plex: add env vars (PLEX_UID/GID, TZ, ALLOWED_NETWORKS); homepage: rename Overseerr->Seerr

Plex Deployment had no Plex env vars. Add via the ServiceDefinition env list
(rendered verbatim by catalog/render.py):
- PLEX_UID/PLEX_GID=1000 (image chowns /config to this and drops; matches the
  Longhorn ownership convention seerr/semaphore use)
- TZ=Etc/UTC (no other service sets TZ repo-wide)
- ALLOWED_NETWORKS=10.0.0.0/8,192.168.0.0/16 so in-cluster clients (Seerr ->
  plex:32400) are trusted as LAN (pod CIDR 10.0.0.0/16 + svc 10.43.0.0/16 + LAN)

PLEX_CLAIM intentionally not set (4-min TTL is unusable via git; one-time live
claim persists on /config). ADVERTISE_IP deferred: the only candidate host
resolves via split-horizon DNS to the internal Gateway VIP and its remote
reachability is unverified — a wrong value breaks remote access, so omitted
per prefer-safety, documented as a follow-up in catalog/plex.yaml.

Homepage still labeled seerr as "Overseerr"; renamed the tile to "Seerr"
(icon mdi-play-box-multiple keeps — not overseerr-specific).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/wave-0/plex.yaml

@@ -78,6 +78,15 @@ spec:
         image: plexinc/pms-docker:latest
         ports:
         - containerPort: 32400
+        env:
+        - name: PLEX_UID
+          value: '1000'
+        - name: PLEX_GID
+          value: '1000'
+        - name: TZ
+          value: Etc/UTC
+        - name: ALLOWED_NETWORKS
+          value: 10.0.0.0/8,192.168.0.0/16
         volumeMounts:
         - name: config
           mountPath: /config

catalog/plex.yaml

@@ -23,6 +23,38 @@ name: plex
 kind: container
 source:
   image: plexinc/pms-docker:latest
+# plexinc/pms-docker env. Rendered VERBATIM onto the app container by render.py (schema env list).
+env:
+  # PLEX_UID/PLEX_GID: the image boots as root (s6 PID1), chowns /config to this uid/gid, then drops
+  # the "Plex Media Server" process to it. 1000 matches the Longhorn ownership convention the other
+  # stateful apps use (seerr/semaphore run as UID/GID 1000), keeping the /config PVC writable by the
+  # dropped plex user. (Plex has no podSecurityContext/fsGroup — the image manages ownership itself.)
+  - name: PLEX_UID
+    value: "1000"
+  - name: PLEX_GID
+    value: "1000"
+  # TZ: no other service in the repo sets a timezone (repo-wide grep: none), so use the safe default.
+  - name: TZ
+    value: Etc/UTC
+  # ALLOWED_NETWORKS marks these CIDRs as trusted LAN, so in-cluster clients (Seerr -> plex:32400) are
+  # treated as local and NOT pushed onto Plex's remote-auth/relay path. 10.0.0.0/8 covers the Cilium
+  # pod CIDR (10.0.0.0/16, CLUSTER_POD_CIDR — Seerr's pod is 10.0.x.x) and the k3s service net
+  # (10.43.0.0/16); 192.168.0.0/16 covers the home LAN.
+  - name: ALLOWED_NETWORKS
+    value: 10.0.0.0/8,192.168.0.0/16
+  # PLEX_CLAIM is deliberately NOT set here: a https://plex.tv/claim token has a ~4-min TTL, far
+  # shorter than the commit -> push -> Flux reconcile -> pod-roll cycle, so any token committed to git
+  # is already expired by the time the pod starts. Claiming is a one-time LIVE step (UI sign-in, or a
+  # single API POST) against the running server; the claim then persists on the /config PVC and
+  # survives pod rolls (including the roll this env change causes), so it never belongs in git.
+  # ADVERTISE_IP ("Custom server access URLs") is DEFERRED, not accidentally omitted. It tells Plex
+  # which URL to advertise to plex.tv for REMOTE clients. The only candidate is
+  # https://plex.home.keithjackson.dev, but that host resolves via split-horizon DNS to the INTERNAL
+  # Gateway VIP (conformance/tests/l2-behavioral/dns-internal-resolution), and both its public
+  # reachability and whether the TLS-terminating Cilium Gateway proxies Plex's 32400 API correctly for
+  # remote access are UNVERIFIED. Advertising a wrong/internal-only URL breaks remote access for ALL
+  # clients, so per "prefer safety over completeness" it is left unset. FOLLOW-UP: once remote
+  # reachability through the Gateway is confirmed, set ADVERTISE_IP: "https://plex.home.keithjackson.dev:443".
 exposure: public              # edge port-forward + public DNS; clients + Seerr reach it (docs/09; R-DNS/R-NET)
 egress: internet              # normal WAN egress (docs/03; R-NET-05)
 storage:

platform/homepage/configmap.yaml

@@ -61,7 +61,7 @@ data:
             href: https://plex.home.keithjackson.dev
             description: Media streaming
             icon: mdi-plex
-        - Overseerr:
+        - Seerr:
             href: https://seerr.home.keithjackson.dev
             description: Media requests
             icon: mdi-play-box-multiple