plex: wire the GTX 1070 in beside Quick Sync — NVENC is the only hardware HEVC-out

Mike 2026-08-20, revising the 2026-07-31 iGPU-only call with the 2026-08-04
finding that this UHD 630 has no HEVC encode entrypoint. runtime: nvidia +
NVIDIA_VISIBLE_DEVICES/CAPABILITIES on the plex service; /dev/dri stays.
Also brings the compose current with the live opt-in watchtower config, and
50-plex.sh now sources WATCHTOWER_NOTIFICATION_URL (carries the publish
token) from stacks.env, soft-gates on nvidia-smi, and adds the NVENC line
to the walk-away checks.

plex/docker-compose.yml

@@ -27,6 +27,10 @@ services:
       - PUID=3000            # MUST equal uid= on the CIFS mounts
       - PGID=3000            # MUST equal gid= on the CIFS mounts
       - TZ=${TZ:-America/New_York}
+      # NVIDIA runtime injection — which GPUs and which driver capabilities
+      # reach the container. `video` is the capability that carries NVENC.
+      - NVIDIA_VISIBLE_DEVICES=all
+      - NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
       # VERSION=docker stays even with auto-update: the container must never
       # self-update INSIDE (those updates evaporate on recreate). Watchtower
       # updates by replacing the image, which is the durable path.
@@ -37,18 +41,26 @@ services:
       # claimed, shared users intact, clients not needing to re-add it.
       # Claiming would create a NEW server identity and throw that away.
 
+    # BOTH hardware paths on purpose — REVISED 2026-08-20 (Mike), updating the
+    # 2026-07-31 iGPU-only call with what the 2026-08-04 measurement found:
+    # this UHD 630 has NO HEVC encode entrypoint (H.264 EncSliceLP only — see
+    # homelab/hosts/mediabox-transcoding.md), so every HEVC-out transcode was
+    # quietly falling back to software. Quick Sync STAYS for its strengths
+    # (no session cap, kernel i915 driver, HDR tone mapping); the 1070's NVENC
+    # is wired in beside it as the only hardware HEVC-out on the box. Plex
+    # picks per session, and an HEVC target can only be satisfied on NVIDIA.
+    runtime: nvidia
+
     devices:
-      # Quick Sync on the UHD 630 — DECIDED 2026-07-31. No session cap and
-      # better HDR tone mapping than the Pascal-era NVENC on the 1070, and the
-      # i915 driver lives in the kernel, so nothing breaks on updates. The
-      # GTX 1070 stays free for other work. Requires the BIOS iGPU
-      # Multi-Monitor toggle or /dev/dri does not exist.
+      # Quick Sync on the UHD 630. Requires the BIOS iGPU Multi-Monitor
+      # toggle or /dev/dri does not exist.
       - /dev/dri:/dev/dri
 
     group_add:
       # Render node is root:render and PGID 3000 is not in that group.
       # Resolved from the live host by 50-plex.sh — the gid differs across
-      # distro releases, so do not hardcode it.
+      # distro releases, so do not hardcode it. Verified 993 on this host
+      # 2026-08-04, which is also the fallback below.
       - "${RENDER_GID:-993}"
 
     volumes:
@@ -82,6 +94,12 @@ services:
       # Read-only here AND at the mount AND at the Synology — the mediabox NAS
       # account has no write permission on the library shares. media_pc (the
       # box's write share) is deliberately not exposed to Plex.
+      #
+      # These are x-systemd.automount paths. A bind into one TRIGGERS the mount
+      # (verified 2026-08-04), so a container start after an idle unmount is
+      # fine. If the NAS itself is unreachable at start, the bind lands on an
+      # empty directory and the library reads as missing — check the mounts
+      # first when that happens.
       - type: bind
         source: /mnt/nas/media
         target: /mnt/nas/media
@@ -144,10 +162,6 @@ services:
       - WATCHTOWER_SCHEDULE=0 0 5 * * *
       - WATCHTOWER_CLEANUP=true
       - WATCHTOWER_NOTIFICATIONS=shoutrrr
-      # Carries ntfy credentials, so it lives in /srv/plex/.env (gitignored,
-      # 0600) and NEVER in this file. See .env.example. ntfy went deny-all on
-      # 2026-08-03; before that this URL was anonymous and publishing to
-      # arrsstack-alerts with no auth at all.
       - WATCHTOWER_NOTIFICATION_URL=${WATCHTOWER_NOTIFICATION_URL}
       - WATCHTOWER_NOTIFICATION_TEMPLATE={{range .}}{{.Message}}{{println}}{{end}}
     volumes: