plex: provide its API to the mesh as plex-api

kometa, tautulli and ombi reached plex by a hand-typed address - a public
name, a HAL network gateway - which the mesh cannot keep true. Plex now
provides plex-api at mesh scope and serves the server's port and scheme, so
the mesh tells each consumer where it is.

The port is written out rather than inferred: plex listens on five ports
(the server and four discovery ones), and the mesh only infers a provision's
port when a module listens on exactly one.

No grants and no provisioner: the credential is the server owner's
X-Plex-Token, which plex.tv issues and the mesh cannot mint. The operator
accepts it as the pair credential for each consumer (ADR 0092); each
consumer's step checks it against the server and writes nothing it refuses.

modules/ca-trust/module.json

@@ -0,0 +1,56 @@
+{
+  "module": "ca-trust",
+  "version": "1",
+  "slug": "catrust",
+  "capabilities": [
+    "service-manager"
+  ],
+  "requires": [
+    "internal-acme-ca"
+  ],
+  "seats": [
+    {
+      "name": "the-mesh-trust-anchor",
+      "scope": "node"
+    }
+  ],
+  "claims": [
+    {
+      "name": "the-mesh-trust-anchor",
+      "scope": "node"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "anchor",
+      "type": "file",
+      "path": "${dir:state}/anchor",
+      "mode": "0755",
+      "content": "#!/bin/sh\n# The mesh's internal certificate authority, trusted by this machine.\n#\n# Written by the mesh from the ca-trust module's manifest (novox/hq ADR 0147).\n# Editing it here lasts until the next apply.\n#\n# There is no prior trust to verify the fetch against \u2014 this is the thing that\n# establishes it \u2014 so it is made over the mesh's own private network, which is\n# what authenticates it (novox/hq ADR 0098, the same reasoning that lets the\n# route proxy fetch this root for itself). What comes back is checked here: a\n# body that is not a certificate is refused now, rather than believed and then\n# failed by whatever reads the trust store next.\nset -eu\n\nROOTS='https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}'\nANCHORS=/etc/ca-certificates/trust-source/anchors\nANCHOR=\"$ANCHORS/mesh-internal-ca.crt\"\n\n# Arch's layout, said out loud rather than assumed: a machine that keeps its\n# anchors elsewhere fails here, visibly, instead of writing a file nothing\n# reads. That failure is the signal that this belongs in the host, where one\n# operating system's difference lives (novox/hq ADR 0147, option 2).\n[ -d \"$ANCHORS\" ] || {\n\techo \"this machine keeps no trust anchors in $ANCHORS; ca-trust is written for that layout\" >&2\n\texit 1\n}\n\ncase \"${1:-}\" in\ninstall)\n\ttmp=$(mktemp)\n\ttrap 'rm -f \"$tmp\"' EXIT\n\t# The authority may still be starting, or this machine may have come up\n\t# before it: two minutes of asking, then an honest failure.\n\tn=0\n\twhile [ \"$n\" -lt 60 ]; do\n\t\tif curl --fail --silent --show-error --insecure --max-time 10 \\\n\t\t\t--output \"$tmp\" \"$ROOTS\" &&\n\t\t\tgrep -q 'BEGIN CERTIFICATE' \"$tmp\"; then\n\t\t\tinstall -m 0644 \"$tmp\" \"$ANCHOR\"\n\t\t\tupdate-ca-trust\n\t\t\texit 0\n\t\tfi\n\t\tn=$((n + 1))\n\t\tsleep 2\n\tdone\n\techo \"the authority at $ROOTS did not serve a certificate within two minutes\" >&2\n\texit 1\n\t;;\nremove)\n\t# What stopping the unit does, and therefore what being unassigned does.\n\trm -f \"$ANCHOR\"\n\tupdate-ca-trust\n\t;;\n*)\n\techo \"usage: $(basename \"$0\") install|remove\" >&2\n\texit 2\n\t;;\nesac\n"
+    },
+    {
+      "id": "unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-ca-trust.service",
+      "mode": "0644",
+      "content": "[Unit]\nDescription=The mesh's internal certificate authority, trusted by this machine\n# novox/hq ADR 0147. Starting this unit places the mesh's root among this\n# machine's trust anchors; stopping it takes the root away again, which is what\n# the host does when the module is no longer assigned here.\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=${dir:state}/anchor install\nExecStop=${dir:state}/anchor remove\n\n[Install]\nWantedBy=multi-user.target\n"
+    },
+    {
+      "id": "trust",
+      "type": "service",
+      "unit": "mesh-ca-trust.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "anchor",
+        "unit"
+      ]
+    }
+  ]
+}

