---

🍿 Smash that ⭐️ like the streaming service just asked, “Are you still watching?”

─── ⛧ ───

⚡ Got bugs or questionable plot decisions? Enter 🔥HADES🔥.

---

Duplex 📺🚀

Duplex is the backstage crew for a Plex production that has somehow survived multiple seasons, three recasts, and one database nobody remembers approving. It runs metadata, artwork maintenance, monitoring, notifications, and controlled container updates as one Docker Compose project, with Synology Container Manager as the premiere venue.

Duplex does not install Plex Media Server. It connects the supporting cast to an existing Plex installation and its application-data directory.

Note

☠️ There is a pirate crossover hidden in this season. Follow the suspiciously damp map to Plundarr if ye dare.

Tonight's cast 🎭

The services and deployment guidance below were verified against each project's official documentation on August 5, 2026. Reviewed default image references remain centralized in example.env.

Service	Role	Docs
Kometa ✨	Metadata, collections, playlists, and overlays	Wiki
ImageMaid 🧼	Plex image-cache maintenance	Wiki
PATTRMM 📅	Returning Soon and In-History metadata	Repository
Tautulli 📊	Plex activity monitoring	Docs
Notifiarr 🔔	Notifications and service checks	Wiki
Watchtower 🛠️	Label-scoped container updates	Docs

Kometa Overlay Reset has its own one-shot chart under config/overlay-reset. It is deliberately not part of the everyday cast because its entire job description is “remove things with confidence.”

What changed in this director's cut? 🎬

• Release-capable services use current versioned image tags instead of every container improvising on latest.
• PATTRMM's only stable channel is pinned to a reviewed multi-architecture digest.
• Watchtower now uses the maintained community fork. The original containrrr/watchtower project was archived in December 2025.
• Watchtower updates only containers with an explicit enable label. It no longer wanders through the entire Docker host like an intern with a master key.
• Compose files omit the obsolete top-level version field and use stable container names.
• Renovate, CodeQL, OpenSSF Scorecard, secret scanning, Markdown linting, ShellCheck, actionlint, and strict YAML validation now cover the repository.
• Checked-in examples drive validation; private .env files stay off camera.

Requirements 🧰

• Docker Engine with Docker Compose v2, or Synology DSM 7.2+ with Container Manager.
• An existing Plex Media Server.
• A Plex token for Kometa, ImageMaid, PATTRMM, Tautulli, or Overlay Reset where each upstream tool requires one.
• Read/write access to the Duplex config directory.
• Read/write access to Plex application data for ImageMaid.
• Git submodule support for the Kometa configuration.

Quick premiere 🚀

Clone Duplex with its Kometa configuration submodule:

git clone --recurse-submodules https://github.com/scottgigawatt/duplex.git /volume1/docker/duplex
cd /volume1/docker/duplex

Create private environment files from the checked-in examples:

cp example.env .env
cp config/imagemaid/example.env config/imagemaid/.env

Review at least these settings before opening night:

• HOST_DUPLEX_CONFIG
• HOST_PLEX_CONFIG
• PATTRMM_PUID and PATTRMM_PGID
• TAUTULLI_PUID and TAUTULLI_PGID
• COMPOSE_NETWORK_*
• WATCHTOWER_NOTIFICATION_URL, or disable notifications
• Plex URLs and tokens in each application's private configuration

Then rehearse and launch:

make help
make validate
make config
make up

make validate uses only safe checked-in examples. make config renders the private deployment and may display interpolated values, so do not paste its output into issues without redacting it.

Important

Read the full Docker Project Setup before deploying on Synology. It covers networking, permissions, Container Manager, upgrades, and the image variable migration from older Duplex checkouts. Skipping it is how the plucky side character becomes a six-hour troubleshooting subplot.

First-run service notes 📋

Kometa and ImageMaid

The Kometa configuration is a git submodule at config/kometa. ImageMaid reads its application settings from config/imagemaid/.env and needs the Plex application-data directory mounted at /plex.

PATTRMM

PATTRMM writes generated metadata into the Kometa config mount. Its official image publishes channel tags rather than release-version tags, so Duplex pins the reviewed latest manifest digest and excludes that container from Watchtower. Renovate proposes digest changes for review.

Tautulli

Open http://YOUR-NAS:8181 after the container starts. If the config directory is not writable by the configured PUID and PGID, Tautulli's pilot episode will be a permissions error with a very short runtime.

Notifiarr

Open http://YOUR-NAS:5454 and complete the first-run client setup. The static hostname: notifiarr prevents duplicate client identities. The tracked sample configuration contains placeholders only; keep the generated live notifiarr.conf private.

Watchtower

Watchtower can control the Docker daemon through /var/run/docker.sock. That is effectively host-level authority, even when the mount is marked read-only. Duplex limits the blast radius with WATCHTOWER_LABEL_ENABLE=true and explicit service labels, but you should still review image release notes and keep tested backups.

The separate one-shot chart performs one labeled update pass:

cp config/watchtower/example.env config/watchtower/.env
make watchtower-config
make watchtower-run

Overlay Reset: the “are you absolutely sure?” special 💣

Kometa's documentation describes Overlay Reset as destructive with no undo. Duplex therefore ships it separately, never restarts it automatically, and defaults its example to DRY_RUN="True".

cp config/overlay-reset/example.env config/overlay-reset/.env
make overlay-reset-config
make overlay-reset-run

Read the Overlay Reset guide, back up Plex, and review the dry-run output before disabling dry-run mode. This is not the scene for method acting.

Updating the production 📦

Routine dependency updates arrive through Renovate pull requests. After an approved change lands:

git pull --ff-only
git submodule update --init --recursive
make validate
make pull
make up

Back up application config and Plex data before version changes. Do not assume a successful Compose render proves an application's database migration is safe.

Repository checks 🧪

make validate
pre-commit run --all-files
git diff --check

These checks cover every Compose chart, environment-variable parity, secrets, Markdown, YAML, shell, and GitHub Actions. There is no Duplex-owned Dockerfile, so image-build and image-vulnerability gates from Privateerr and Plundarr do not apply here.

Documentation map 🗺️

• Deployment and upgrade setup
• Contributing
• Security policy
• Code of conduct
• ImageMaid config
• Notifiarr config
• PATTRMM config
• Tautulli config
• One-shot Watchtower

License 📄

Duplex-owned files are licensed under Apache-2.0. Container images and the Kometa configuration submodule remain under their respective upstream licenses.

   __________________________
  | .----------------------. |
  | |                      | |
  | |   📺 Now Streaming   | |
  | |   🍿 Duplex Media    | |
  | |                      | |
  | '----------------------' |
  |__________________________|
    (_)                  (_)

May your metadata match, your posters remain uncursed, and your YAML never get renewed for an unnecessary indentation arc. 🌟