Add novox.be; replace photos immich stub with the real app

- novox.be: owned www:latest container, public route novox.be
  (host 4000 -> app 8080). No DB, no secrets. Analog: de-spiegel/hello-web.
- photos: the existing module.json was a wrong immich stub (alpine image,
  port 2283). Replace it with the user's real photo app: photos-server
  backend consuming the mesh s3-bucket (bucket photos) + mongodb-database
  (db photos) providers, env templated from the provisions (analog:
  invoicing), plus the three static client containers (admin + two family
  sites). Only photos.novox.be is routed: contributes.route is single-valued
  across the catalog, so eef/filip need their own modules (flagged).

modules/novox.be/module.json

@@ -0,0 +1,50 @@
+{
+  "module": "novox.be",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "novox.be",
+      "port": 4000
+    }
+  },
+  "binds": {
+    "route": "/var/lib/novox.be/route.json"
+  },
+  "listens": [
+    {
+      "port": 4000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the public website over http; the public name novox.be is a route grant, and route-proxy reaches it on this published port"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/novox.be",
+      "mode": "0700"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "novox-be"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "novox-be",
+      "image": "registry-api.novox.be/novox/www:latest",
+      "network": "novox-be",
+      "ports": [
+        "4000:8080"
+      ]
+    }
+  ]
+}

modules/photos/module.json

@@ -1,82 +1,110 @@
 {
   "module": "photos",
   "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
   "requires": [
-    "s3-bucket"
+    "s3-bucket",
+    "mongodb-database",
+    "route"
   ],
   "contributes": {
     "s3-bucket": {
       "bucket": "photos"
+    },
+    "mongodb-database": {
+      "name": "photos"
+    },
+    "route": {
+      "name": "photos.novox.be",
+      "port": 4001
     }
   },
   "binds": {
-    "s3-bucket": "/etc/photos/store.json"
+    "s3-bucket": "/var/lib/photos/store.json",
+    "mongodb-database": "/var/lib/photos/database.json",
+    "route": "/var/lib/photos/route.json"
   },
   "secrets": {
-    "s3-bucket": "/etc/photos/store.secret"
+    "s3-bucket": "/var/lib/photos/store.secret",
+    "mongodb-database": "/var/lib/photos/database.secret"
   },
-  "emits": [
+  "listens": [
-    "module.photos.item.added"
+    {
+      "port": 9000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the photos backend API; the client sites on the module network call it"
+    },
+    {
+      "port": 4001,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the admin client site over http; the public name photos.novox.be is a route grant, and route-proxy reaches it on this published port"
+    }
   ],
-  "own-secrets": {
-    "broker": "/var/lib/mesh/photos/broker"
-  },
   "resources": [
     {
-      "id": "mesh-state",
+      "id": "state",
       "type": "directory",
-      "path": "/var/lib/mesh/photos",
+      "path": "/var/lib/photos",
       "mode": "0700"
     },
     {
-      "id": "config",
+      "id": "server-env",
-      "type": "directory",
+      "type": "file",
-      "path": "/etc/photos",
+      "path": "/var/lib/photos/server.env",
-      "mode": "0750"
+      "mode": "0600",
+      "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\n"
     },
     {
-      "id": "app",
+      "id": "net",
+      "type": "network",
+      "name": "photos"
+    },
+    {
+      "id": "server",
       "type": "container",
-      "name": "photos",
+      "name": "photos-server",
-      "image": "alpine@sha256:c64c687cbea9300178b30c95835354e34c4e4febc4badfe27102879de0483b5e",
+      "image": "registry-api.novox.be/novox/photos-server:latest",
-      "env": {
+      "network": "photos",
-        "PHOTOS_STORE": "/etc/photos/store.json",
+      "env-file": [
-        "PHOTOS_STORE_SECRET_FILE": "/etc/photos/store.secret"
+        "/var/lib/photos/server.env"
-      },
+      ],
-      "volumes": [
+      "ports": [
-        "/etc/photos/store.json:/etc/photos/store.json:ro",
+        "9000"
-        "/etc/photos/store.secret:/etc/photos/store.secret:ro"
       ]
     },
     {
-      "id": "runtime-config",
+      "id": "admin-client",
-      "type": "file",
+      "type": "container",
-      "path": "/var/lib/mesh/photos/config.json",
+      "name": "photos-admin-client",
-      "mode": "0600",
+      "image": "registry-api.novox.be/novox/photos-admin-client:latest",
-      "content": "{}\n",
+      "network": "photos",
-      "merge": "json"
+      "ports": [
+        "4001:80"
+      ]
     },
     {
-      "id": "runtime",
+      "id": "eef-client",
       "type": "container",
-      "name": "mesh-photos",
+      "name": "photos-client-eef",
-      "image": "mesh-runtime-photos@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "image": "registry-api.novox.be/novox/photos-client:latest",
-      "network": "host",
+      "network": "photos",
-      "volumes": [
+      "ports": [
-        "/var/lib/mesh/photos/broker:/run/secrets/broker:ro",
+        "4002:80"
-        "/var/lib/mesh/photos/config.json:/run/config/config.json:ro"
+      ]
-      ],
+    },
-      "env": {
+    {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
+      "id": "filip-client",
-        "MESH_PHOTOS_URL": "http://127.0.0.1:2283",
+      "type": "container",
-        "MESH_PHOTOS_CONFIG_FILE": "/run/config/config.json"
+      "name": "photos-client-filip",
-      },
+      "image": "registry-api.novox.be/novox/photos-client:latest",
-      "restart-on": [
+      "network": "photos",
-        "runtime-config"
+      "ports": [
+        "4003:80"
       ]
     }
-  ],
-  "capabilities": [
-    "container-runtime"
   ]
 }