plex: provide its API to the mesh as plex-api

kometa, tautulli and ombi reached plex by a hand-typed address - a public
name, a HAL network gateway - which the mesh cannot keep true. Plex now
provides plex-api at mesh scope and serves the server's port and scheme, so
the mesh tells each consumer where it is.

The port is written out rather than inferred: plex listens on five ports
(the server and four discovery ones), and the mesh only infers a provision's
port when a module listens on exactly one.

No grants and no provisioner: the credential is the server owner's
X-Plex-Token, which plex.tv issues and the mesh cannot mint. The operator
accepts it as the pair credential for each consumer (ADR 0092); each
consumer's step checks it against the server and writes nothing it refuses.

modules/mosquitto/Dockerfile

@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/mosquitto
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc topics.ts client.ts index.ts tools/index.ts provisioner/index.ts bootstrap/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisioner/index.ts bootstrap/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}

modules/mosquitto/client.ts

@@ -20,8 +20,6 @@ import { readFileSync } from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
-import { missingAcls, parseRoleAcls, staleAcls, wantedAcls } from "./topics.js";
-
 const run = promisify(execFile);
 
 export interface MqttConn {
@@ -143,19 +141,14 @@ export class MosquittoClient {
   }
 
   /**
-   * Create (or reset to a known state) a client granted exactly these topic filters, idempotently.
+   * Create (or reset to a known state) a client scoped to one topic namespace, idempotently. The
-   * The grant is a same-named role carrying, for every filter, publish, receive and subscribe — and
+   * client is confined to `<prefix>/#` by a same-named role: it may publish to, subscribe to and
-   * nothing else: an ACL the role carries that the filters no longer name is removed, so narrowing a
+   * receive on exactly its own subtree and nothing else — the MQTT analog of redis's keyspace-scoped
-   * consumer's `topics` narrows what it may do. By default the filters are the consumer's own
+   * ACL user. Called again for an existing client, it resets the password and re-asserts the ACLs.
-   * subtree, `<as>/#` (see topics.ts). Called again for an existing client, it resets the password
-   * and re-asserts the ACLs.
-   *
-   * Only the role named for this client is ever changed. A client or role the mesh did not make —
-   * a device carried from the predecessor's password file, its `legacy-full-access` role — is never
-   * read, changed or removed here.
    */
-  async createScopedClient(username: string, password: string, filters: readonly string[]): Promise<void> {
+  async createScopedClient(username: string, password: string, topicPrefix: string): Promise<void> {
     const role = username; // one role per client, named for it
+    const pattern = `${topicPrefix}/#`;
 
     if (await this.clientExists(username)) {
       await this.ctl("setClientPassword", username, password);
@@ -168,18 +161,17 @@ export class MosquittoClient {
       await this.ctl("createClient", username, "-p", password);
     }
 
-    // createRole and addRoleACL are one-shot: each rejects with an "already exists" when re-run
+    // A role carrying exactly this client's topic ACLs. createRole, addRoleACL and addClientRole are
-    // against a role/ACL it created on a previous reconcile. That rejection is the intended terminal
+    // all one-shot: each rejects with an "already exists" when re-run against a role/ACL/binding it
-    // state, so it is swallowed.
+    // created on a previous reconcile. That rejection is the intended terminal state — the ACL is
+    // deterministic (`<prefix>/#`, allow), so re-adding the identical entry is a no-op — so it is
+    // swallowed. (Until the exit code was fixed this was invisible: the tool returned 0 and the
+    // rejection was lost; now it surfaces, and each of these adds must tolerate its own idempotent
+    // re-run explicitly.)
     await ignoreExisting(this.ctl("createRole", role));
-    const wanted = wantedAcls(filters);
+    for (const acl of ["publishClientSend", "publishClientReceive", "subscribePattern"]) {
-    const current = parseRoleAcls(await this.ctl("getRole", role));
+      // allow (1) this client to send to, receive on, and subscribe under its own subtree.
-    for (const acl of missingAcls(current, wanted)) {
+      await ignoreExisting(this.ctl("addRoleACL", role, acl, pattern, "allow"));
-      await ignoreExisting(this.ctl("addRoleACL", role, acl.type, acl.topic, "allow"));
-    }
-    // What the consumer no longer asks for — added before it narrowed its topics — is taken away.
-    for (const acl of staleAcls(current, wanted)) {
-      await ignoreMissing(this.ctl("removeRoleACL", role, acl.type, acl.topic));
     }
     // Bind the role only when it is not already bound — addClientRole is the one call whose
     // idempotent re-run cannot be recognised by message (see clientHasRole).
@@ -189,31 +181,25 @@ export class MosquittoClient {
   }
 
