Media Server

Overview#

A media server that turned into a virtualization stack, and then into the single most useful thing on my CV. A homelab in everything except the home - it lives at work, on work hardware. The real one is still waiting on a house to put it in.

It runs Jellyfin and live television for people who have no idea there's a virtualization host, a ZFS pool and a segmented network underneath. That's the point. It's a real service with real users, which is precisely why it was worth building.

The full story, including everything that went wrong, is in The media server that taught me infrastructure.

Why it exists#

The WiFi covering the gym was too weak to stream anything without buffering. Rather than fight the wireless coverage, I moved the content onto the local network where there was gigabit of unused capacity.

The second reason mattered more: I wanted to learn Linux and infrastructure on something with real consequences. A lab VM breaking costs nothing and teaches nothing. A media server going down gets noticed, and that pressure turned out to be the most effective teacher I've had.

Architecture#

flowchart TD
  subgraph Host["Proxmox VE on a Dell OptiPlex Micro"]
    J[LXC: Jellyfin<br/>Quick Sync transcoding]
    T[LXC: TVHeadend]
  end

  Z[(Local ZFS RAIDZ1<br/>reclaimed disks)] --> J
  S[(Synology DS923+<br/>NFS, long-term)] --> J
  IP[IPTV multicast<br/>dedicated VLAN] --> T
  T --> J
  J --> CL[Clients: movies, shows,<br/>music, live TV]

Virtualization. Proxmox VE, with every service in its own unprivileged LXC container. Snapshot before a change, roll back in seconds, back up on a schedule.

Storage. Media on a local ZFS RAIDZ1 pool built from reclaimed drives, chosen for checksumming and snapshots after a bad experience with silent read errors. The Synology continues to serve long-term storage over NFS. The OS lives on its own SSD.

Transcoding. Intel Quick Sync on the host iGPU, passed through to the Jellyfin container. Turned a machine considered too old to keep into one that handles multiple simultaneous streams.

Networking. Separate VLANs for administration, storage, services and IPTV, with inter-VLAN routing and firewall rules between them.

Live TV. TVHeadend receives multicast television streams on the IPTV VLAN, maps services to channels, and presents them to Jellyfin so live television appears alongside the on-demand libraries.

The evolution#

Each rebuild was driven by a limitation of the previous one:

What it taught me#

Old enterprise hardware isn't automatically better. The EqualLogic SAN looked like an upgrade over consumer disks in a plastic enclosure. It had been decommissioned for a reason, and weeks of I/O errors proved it. Knowing when to abandon an approach is an engineering skill.

Permissions are the same lesson three times. Docker bind mounts, GPU device access, and unprivileged LXC UID mapping are one problem wearing different hats: a process runs as a numeric ID, and the filesystem only cares about the number.

Multicast fails silently. A stream that stopped until TVHeadend was restarted turned out to be IGMP group membership expiring with nothing to refresh it. The network was correctly forwarding traffic to nobody. Diagnosing it with bridge mdb, ip maddr and tcpdump taught me more than any lab.

Constraints drove the learning. With no budget, every capability had to come from understanding something well enough to repurpose it.

What it fed into#

The VLAN design and inter-VLAN routing here went directly into a production network migration at work. The Linux, Docker and storage work underpins the Tracker and the fiventhree.com domain, both of which run on infrastructure I manage the same way.