Merge pull request 'feat(plex): one advertised hostname for local+remote, its own LE cert, and a LAN definition so LAN clients stop reading as remote' (#48) from feat/plex-vip-hostname-and-lan-networks into main

Reviewed-on: #48
Reviewed-by: Keith Jackson <[email protected]>

catalog/render.py

@@ -2209,6 +2209,23 @@ EXTRA_UNITS: dict = {
             "plex-remote.yaml",
         ],
     },
+    # Plex's own TLS certificate for the single hostname it advertises to plex.tv
+    # (apps/wave-0/plex-cert.yaml). `above: False` co-locates it in plex's OWN wave, which is the
+    # only placement available: the Certificate must land in the `plex` namespace, and that
+    # namespace is created by the rendered plex.yaml in this very wave, so it CANNOT be issued
+    # earlier. The workload tolerates the resulting gap by marking the env refs `optional` rather
+    # than by ordering -- see the header of plex-cert.yaml.
+    #
+    # Non-catalog because the ServiceDefinition schema has no field for a cert-manager Certificate
+    # (additionalProperties is false); `ingressRoutes` inherits the Gateway wildcard instead, which
+    # is the opposite case to a workload terminating its own TLS on a raw L4 port.
+    "plex-cert": {
+        "anchor": "plex",
+        "above": False,
+        "files": [
+            "plex-cert.yaml",
+        ],
+    },
 }