/Media --apply would touch the other 14 members.

🤖 Generated with Claude Code