coop/docs/SETUP-INFRASTRUCTURE.md

CoopCredits Setup for 172.20.1.0/24 Infrastructure

This guide covers setting up CoopCredits with your existing Plex/Tautulli/Overseer infrastructure.

Prerequisites

• Server running Docker and Docker Compose
• Access to 172.20.1.0/24 network
• API keys from Tautulli and Overseer
• Domain name (coop.hobokenchicken.com) pointing to your server

Network Overview

┌─────────────────────────────────────────────────────────────────┐
│                     CoopCredits Server                           │
│                    (Your Server IP)                              │
│                         :443                                     │
└─────────────────────────────────┬───────────────────────────────┘
                                  │ HTTPS
        ┌─────────────────────────┼──────────────────────────┐
        │                         │                          │
        ▼                         ▼                          ▼
┌──────────────┐         ┌──────────────┐          ┌──────────────┐
│     Plex     │         │   Tautulli   │          │   Overseer   │
│172.20.1.220  │         │172.20.1.255  │          │172.20.1.225  │
│   :32400     │         │   :8181      │          │   :5055      │
└──────────────┘         └──────────────┘          └──────────────┘

Quick Start

1. Clone Repository

cd /opt
git clone <repository> coop-credits
cd coop-credits

2. Run Infrastructure Setup

./deployment/setup-infrastructure.sh

This script will:

• Test connectivity to your services (Plex, Tautulli, Overseer)
• Generate a secure .env file
• Check SSL certificate status
• Output configuration instructions

3. Configure Environment

Edit the generated .env file:

nano .env

Add your API keys:

# Get from Tautulli: Settings > Web Interface > API
TAUTULLI_API_KEY=your-tautulli-api-key

# Get from Overseer: Settings > General > API Key
OVERSEER_API_KEY=your-overseer-api-key

# Get from https://plex.tv/claim or Plex settings
PLEX_CLIENT_ID=your-plex-client-id
PLEX_CLIENT_SECRET=your-plex-client-secret

4. Setup Solana

npm run setup:solana

This will:

• Install Solana CLI
• Create a devnet wallet
• Request airdrop
• Output the private key for your .env file

Copy the SOLANA_MINT_AUTHORITY_KEYPAIR into your .env file.

5. Deploy Solana Program

cd anchor-program
anchor build
anchor deploy

Update SOLANA_PROGRAM_ID in .env with the deployed program ID.

6. Setup SSL Certificates

Option A: Let's Encrypt (Recommended)

# Obtain certificate
docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
  --webroot -w /var/www/certbot \
  -d coop.hobokenchicken.com \
  --agree-tos --no-eff-email

# Update nginx config to use Let's Encrypt paths
# Edit docker/nginx/nginx.prod.conf:
#   ssl_certificate /etc/letsencrypt/live/coop.hobokenchicken.com/fullchain.pem;
#   ssl_certificate_key /etc/letsencrypt/live/coop.hobokenchicken.com/privkey.pem;

Option B: Existing Certificates

cp /path/to/your/cert.pem docker/nginx/ssl/cert.pem
cp /path/to/your/key.pem docker/nginx/ssl/key.pem

Option C: Self-Signed (Testing only)

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout docker/nginx/ssl/key.pem \
  -out docker/nginx/ssl/cert.pem \
  -subj '/CN=coop.hobokenchicken.com'

7. Deploy

./deployment/deploy-production.sh

8. Configure Tautulli Webhook

1. Open Tautulli: http://172.20.1.255:8181
2. Go to Settings > Notification Agents
3. Click Add a new notification agent > Webhook

Configuration:

• Webhook URL: https://coop.hobokenchicken.com/webhooks/tautulli
• Webhook Method: POST
• Content Type: application/json

JSON Payload:

{
  "action": "watched",
  "user_id": "{user_id}",
  "username": "{username}",
  "rating_key": "{rating_key}",
  "session_key": "{session_key}",
  "media_type": "{media_type}",
  "title": "{title}",
  "grandparent_title": "{grandparent_title}",
  "started": "{started}",
  "stopped": "{stopped}",
  "percent_complete": "{percent_complete}",
  "is_new": "{is_new}"
}

