my NixOS Plex module (with a PlexPass overlay)

plex.nix

{ pkgs, ... }:
### Plex Media server
# Uses plexpass version if plexpass.json exists

let
  plexpass-overlay = import ./plexpass-overlay.nix;
in {
  # Plex is unfree, allow it anyways
  imports = [ ./allowed_unfree.nix ];
  allowedUnfreePkgs = [ "plexmediaserver" ];

  services.plex = {
    enable = true;
    # openFirewall = true;
    extraPlugins = [];
    extraScanners = [];

    # Use newer plexpass package from our overlay
    package = pkgs.plexPass;
  };

  nixpkgs.overlays = [ plexpass-overlay ];
}

plexpass-overlay.nix

### Overlay for plexpass version of plex
#
# expects ./plexpass.json to exist and have the following keys:
#   version, arm64.url, arm64.sha1, amd64.url, amd64.sha1
#
# the hashes in plexpass.json should be base32 encoded (use `nix to-base32 $checksum --type sha1`)
#
# based on https://github.com/davidtwco/veritas/blob/master/nix/overlays/plex.nix
self: super:
let
  fetchurl = super.fetchurl;
  urlAttrs = super.lib.getAttrs [ "url" "sha1" ];

  v = super.lib.importJSON ./plexpass.json;

  version = v.version;
  url =
    if super.stdenv.hostPlatform.system == "aarch64-linux"
    then urlAttrs v.arm64
    else urlAttrs v.amd64;

in {
  plexPassRaw = super.plexRaw.overrideAttrs (
    old: {
      version = version;
      name = "${old.pname}-${version}";
      src = fetchurl url;
    });

  plexPass = super.plex.override { plexRaw = self.plexPassRaw; };
}

plexpass.json

{
  "version": "1.25.5.5492-12f6b8c83",
  "release_date": "2022-02-01T09:01:11Z",
  "amd64": {
    "url": "https://downloads.plex.tv/plex-media-server-new/1.25.5.5492-12f6b8c83/debian/plexmediaserver_1.25.5.5492-12f6b8c83_amd64.deb",
    "sha1": "20ngx3h9f5jivm1wvx5j41wv6n8c97q7"
  },
  "arm64": {
    "url": "https://downloads.plex.tv/plex-media-server-new/1.25.5.5492-12f6b8c83/debian/plexmediaserver_1.25.5.5492-12f6b8c83_arm64.deb",
    "sha1": "gq0zax15144z0g4jxk3dcpnmilqghk95"
  },
  "timestamp": 1643706071
}

query_plex_release.fish

# Get urls and hashes for most recent plex version
# Outputs json for plexpass-overlay.nix
#
# Requires: fish curl jq nix
#
# If given a plex authentication token as an argument, uses plexpass channel instead of public channel
#
# To get an authentication token: https://forums.plex.tv/t/authenticating-with-plex/609370

function query_plex_release
  set -l argc (count $argv)
  if test $argc -gt 1
    echo "Error: too many args"
    return 1
  end

  set -l curlArgs --no-progress-meter
  set -l plexUrl "https://plex.tv/api/downloads/5.json"
  if test $argc -eq 1
    set --append curlArgs --header "X-Plex-Token: $argv[1]"
    set plexUrl "$plexUrl?channel=plexpass"
  end

  set -l plexFeed (curl $curlArgs $plexUrl)

  set -l versionInfo (echo $plexFeed | jq '
    def getRelease(arch): (
      .computer.Linux.releases
      | map(select(.build == "linux-" + arch
                   and .distro == "debian"))
      [0]);

    { version: .computer.Linux.version
    , release_date: .computer.Linux.release_date
    , amd64:
      { url: getRelease("x86_64")|.url
      , checksum: getRelease("x86_64")|.checksum
      }
    , arm64:
      { url: getRelease("aarch64")|.url
      , checksum: getRelease("aarch64")|.checksum
      }
    }')

  set -l x64_checksum (echo $versionInfo | jq -r '.amd64.checksum')
  set -l x64_hashed (nix to-base32 $x64_checksum --type sha1)

  set -l arm_checksum (echo $versionInfo | jq -r '.arm64.checksum')
  set -l arm_hashed (nix to-base32 $arm_checksum --type sha1)

  echo $versionInfo | jq '
    .timestamp = .release_date
    | .release_date = (.release_date | todate)
    | .amd64 = { url: .amd64.url, sha1: "'"$x64_hashed"'"}
    | .arm64 = { url: .arm64.url, sha1: "'"$arm_hashed"'"}'
end

unfree_packages.nix

## allowedUnfreePkgs
# config option containing a list of pacakages to allow despite being unfree
#
# With this as a module, multiple other modules can specify a list of packages
# to allow without stepping on eachother's toes.

{ config, lib, ... }:
with lib;
let
  notEmpty = lst: builtins.length lst > 0;
in {
  options = {
    allowedUnfreePkgs = mkOption {
      type = types.listOf ( types.str );
      default = [];
      description = ''
        A list of packages to allow despite being unfree.
      '';
    };
  };

  config = mkIf (notEmpty config.allowedUnfreePkgs) {
    nixpkgs.config.allowUnfreePredicate =
      pkg: builtins.elem (getName pkg) config.allowedUnfreePkgs;
  };
}

plex.nix is included in my /etc/nixos/configuration.nix in imports.

The fish script is a bit of a mess but it works well enough, I call it with my plex user token and write the output over plexpass.json to update the version info.

I have the unfree_packages.nix module so that multiple other modules can each allow their packages. If each module specified nixpkgs.config.allowUnfreePredicate, they'd overwrite eachother and only one would end up actually allowed. Defining this option as a list lets nixos nicely merge what any modules set.

(the example plexpass.json has version info from the public non-plexpass channel)