From ad5c61e749a25524bdc7f60dd2eada0af442518f Mon Sep 17 00:00:00 2001
From: Ben Martin <ben@brmartin.co.uk>
Date: Wed, 9 Apr 2025 22:10:59 +0000
Subject: [PATCH] chore(media-centre): onboard plex onto consul service mesh

- allows for plex to upgrade connections away from http1.1
---
 modules/media-centre/jobspec.nomad.hcl | 74 ++++++++++++++++++++++----
 1 file changed, 63 insertions(+), 11 deletions(-)

diff --git a/modules/media-centre/jobspec.nomad.hcl b/modules/media-centre/jobspec.nomad.hcl
index 6397e10..0fce0db 100644
--- a/modules/media-centre/jobspec.nomad.hcl
+++ b/modules/media-centre/jobspec.nomad.hcl
@@ -9,10 +9,8 @@ job "media-centre" {
       }
 
       config {
-        image        = "plexinc/pms-docker:latest"
-        runtime      = "nvidia"
-        ports        = ["plex"]
-        network_mode = "host"
+        image   = "plexinc/pms-docker:latest"
+        runtime = "nvidia"
 
         mount {
           type   = "volume"
@@ -78,17 +76,36 @@ job "media-centre" {
 
     service {
       provider = "consul"
-      port     = "plex"
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.plex.entrypoints=websecure",
-        "traefik.http.routers.plex.rule=Host(`plex.brmartin.co.uk`)"
-      ]
+      port     = "32400"
+
+      meta {
+        envoy_metrics_port = "${NOMAD_HOST_PORT_envoy_metrics}"
+      }
+
+      connect {
+        sidecar_service {
+          proxy {
+            expose {
+              path {
+                path            = "/metrics"
+                protocol        = "http"
+                local_path_port = 9102
+                listener_port   = "envoy_metrics"
+              }
+            }
+            transparent_proxy {}
+          }
+        }
+      }
     }
 
     network {
+      mode = "bridge"
       port "plex" {
-        static = 32400
+        to = 32400
+      }
+      port "envoy_metrics" {
+        to = 9102
       }
     }
   }
@@ -135,4 +152,39 @@ job "media-centre" {
       }
     }
   }
+
+  group "plex-ingress-group" {
+
+    network {
+      mode = "bridge"
+      port "inbound" {
+        to = 8080
+      }
+    }
+
+    service {
+      port = "inbound"
+      tags = [
+        "traefik.enable=true",
+
+        "traefik.http.routers.plex.entrypoints=websecure",
+        "traefik.http.routers.plex.rule=Host(`plex.brmartin.co.uk`)"
+      ]
+
+      connect {
+        gateway {
+          ingress {
+            listener {
+              port     = 8080
+              protocol = "http"
+              service {
+                name  = "media-centre-plex"
+                hosts = ["*"]
+              }
+            }
+          }
+        }
+      }
+    }
+  }
 }