mosquitto: its directories are placed, not stated, and it runs the build in use

The module stated /var/lib/mosquitto-module and /services/mosquitto/data —
novox's layout, a path no definition may carry (ADR 0112). State, grants and
data are now placed directories (${dir:state}, ${dir:grants}, ${dir:data}),
the admin secret lives beside the broker account under the mesh's own state,
and the receives/grants maps follow the grants directory. Paths inside the
sidecar are its own view and are unchanged.

Image pinned to the 2.1.2 build ace's predecessor runs (2026-09-17); the old
pin was the same version, built in June.

Found preparing ace, whose broker carries a password-file user (an IoT switch
and home-assistant). Carrying it is a data step, not a manifest one: the
migration repo has scripts/mosquitto-pwdfile-to-dynsec.py, which moves $7$
PBKDF2 entries into the dynsec store hash-for-hash (tested end to end).

modules/mosquitto/module.json

@@ -23,13 +23,13 @@
     "mqtt-topic": {}
   },
   "receives": {
-    "mqtt-topic": "/var/lib/mosquitto-module/grants/mesh.json"
+    "mqtt-topic": "${dir:grants}/mesh.json"
   },
   "grants": {
-    "mqtt-topic": "/var/lib/mosquitto-module/grants"
+    "mqtt-topic": "${dir:grants}"
   },
   "own-secrets": {
-    "admin": "/var/lib/mosquitto-module/admin.secret",
+    "admin": "/var/lib/mesh/mosquitto/admin",
     "broker": "/var/lib/mesh/mosquitto/broker"
   },
   "listens": [
@@ -58,26 +58,24 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/mosquitto-module",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
-      "id": "grants-dir",
+      "id": "grants",
       "type": "directory",
-      "path": "/var/lib/mosquitto-module/grants",
       "mode": "0700"
     },
     {
       "id": "data",
       "type": "directory",
-      "path": "/services/mosquitto/data",
       "mode": "0700",
       "owner": "1883:1883"
     },
     {
       "id": "server-conf",
       "type": "file",
-      "path": "/var/lib/mosquitto-module/mosquitto.conf",
+      "path": "${dir:state}/mosquitto.conf",
       "mode": "0600",
       "owner": "1883:1883",
       "content": "persistence true\npersistence_location /mosquitto/data\n\nlog_dest stdout\nlog_type warning\nlog_type error\nlog_type notice\n\n# Every client authenticates; identities and their per-topic ACLs are managed\n# at runtime by the dynamic security plugin, whose store the plugin itself owns.\nallow_anonymous false\nplugin /usr/lib/mosquitto_dynamic_security.so\nplugin_opt_config_file /mosquitto/data/dynamic-security.json\n\n# MQTT listener\nlistener 1883\n\n# MQTT-over-WebSockets listener\nlistener 8081\nprotocol websockets\n"
@@ -93,8 +91,8 @@
       "name": "mosquitto-bootstrap",
       "run-once": true,
       "volumes": [
-        "/services/mosquitto/data:/mosquitto/data",
-        "/var/lib/mosquitto-module/admin.secret:/run/secrets/admin:ro"
+        "${dir:data}:/mosquitto/data",
+        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
       ],
       "env": {
         "MESH_PROVISION_MQTT": "mosquitto:1883",
@@ -112,15 +110,15 @@
       "id": "server",
       "type": "container",
       "name": "mosquitto",
-      "image": "eclipse-mosquitto@sha256:6f8d8a947c506f8a2290ec65cd4bd2bc7cb4d43fb5f6271f861cb013e2ef9797",
+      "image": "eclipse-mosquitto@sha256:38c0da4f2ef84284d47b3b3eeea1cb3bdeabe81ee10caf0cd5c5ff61ee3ea408",
       "network": "mosquitto",
       "ports": [
         "1883",
         "8081"
       ],
       "volumes": [
-        "/services/mosquitto/data:/mosquitto/data",
-        "/var/lib/mosquitto-module/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro"
+        "${dir:data}:/mosquitto/data",
+        "${dir:state}/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro"
       ]
     },
     {
@@ -130,8 +128,8 @@
       "network": "mosquitto",
       "volumes": [
         "/var/lib/mesh/mosquitto/broker:/run/secrets/broker:ro",
-        "/var/lib/mosquitto-module/grants:/var/lib/mosquitto-module/grants:ro",
-        "/var/lib/mosquitto-module/admin.secret:/run/secrets/admin:ro"
+        "${dir:grants}:/var/lib/mosquitto-module/grants:ro",
+        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/plex/client.ts

@@ -58,10 +58,8 @@ export class PlexClient {
   static fromEnv(env: NodeJS.ProcessEnv = process.env): PlexClient {
     const url = env.MESH_PLEX_URL ?? `http://127.0.0.1:${env.PLEX_PORT ?? "32400"}`;
     const dataDir = env.MESH_PLEX_DATA_DIR ?? "/var/lib/plex";
-    // The manifest sets neither MESH_PLEX_TOKEN_FILE nor MESH_PLEX_TOKEN: the server already keeps its
-    // token in Preferences.xml, read here through the manifest's read-only mount of the config dir.
-    // A token the mesh minted would be one plex.tv never issued, and preferring it would break every
-    // call, so the module declares no token secret. The file and env overrides stay for hand runs.
+    // The operator-provided token is an own-secret the mesh mounts at MESH_PLEX_TOKEN_FILE (delivered
+    // by `secret accept`); prefer it, fall back to a bare env var, then to discovery from the data dir.
     const token = readSecret(env.MESH_PLEX_TOKEN_FILE) ?? env.MESH_PLEX_TOKEN ?? PlexClient.detectToken(dataDir);
     if (!token) throw new Error("no Plex token — set MESH_PLEX_TOKEN or make the data dir readable");
     return new PlexClient(url, token);

modules/plex/module.json

@@ -13,7 +13,8 @@
     "*.download.completed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/plex/broker"
+    "broker": "/var/lib/mesh/plex/broker",
+    "token": "/var/lib/mesh/plex/token"
   },
   "listens": [
     {
@@ -21,35 +22,7 @@
       "port": 32400,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the server itself: the apps, streaming and the web player, direct and through its route"
-    },
-    {
-      "name": "gdm-1",
-      "port": 32410,
-      "protocol": "udp",
-      "from": "mesh",
-      "why": "G'Day Mate discovery: players on the same network find the server without signing in"
-    },
-    {
-      "name": "gdm-2",
-      "port": 32412,
-      "protocol": "udp",
-      "from": "mesh",
-      "why": "G'Day Mate discovery"
-    },
-    {
-      "name": "gdm-3",
-      "port": 32413,
-      "protocol": "udp",
-      "from": "mesh",
-      "why": "G'Day Mate discovery"
-    },
-    {
-      "name": "gdm-4",
-      "port": 32414,
-      "protocol": "udp",
-      "from": "mesh",
-      "why": "G'Day Mate discovery"
+      "why": "streaming and the app; reaching it from outside is a route grant later"
     }
   ],
   "accesses": [
@@ -72,18 +45,6 @@
     {
       "path": "/services/media/audiobooks",
       "mode": "read"
-    },
-    {
-      "path": "/services/media/sport-games",
-      "mode": "read"
-    },
-    {
-      "path": "/services/media/live-shows",
-      "mode": "read"
-    },
-    {
-      "path": "/services/media/formula-1",
-      "mode": "read"
     }
   ],
   "resources": [
@@ -93,63 +54,39 @@
       "path": "/var/lib/mesh/plex",
       "mode": "0700"
     },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
     {
       "id": "config",
       "type": "directory",
-      "mode": "0755",
-      "owner": "1000:1000"
-    },
-    {
-      "id": "data",
-      "type": "directory",
-      "mode": "0755",
+      "path": "/services/plex/config",
+      "mode": "0700",
       "owner": "1000:1000"
     },
     {
       "id": "transcode",
       "type": "directory",
-      "mode": "0755",
+      "path": "/services/plex/transcode",
+      "mode": "0700",
       "owner": "1000:1000"
     },
-    {
-      "id": "server-env",
-      "type": "file",
-      "path": "${dir:state}/server.env",
-      "mode": "0600",
-      "content": "ADVERTISE_IP=https://${bound:route:name}/\n"
-    },
     {
       "id": "server",
       "type": "container",
       "name": "plex",
-      "image": "plexinc/pms-docker@sha256:e0ab27395614a8e1a4fdf84c6bc60ac664915cfdde70c52d030c7728a1c48e14",
+      "image": "plexinc/pms-docker@sha256:83a425ae9e133b1cb2cc3b809556e01c61cd8ff65c582e41b4374bc2210bac9e",
       "network": "host",
       "env": {
         "PLEX_UID": "1000",
         "PLEX_GID": "1000",
         "TZ": "Etc/UTC"
       },
-      "env-file": [
-        "${dir:state}/server.env"
-      ],
       "volumes": [
-        "${dir:config}:/config",
-        "${dir:data}:/data",
-        "${dir:transcode}:/transcode",
-        "/services/media/movies:/movies:ro",
-        "/services/media/series:/series:ro",
-        "/services/media/anime:/anime:ro",
-        "/services/media/music:/music:ro",
-        "/services/media/audiobooks:/audiobooks:ro",
-        "/services/media/sport-games:/sport-games:ro",
-        "/services/media/live-shows:/live-shows:ro",
-        "/services/media/formula-1:/formula-1:ro"
+        "/services/plex/config:/config",
+        "/services/plex/transcode:/transcode",
+        "/services/media/movies:/movies",
+        "/services/media/series:/series",
+        "/services/media/anime:/anime",
+        "/services/media/music:/music",
+        "/services/media/audiobooks:/audiobooks"
       ]
     },
     {
@@ -159,28 +96,18 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/plex/broker:/run/secrets/broker:ro",
-        "${dir:config}:/var/lib/plex/config:ro"
+        "/var/lib/mesh/plex/token:/run/secrets/token:ro",
+        "/services/plex/config:/var/lib/plex/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_PLEX_URL": "http://127.0.0.1:${port:32400}",
+        "MESH_PLEX_URL": "http://127.0.0.1:32400",
+        "MESH_PLEX_TOKEN_FILE": "/run/secrets/token",
         "MESH_PLEX_DATA_DIR": "/var/lib/plex"
       },
       "artifact": "runtime"
     }
   ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "plex",
-      "endpoint": "stream"
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
   "build": {
     "on": [
       {