kometa: dial plex on the scheme plex-api serves

The url's scheme was typed as http while its host and port came from the
binding. plex now serves plex-api with its scheme (#162), so the whole
address is the mesh's: a plex that one day serves https is followed rather
than dialled on the wrong protocol.

modules/kometa/module.json

@@ -0,0 +1,66 @@
+{
+  "module": "kometa",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "plex-api",
+    "secret"
+  ],
+  "binds": {
+    "plex-api": "${dir:state}/plex-api.json"
+  },
+  "secrets": {
+    "plex-api": "${dir:state}/plex-api.secret",
+    "secret": {
+      "tmdb": "${dir:state}/tmdb.secret"
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "mode": "0700"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/config.yml",
+      "mode": "0600",
+      "merge": "json",
+      "content": "{\n  \"plex\": {\n    \"url\": \"${bound:plex-api:scheme}://${bound:plex-api:at}:${bound:plex-api:port}\",\n    \"token\": \"${secret:plex-api}\",\n    \"timeout\": 60,\n    \"clean_bundles\": false,\n    \"empty_trash\": false,\n    \"optimize\": false,\n    \"verify_ssl\": null,\n    \"db_cache\": null\n  },\n  \"tmdb\": {\n    \"apikey\": \"${secret:tmdb}\",\n    \"language\": \"en\",\n    \"cache_expiration\": 60,\n    \"region\": null\n  },\n  \"settings\": {\n    \"cache\": true,\n    \"cache_expiration\": 60,\n    \"asset_directory\": \"config/assets\",\n    \"sync_mode\": \"append\",\n    \"minimum_items\": 1,\n    \"delete_below_minimum\": false,\n    \"run_again_delay\": 2,\n    \"show_missing\": false,\n    \"save_report\": false,\n    \"run_order\": [\n      \"operations\",\n      \"metadata\",\n      \"collections\",\n      \"overlays\"\n    ],\n    \"asset_folders\": true,\n    \"asset_depth\": 0,\n    \"create_asset_folders\": false,\n    \"prioritize_assets\": false,\n    \"dimensional_asset_rename\": false,\n    \"download_url_assets\": false,\n    \"show_missing_assets\": true,\n    \"show_missing_season_assets\": false,\n    \"show_missing_episode_assets\": false,\n    \"show_asset_not_needed\": true,\n    \"default_collection_order\": null,\n    \"item_refresh_delay\": 0,\n    \"delete_not_scheduled\": false,\n    \"missing_only_released\": false,\n    \"only_filter_missing\": false,\n    \"show_unmanaged\": true,\n    \"show_unconfigured\": true,\n    \"show_filtered\": false,\n    \"show_unfiltered\": false,\n    \"show_options\": false,\n    \"tvdb_language\": \"default\",\n    \"ignore_ids\": null,\n    \"ignore_imdb_ids\": null,\n    \"playlist_sync_to_users\": null,\n    \"playlist_exclude_users\": null,\n    \"playlist_report\": true,\n    \"custom_repo\": null,\n    \"overlay_artwork_filetype\": \"webp_lossy\",\n    \"overlay_artwork_quality\": 90,\n    \"auto_sort_hubs\": null,\n    \"verify_ssl\": true\n  },\n  \"libraries\": {}\n}\n"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "kometa"
+    },
+    {
+      "id": "run",
+      "type": "container",
+      "name": "kometa",
+      "image": "kometateam/kometa@sha256:6c3971a4aaa928b045e5f22514196b6db7f9b2b186158ebfe3239f4b328dfb0a",
+      "network": "kometa",
+      "schedule": "0 3 * * *",
+      "args": [
+        "--run"
+      ],
+      "env": {
+        "TZ": "Etc/UTC",
+        "KOMETA_NO_MISSING": "true",
+        "KOMETA_READ_ONLY_CONFIG": "true"
+      },
+      "volumes": [
+        "${dir:config}:/config",
+        "${dir:state}/config.yml:/config/config.yml:ro"
+      ]
+    }
+  ]
+}

modules/n8n/Dockerfile

@@ -1,20 +0,0 @@
-# n8n with what its workflows reach for beyond the upstream image.
-#
-# The base is named, not pinned here (novox/hq issue 044): module.json's `build.on` declares N8N_BASE
-# as the upstream image by digest, and the mesh hands the build its own copy (ADR 0097).
-ARG N8N_BASE
-FROM ${N8N_BASE}
-
-USER root
-# - `media` (GID 2000), with `node` in it: the shared media library is group-writable by the
-#   operator's media group, and a workflow files downloads into it. A container resource cannot add
-#   a supplementary group, so the image's own /etc/group carries it. 2000 is the operator's media
-#   group today; novox/hq 153 proposes reading it from the accessed data (${access:<id>:gid}).
-# - uuid, pinned to the version the workflows were written against: Code nodes require() it
-#   (NODE_FUNCTION_ALLOW_EXTERNAL=*), and a Code node can only require what is installed.
-RUN apk add --no-cache shadow \
- && groupadd -g 2000 media \
- && usermod -aG media node \
- && npm install -g uuid@14.0.1
-
-USER node