   /**
-   * Whether a consumer's client accepts exactly this password, still carries its own role, and that
+   * Whether a consumer's client accepts exactly this password and still carries its own role.
-   * role grants exactly these filters. Read-only. The password is checked the way the consumer is
+   * Read-only. The password is checked the way the consumer is checked, by an MQTT CONNECT as it,
-   * checked, by an MQTT CONNECT as it, and the broker's CONNACK code is the answer: 0 accepted,
+   * and the broker's CONNACK code is the answer: 0 accepted, 4 bad credentials, 5 not authorised.
-   * 4 bad credentials, 5 not authorised. Nothing rides on argv. An unreachable broker rejects
+   * Nothing rides on argv. An unreachable broker rejects (novox/hq issue 120).
-   * (novox/hq issue 120).
    */
-  async holdsClient(username: string, password: string, filters: readonly string[]): Promise<boolean> {
+  async holdsClient(username: string, password: string): Promise<boolean> {
     const code = await mqttConnack(this.conn.host, this.conn.port, username, password);
     if (code === 4 || code === 5) return false;
     if (code !== 0) throw new Error(`mosquitto refused ${username} with CONNACK ${code}`);
     // The role, asked directly: only "not found" means absent. Any other failure to ask rejects,
     // unlike clientHasRole, which reads every failure as "no role".
-    let client: string;
+    let out: string;
-    let role: string;
     try {
-      client = await this.ctl("getClient", username);
+      out = await this.ctl("getClient", username);
-      role = await this.ctl("getRole", username);
     } catch (err) {
       if (/not\s*found|does not exist|no such/i.test(String(err))) return false;
       throw err;
     }
-    if (!new RegExp(`(^|\\s)${escapeRegExp(username)}\\s+\\(priority`, "m").test(client)) return false;
+    return new RegExp(`(^|\\s)${escapeRegExp(username)}\\s+\\(priority`, "m").test(out);
-    const current = parseRoleAcls(role);
-    const wanted = wantedAcls(filters);
-    return missingAcls(current, wanted).length === 0 && staleAcls(current, wanted).length === 0;
   }
 
