serverAppConfigs/serverAppConfigs-docs/Dankserver/Plex.md

Plex

Plex Media Server is the containerized media server on Dankserver: a podman quadlet (plex.service) under the systemd user generator, generated from dankserver/plex/quadlet/plex.container. It is the only media server actually listening on this host. Jellyfin, by contrast, is a research brief on this host, not a running service (see Jellyfin).

Host: Dankserver — Ports: 32400/tcp (PMS web + API), 32400 is the only port PMS needs for client streaming; LAN clients connect directly, public traffic can be fronted by Caddy like every other vhost.

Facts

Item	Value
Runtime	podman quadlet, plex.service (user manager) — migrated from the native plexmediaserver.service OS-package unit (2026-09)
Image	lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322 (pinned; verified == the ghcr latest manifest digest at pin time)
Data root	/var/lib/plexmediaserver bind-mounted in place as /config (RW) — the migration moved zero bytes
Media	/mnt/entropy mounted at the same absolute path read-only — every library path in the PMS database stayed valid, zero re-scan
Identity	UsernsMode=host + PUID=997 PGID=984 — container writes land owned 997:984, byte-compatible with the former native unit
Port	32400/tcp published on 0.0.0.0 — zero client reconfiguration
Network	dankserver_appnet, alias plex; Tautulli reaches it at http://plex:32400
GPU	none by decision — CPU decode only; the RTX 3090 stays dedicated to frank-default-small
Deploy	./scripts/deploy.sh dankserver --service plex
Docs	https://support.plex.tv

Why in-place bind mounts

The migration moved zero bytes: the container bind-mounts the native data root where it already lived, and the media archive re-mounts at /mnt/entropy inside the container, so every absolute library path in the PMS database keeps resolving. UsernsMode=host + PUID=997/PGID=984 makes the container's file identity indistinguishable from the old service's — no chown, no re-scan. Rollback is byte-safe at any time before decommission.

Cutover & rollback

• First deploy stops and masks plexmediaserver.service (never disable — on these hosts disable deletes the unit file), then starts the quadlet; the deployer blocks until /identity answers on 32400.
• Rollback lever while masked: systemctl --user stop plex.service && sudo systemctl unmask plexmediaserver.service && sudo systemctl start plexmediaserver.service.
• Decommission (sudo apt-get -y purge plexmediaserver) only after explicit operator sign-off.

Integration points

• Caddy: Plex is exempt from the Anubis bot challenge (plain-HTTP legacy clients cannot solve JS challenges) — see Anubis "Exempt by construction".
• Tautulli (Tautulli) is the companion: it polls PMS on the appnet for statistics and notifications and makes no sense without Plex.
• Auth wall: if a public vhost is ever pointed at Plex, put the Authentik outpost + Anubis chain in front of it like every other guarded vhost (Authentik, Caddy); direct :32400 exposure to the LAN is unauthenticated by design (Plex owns its own auth via claim tokens).

Gotchas

1. Do not benchmark on it blind. Transcoding is CPU-only now but still contends with the LLM fleet's host-RAM expert streaming; stop the service before benchmark runs, per the Benchmarking Policy.
2. Updates are commit-driven, not apt. The OS package is retired at cutover; upgrading PMS means pinning a new -ls tag in the unit file and redeploying — never run :latest.
3. The claim token is the identity of this server; document it in the host .env, never in this repo (secret rules apply). The token lives in Preferences.xml inside the RW data bind, preserved by the migration.