Add Plex media server app v1.43.0

[BookJJun-IJ]

Summary

Add Plex Media Server (v1.43.0) via LinuxServer.io image with nginx-hash-lock proxy.

Architecture

Service	Image	cpu_shares
nginxhashlock	yundera/nginx-hash-lock:latest	80
plex	lscr.io/linuxserver/plex:1.43.0	70

• nginx-hash-lock:latest is a Yundera-maintained image
• Internal network: plex-network (bridge)
• External network: pcs (Caddy via nginxhashlock)
• Media: /DATA/Media/Movies, /DATA/Media/TV Shows, /DATA/Media/Music

Submission Checklist

Tech Checklist

• Proper file permissions — user: $PUID:$PGID (accesses user Media directories)
• Migration path — Plex handles migrations internally
• Pre-install/post-install commands — N/A

Security Checklist

• Default authentication — Plex requires account claim on first launch
• No hardcoded credentials — uses $PUID, $PGID, $TZ
• Specific version tags — lscr.io/linuxserver/plex:1.43.0 (nginx-hash-lock:latest is Yundera image)

Functionality Checklist

• Works immediately after installation
• Data mapped to /DATA/AppData/$AppID/config + /DATA/Media/
• No manual configuration required
• Data persistence — config and metadata persist
• cpu_shares set on all services — nginxhashlock: 80, plex: 70
• Fresh installation tested
• Uninstall/reinstall tested

Documentation Checklist

• Clear description — en_us, ko_kr, zh_cn, fr_fr, es_es
• Tagline in 5 languages
• Icon and screenshots provided, CDN URLs point to Yundera/AppStore@main

[Maelisse2002]

🤖 AI Pre-Check

Decision: ⚠️ ai-reviewed:needs-review
Tech review (incl. security): needed — new app submission (advisory; human flow owns the decision). Volumes also mount user media dirs outside /DATA/AppData/.
Commit: 00e04b1 | Checklist source: CONTRIBUTING.md@main

Apps in this PR

• Plex — new app (linuxserver/plex v1.43.0)

AI static checks

• ✅ Specific version tag (no :latest) — nginx-hash-lock:1.0.7, plex:1.43.0
• ✅ No hardcoded credentials — AUTH_HASH via env, PLEX_CLAIM empty
• ✅ Volumes under /DATA/AppData/$AppID/ for config/transcode; media mounts outside AppData documented in rationale.md
• ✅ user:/PUID:PGID set on all services
• ✅ cpu_shares set on all services (80, 50)
• ✅ x-casaos metadata present (description, icon, screenshots, tagline)
• ✅ Asset URLs point to Yundera/AppStore@main; icon/3 screenshots/thumbnail present in PR
• ➖ pre/post-install commands — none used

→ Tier 2 must verify (human)

• Works immediately after installation
• Fresh installation tested
• Uninstall / reinstall preserves data
• Migration from previous version succeeds

Notes for reviewers

New app, so the AI pre-check is advisory only — the human flow (PH + Cristian) owns the verdict. Auth is gated by the nginx-hash-lock sidecar (OIDC/Authelia). rationale.md claims two exceptions to judge: "Runs as user: 0:0 (root) while accessing user media directories" (justified by the LSIO s6-overlay init requiring root at startup for /dev/dri hardware transcode), and media mounts (/DATA/Media/*, /DATA/Downloads) outside /DATA/AppData/. Both are typical for a media server but warrant human sign-off.

Next step

→ Tier 2 functional review, then tech + security review (new app submission; root user + media mounts outside AppData).

---

_{Generated by AI pre-check. Checklist read live from CONTRIBUTING.md on main. Labels are the machine-readable verdict; this comment is the human-readable explanation. Humans own the merge.}