   /** Remove a client and the per-client role created for it, idempotently. */

modules/mosquitto/module.json

@@ -20,19 +20,16 @@
     "mosquitto.topic.deprovisioned"
   ],
   "serves": {
-    "mqtt-topic": {
+    "mqtt-topic": {}
-      "scheme": "mqtt",
-      "port": 1883
-    }
   },
   "receives": {
-    "mqtt-topic": "${dir:grants}/mesh.json"
+    "mqtt-topic": "/var/lib/mosquitto-module/grants/mesh.json"
   },
   "grants": {
-    "mqtt-topic": "${dir:grants}"
+    "mqtt-topic": "/var/lib/mosquitto-module/grants"
   },
   "own-secrets": {
-    "admin": "/var/lib/mesh/mosquitto/admin",
+    "admin": "/var/lib/mosquitto-module/admin.secret",
     "broker": "/var/lib/mesh/mosquitto/broker"
   },
   "listens": [
@@ -61,24 +58,26 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
+      "path": "/var/lib/mosquitto-module",
-      "place": "."
+      "mode": "0700"
     },
     {
-      "id": "grants",
+      "id": "grants-dir",
       "type": "directory",
+      "path": "/var/lib/mosquitto-module/grants",
       "mode": "0700"
     },
     {
       "id": "data",
       "type": "directory",
+      "path": "/services/mosquitto/data",
       "mode": "0700",
       "owner": "1883:1883"
     },
     {
       "id": "server-conf",
       "type": "file",
-      "path": "${dir:state}/mosquitto.conf",
+      "path": "/var/lib/mosquitto-module/mosquitto.conf",
       "mode": "0600",
       "owner": "1883:1883",
       "content": "persistence true\npersistence_location /mosquitto/data\n\nlog_dest stdout\nlog_type warning\nlog_type error\nlog_type notice\n\n# Every client authenticates; identities and their per-topic ACLs are managed\n# at runtime by the dynamic security plugin, whose store the plugin itself owns.\nallow_anonymous false\nplugin /usr/lib/mosquitto_dynamic_security.so\nplugin_opt_config_file /mosquitto/data/dynamic-security.json\n\n# MQTT listener\nlistener 1883\n\n# MQTT-over-WebSockets listener\nlistener 8081\nprotocol websockets\n"
@@ -94,8 +93,8 @@
       "name": "mosquitto-bootstrap",
       "run-once": true,
       "volumes": [
-        "${dir:data}:/mosquitto/data",
+        "/services/mosquitto/data:/mosquitto/data",
-        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
+        "/var/lib/mosquitto-module/admin.secret:/run/secrets/admin:ro"
       ],
       "env": {
         "MESH_PROVISION_MQTT": "mosquitto:1883",
@@ -113,15 +112,15 @@
       "id": "server",
       "type": "container",
       "name": "mosquitto",
-      "image": "eclipse-mosquitto@sha256:38c0da4f2ef84284d47b3b3eeea1cb3bdeabe81ee10caf0cd5c5ff61ee3ea408",
+      "image": "eclipse-mosquitto@sha256:6f8d8a947c506f8a2290ec65cd4bd2bc7cb4d43fb5f6271f861cb013e2ef9797",
       "network": "mosquitto",
       "ports": [
         "1883",
         "8081"
       ],
       "volumes": [
-        "${dir:data}:/mosquitto/data",
+        "/services/mosquitto/data:/mosquitto/data",
-        "${dir:state}/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro"
+        "/var/lib/mosquitto-module/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro"
       ]
     },
     {
@@ -131,8 +130,8 @@
       "network": "mosquitto",
       "volumes": [
         "/var/lib/mesh/mosquitto/broker:/run/secrets/broker:ro",
-        "${dir:grants}:/var/lib/mosquitto-module/grants:ro",
+        "/var/lib/mosquitto-module/grants:/var/lib/mosquitto-module/grants:ro",
-        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
+        "/var/lib/mosquitto-module/admin.secret:/run/secrets/admin:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/mosquitto/package.json

@@ -1,14 +1,9 @@
 {
   "name": "@novox/module-mosquitto",
   "version": "0.1.0",
-  "description": "mosquitto \u2014 provides the mesh mqtt-topic interface. Its admin client, provisioner, tools and events live here (novox/hq ADR 0039).",
+  "description": "mosquitto — provides the mesh mqtt-topic interface. Its admin client, provisioner, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc topics.ts client.ts index.ts tools/index.ts provisioner/index.ts bootstrap/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.1"
   },

modules/mosquitto/provisioner/index.ts

@@ -5,14 +5,7 @@
 //
 // The `mqtt-topic` interface: a consumer connects as `as` with the password the mesh minted, and
 // publishes and subscribes under `<as>/#`, isolated from every other consumer by a Dynamic Security
-// role scoped to exactly that subtree — unless it contributed `topics`, the MQTT topic filters its
+// role scoped to exactly that subtree.
-// work needs (a home-automation hub needs the devices' topics); then the role grants exactly those
-// (topics.ts). A list that is not valid topic filters is refused, and the consumer is not created
-// or changed until it is fixed.
-//
-// What a consumer is told (its binding): `at` — the broker's machine — and `port`, the machine port
-// of the MQTT listener (the manifest's `serves`); `as` is its login, and its copy of the password is
-// the pair credential the mesh delivers to it.
 //
 // **The login and password are the mesh's, not the provisioner's (ADR 0048).** The mesh derives the
 // login and hands it to both ends so they agree, and mints the password and delivers a copy to each.
@@ -22,7 +15,6 @@
 import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
 import { emit } from "@novox/mesh-sdk/events";
 import { MosquittoClient } from "../client.js";
-import { topicFilters } from "../topics.js";
 
 const mosquitto = MosquittoClient.fromEnv();
 
@@ -37,20 +29,13 @@ async function announce(type: string, body: Record<string, string>): Promise<voi
 
 runProvisioner("mqtt-topic", {
   async create(p: Provision): Promise<void> {
-    // By default the consumer's own subtree, so one cannot read another's topics; what it
+    // The topic subtree is scoped to the consumer's own login, so one cannot read another's topics.
-    // contributed as `topics` otherwise.
+    const topicPrefix = p.as;
-    const granted = topicFilters(p.values, p.as);
+    await mosquitto.createScopedClient(p.as, p.password, topicPrefix);
-    if ("problem" in granted) {
-      // Thrown, so the harness logs it and retries: the consumer stays as it was (or absent) until
-      // its contribution is valid, rather than being given a grant it did not ask for.
-      throw new Error(`${p.as}: ${granted.problem}`);
-    }
-    await mosquitto.createScopedClient(p.as, p.password, granted.filters);
     await announce("topic.provisioned", {
       consumer: p.consumer ?? "",
       username: p.as,
-      topicPrefix: granted.own ? p.as : "",
+      topicPrefix,
-      topics: granted.filters.join(" "),
     });
   },
 
@@ -61,9 +46,6 @@ runProvisioner("mqtt-topic", {
   // Asked every minute by the harness: whether the backend still holds this consumer exactly as
   // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
   async holds(p: Provision): Promise<boolean> {
-    const granted = topicFilters(p.values, p.as);
+    return mosquitto.holdsClient(p.as, p.password);
-    // An invalid list was never applied; create refuses it again, loudly, on every pass.
-    if ("problem" in granted) return false;
-    return mosquitto.holdsClient(p.as, p.password, granted.filters);
   },
 });

modules/mosquitto/test/topics.test.ts

@@ -1,72 +0,0 @@
-// What a consumer of mqtt-topic is granted (topics.ts): its own subtree unless it contributed
-// `topics`; a contributed list is granted exactly, refused whole when it is not topic filters; and
-// the role is brought to exactly the wanted ACLs — missing ones added, stale ones removed — read from
-// `mosquitto_ctrl dynsec getRole` as eclipse-mosquitto 2.1.2 prints it.
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { filterProblem, missingAcls, parseRoleAcls, staleAcls, topicFilters, wantedAcls } from "../topics.ts";
-
-test("a consumer that contributed nothing gets its own subtree", () => {
-  assert.deepEqual(topicFilters({}, "mesh_ace_hass"), { ok: true, filters: ["mesh_ace_hass/#"], own: true });
-  assert.deepEqual(topicFilters(undefined, "x"), { ok: true, filters: ["x/#"], own: true });
-  // Settings merge into every contribution: keys that are not `topics` change nothing.
-  assert.deepEqual(topicFilters({ endpoints: { web: {} } }, "x"), { ok: true, filters: ["x/#"], own: true });
-});
-
-test("a contributed list is granted exactly, duplicates once", () => {
-  assert.deepEqual(topicFilters({ topics: ["#"] }, "x"), { ok: true, filters: ["#"], own: false });
-  assert.deepEqual(topicFilters({ topics: ["stat/+/POWER", "tele/#", "tele/#", "/octoprint/x"] }, "x"), {
-    ok: true,
-    filters: ["stat/+/POWER", "tele/#", "/octoprint/x"],
-    own: false,
-  });
-});
-
-test("a list that is not topic filters is refused whole", () => {
-  for (const topics of [[], "#", [""], ["a/#/b"], ["a#"], ["a/b+"], [42], ["a\u0000b"], {}]) {
-    const out = topicFilters({ topics } as Record<string, unknown>, "x");
-    assert.equal(out.ok, false, JSON.stringify(topics));
-  }
-  assert.equal(filterProblem("+/+/#"), undefined);
-  assert.equal(filterProblem("#"), undefined);
-});
-
-const GET_ROLE = `Warning: You are running mosquitto_ctrl without encryption.
-This means all of the configuration changes you are making are visible on the network, including passwords.
-
-Rolename: u1
-ACLs:     publishClientSend    : allow : # (priority: 0)
-          subscribePattern     : allow : u1/# (priority: 0)
-          publishClientReceive : deny : secret topic/with space (priority: -1)
-`;
-
-test("getRole's ACL lines are read, the warning and headings are not", () => {
-  assert.deepEqual(parseRoleAcls(GET_ROLE), [
-    { type: "publishClientSend", allow: true, topic: "#" },
-    { type: "subscribePattern", allow: true, topic: "u1/#" },
-    { type: "publishClientReceive", allow: false, topic: "secret topic/with space" },
-  ]);
-  assert.deepEqual(parseRoleAcls("Rolename: empty\nACLs:\n"), []);
-});
-
-test("the role is brought to exactly the wanted ACLs", () => {
-  const current = parseRoleAcls(GET_ROLE);
-  const wanted = wantedAcls(["u1/#"]);
-  assert.deepEqual(wanted, [
-    { type: "publishClientSend", allow: true, topic: "u1/#" },
-    { type: "publishClientReceive", allow: true, topic: "u1/#" },
-    { type: "subscribePattern", allow: true, topic: "u1/#" },
-  ]);
-  assert.deepEqual(missingAcls(current, wanted), [
-    { type: "publishClientSend", allow: true, topic: "u1/#" },
-    { type: "publishClientReceive", allow: true, topic: "u1/#" },
-  ]);
-  assert.deepEqual(staleAcls(current, wanted), [
-    { type: "publishClientSend", allow: true, topic: "#" },
-    { type: "publishClientReceive", allow: false, topic: "secret topic/with space" },
-  ]);
-  assert.deepEqual(staleAcls(wanted, wanted), []);
-  assert.deepEqual(missingAcls(wanted, wanted), []);
-});

