Caddy: keep plex.franksdank.casa HTTP-only (not in the Porkbun account)

dankclaw/Caddyfile

@@ -118,7 +118,11 @@ loki.franksdank.cloud {
 # ═══════════════════════════════════════════════════════════════
 
 # --- Plex (existing, kept) ---
-plex.franksdank.casa {
+# http:// on purpose: franksdank.casa is not hosted in the same Porkbun
+# account as franksdank.cloud, so the DNS-01 provider cannot issue a
+# Let's Encrypt cert for it. It stays plain-HTTP legacy; the canonical
+# name is plex.franksdank.cloud (HTTPS, below).
+http://plex.franksdank.casa {
 	reverse_proxy 192.168.0.235:32400
 }
 

tests/caddyfile.bats

@@ -61,8 +61,13 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
 
 # --- Phase 2: real TLS via DNS-01 (Porkbun wildcard cert) ---
 
-@test "all vhosts use TLS (no http:// site prefix remains)" {
-    ! grep -qE '^http://' "$CADDYFILE"
+@test "all vhosts use TLS except the legacy .casa name" {
+    # franksdank.casa is not in the same Porkbun account, so it cannot get
+    # a DNS-01 Let's Encrypt cert; it stays explicitly http. Every other
+    # site address must carry no http:// prefix.
+    local offenders
+    offenders=$(grep -E '^http://' "$CADDYFILE" | grep -v 'plex\.franksdank\.casa' || true)
+    [ -z "$offenders" ] || { echo "non-.casa http:// vhosts: $offenders"; return 1; }
 }
 
 @test "the Caddyfile configures the Porkbun DNS-01 provider globally" {