modules/plex/client.ts

@@ -58,8 +58,10 @@ export class PlexClient {
   static fromEnv(env: NodeJS.ProcessEnv = process.env): PlexClient {
     const url = env.MESH_PLEX_URL ?? `http://127.0.0.1:${env.PLEX_PORT ?? "32400"}`;
     const dataDir = env.MESH_PLEX_DATA_DIR ?? "/var/lib/plex";
-    // The operator-provided token is an own-secret the mesh mounts at MESH_PLEX_TOKEN_FILE (delivered
-    // by `secret accept`); prefer it, fall back to a bare env var, then to discovery from the data dir.
+    // The manifest sets neither MESH_PLEX_TOKEN_FILE nor MESH_PLEX_TOKEN: the server already keeps its
+    // token in Preferences.xml, read here through the manifest's read-only mount of the config dir.
+    // A token the mesh minted would be one plex.tv never issued, and preferring it would break every
+    // call, so the module declares no token secret. The file and env overrides stay for hand runs.
     const token = readSecret(env.MESH_PLEX_TOKEN_FILE) ?? env.MESH_PLEX_TOKEN ?? PlexClient.detectToken(dataDir);
     if (!token) throw new Error("no Plex token — set MESH_PLEX_TOKEN or make the data dir readable");
     return new PlexClient(url, token);

modules/plex/module.json

@@ -1,6 +1,18 @@
 {
   "module": "plex",
   "version": "1",
+  "provides": [
+    {
+      "name": "plex-api",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "plex-api": {
+      "scheme": "http",
+      "port": 32400
+    }
+  },
   "capabilities": [
     "container-runtime"
   ],
@@ -13,8 +25,7 @@
     "*.download.completed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/plex/broker",
-    "token": "/var/lib/mesh/plex/token"
+    "broker": "/var/lib/mesh/plex/broker"
   },
   "listens": [
     {
@@ -22,7 +33,35 @@
       "port": 32400,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "streaming and the app; reaching it from outside is a route grant later"
+      "why": "the server itself: the apps, streaming and the web player, direct and through its route"
+    },
+    {
+      "name": "gdm-1",
+      "port": 32410,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery: players on the same network find the server without signing in"
+    },
+    {
+      "name": "gdm-2",
+      "port": 32412,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery"
+    },
+    {
+      "name": "gdm-3",
+      "port": 32413,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery"
+    },
+    {
+      "name": "gdm-4",
+      "port": 32414,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery"
     }
   ],
   "accesses": [
@@ -45,6 +84,18 @@
     {
       "path": "/services/media/audiobooks",
       "mode": "read"
+    },
+    {
+      "path": "/services/media/sport-games",
+      "mode": "read"
+    },
+    {
+      "path": "/services/media/live-shows",
+      "mode": "read"
+    },
+    {
+      "path": "/services/media/formula-1",
+      "mode": "read"
     }
   ],
   "resources": [
@@ -54,39 +105,63 @@
       "path": "/var/lib/mesh/plex",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "config",
       "type": "directory",
-      "path": "/services/plex/config",
-      "mode": "0700",
+      "mode": "0755",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0755",
       "owner": "1000:1000"
     },
     {
       "id": "transcode",
       "type": "directory",
-      "path": "/services/plex/transcode",
-      "mode": "0700",
+      "mode": "0755",
       "owner": "1000:1000"
     },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "content": "ADVERTISE_IP=https://${bound:route:name}/\n"
+    },
     {
       "id": "server",
       "type": "container",
       "name": "plex",
-      "image": "plexinc/pms-docker@sha256:83a425ae9e133b1cb2cc3b809556e01c61cd8ff65c582e41b4374bc2210bac9e",
+      "image": "plexinc/pms-docker@sha256:e0ab27395614a8e1a4fdf84c6bc60ac664915cfdde70c52d030c7728a1c48e14",
       "network": "host",
       "env": {
         "PLEX_UID": "1000",
         "PLEX_GID": "1000",
         "TZ": "Etc/UTC"
       },
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
       "volumes": [
-        "/services/plex/config:/config",
-        "/services/plex/transcode:/transcode",
-        "/services/media/movies:/movies",
-        "/services/media/series:/series",
-        "/services/media/anime:/anime",
-        "/services/media/music:/music",
-        "/services/media/audiobooks:/audiobooks"
+        "${dir:config}:/config",
+        "${dir:data}:/data",
+        "${dir:transcode}:/transcode",
+        "/services/media/movies:/movies:ro",
+        "/services/media/series:/series:ro",
+        "/services/media/anime:/anime:ro",
+        "/services/media/music:/music:ro",
+        "/services/media/audiobooks:/audiobooks:ro",
+        "/services/media/sport-games:/sport-games:ro",
+        "/services/media/live-shows:/live-shows:ro",
+        "/services/media/formula-1:/formula-1:ro"
       ]
     },
     {
@@ -96,18 +171,28 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/plex/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/plex/token:/run/secrets/token:ro",
-        "/services/plex/config:/var/lib/plex/config:ro"
+        "${dir:config}:/var/lib/plex/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_PLEX_URL": "http://127.0.0.1:32400",
-        "MESH_PLEX_TOKEN_FILE": "/run/secrets/token",
+        "MESH_PLEX_URL": "http://127.0.0.1:${port:32400}",
         "MESH_PLEX_DATA_DIR": "/var/lib/plex"
       },
       "artifact": "runtime"
     }
   ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "plex",
+      "endpoint": "stream"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
   "build": {
     "on": [
       {

