test: pin TLS upstream transport for Plex vhosts

tests/caddyfile.bats

@@ -85,6 +85,29 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
     grep -q 'curl.*-sf.*http://localhost:80/' "$REPO_ROOT/dankclaw/compose.yaml"
 }
 
+@test "plex vhosts proxy to PMS over a TLS upstream (PMS drops plain HTTP off-loopback)" {
+    # 2026-08-26 diagnosis: PMS 1.43.x on :32400 accepts, reads, and then
+    # silently closes every non-TLS connection from a non-loopback source
+    # (loopback is exempt). A plain-HTTP reverse_proxy therefore gets EOF
+    # and Caddy answers 502 with an empty body (blank page in browsers).
+    # Both plex vhosts must dial the upstream over TLS. PMS serves a
+    # self-signed cert, so verification is skipped on this pinned-LAN-IP
+    # hop only; client-facing Let's Encrypt TLS is untouched.
+    local block name
+    for name in 'plex.franksdank.cloud {' 'http://plex.franksdank.casa {'; do
+        block=$(awk -v s="$name" '
+            index($0, s) == 1 { inblk = 1 }
+            inblk { print }
+            inblk && /^}/ { exit }' "$CADDYFILE")
+        echo "$block" | grep -q 'reverse_proxy 192.168.0.235:32400' \
+            || { echo "$name: missing PMS upstream"; return 1; }
+        echo "$block" | grep -q 'transport http' \
+            || { echo "$name: upstream must use the http transport with TLS"; return 1; }
+        echo "$block" | grep -q 'insecure_skip_verify' \
+            || { echo "$name: TLS upstream must skip PMS self-signed cert verification"; return 1; }
+    done
+}
+
 @test "Gitea has no standalone reverse-proxy Quadlet" {
     [ ! -e "$REPO_ROOT/dankclaw/gitea/quadlet/gitea-caddy.container" ]
 }