plex: auto-update via watchtower (Mike's call 2026-08-02, supersedes the pin)

Back to :latest + a watchtower service checking daily at 05:00, cleanup
on, ntfy notification to arrsstack-alerts on every update. Rollback net
= Plex's own scheduled DB backups + the NAS media_pc backup. shell-mcp
is a local build, watchtower ignores it.

plex/docker-compose.yml

@@ -1,10 +1,11 @@
 services:
   plex:
-    # PINNED 2026-08-02 to the exact version running (and matching the migrated
-    # database — Windows also ran 1.43.3.10828, so no schema upgrade occurred).
-    # SQLite schema upgrades are ONE-WAY; upgrade by bumping this pin
-    # deliberately, never by riding :latest.
-    image: lscr.io/linuxserver/plex:1.43.3.10828-00f62d37d-ls316
+    # AUTO-UPDATE — Mike's call 2026-08-02, superseding the short-lived pin.
+    # :latest + the watchtower service below (daily 05:00 check). Remember:
+    # SQLite schema upgrades are ONE-WAY. The rollback net is Plex's own
+    # scheduled database backups (Settings > Scheduled Tasks, default every
+    # 3 days) and the NAS media_pc backup. Watchtower ntfys every update.
+    image: lscr.io/linuxserver/plex:latest
     container_name: plex
     restart: unless-stopped
 
@@ -20,6 +21,9 @@ services:
       - PUID=3000            # MUST equal uid= on the CIFS mounts
       - PGID=3000            # MUST equal gid= on the CIFS mounts
       - TZ=${TZ:-America/New_York}
+      # VERSION=docker stays even with auto-update: the container must never
+      # self-update INSIDE (those updates evaporate on recreate). Watchtower
+      # updates by replacing the image, which is the durable path.
       - VERSION=docker
       # No PLEX_CLAIM. The migration carries MachineIdentifier,
       # ProcessedMachineIdentifier and the online token across in
@@ -103,3 +107,21 @@ services:
       # a great deal of SSD write wear. 4G of 16G, capped so a pathological
       # transcode cannot pressure the rest of the system.
       - /transcode:rw,size=4g,mode=1777
+
+  watchtower:
+    # Auto-updater — checks daily at 05:00 local, pulls newer images,
+    # recreates the container with identical settings, prunes old images,
+    # and ntfys arrsstack-alerts about anything it did. Local builds
+    # (shell-mcp) have no registry to compare against and are ignored.
+    image: containrrr/watchtower
+    container_name: watchtower
+    restart: unless-stopped
+    environment:
+      - TZ=${TZ:-America/New_York}
+      - WATCHTOWER_SCHEDULE=0 0 5 * * *
+      - WATCHTOWER_CLEANUP=true
+      - WATCHTOWER_NOTIFICATIONS=shoutrrr
+      - WATCHTOWER_NOTIFICATION_URL=ntfy://ntfy.thewichersfamily.com/arrsstack-alerts
+      - WATCHTOWER_NOTIFICATION_TEMPLATE={{range .}}{{.Message}}{{println}}{{end}}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock