𝔩𝔢𝔩𝕠𝔭𝔢𝔷
Buy Me a Coffee Connect With Me on LinkedIn
Theme

Homelab

Plex Hardening

Hardening Plex: Encrypted Storage, NetworkPolicy, and Security

Overview

This article hardens the Plex server: we migrate to encrypted storage, lock down network access with NetworkPolicy, make media read-only, and pin Helm versions. Unlike game servers, Plex has large volumes (500GB+ media) that can't be backed up locally, so we use a migration job to copy directly between PVCs.

Tip:Having trouble? See v1.10.2 for what your setup should look like after completing this article.

Before You Begin

Prerequisites

What We're Hardening

ComponentBeforeAfter
StorageUnencrypted longhornEncrypted longhorn-encrypted
NetworkPolicyNoneEgress limited
Media mountRead-writeRead-only
Helm chart0.x (floating)0.11.0 pinned

Why These Controls

Encrypted Storage: Config and media are protected at rest1. Physical disk theft or node compromise no longer exposes plaintext data.

NetworkPolicy: Plex needs internet access for metadata and authentication. We block access to other VLANs (Network, Drive) while allowing required services.

Read-only Media: A compromised Plex container shouldn't be able to delete or corrupt your media library.

Helm Pinning: Ensures reproducible deployments without surprise breaking changes.

Migration Strategy

Plex has two large PVCs that can't be backed up locally:

  • plex-config (50Gi) - metadata, database, preferences
  • plex-media (500Gi) - media files

Instead of backup/restore, we run a migration job that copies directly from the old unencrypted PVCs to new encrypted PVCs while Plex is stopped.

This article requires multiple commits with a manual migration step between them. Tags: v1.10.0 (encrypted PVCs), v1.10.1 (switch to encrypted), v1.10.2 (cleanup).

Migration Performance

Expect ~35-45 MB/s throughput when migrating to encrypted volumes. This is normal given:

  • rsync is single-threaded - caps at ~37 MB/s even on fast disks2
  • LUKS encryption overhead - minimal with modern CPUs but adds latency3
  • Longhorn's storage layer - distributed replication adds overhead vs direct disk

Time estimates by data size:

Data SizeEstimated Time
50GB~20-25 minutes
200GB~1.5 hours
500GB~3-4 hours

Parallelization tools like k-rsync4 exist but aren't worth the complexity for a one-time migration.

Check Current Helm Version

helm list -n plex

Note the chart version (e.g., plex-media-server-0.11.0) - this is what you'll pin.

Deploy Encrypted PVCs

Create new encrypted PVCs and NetworkPolicy. Plex continues running on the old PVCs during this step.

PVCs: Create Encrypted Volumes

k8s/apps/plex/pvc.yaml:

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
    name: plex-config-encrypted
    namespace: plex
spec:
    accessModes:
        - ReadWriteOnce
    storageClassName: longhorn-encrypted
    resources:
        requests:
            storage: 50Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
    name: plex-media-encrypted
    namespace: plex
spec:
    accessModes:
        - ReadWriteOnce
    storageClassName: longhorn-encrypted
    resources:
        requests:
            storage: 500Gi

NetworkPolicy: Internet-Only Egress

k8s/apps/plex/networkpolicy.yaml:

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: plex
    namespace: plex
spec:
    podSelector: {}
    policyTypes:
        - Egress
    egress:
        # DNS resolution
        - to:
              - namespaceSelector:
                    matchLabels:
                        kubernetes.io/metadata.name: kube-system
          ports:
              - protocol: UDP
                port: 53
        # Internet (Plex auth, metadata)
        # Block private ranges
        - to:
              - ipBlock:
                    cidr: 0.0.0.0/0
                    except:
                        - 10.0.0.0/8
                        - 172.16.0.0/12
                        - 192.168.0.0/16

Kustomization: Add PVC and Policy

k8s/apps/plex/kustomization.yaml:

# ... existing header ...
resources:
    - namespace.yaml
    - pvc.yaml
    - configmap.yaml
    - secret.sops.yaml
    - helmrelease.yaml
    - networkpolicy.yaml # ADD

Git: Commit PVC and NetworkPolicy

git add k8s/apps/plex/pvc.yaml k8s/apps/plex/networkpolicy.yaml k8s/apps/plex/kustomization.yaml
git commit -m "feat(plex): add encrypted PVCs and NetworkPolicy"
git push

Flux: Sync PVC and Policy

flux reconcile source git flux-system
flux reconcile kustomization sync

Verify: PVCs Created

kubectl get pvc -n plex -w

Expected: Four PVCs - two old (plex-config, plex-media) and two new encrypted (plex-config-encrypted, plex-media-encrypted). All should show Bound. Press Ctrl+C to exit watch.

