services:
  plex:
    image: lscr.io/linuxserver/plex:latest
    container_name: plex
    restart: unless-stopped

    # NOT OPTIONAL. Plex's local discovery (GDM), DLNA and the Plex-for-client
    # "found a local server" path all rely on broadcast traffic that a bridge
    # network silently eats. This is why Plex does not sit behind NPM the way
    # every other service here does — NPM proxy host 17 already points
    # plex.thewichersfamily.com at 10.0.1.20:32400 and needs no change.
    network_mode: host

    environment:
      - PUID=3000            # MUST match uid= on the CIFS mounts
      - PGID=3000            # MUST match gid= on the CIFS mounts
      - TZ=${TZ:-America/New_York}
      - VERSION=docker
      # PLEX_CLAIM is intentionally absent from this file. Claim tokens expire
      # four minutes after they are issued, so one can never be committed to a
      # repo, written to a USB, or baked into an image. It is injected at first
      # start by 50-plex.sh and never persisted.
      - PLEX_CLAIM=${PLEX_CLAIM:-}
      - ADVERTISE_IP=${PLEX_ADVERTISE_URL:-http://10.0.1.20:32400}

    devices:
      # Quick Sync. The i7-8700K's UHD 630 is the transcode target: no session
      # cap, and better HDR tone mapping than the Pascal-era NVENC on the 1070.
      - /dev/dri:/dev/dri

    group_add:
      # The render node is root:render, and PGID 3000 is not in that group.
      # Resolved from the live host by 50-plex.sh — do not hardcode, the gid
      # differs between distro releases.
      - "${RENDER_GID:-993}"

    volumes:
      # Config lives on the SSD, deliberately. The Plex SQLite database is the
      # most latency-sensitive thing on this box; it does not belong on the
      # 3TB spinner.
      - /srv/plex/config:/config

      # NAS media, read-write per the account scope. Mounted read-only INTO the
      # container for every library that Plex has no business writing to.
      - /mnt/nas/audiobooks:/media/audiobooks:ro
      - /mnt/nas/education-videos:/media/education-videos:ro
      - /mnt/nas/health:/media/health:ro
      - /mnt/nas/home-movies:/media/home-movies:ro
      - /mnt/nas/media:/media/media:ro
      - /mnt/nas/music-organized:/media/music-organized:ro
      - /mnt/nas/pictures:/media/pictures:ro
      - /mnt/nas/radio-shows:/media/radio-shows:ro

    tmpfs:
      # Transcodes are throwaway. Keeping them in RAM saves a great deal of
      # SSD write wear. 4G of the box's 16G, capped so a pathological transcode
      # cannot pressure the rest of the system.
      - /transcode:rw,size=4g,mode=1777