modules/n8n/module.json

@@ -18,60 +18,44 @@
     }
   },
   "binds": {
-    "postgres-database": "${dir:state}/database.json",
-    "route": "${dir:state}/route.json"
+    "postgres-database": "/var/lib/n8n/database.json",
+    "route": "/var/lib/n8n/route.json"
   },
   "secrets": {
-    "postgres-database": "${dir:state}/database.secret"
+    "postgres-database": "/var/lib/n8n/database.secret"
+  },
+  "own-secrets": {
+    "basic-auth": "/var/lib/n8n/basic-auth.secret"
   },
-  "accesses": [
-    {
-      "path": "/services/media",
-      "mode": "read-write"
-    }
-  ],
   "listens": [
     {
       "name": "web",
-      "port": 5678,
+      "port": 5682,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the n8n editor, its REST API and the webhook endpoints workflows are triggered through; a public name is the route's"
+      "why": "the n8n editor and webhook endpoints over http; the public name n8n.novox.be is a route grant, and route-proxy reaches it on this published port"
     }
   ],
   "resources": [
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/n8n",
+      "mode": "0700"
     },
     {
       "id": "data",
       "type": "directory",
+      "path": "/services/n8n/n8n-data",
       "mode": "0700",
       "owner": "1000:1000"
     },
-    {
-      "id": "cache",
-      "type": "directory",
-      "mode": "0700",
-      "owner": "999:999"
-    },
-    {
-      "id": "database-secret",
-      "type": "file",
-      "path": "${dir:state}/n8n-database.secret",
-      "mode": "0400",
-      "owner": "1000:1000",
-      "content": "${secret:postgres-database}"
-    },
     {
       "id": "server-env",
       "type": "file",
-      "path": "${dir:state}/server.env",
+      "path": "/var/lib/n8n/server.env",
       "mode": "0600",
-      "content": "N8N_HOST=${bound:route:name}\nN8N_PORT=5678\nN8N_PROTOCOL=https\nWEBHOOK_URL=https://${bound:route:name}/\nNODE_FUNCTION_ALLOW_BUILTIN=*\nNODE_FUNCTION_ALLOW_EXTERNAL=*\nDB_TYPE=postgresdb\nDB_POSTGRESDB_HOST=${bound:postgres-database:at}\nDB_POSTGRESDB_PORT=${bound:postgres-database:port}\nDB_POSTGRESDB_DATABASE=${bound:postgres-database:as}\nDB_POSTGRESDB_USER=${bound:postgres-database:as}\nDB_POSTGRESDB_PASSWORD_FILE=/run/secrets/database\n"
+      "content": "N8N_HOST=n8n.novox.be\nN8N_PORT=5678\nN8N_PROTOCOL=https\nWEBHOOK_URL=https://n8n.novox.be/\nN8N_BASIC_AUTH_ACTIVE=true\nN8N_BASIC_AUTH_USER=admin\nN8N_BASIC_AUTH_PASSWORD=${secret:basic-auth}\nNODE_FUNCTION_ALLOW_BUILTIN=*\nNODE_FUNCTION_ALLOW_EXTERNAL=*\nDB_TYPE=postgresdb\nDB_POSTGRESDB_HOST=${bound:postgres-database:at}\nDB_POSTGRESDB_PORT=${bound:postgres-database:port}\nDB_POSTGRESDB_DATABASE=${bound:postgres-database:as}\nDB_POSTGRESDB_USER=${bound:postgres-database:as}\nDB_POSTGRESDB_PASSWORD=${secret:postgres-database}\n"
     },
     {
       "id": "net",
@@ -82,61 +66,18 @@
       "id": "server",
       "type": "container",
       "name": "n8n",
-      "artifact": "server",
+      "image": "n8nio/n8n@sha256:4846eb2f4b874ab04cde7fc1e249d2ddaec66e9aea64439beb2972cfea88e3c0",
       "network": "n8n",
       "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/n8n/server.env"
       ],
       "ports": [
         "5678"
       ],
       "volumes": [
-        "${dir:data}:/home/node/.n8n",
-        "${dir:state}/n8n-database.secret:/run/secrets/database:ro",
-        "/services/media:/media-library"
-      ]
-    },
-    {
-      "id": "cache-server",
-      "type": "container",
-      "name": "n8n-redis",
-      "image": "redis@sha256:8a1efc5f479551822b47424ccae982026b633f28818eab0387348120a61e10e2",
-      "network": "n8n",
-      "args": [
-        "redis-server",
-        "--appendonly",
-        "yes"
+        "/services/n8n/n8n-data:/home/node/.n8n"
       ],
-      "volumes": [
-        "${dir:cache}:/data"
-      ]
-    },
-    {
-      "id": "browser",
-      "type": "container",
-      "name": "n8n-selenium",
-      "image": "selenium/standalone-chrome@sha256:9ae1c78e9b2ca9fe4b22e57873b5ee34aeb8e814e3122293eef4c3abe4c5f448",
-      "network": "n8n",
-      "env": {
-        "SE_ENABLE_TRACING": "false",
-        "SE_NODE_MAX_SESSIONS": "5",
-        "SE_NODE_OVERRIDE_MAX_SESSIONS": "true"
-      }
+      "secrets-in-environment": "n8n's loader honours <VAR>_FILE for every setting; convertible, awaiting a bed that proves it (N8N_BASIC_AUTH_* was removed in n8n 1.0 and is likely dead)"
     }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "N8N_BASE",
-        "image": "n8nio/n8n@sha256:4846eb2f4b874ab04cde7fc1e249d2ddaec66e9aea64439beb2972cfea88e3c0"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "server",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
+  ]
 }