Roll out the tool runtime to the remaining tools+events modules (ADR 0052/0051)

Nineteen modules gain a broker-bound runtime container that serves the module's
tools under its own scoped account: bazarr, gitea, grafana, home-assistant,
icecast, influxdb, jackett, keycloak, mailu, nextcloud, nodered, nzbget, ombi,
photos, portainer, qbittorrent, searxng, tautulli, verdaccio.

Config is the assignment's, not the manifest's (ADR 0051): each client's fromEnv
overlays a settings-merged config file (MESH_<M>_CONFIG_FILE) over its env
fallbacks, so URL and credentials come from `settings set`, with the URL defaulting
to the server on the node. nextcloud and mailu also mount the docker socket for
their exec-based tools.

Proven in the mesh-lab: assigned-grafana green — settings deliver the URL and token,
the runtime reads the merged config and serves grafana's tools under the scoped
account, with nothing in the manifest. Two gaps this surfaced are filed as hq
issues 008 (a provider runtime's seal key) and 009 (a settings change does not
restart a container runtime).

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/mailu/client.ts

@@ -9,6 +9,7 @@
 // falls back to `doveadm` inside the imap container, the operation the HTTP surface cannot serve.
 
 import { execFile } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { promisify } from "node:util";
 
 const run = promisify(execFile);
@@ -44,6 +45,13 @@ export interface MailMessage {
 // The fields we ask doveadm for, once — kept together so read and search stay identical in shape.
 const FETCH_FIELDS = "date.received hdr.subject hdr.from body.snippet";
 
+/** The settings-merged config the mesh delivers (novox/hq ADR 0051): { url, apiKey, token, password, user, ... }. */
+function meshConfig(file?: string): Record<string, string> {
+  if (!file) return {};
+  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
+  catch { return {}; }
+}
+
 export class MailuClient {
   readonly baseUrl: string;
 
@@ -62,12 +70,13 @@ export class MailuClient {
    * client with neither would only fail later, one call at a time, so it fails here instead.
    */
   static fromEnv(env: NodeJS.ProcessEnv = process.env): MailuClient {
-    const url = env.MESH_MAILU_URL;
-    const apiKey = env.MESH_MAILU_API_KEY;
+    const cfg = meshConfig(env.MESH_MAILU_CONFIG_FILE);
+    const url = cfg.url ?? env.MESH_MAILU_URL;
+    const apiKey = cfg.apiKey ?? env.MESH_MAILU_API_KEY;
     if (!url || !apiKey) {
       throw new Error("Mailu is not configured — set MESH_MAILU_URL and MESH_MAILU_API_KEY");
     }
-    const imapContainer = env.MESH_MAILU_IMAP_CONTAINER ?? "mailu-imap";
+    const imapContainer = cfg.container ?? env.MESH_MAILU_IMAP_CONTAINER ?? "mailu-imap";
     return new MailuClient(url, apiKey, imapContainer);
   }
 

modules/mailu/module.json

@@ -282,6 +282,31 @@
         "/services/mailu/data/certs:/certs",
         "/services/mailu/data/overrides/nginx:/overrides:ro"
       ]
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/var/lib/mesh/mailu/config.json",
+      "mode": "0600",
+      "content": "{}\n",
+      "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-mailu",
+      "image": "mesh-runtime-mailu@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/mailu/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/mailu/config.json:/run/config/config.json:ro",
+        "/var/run/docker.sock:/var/run/docker.sock"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_MAILU_URL": "http://127.0.0.1:80",
+        "MESH_MAILU_CONFIG_FILE": "/run/config/config.json"
+      }
     }
   ]
 }