# Plex

Plex Media Server is the **native (non-container) media server running on
Dankserver**. It is the only media server actually listening on this host:
`plexmediaserver.service` is an OS-package systemd unit
(`/usr/lib/systemd/system/plexmediaserver.service`), enabled and
running — verified live 2026-08-29. Jellyfin, by contrast, is a research
brief on this host, not a running service (see [[Jellyfin]]).

**Host:** Dankserver — **Ports:** 32400/tcp (PMS web + API), 32400 is the
only port PMS needs for client streaming; LAN clients connect directly,
public traffic can be fronted by Caddy like every other vhost.

## Facts (live-verified 2026-08-29)

| Item | Value |
|------|-------|
| Runtime | native systemd service (`plexmediaserver.service`), **not** a podman quadlet |
| State | enabled + running (up since 2026-08-21) |
| Port | `32400/tcp` on `0.0.0.0` |
| Updates | OS package manager (`apt`) — **not** `scripts/deploy.sh`; the deploy flow never touches this service |
| GPU | RTX 3090 present; NVENC hardware transcode needs the NVIDIA driver + Plex Pass (PMS gates HW transcoding behind the paid tier) |
| Docs | https://support.plex.tv |

## Why it is not a quadlet

Plex ships as a distro package with its own systemd unit and update
channel; the repo's boot-persistence rule is satisfied by the native unit
(it is `enabled`, so it survives reboot — verify with
`systemctl is-enabled plexmediaserver`). Converting it to a container later
is a migration, not a config edit: the PMS database (`/var/lib/plexmediaserver`)
and its claim-token identity would move with it.

## Integration points

- **Caddy:** Plex is exempt from the Anubis bot challenge
  (plain-HTTP legacy clients cannot solve JS challenges) — see
  [[Anubis]] "Exempt by construction".
- **Tautulli** ([[Tautulli]]) is the companion: it polls PMS on `:32400`
  for statistics and notifications and makes no sense without Plex.
- **Auth wall:** if a public vhost is ever pointed at Plex, put the
  Authentik outpost + Anubis chain in front of it like every other guarded
  vhost ([[Authentik]], [[Caddy]]); direct `:32400` exposure to the LAN is
  unauthenticated by design (Plex owns its own auth via claim tokens).

## Gotchas

1. **Do not benchmark on it blind.** PMS transcodes contend with the LLM
   fleet for the same GPU; stop the service (or pin it to CPU
   transcoding) before benchmark runs, per the Benchmarking Policy.
2. **Updates are OS-level** — `apt`/`aptly`, not `deploy.sh`; a deploy
   plan that names `plex` is a bug in the plan.
3. The claim token is the identity of this server; document it in the host
   `.env`, never in this repo (secret rules apply).