Run Migration

Kubectl: Stop Plex

Stop Plex so data isn't changing during migration:

kubectl scale statefulset -n plex plex-plex-media-server --replicas=0
kubectl wait --for=delete pod -n plex -l app.kubernetes.io/name=plex-media-server --timeout=120s

Job: Data Migration

Create the migration job file. This file is applied manually and deleted after migration - do not add it to kustomization.yaml.

k8s/apps/plex/migration-job.yaml:

---
apiVersion: batch/v1
kind: Job
metadata:
    name: plex-migrate
    namespace: plex
spec:
    ttlSecondsAfterFinished: 86400
    backoffLimit: 0
    template:
        spec:
            containers:
                - name: migrate
                  image: alpine:3.19
                  command:
                      - sh
                      - -c
                      - |
                          apk add --no-cache rsync
                          echo "Migrating config..."
                          rsync -av --progress /old-config/ /new-config/
                          echo "Migrating media..."
                          rsync -av --progress /old-media/ /new-media/
                          echo "Migration complete"
                  volumeMounts:
                      - name: old-config
                        mountPath: /old-config
                        readOnly: true
                      - name: new-config
                        mountPath: /new-config
                      - name: old-media
                        mountPath: /old-media
                        readOnly: true
                      - name: new-media
                        mountPath: /new-media
                  resources:
                      requests:
                          memory: "256Mi"
                          cpu: "500m"
                      limits:
                          memory: "512Mi"
                          cpu: "2000m"
            volumes:
                - name: old-config
                  persistentVolumeClaim:
                      claimName: plex-config
                - name: new-config
                  persistentVolumeClaim:
                      claimName: plex-config-encrypted
                - name: old-media
                  persistentVolumeClaim:
                      claimName: plex-media
                - name: new-media
                  persistentVolumeClaim:
                      claimName: plex-media-encrypted
            restartPolicy: Never

Git: Commit Migration Reference

Optionally commit the migration job for reference. It's not in kustomization.yaml so Flux won't apply it.

git add k8s/apps/plex/migration-job.yaml
git commit -m "docs(plex): add migration job for reference (not in kustomization)"
git push

Kubectl: Apply Migration Job

kubectl apply -f k8s/apps/plex/migration-job.yaml

Check: Migration Progress

Wait for the pod to start:

kubectl get pod -n plex -l job-name=plex-migrate -w

Once it shows Running, follow the logs:

kubectl logs -n plex -f job/plex-migrate

This may take a while depending on media size (~35-45 MB/s throughput). For 500GB, expect 3-4 hours.

Expected: Log shows rsync progress, ends with "Migration complete".

Verify: Migration Complete

# Check job completed
kubectl get job -n plex plex-migrate

# Check old PVC sizes
kubectl run -n plex check-old --rm -it --restart=Never --image=alpine \
  --overrides='{
    "spec": {
      "containers": [{
        "name": "check",
        "image": "alpine",
        "command": ["sh", "-c", "du -sh /config /media"],
        "volumeMounts": [
          {"name": "config", "mountPath": "/config"},
          {"name": "media", "mountPath": "/media"}
        ]
      }],
      "volumes": [
        {"name": "config", "persistentVolumeClaim": {"claimName": "plex-config"}},
        {"name": "media", "persistentVolumeClaim": {"claimName": "plex-media"}}
      ]
    }
  }'

# Check new PVC sizes (should match old)
kubectl run -n plex check-new --rm -it --restart=Never --image=alpine \
  --overrides='{
    "spec": {
      "containers": [{
        "name": "check",
        "image": "alpine",
        "command": ["sh", "-c", "du -sh /config /media"],
        "volumeMounts": [
          {"name": "config", "mountPath": "/config"},
          {"name": "media", "mountPath": "/media"}
        ]
      }],
      "volumes": [
        {"name": "config", "persistentVolumeClaim": {"claimName": "plex-config-encrypted"}},
        {"name": "media", "persistentVolumeClaim": {"claimName": "plex-media-encrypted"}}
      ]
    }
  }'

Switch to Encrypted PVCs

Update HelmRelease to use the encrypted PVCs with read-only media and pinned version.