modules/mosquitto/topics.ts

@@ -1,107 +0,0 @@
-// Which topics a consumer of `mqtt-topic` may use — the one choice a consumer makes about its grant.
-//
-// **By default, its own subtree and nothing else.** A consumer connects as the login the mesh derived
-// (`as`) and may publish, receive and subscribe under `<as>/#` — isolated from every other consumer,
-// which is the point of a per-consumer client (novox/hq ADR 0039/0048).
-//
-// **A consumer whose work IS the shared topic space says so.** Home Assistant discovers devices
-// under `homeassistant/#` and `tasmota/discovery/#` and follows whatever state topics they announce;
-// Node-RED's flows subscribe to the topics devices publish on (`stat/<device>/POWER`, …). Confined
-// to `<as>/#` neither could do its job. So a consumer contributes `topics` to its `mqtt-topic`
-// requirement — a list of MQTT topic filters — and the provisioner grants exactly those, both ways.
-// Because assignment settings merge into every contribution, an operator narrows (or widens) the
-// list per machine with the same key, without editing a manifest.
-//
-// Pure, so it is tested without a broker (test/topics.test.ts).
-
-/** The dynsec ACL types a granted filter carries: send to it, receive from it, subscribe to it. */
-export const GRANTED_ACL_TYPES = ["publishClientSend", "publishClientReceive", "subscribePattern"] as const;
-
-/** One ACL on a role, as `mosquitto_ctrl dynsec getRole` reports it. */
-export interface Acl {
-  type: string;
-  allow: boolean;
-  topic: string;
-}
-
-export type Filters = { ok: true; filters: string[]; own: boolean } | { ok: false; problem: string };
-
-/**
- * The topic filters a consumer is granted: what it contributed as `topics`, or its own subtree when
- * it contributed nothing. Refused — never silently narrowed or widened — when the list is not a
- * list of valid MQTT topic filters: a grant that quietly differs from what was asked is a consumer
- * that fails somewhere far from the cause.
- */
-export function topicFilters(values: Readonly<Record<string, unknown>> | undefined, as: string): Filters {
-  const given = values?.topics;
-  if (given === undefined || given === null) {
-    return { ok: true, filters: [`${as}/#`], own: true };
-  }
-  if (!Array.isArray(given) || given.length === 0) {
-    return { ok: false, problem: `topics must be a non-empty list of MQTT topic filters, not ${JSON.stringify(given)}` };
-  }
-  const out: string[] = [];
-  for (const f of given) {
-    if (typeof f !== "string") {
-      return { ok: false, problem: `topics holds ${JSON.stringify(f)}, which is not a topic filter` };
-    }
-    const problem = filterProblem(f);
-    if (problem) return { ok: false, problem: `topic filter ${JSON.stringify(f)}: ${problem}` };
-    if (!out.includes(f)) out.push(f);
-  }
-  return { ok: true, filters: out, own: out.length === 1 && out[0] === `${as}/#` };
-}
-
-/** Why a string is not a valid MQTT topic filter (MQTT 3.1.1 §4.7), or undefined when it is one. */
-export function filterProblem(filter: string): string | undefined {
-  if (filter.length === 0) return "it is empty";
-  if (Buffer.byteLength(filter, "utf8") > 65535) return "it is longer than MQTT allows";
-  if (filter.includes("\u0000")) return "it contains a NUL character";
-  const levels = filter.split("/");
-  for (let i = 0; i < levels.length; i++) {
-    const level = levels[i];
-    if (level.includes("#") && (level !== "#" || i !== levels.length - 1)) {
-      return "'#' must be a whole level, and the last one";
-    }
-    if (level.includes("+") && level !== "+") return "'+' must be a whole level";
-  }
-  return undefined;
-}
-
-/** The ACLs a role must carry to grant these filters: every granted type, allowed, on every filter. */
-export function wantedAcls(filters: readonly string[]): Acl[] {
-  const out: Acl[] = [];
-  for (const topic of filters) {
-    for (const type of GRANTED_ACL_TYPES) out.push({ type, allow: true, topic });
-  }
-  return out;
-}
-
-/**
- * The ACLs `mosquitto_ctrl dynsec getRole` lists, one per line under its "ACLs:" heading:
- *   `ACLs:     publishClientSend    : allow : # (priority: 0)`
- *   `          subscribePattern     : allow : u1/# (priority: 0)`
- */
-export function parseRoleAcls(output: string): Acl[] {
-  const out: Acl[] = [];
-  const line = /^(?:ACLs:)?\s*([A-Za-z]+)\s*:\s*(allow|deny)\s*:\s*(.*?)\s+\(priority:\s*-?\d+\)\s*$/;
-  for (const raw of output.split(/\r?\n/)) {
-    const m = raw.match(line);
-    if (m) out.push({ type: m[1], allow: m[2] === "allow", topic: m[3] });
-  }
-  return out;
-}
-
-const key = (a: Acl): string => `${a.type}\u0000${a.allow ? "allow" : "deny"}\u0000${a.topic}`;
-
-/** ACLs a role carries that it should not: in `current` and not in `wanted`. */
-export function staleAcls(current: readonly Acl[], wanted: readonly Acl[]): Acl[] {
-  const want = new Set(wanted.map(key));
-  return current.filter((a) => !want.has(key(a)));
-}
-
-/** ACLs a role should carry and does not. */
-export function missingAcls(current: readonly Acl[], wanted: readonly Acl[]): Acl[] {
-  const have = new Set(current.map(key));
-  return wanted.filter((a) => !have.has(key(a)));
-}

