plex: wire the GTX 1070 in beside Quick Sync — NVENC is the only hardware HEVC-out

Mike 2026-08-20, revising the 2026-07-31 iGPU-only call with the 2026-08-04
finding that this UHD 630 has no HEVC encode entrypoint. runtime: nvidia +
NVIDIA_VISIBLE_DEVICES/CAPABILITIES on the plex service; /dev/dri stays.
Also brings the compose current with the live opt-in watchtower config, and
50-plex.sh now sources WATCHTOWER_NOTIFICATION_URL (carries the publish
token) from stacks.env, soft-gates on nvidia-smi, and adds the NVENC line
to the walk-away checks.

plex/docker-compose.yml

@@ -27,6 +27,10 @@ services:
       - PUID=3000            # MUST equal uid= on the CIFS mounts
       - PGID=3000            # MUST equal gid= on the CIFS mounts
       - TZ=${TZ:-America/New_York}
+      # NVIDIA runtime injection — which GPUs and which driver capabilities
+      # reach the container. `video` is the capability that carries NVENC.
+      - NVIDIA_VISIBLE_DEVICES=all
+      - NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
       # VERSION=docker stays even with auto-update: the container must never
       # self-update INSIDE (those updates evaporate on recreate). Watchtower
       # updates by replacing the image, which is the durable path.
@@ -37,18 +41,26 @@ services:
       # claimed, shared users intact, clients not needing to re-add it.
       # Claiming would create a NEW server identity and throw that away.
 
+    # BOTH hardware paths on purpose — REVISED 2026-08-20 (Mike), updating the
+    # 2026-07-31 iGPU-only call with what the 2026-08-04 measurement found:
+    # this UHD 630 has NO HEVC encode entrypoint (H.264 EncSliceLP only — see
+    # homelab/hosts/mediabox-transcoding.md), so every HEVC-out transcode was
+    # quietly falling back to software. Quick Sync STAYS for its strengths
+    # (no session cap, kernel i915 driver, HDR tone mapping); the 1070's NVENC
+    # is wired in beside it as the only hardware HEVC-out on the box. Plex
+    # picks per session, and an HEVC target can only be satisfied on NVIDIA.
+    runtime: nvidia
+
     devices:
-      # Quick Sync on the UHD 630 — DECIDED 2026-07-31. No session cap and
-      # better HDR tone mapping than the Pascal-era NVENC on the 1070, and the
-      # i915 driver lives in the kernel, so nothing breaks on updates. The
-      # GTX 1070 stays free for other work. Requires the BIOS iGPU
-      # Multi-Monitor toggle or /dev/dri does not exist.
+      # Quick Sync on the UHD 630. Requires the BIOS iGPU Multi-Monitor
+      # toggle or /dev/dri does not exist.
       - /dev/dri:/dev/dri
 
     group_add:
       # Render node is root:render and PGID 3000 is not in that group.
       # Resolved from the live host by 50-plex.sh — the gid differs across
-      # distro releases, so do not hardcode it.
+      # distro releases, so do not hardcode it. Verified 993 on this host
+      # 2026-08-04, which is also the fallback below.
       - "${RENDER_GID:-993}"
 
     volumes:
@@ -82,6 +94,12 @@ services:
       # Read-only here AND at the mount AND at the Synology — the mediabox NAS
       # account has no write permission on the library shares. media_pc (the
       # box's write share) is deliberately not exposed to Plex.
+      #
+      # These are x-systemd.automount paths. A bind into one TRIGGERS the mount
+      # (verified 2026-08-04), so a container start after an idle unmount is
+      # fine. If the NAS itself is unreachable at start, the bind lands on an
+      # empty directory and the library reads as missing — check the mounts
+      # first when that happens.
       - type: bind
         source: /mnt/nas/media
         target: /mnt/nas/media
@@ -144,10 +162,6 @@ services:
       - WATCHTOWER_SCHEDULE=0 0 5 * * *
       - WATCHTOWER_CLEANUP=true
       - WATCHTOWER_NOTIFICATIONS=shoutrrr
-      # Carries ntfy credentials, so it lives in /srv/plex/.env (gitignored,
-      # 0600) and NEVER in this file. See .env.example. ntfy went deny-all on
-      # 2026-08-03; before that this URL was anonymous and publishing to
-      # arrsstack-alerts with no auth at all.
       - WATCHTOWER_NOTIFICATION_URL=${WATCHTOWER_NOTIFICATION_URL}
       - WATCHTOWER_NOTIFICATION_TEMPLATE={{range .}}{{.Message}}{{println}}{{end}}
     volumes:

scripts/50-plex.sh

@@ -108,6 +108,17 @@ else
 fi
 export RENDER_GID
 
+# ---------------------------------------------------------------------------
+#  NVIDIA — wired in beside Quick Sync 2026-08-20. NVENC is the only hardware
+#  HEVC encode on this box. Soft gate: Plex still starts without it, loudly.
+# ---------------------------------------------------------------------------
+if nvidia-smi -L >/dev/null 2>&1; then
+  ok "NVIDIA answers: $(nvidia-smi -L | head -1)"
+else
+  note "[warn] nvidia-smi not answering — Plex will start, but HEVC-out"
+  note "       transcodes fall back to software until driver/toolkit is fixed."
+fi
+
 # ---------------------------------------------------------------------------
 #  Deploy
 # ---------------------------------------------------------------------------
@@ -117,6 +128,9 @@ chown -R 3000:3000 "$PLEXDIR/config"
 
 set -a
 TZ="$(grep -E '^TZ=' "$MASTER" 2>/dev/null | head -1 | cut -d= -f2- || echo America/New_York)"
+# Watchtower's ntfy URL carries the publish token, so it lives in stacks.env on
+# the host and is sourced here — never hardcoded in the compose file.
+WATCHTOWER_NOTIFICATION_URL="$(grep -E '^WATCHTOWER_NOTIFICATION_URL=' "$MASTER" 2>/dev/null | head -1 | cut -d= -f2-)"
 set +a
 
 cd "$PLEXDIR" || exit 1
@@ -153,6 +167,8 @@ cat <<'NEXT'
       without re-adding.
     * Force a transcode, then: sudo intel_gpu_top
       Video / VideoEnhance rows should be busy.
+    * Force an HEVC-out transcode, then: nvidia-smi
+      Plex Transcoder should hold an ENC session on the 1070.
 NEXT
 
 exit 0