plex: provide its API to the mesh as plex-api

kometa, tautulli and ombi reached plex by a hand-typed address - a public
name, a HAL network gateway - which the mesh cannot keep true. Plex now
provides plex-api at mesh scope and serves the server's port and scheme, so
the mesh tells each consumer where it is.

The port is written out rather than inferred: plex listens on five ports
(the server and four discovery ones), and the mesh only infers a provision's
port when a module listens on exactly one.

No grants and no provisioner: the credential is the server owner's
X-Plex-Token, which plex.tv issues and the mesh cannot mint. The operator
accepts it as the pair credential for each consumer (ADR 0092); each
consumer's step checks it against the server and writes nothing it refuses.

modules/distribution/module.json

@@ -55,7 +55,7 @@
       "name": "mesh-registry",
       "image": "registry@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373",
       "ports": [
-        "5000"
+        "5000:5000"
       ],
       "volumes": [
         "/var/lib/mesh-registry:/var/lib/registry"

modules/mailu/module.json

@@ -117,14 +117,14 @@
     },
     {
       "name": "web",
-      "port": 80,
+      "port": 7080,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here \u2014 everything else 301s to https and would loop a proxy"
     },
     {
       "name": "web-tls",
-      "port": 443,
+      "port": 7443,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the web front over its own TLS (admin, webmail, API); the public name mail.novox.be is a route grant reaching it here"
@@ -168,7 +168,7 @@
       "type": "file",
       "path": "${dir:state}/mailu.env",
       "mode": "0644",
-      "content": "ADMIN_ADDRESS=mailu-admin\nANTISPAM_ADDRESS=mailu-antispam\nANTIVIRUS_ADDRESS=mailu-antivirus\nIMAP_ADDRESS=mailu-imap\nSMTP_ADDRESS=mailu-smtp\nFRONT_ADDRESS=mailu-front\nWEBMAIL_ADDRESS=mailu-webmail\nWEBDAV_ADDRESS=mailu-webdav\nREDIS_ADDRESS=mailu-redis\nPORTS=25,80,443,465,993,995,4190,110,143,587\nDOMAIN=novox.be\nHOSTNAMES=mail.novox.be\nPOSTMASTER=admin\nSITENAME=Novox\nWEBSITE=https://novox.be\nTLS_FLAVOR=letsencrypt\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=novox.be\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=${port:80}\nHTTPS_PORT=${port:443}\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=mail.novox.be\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=mail.novox.be\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=novox.be\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=142.132.152.141\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\nWELCOME_SUBJECT=Welcome to your new email account\nWELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!\n"
+      "content": "ADMIN_ADDRESS=mailu-admin\nANTISPAM_ADDRESS=mailu-antispam\nANTIVIRUS_ADDRESS=mailu-antivirus\nIMAP_ADDRESS=mailu-imap\nSMTP_ADDRESS=mailu-smtp\nFRONT_ADDRESS=mailu-front\nWEBMAIL_ADDRESS=mailu-webmail\nWEBDAV_ADDRESS=mailu-webdav\nREDIS_ADDRESS=mailu-redis\nPORTS=25,80,443,465,993,995,4190,110,143,587\nDOMAIN=novox.be\nHOSTNAMES=mail.novox.be\nPOSTMASTER=admin\nSITENAME=Novox\nWEBSITE=https://novox.be\nTLS_FLAVOR=letsencrypt\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=novox.be\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=7080\nHTTPS_PORT=7443\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=mail.novox.be\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=mail.novox.be\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=novox.be\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=142.132.152.141\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\nWELCOME_SUBJECT=Welcome to your new email account\nWELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!\n"
     },
     {
       "id": "secret-env",
@@ -456,8 +456,8 @@
         "587",
         "993",
         "995",
-        "80",
-        "443"
+        "7080:80",
+        "7443:443"
       ],
       "volumes": [
         "${dir:data-certs}:/certs",

modules/only-office/module.json

@@ -23,7 +23,7 @@
   "listens": [
     {
       "name": "web",
-      "port": 80,
+      "port": 9070,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the document server over http; the public name office.novox.be is a route grant, and route-proxy reaches it on this published port"
@@ -93,7 +93,7 @@
         "${dir:state}/server.env"
       ],
       "ports": [
-        "80"
+        "9070:80"
       ],
       "volumes": [
         "${dir:logs}:/var/log/onlyoffice",

modules/plex/client.ts

@@ -58,8 +58,10 @@ export class PlexClient {
   static fromEnv(env: NodeJS.ProcessEnv = process.env): PlexClient {
     const url = env.MESH_PLEX_URL ?? `http://127.0.0.1:${env.PLEX_PORT ?? "32400"}`;
     const dataDir = env.MESH_PLEX_DATA_DIR ?? "/var/lib/plex";
-    // The operator-provided token is an own-secret the mesh mounts at MESH_PLEX_TOKEN_FILE (delivered
-    // by `secret accept`); prefer it, fall back to a bare env var, then to discovery from the data dir.
+    // The manifest sets neither MESH_PLEX_TOKEN_FILE nor MESH_PLEX_TOKEN: the server already keeps its
+    // token in Preferences.xml, read here through the manifest's read-only mount of the config dir.
+    // A token the mesh minted would be one plex.tv never issued, and preferring it would break every
+    // call, so the module declares no token secret. The file and env overrides stay for hand runs.
     const token = readSecret(env.MESH_PLEX_TOKEN_FILE) ?? env.MESH_PLEX_TOKEN ?? PlexClient.detectToken(dataDir);
     if (!token) throw new Error("no Plex token — set MESH_PLEX_TOKEN or make the data dir readable");
     return new PlexClient(url, token);