modules/searxng/module.json

@@ -5,7 +5,7 @@
     "container-runtime"
   ],
   "own-secrets": {
-    "secret": "/var/lib/searxng-module/secret.secret",
+    "secret": "/var/lib/mesh/searxng/secret",
     "broker": "/var/lib/mesh/searxng/broker"
   },
   "listens": [
@@ -27,22 +27,14 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/searxng-module",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "valkey-data",
       "type": "directory",
-      "path": "/var/lib/searxng-module/valkey-data",
       "mode": "0700"
     },
-    {
-      "id": "server-env",
-      "type": "file",
-      "path": "/var/lib/searxng-module/server.env",
-      "mode": "0600",
-      "content": "SEARXNG_SECRET=${secret:secret}\nSEARXNG_VALKEY_URL=valkey://valkey:6379/0\n"
-    },
     {
       "id": "net",
       "type": "network",
@@ -63,30 +55,39 @@
         "warning"
       ],
       "volumes": [
-        "/var/lib/searxng-module/valkey-data:/data"
+        "${dir:valkey-data}:/data"
       ]
     },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.yml",
+      "mode": "0600",
+      "merge": "json",
+      "content": "{\n  \"use_default_settings\": true,\n  \"server\": {\n    \"secret_key\": \"${secret:secret}\",\n    \"base_url\": false,\n    \"limiter\": false,\n    \"image_proxy\": false,\n    \"public_instance\": false\n  },\n  \"search\": {\n    \"formats\": [\"html\", \"json\"]\n  },\n  \"valkey\": {\n    \"url\": \"valkey://valkey:6379/0\"\n  }\n}\n"
+    },
     {
       "id": "server",
       "type": "container",
       "name": "searxng",
-      "image": "searxng/searxng@sha256:c7cc75852051bf6254afda6ed1b920dd1677d8efe4ab141bf558f02e582f4371",
+      "image": "searxng/searxng@sha256:cd8812607ab73730a0b1a0dc4990223fe1b9e383f6f35947114d0bef7f8bb441",
       "network": "searxng",
-      "env-file": [
-        "/var/lib/searxng-module/server.env"
-      ],
       "ports": [
         "8080"
       ],
-      "secrets-in-environment": "SEARXNG_SECRET is env-only, but settings.yml carries server.secret_key; convertible by mounting a generated settings.yml, not yet done"
+      "volumes": [
+        "${dir:state}/settings.yml:/etc/searxng/settings.yml:ro"
+      ],
+      "restart-on": [
+        "settings"
+      ]
     },
     {
       "id": "runtime-config",
       "type": "file",
       "path": "/var/lib/mesh/searxng/config.json",
       "mode": "0600",
-      "content": "{}\n",
-      "merge": "json"
+      "content": "{}\n"
     },
     {
       "id": "runtime",
@@ -118,7 +119,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/searxng-module/route.json"
+    "route": "${dir:state}/route.json"
   },
   "build": {
     "on": [