HelmRelease: Switch to Encrypted

k8s/apps/plex/helmrelease.yaml:

# ... existing HelmRepository ...
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
    name: plex
    namespace: plex
spec:
    interval: 30m
    chart:
        spec:
            chart: plex-media-server
            version: "0.11.0" # PIN to current version
            sourceRef:
                kind: HelmRepository
                name: plex
    # ... existing valuesFrom ...
    values:
        # ... existing image, extraEnv, service ...

        pms:
            configExistingClaim: plex-config-encrypted # CHANGE from plex-config

        extraVolumes:
            - name: media
              persistentVolumeClaim:
                  claimName: plex-media-encrypted # CHANGE from plex-media
            - name: dev-dri
              hostPath:
                  path: /dev/dri
                  type: Directory

        extraVolumeMounts:
            - name: media
              mountPath: /data/media
              readOnly: true # ADD: prevent media modification
            - name: dev-dri
              mountPath: /dev/dri

Git: Commit HelmRelease Update

git add k8s/apps/plex/helmrelease.yaml
git commit -m "feat(plex): switch to encrypted PVCs with read-only media"
git push

Flux: Sync HelmRelease Update

flux reconcile source git flux-system
flux reconcile kustomization sync

Kubectl: Start Plex

The manual scale-down persists until you scale back up (Flux doesn't override imperative changes unless replicas is explicitly set in HelmRelease values).

kubectl scale statefulset -n plex plex-plex-media-server --replicas=1

Plex will start using the encrypted volumes.

Verify Hardening

Verify: Pod Running

kubectl get pods -n plex -w

Expected: Pod transitions to Running with all containers ready. Press Ctrl+C to exit watch.

Verify: Encrypted PVCs in Use

kubectl get pod -n plex -l app.kubernetes.io/name=plex-media-server -o jsonpath='{.items[0].spec.volumes[*].persistentVolumeClaim.claimName}'

Expected: plex-config-encrypted and plex-media-encrypted

Verify: NetworkPolicy Applied

kubectl get networkpolicy -n plex

Expected: plex policy listed.

Verify: Plex Functional

Open Plex in your browser and verify:

  • Library loads correctly
  • Media plays
  • Metadata is intact

Clean Up Migration Resources

Kubectl: Delete Job and Old PVCs

kubectl delete job -n plex plex-migrate
kubectl delete pvc -n plex plex-config plex-media

PVCs: Remove Old Definitions

Remove old PVC definitions from k8s/apps/plex/pvc.yaml (keep only the encrypted PVCs):

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
    name: plex-config-encrypted
    namespace: plex
spec:
    accessModes:
        - ReadWriteOnce
    storageClassName: longhorn-encrypted
    resources:
        requests:
            storage: 50Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
    name: plex-media-encrypted
    namespace: plex
spec:
    accessModes:
        - ReadWriteOnce
    storageClassName: longhorn-encrypted
    resources:
        requests:
            storage: 500Gi

Git: Commit Cleanup

rm k8s/apps/plex/migration-job.yaml
git add k8s/apps/plex/pvc.yaml
git rm k8s/apps/plex/migration-job.yaml
git commit -m "chore(plex): remove old PVCs and migration job"
git push

Next Steps

With all applications hardened, encrypt the Talos system disks to protect etcd and cluster state.

See: SecureBoot & Encryption Prep

For Plex performance tuning (4K playback, GPU transcoding):

Resources

Footnotes

  1. Longhorn, "Volume Encryption," longhorn.io. Accessed: Mar. 1, 2026. [Online]. Available: https://longhorn.io/docs/1.9.2/advanced-resources/security/volume-encryption/ ↩

  2. J. Corbet, "A look at rsync performance," lwn.net. Accessed: Mar. 1, 2026. [Online]. Available: https://lwn.net/Articles/400489/ ↩

  3. Linux Mint Forums, "Performance impact of LUKS encryption," forums.linuxmint.com. Accessed: Mar. 1, 2026. [Online]. Available: https://forums.linuxmint.com/viewtopic.php?t=410375 ↩

  4. D. Gledhill, "k-rsync - kube-native parallel rsync," github.io. Accessed: Mar. 1, 2026. [Online]. Available: https://doughgle.github.io/k-rsync/ ↩

Previous
Factorio Hardening
Next
SecureBoot & Encryption Prep