modules/plex/module.json

@@ -1,6 +1,18 @@
 {
   "module": "plex",
   "version": "1",
+  "provides": [
+    {
+      "name": "plex-api",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "plex-api": {
+      "scheme": "http",
+      "port": 32400
+    }
+  },
   "capabilities": [
     "container-runtime"
   ],
@@ -13,8 +25,7 @@
     "*.download.completed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/plex/broker",
-    "token": "/var/lib/mesh/plex/token"
+    "broker": "/var/lib/mesh/plex/broker"
   },
   "listens": [
     {
@@ -22,7 +33,35 @@
       "port": 32400,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "streaming and the app; reaching it from outside is a route grant later"
+      "why": "the server itself: the apps, streaming and the web player, direct and through its route"
+    },
+    {
+      "name": "gdm-1",
+      "port": 32410,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery: players on the same network find the server without signing in"
+    },
+    {
+      "name": "gdm-2",
+      "port": 32412,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery"
+    },
+    {
+      "name": "gdm-3",
+      "port": 32413,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery"
+    },
+    {
+      "name": "gdm-4",
+      "port": 32414,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "G'Day Mate discovery"
     }
   ],
   "accesses": [
@@ -45,6 +84,18 @@
     {
       "path": "/services/media/audiobooks",
       "mode": "read"
+    },
+    {
+      "path": "/services/media/sport-games",
+      "mode": "read"
+    },
+    {
+      "path": "/services/media/live-shows",
+      "mode": "read"
+    },
+    {
+      "path": "/services/media/formula-1",
+      "mode": "read"
     }
   ],
   "resources": [
@@ -54,39 +105,63 @@
       "path": "/var/lib/mesh/plex",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "config",
       "type": "directory",
-      "path": "/services/plex/config",
-      "mode": "0700",
+      "mode": "0755",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0755",
       "owner": "1000:1000"
     },
     {
       "id": "transcode",
       "type": "directory",
-      "path": "/services/plex/transcode",
-      "mode": "0700",
+      "mode": "0755",
       "owner": "1000:1000"
     },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "content": "ADVERTISE_IP=https://${bound:route:name}/\n"
+    },
     {
       "id": "server",
       "type": "container",
       "name": "plex",
-      "image": "plexinc/pms-docker@sha256:83a425ae9e133b1cb2cc3b809556e01c61cd8ff65c582e41b4374bc2210bac9e",
+      "image": "plexinc/pms-docker@sha256:e0ab27395614a8e1a4fdf84c6bc60ac664915cfdde70c52d030c7728a1c48e14",
       "network": "host",
       "env": {
         "PLEX_UID": "1000",
         "PLEX_GID": "1000",
         "TZ": "Etc/UTC"
       },
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
       "volumes": [
-        "/services/plex/config:/config",
-        "/services/plex/transcode:/transcode",
-        "/services/media/movies:/movies",
-        "/services/media/series:/series",
-        "/services/media/anime:/anime",
-        "/services/media/music:/music",
-        "/services/media/audiobooks:/audiobooks"
+        "${dir:config}:/config",
+        "${dir:data}:/data",
+        "${dir:transcode}:/transcode",
+        "/services/media/movies:/movies:ro",
+        "/services/media/series:/series:ro",
+        "/services/media/anime:/anime:ro",
+        "/services/media/music:/music:ro",
+        "/services/media/audiobooks:/audiobooks:ro",
+        "/services/media/sport-games:/sport-games:ro",
+        "/services/media/live-shows:/live-shows:ro",
+        "/services/media/formula-1:/formula-1:ro"
       ]
     },
     {
@@ -96,18 +171,28 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/plex/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/plex/token:/run/secrets/token:ro",
-        "/services/plex/config:/var/lib/plex/config:ro"
+        "${dir:config}:/var/lib/plex/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_PLEX_URL": "http://127.0.0.1:32400",
-        "MESH_PLEX_TOKEN_FILE": "/run/secrets/token",
+        "MESH_PLEX_URL": "http://127.0.0.1:${port:32400}",
         "MESH_PLEX_DATA_DIR": "/var/lib/plex"
       },
       "artifact": "runtime"
     }
   ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "plex",
+      "endpoint": "stream"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
   "build": {
     "on": [
       {

modules/portainer/module.json

@@ -8,10 +8,10 @@
   "listens": [
     {
       "name": "web",
-      "port": 9000,
+      "port": 9090,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the dashboard over http; routed, so the proxy reaches it here"
+      "why": "the dashboard over http; portainer.novox.be is a route grant and the proxy reaches it here \u2014 the machine side of 9090:9000, the predecessor's number"
     },
     {
       "name": "web-tls",
@@ -39,8 +39,8 @@
       "name": "portainer",
       "image": "portainer/portainer-ce@sha256:4d616db18cfeb5dd41a69c0958bc825c84483ea9cde1106eb82a5d26f3bd8b0e",
       "ports": [
-        "9000",
-        "9443"
+        "9090:9000",
+        "9443:9443"
       ],
       "volumes": [
         "${dir:data}:/data",

modules/postgres/module.json

@@ -87,7 +87,7 @@
         "PGDATA": "/var/lib/postgresql/data/pgdata"
       },
       "ports": [
-        "5432"
+        "5432:5432"
       ],
       "volumes": [
         "/var/lib/mesh-store:/var/lib/postgresql/data",