Become a nox mesh module

The mesh builds all three images from this repository and a commit
(novox/hq ADR 0069) — the Drone pipeline that built outside Docker and
copied its output in retires with the predecessor. One module carries the
API and every client instance: eef and filip are the same built client
under two names, which is a second route contribution, not a second
module (ADR 0015 — an application is one repository).

The clients drop nginx and its bash startup script: the node the API
already needs serves the static build too (client-server/serve.mjs —
files, the SPA fallback, env-config.js from the environment), so the
whole module stands on one declared base.

What the machine serves does not move: the same four public names, the
same four machine ports. MongoDB, the bucket and every credential arrive
as mesh grants instead of hand-set environment; SUPER_ADMIN_KEY stops
being a default written in code and becomes a minted secret.

module.json

@@ -0,0 +1,181 @@
+{
+  "module": "photos",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "s3-bucket",
+    "mongodb-database",
+    "route"
+  ],
+  "contributes": {
+    "s3-bucket": {
+      "bucket": "photos"
+    },
+    "mongodb-database": {
+      "name": "photos"
+    },
+    "route": {
+      "api": {
+        "label": "photos-api",
+        "port": 9102
+      },
+      "admin": {
+        "label": "photos",
+        "port": 8102
+      },
+      "eef": {
+        "label": "eef",
+        "port": 8104
+      },
+      "filip": {
+        "label": "filip",
+        "port": 8103
+      }
+    }
+  },
+  "binds": {
+    "s3-bucket": "/var/lib/photos/store.json",
+    "mongodb-database": "/var/lib/photos/database.json",
+    "route": "/var/lib/photos/route.json"
+  },
+  "secrets": {
+    "s3-bucket": "/var/lib/photos/store.secret",
+    "mongodb-database": "/var/lib/photos/database.secret"
+  },
+  "own-secrets": {
+    "admin-key": "/var/lib/photos/admin-key.secret"
+  },
+  "listens": [
+    {
+      "port": 9102,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the photos API over http; photos-api.novox.be is a route grant, and the proxy reaches it here. The machine side of the 9102:9000 mapping, named because three of this module's containers share the container-side port 80 and only the machine side tells them apart"
+    },
+    {
+      "port": 8102,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the admin client site over http; the public name photos.novox.be is a route grant, and the proxy reaches it here"
+    },
+    {
+      "port": 8103,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the filip client site over http; the public name filip.novox.be is a route grant, and the proxy reaches it here"
+    },
+    {
+      "port": 8104,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the eef client site over http; the public name eef.novox.be is a route grant, and the proxy reaches it here"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/photos",
+      "mode": "0700"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "/var/lib/photos/server.env",
+      "mode": "0600",
+      "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\nSUPER_ADMIN_KEY=${secret:admin-key}\n"
+    },
+    {
+      "id": "client-env",
+      "type": "file",
+      "path": "/var/lib/photos/client.env",
+      "mode": "0644",
+      "content": "REACT_APP_API_URL=https://photos-api.novox.be\n"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "photos"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "photos-server",
+      "artifact": "server",
+      "network": "photos",
+      "env-file": [
+        "/var/lib/photos/server.env"
+      ],
+      "ports": [
+        "9102:9000"
+      ],
+      "secrets-in-environment": "the application's own code reads MONGO_URL, MINIO_SECRET and SUPER_ADMIN_KEY from the environment (server/src/config.js); converting is this repository's change, tracked but not blocking the mesh conversion"
+    },
+    {
+      "id": "admin",
+      "type": "container",
+      "name": "photos-admin",
+      "artifact": "admin-client",
+      "network": "photos",
+      "env-file": [
+        "/var/lib/photos/client.env"
+      ],
+      "ports": [
+        "8102:80"
+      ]
+    },
+    {
+      "id": "eef",
+      "type": "container",
+      "name": "photos-eef",
+      "artifact": "client",
+      "network": "photos",
+      "env-file": [
+        "/var/lib/photos/client.env"
+      ],
+      "ports": [
+        "8104:80"
+      ]
+    },
+    {
+      "id": "filip",
+      "type": "container",
+      "name": "photos-filip",
+      "artifact": "client",
+      "network": "photos",
+      "env-file": [
+        "/var/lib/photos/client.env"
+      ],
+      "ports": [
+        "8103:80"
+      ]
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "NODE_BASE",
+        "image": "node@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "image",
+        "from": "server/Dockerfile"
+      },
+      {
+        "name": "client",
+        "kind": "image",
+        "from": "client/Dockerfile"
+      },
+      {
+        "name": "admin-client",
+        "kind": "image",
+        "from": "admin-client/Dockerfile"
+      }
+    ]
+  }
+}