Recommended Plex workflow with sharing when accounting for HostPath validation?

[neofusion]

That's what I do now, no issues.

I don't undetstand the difference. Isn't the issue that direct file access using host paths combined with SMB could result in data corruption because SMB won't know when the file is being altered directly by another process (and probably vice versa)?

How is NFS + SMB different to that? Do the different protocols understand each other's file locks?

 

[oblivioncth]

I don't undetstand the difference. Isn't the issue that direct file access using host paths combined with SMB could result in data corruption because SMB won't know when the file is being altered directly by another process (and probably vice versa)?

How is NFS + SMB different to that? Do the different protocols understand each other's file locks?

Nope :)

I'm blanking on a few details but the lock issue is still a problem, though I think this approach may handle ACLs more gracefully since in theory the NFS server should understand NFSv4.

Doing this also avoids turning off the security check portion of host path validation which has no reason ever being off, as explained in one of my previous replies.

Overall better, but still technically some caveats. It drops to basically zero caveats though if you mount the NFS share to the container as Read Only in situations where that's acceptable.

 

[VanDuncan]

Nope :)

I'm blanking on a few details but the lock issue is still a problem, though I think this approach may handle ACLs more gracefully since in theory the NFS server should understand NFSv4.

Doing this also avoids turning off the security check portion of host path validation which has no reason ever being off, as explained in one of my previous replies.

Overall better, but still technically some caveats. It drops to basically zero caveats though if you mount the NFS share to the container as Read Only in situations where that's acceptable.

But it only works with Truecharts apps? Because the option to choose an NFS Host Path in official apps is missing. Same thing for images installed via Launch Docker Image.
For exemple, as I'm mostly using the Launch Docker Image instead of Truecharts, I can't specify the NFS option, as far as I can see.
If that's the sase, it can't be an official solution.

 

[oblivioncth]

But it only works with Truecharts apps? Because the option to choose an NFS Host Path in official apps is missing. Same thing for images installed via Launch Docker Image.
For exemple, as I'm mostly using the Launch Docker Image instead of Truecharts, I can't specify the NFS option, as far as I can see.
If that's the sase, it can't be an official solution.

Yes it is TrueCharts only. I agree it's perplexing how the official charts seem quite limited in this regard, though I imagine this is why they're working to make disabling the validation less severe.

Unfortunately the "big blue button" is in itself a feature that doesn't get much love.

There is a TrueCharts docker compose app you could try using instead that I'd imagine supports NFS like the rest of them.

When it comes to "official solutions", the two most major standouts I know of are a recent blog post where iXSystems mentioned the merits of using the NFS share feature of a TrueCharts app (I think Jellyfin?), and a reddit post where one of their head engineers said that they themselves disabled host path validation on their home install.

So... take that as you will, lol.

 

[indivision]

My 10 cents on this:

1) If the problem is not SMB but SMB + ACL, can the system be designed to detect and prevent only SMB + ACL? I try to avoid using ACL. I would happily disable it altogether in exchange for the old SMB access. But, maybe there is a technical obstacle for that solution?

2) It sounds like we can set up NFS for the app configurations. And that will allow SMB via external access to work at the same time. But, isn't that basically a bug like the fleeting ability we had to use sub-directories of SMB shares? Will this be disallowed in the future? It seems like that setup is likely to produce more bug reports for iX-Systems than the number of bugs disabling host path validation will generate...

 

[georgelza]

Thanks for the sensible reply.

I'm glad someone else agrees with the sketchiness of the aforementioned workaround.

I also particularly appreciate the first hand account of someone confirming they used Plex with a SMB shared dataset and NFSv4 ACLs without issue (read only of course).

After your response I said screw it and implemented an acceptable (to me) layout that happened to allow me to use the "workaround", just for the slight edge it gives over outright disabling HostPath validation (e.g. the rare case of actually getting support); however, I've done this knowing that it essentially causes the same conflict as you and I agree on.

So far so good. Plex is working really well, GPU passthrough and RAM disk included.

In the end you're right. Since this software is much more so directed at enterprise and more "hard core" users, in the end I might have to cut slight corners for the sake of convenience in a home setting. As long as I make note of the lines I'm crossing so that I know what may be at fault if something does go wrong, then I should be ok in the end :).

ok.

confession time,

I also from TrueNAS CORE using SMB and Plex only, 80% of my NAS is host for plex and media, with a 2nd usage for consolidated photos and documents (which is rsync'd to Google, note to self, check that thats still working after the SCALE upgrade) and then a TimeMachine backup target.
:tank/media -> Primary plex root for all media
:tank/media/download -> used to down into by qbittorrent, then moved into above destination folders. I SMB this to my MAC, then work/move files around in ./media between ./media/download to ./media/tvseries ./media/movies ./media/kidsseries ./media/kidsmoves etc. (plex just sees ./media/movies ./media/tvseries ./media/kidsmovies ./media/kidstvseries via libraries configured.
:tank/media/photos -> this is google sync'd, but also available to PMS as a photo/personal video folder.

