meta-core claims model: pin meta-core 2.0.1, meta-read 1.4.1, meta-watch 1.1.0, meta-search 1.3.2, meta-share 2.7.0, gateway 1.1.1, meta-sort 1.1.1, plugins 1.1.0; signing keys + db-cache backup exclude

Apps/MetaPluginOpenSubtitles/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginopensubtitles-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-opensubtitle:1.0.3
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-opensubtitle:1.1.0
     cpu_shares: 30
     container_name: metapluginopensubtitles-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,6 +53,13 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginopensubtitles-plugin.key"
+    volumes:
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginopensubtitles/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -137,3 +144,10 @@ x-casaos:
 # outright rather than starting it without its directories.
 x-compose-app:
   schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metapluginopensubtitles/keys
+      user: $PUID
+      group: $PGID