Triggers: Enable Watched

9. Configure Overseer Webhook

1. Open Overseer: http://172.20.1.225:5055
2. Go to Settings > Notifications
3. Enable Webhook

Configuration:

• Webhook URL: https://coop.hobokenchicken.com/webhooks/overseer
• Authorization Header: Bearer your-webhook-secret-from-env

JSON Payload:

{
  "request_id": "{{request.id}}",
  "status": "{{request.status}}",
  "media_type": "{{media.media_type}}",
  "title": "{{media.title}}"
}

Events: Enable Request Approved and Request Declined

Verification

Test Connectivity

./deployment/health-check.sh

Watch Mode

./deployment/health-check.sh --watch

Manual Tests

Test Tautulli webhook:

curl -X POST https://coop.hobokenchicken.com/webhooks/tautulli \
  -H "Content-Type: application/json" \
  -d '{
    "action": "watched",
    "user_id": "12345",
    "username": "testuser",
    "rating_key": "1234",
    "session_key": "abc123",
    "media_type": "movie",
    "title": "Test Movie",
    "started": "'$(date +%s)'",
    "stopped": "'$(($(date +%s) + 3600))'",
    "percent_complete": "90"
  }'

Test API:

curl https://coop.hobokenchicken.com/api/health

Firewall Configuration

If using UFW:

# Allow web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Allow backend to reach local network
sudo ufw allow from 172.20.2.0/16 to 172.20.1.0/24

# Deny direct access to internal services
sudo ufw deny 3000/tcp
sudo ufw deny 3001/tcp
sudo ufw deny 5432/tcp
sudo ufw deny 6379/tcp

# Enable firewall
sudo ufw enable

Troubleshooting

Cannot reach local services

1. Check Docker network:

   docker network inspect coop-credits_coop-external
   

2. Test connectivity from container:

   docker exec coop-backend ping 172.20.1.255
   

3. Verify firewall rules:

   sudo ufw status verbose
   

Webhooks not working

1. Check Nginx logs:

   tail -f docker/nginx/logs/access.log
   

2. Check backend logs:

   docker-compose -f docker-compose.prod.yml logs -f backend
   

3. Test webhook manually:

   curl -X POST https://coop.hobokenchicken.com/webhooks/tautulli \
     -H "Content-Type: application/json" \
     -d '{"test": true}'
   

Database connection issues

1. Check database status:

   docker-compose -f docker-compose.prod.yml ps postgres
   

2. View database logs:

   docker-compose -f docker-compose.prod.yml logs postgres
   

3. Test connection:

   docker-compose -f docker-compose.prod.yml exec postgres pg_isready -U coop
   

SSL certificate issues

1. Check certificate:

   openssl s_client -connect coop.hobokenchicken.com:443 -servername coop.hobokenchicken.com
   

2. Verify certificate paths in nginx config

3. Check certificate expiry:

   openssl x509 -in docker/nginx/ssl/cert.pem -noout -dates
   

Maintenance

Update Application

cd /opt/coop-credits
git pull
./deployment/deploy-production.sh

Backup Database

# Automated backup
docker-compose -f docker-compose.prod.yml exec -T postgres pg_dump -U coop coop_credits > backup_$(date +%Y%m%d).sql

View Logs

# All services
docker-compose -f docker-compose.prod.yml logs -f

# Specific service
docker-compose -f docker-compose.prod.yml logs -f backend

Restart Services

docker-compose -f docker-compose.prod.yml restart backend

Security Checklist

• Changed all default passwords in .env
• SSL certificates installed and valid
• Firewall rules configured
• Tautulli webhook secret set
• Overseer webhook secret set
• JWT secret is random and secure
• Database not exposed externally
• Redis password set
• Encryption key is random and backed up
• Solana mint authority key backed up securely

Support

For issues:

1. Check health: ./deployment/health-check.sh
2. Review logs: docker-compose -f docker-compose.prod.yml logs
3. Check documentation in docs/INFRASTRUCTURE.md