I think you may want to use for device in /dev/disk/by-uuid/*

That doesn’t explain why you aren’t seeing messages. I see there is a shebang at the start of the script. Can you confirm that the script has the executable bit set for the root user?

It works with USB interfaces using passthrough. But yeah doesn’t make a lot of sense.

From Archwiki > xrandr:

Tip: Both GDM and SDDM have startup scripts that are executed when X is initiated. For GDM, these are in /etc/gdm/, while for SDDM this is done at /usr/share/sddm/scripts/Xsetup. This method requires root access and mucking around in system configuration files, but will take effect earlier in the startup process than using xprofile.

Mount the drive with the user or group as plex. See mount options uid and gid. You can also set precise permissions on the mount point (using options at mount time) to let plex access a subdirectory.

Files could be decrypted by the end user. The OS itself could remain unencrypted.

Nginx is pretty easy to set up. Look up “nginx virtual hosts”. You might want to use certbot/acme if you don’t have SSL certificates for your domain names. You need either a wildcard certificate (*.example.com), a certificate with SAN (Subject Alternative Name) containing the second subdomain, or two certificates (one for each subdomain). Note that subdomains can be found more easily than path based websites, if you allow connections from the whole WAN.