modules/mosquitto/tsconfig.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["topics.ts", "client.ts", "index.ts", "provisioner/index.ts", "tools/index.ts", "bootstrap/index.ts"]
+  "include": ["client.ts", "index.ts", "provisioner/index.ts", "tools/index.ts", "bootstrap/index.ts"]
 }

modules/plex/client.ts

@@ -58,8 +58,10 @@ export class PlexClient {
   static fromEnv(env: NodeJS.ProcessEnv = process.env): PlexClient {
     const url = env.MESH_PLEX_URL ?? `http://127.0.0.1:${env.PLEX_PORT ?? "32400"}`;
     const dataDir = env.MESH_PLEX_DATA_DIR ?? "/var/lib/plex";
-    // The operator-provided token is an own-secret the mesh mounts at MESH_PLEX_TOKEN_FILE (delivered
+    // The manifest sets neither MESH_PLEX_TOKEN_FILE nor MESH_PLEX_TOKEN: the server already keeps its
-    // by `secret accept`); prefer it, fall back to a bare env var, then to discovery from the data dir.
+    // token in Preferences.xml, read here through the manifest's read-only mount of the config dir.
+    // A token the mesh minted would be one plex.tv never issued, and preferring it would break every
+    // call, so the module declares no token secret. The file and env overrides stay for hand runs.
     const token = readSecret(env.MESH_PLEX_TOKEN_FILE) ?? env.MESH_PLEX_TOKEN ?? PlexClient.detectToken(dataDir);
     if (!token) throw new Error("no Plex token — set MESH_PLEX_TOKEN or make the data dir readable");
     return new PlexClient(url, token);

