09 — Operations runbook

<aside> ✅

Status: Published Last verified: 2026-07-24 — GitLab schedule live; CI smoke green; Task Scheduler decommission pending

</aside>

Purpose

Day-2 ops: sync, smoke, tests.

Default masters sync now runs on GitLab.com scheduled / manual pipelines for just-shane/plex-mcp — not Windows Task Scheduler.

Schedule: Pipeline schedules — plex-sync masters daily (id 4358391), cron 17 8 * * * UTC, ref main. Masters runs when SYNC_JOB is unset or masters.
Smoke pipeline (2026-07-24): pipeline #2703791106 — plex-sync-masters success (schedule trigger).
Secrets: Infisical Universal Auth only (INFISICAL_UNIVERSAL_AUTH_CLIENT_ID / _CLIENT_SECRET as masked+protected GitLab CI vars). Plex/Supabase secrets stay in Infisical dev.
Manual run: GitLab UI Run pipeline on main (source web), or glab ci run -b main (source api). Optional var SYNC_JOB=masters (API create may 403 on pipeline variables for some tokens — unset still runs masters).
Manual smoke (2026-07-24): pipeline #2703808812 — plex-sync-masters success (api trigger).
Failure alerts: rolling GitLab issue Scheduled job failing: plex-sync-masters (label ops) via scripts/ci/alert_on_failure.sh.

Documented for later — create as inactive or leave unset until needed:

Description	Cron (UTC)	`SYNC_JOB`
plex-sync container-adjustments	`47 9 * * *`	`container-adjustments`
plex-sync item-adjustments	weekly / manual	`item-adjustments` (+ optional `SYNC_SINCE`)

plex-mcp — stdio server
plex-sync — cache job (infisical run --env dev -- plex-sync …)
Wrapper: scripts/run_sync.ps1 — local/debug only (Infisical; logs logs/plex_sync.log). Not the production scheduler.