Phase-1 SSO/app-passwords for jellyfin needs the ldapauth and sso plugins
present without relying on the in-app catalog (which the plugins-baked PVC
would otherwise let drift). Pin the newest release of each whose targetAbi
is <= the pinned server version (10.11.6) and let the image own the version.
- Add a plugins build stage that downloads, sha256-verifies (matching each
release's published .sha256), and unpacks the plugin zips into versioned
dirs baked at /usr/share/jellyfin/plugins-baked.
- LDAP Authentication 22.0.0.0 (targetAbi 10.11.2.0; v23 needs 10.11.9).
- SSO Authentication 4.0.0.4 (targetAbi 10.11.0.0).
- Add docker-entrypoint.sh that syncs baked plugin dirs into /config/plugins
on every start, removing any stale versioned dir of the same plugin so the
image controls the version across restarts; preserves plugin configurations.
- Point ENTRYPOINT at the new script.