modules/plex/module.json

@@ -1,6 +1,18 @@
 {
   "module": "plex",
   "version": "1",
+  "provides": [
+    {
+      "name": "plex-api",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "plex-api": {
+      "scheme": "http",
+      "port": 32400
+    }
+  },
   "capabilities": [
     "container-runtime"
   ],
@@ -13,8 +25,7 @@
     "*.download.completed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/plex/broker",
+    "broker": "/var/lib/mesh/plex/broker"
-    "token": "/var/lib/mesh/plex/token"
   },
   "listens": [
     {
@@ -22,7 +33,35 @@
       "port": 32400,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "streaming and the app; reaching it from outside is a route grant later"
+      "why": "the server itself: the apps, streaming and the web player, direct and through its route"
+    },
+    {
+      "name": "gdm-1",
+      "port": 32410,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery: players on the same network find the server without signing in"
+    },
+    {
+      "name": "gdm-2",
+      "port": 32412,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery"
+    },
+    {
+      "name": "gdm-3",
+      "port": 32413,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery"
+    },
+    {
+      "name": "gdm-4",
+      "port": 32414,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery"
     }
   ],
   "accesses": [
@@ -45,6 +84,18 @@
     {
       "path": "/services/media/audiobooks",
       "mode": "read"
+    },
+    {
+      "path": "/services/media/sport-games",
+      "mode": "read"
+    },
+    {
+      "path": "/services/media/live-shows",
+      "mode": "read"
+    },
+    {
+      "path": "/services/media/formula-1",
+      "mode": "read"
     }
   ],
   "resources": [
@@ -54,39 +105,63 @@
       "path": "/var/lib/mesh/plex",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "config",
       "type": "directory",
-      "path": "/services/plex/config",
+      "mode": "0755",
-      "mode": "0700",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0755",
       "owner": "1000:1000"
     },
     {
       "id": "transcode",
       "type": "directory",
-      "path": "/services/plex/transcode",
+      "mode": "0755",
-      "mode": "0700",
       "owner": "1000:1000"
     },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "content": "ADVERTISE_IP=https://${bound:route:name}/\n"
+    },
     {
       "id": "server",
       "type": "container",
       "name": "plex",
-      "image": "plexinc/pms-docker@sha256:83a425ae9e133b1cb2cc3b809556e01c61cd8ff65c582e41b4374bc2210bac9e",
+      "image": "plexinc/pms-docker@sha256:e0ab27395614a8e1a4fdf84c6bc60ac664915cfdde70c52d030c7728a1c48e14",
       "network": "host",
       "env": {
         "PLEX_UID": "1000",
         "PLEX_GID": "1000",
         "TZ": "Etc/UTC"
       },
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
       "volumes": [
-        "/services/plex/config:/config",
+        "${dir:config}:/config",
-        "/services/plex/transcode:/transcode",
+        "${dir:data}:/data",
-        "/services/media/movies:/movies",
+        "${dir:transcode}:/transcode",
-        "/services/media/series:/series",
+        "/services/media/movies:/movies:ro",
-        "/services/media/anime:/anime",
+        "/services/media/series:/series:ro",
-        "/services/media/music:/music",
+        "/services/media/anime:/anime:ro",
-        "/services/media/audiobooks:/audiobooks"
+        "/services/media/music:/music:ro",
+        "/services/media/audiobooks:/audiobooks:ro",
+        "/services/media/sport-games:/sport-games:ro",
+        "/services/media/live-shows:/live-shows:ro",
+        "/services/media/formula-1:/formula-1:ro"
       ]
     },
     {
@@ -96,18 +171,28 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/plex/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/plex/token:/run/secrets/token:ro",
+        "${dir:config}:/var/lib/plex/config:ro"
-        "/services/plex/config:/var/lib/plex/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_PLEX_URL": "http://127.0.0.1:32400",
+        "MESH_PLEX_URL": "http://127.0.0.1:${port:32400}",
-        "MESH_PLEX_TOKEN_FILE": "/run/secrets/token",
         "MESH_PLEX_DATA_DIR": "/var/lib/plex"
       },
       "artifact": "runtime"
     }
   ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "plex",
+      "endpoint": "stream"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
   "build": {
     "on": [
       {