:bunker/home/<user> -> SMB mounted to MBP and Windows, docs/addition photos etc
:bunker/TimeMachine

:app/Plex/<config>
:app/Plex/<transcode>
:app/<future app usage/data>

oh and tank is sitting at 92% usage so I need to figure something out, moving things around, getting some more HDD's / $$$ to expand, sometime relatively soon.

The current config of having me pool/dataset available to plex, but at the same time allowing me to SMB mount it onto my MBP so that I can copy content onto it, rename content works awesome.

Now I've gotten it all to work (I went the naughty way) by disabling HostPathValidation... (all make that Plex, as I'm having problems getting qbittorrent working)

Now I read TrueCharts might decide future not to work, or it already does not work when this is disabled. bit <unhappiness>. this is my home system, work with storage i give you, be that NFS presented or hostpath.

also the setting of HostPathValidation on / off system wide, would have thought maybe a pool specific option would have been better, then I could at least say leave bunker disabled, with SMB as my TimeMachine target, as Time Machine is niggly, and hell i don't want to simply create a new Time Machine file, loosing the old and the backups, if i had to reconfigure/change whats working atm.

I understand enterprise security requirements, I work in tech, but this is my home, this is a locked up private network.

Now to figure out how to get it working... before I have for the xnth time redo my libraries and users on my PMS, still have to get qbit and UnifiController working... Unify is going to be fun... I previously on CORE had it on a specific IP address that all my devices talked to, have to now reconfigure them some how because I can't have these services listening on dedicated IP's <different from my NAS>.

G

 

[georgelza]

It is a bit complicated, but that's what's being debates here.

You more-or-less have three options:
1) Don't use SMB or HostPath and instead NFS share to Plex and Windows.
2) Use the same dataset as the SMB share and Plex HostPath and disable HostPath validation. This brings all the caveats discussed previously.
3) Use the workaround shown in Daisuke's thread where you make a child dataset, SMB share the parent dataset and use the child dataset for the HostPath of Plex. But know that likely this is nearly the same as (2) and could stop working in a future update, requiring you to resort to 2 anyway.

While not necessarily OK for all containers, if you do 2 or 3 and just make sure that the HostPath for Plex is mounted as Read Only, you're pretty safe as the container won't be able to touch permissions anyway. Plex doesn't need write permissions to its library directories unless you care to delete media through the Plex UI.

I will also note that it's probably a good idea (and Daisuke does cover this) to set the runAs user of your Plex container to the same user that owns the SMB shared dataset. This would help if you decide to have the HostPath mounted as R/W.

... in these solutions...

While not necessarily OK for all containers, if you do 2 or 3 and just make sure that the HostPath for Plex is mounted as Read Only, you're pretty safe as the container won't be able to touch permissions anyway. Plex doesn't need write permissions to its library directories unless you care to delete media through the Plex UI.

this is actually a "important" feature as it allows my wife to delete some series's after she's finished watching them and don't care to watch them again... can imagine others also delete movies/series via the UI, it's convenient, and don't believe the "hosting solution" should be restricting functionality presented by the app, if the app has already been told this is your data.

G

 

[georgelza]

I'm going to get flamed...
We have the original official apps stream bye ix which expect a hostpath presented volume. but you can't use SMB on top, other words no off system access. - also the official packages does not cover everyone's use cases, and also don't allow for NFS presented storage
then you have TrueCharts, won't work with HPV disabled, won't work on HostPath presented storage, wants to use NFS, not SMB.
this is great option for someone just starting, never used TrueNAS before as they can build, install TC and immediately configure everything around NFS and off they go, for someone coming from a deployed system, that was working perfectly, this is a utter mess atm

2 conflicting "thinkings" here. neither wanting to play with the other, neither covering everything a home user would want, but their design decisions breaking the other.

just discovered my Timemachine is also now broken, haven't looked but sure it's going to be related to something re the storage access.
<good and frustrated on a Sunday morning?
G

 

[truecharts]

Our Charts work with hostPath validation disabled and work with hostPath presented storage
We just don't offer support for it (meaning you cannot ask our support staff to assist you if it doesn't work or permissions are wrong).

 

[chri5]

... Plex doesn't need write permissions to its library directories unless you care to delete media through the Plex UI.

Can you update cover images associated with albums etc if you set to read only?

 

[oblivioncth]

Can you update cover images associated with albums etc if you set to read only?

I believe so as long as your metadata storage is separate (i.e. the host path is only used for the media files themselves). You would likely have that as a PVC (e.g. "App Config Storage").

 

[skittlebrau]

Can you update cover images associated with albums etc if you set to read only?

Yes. All of that is stored in your plex config directory, which needs to have write access anyway — it's separate from your media.