tautulli: its config is placed, it runs the build in use, and its runtime finds its own key

The module stated /services/tautulli/config and /var/lib/mesh/tautulli/route.json,
novox's layout, which no definition may carry (ADR 0112). Tautulli's config dir is
now a placed directory (${dir:config}) and the route binds into the placed state
(${dir:state}), as searxng and mosquitto do.

The image was pinned to v2.18.1-ls242; ace runs ls244 (2026-09-11), and Tautulli
migrates its own database schema, so the pin moves to the digest ace runs.

The runtime called http://127.0.0.1:8181, which is the software's port, not the
machine port the mesh assigns; it now asks with ${port:8181}, as gitea does.

The runtime mounted Tautulli's config dir read-only but never read it: its API key
could only come from MESH_TAUTULLI_APIKEY or the settings-merged config.json, i.e.
a secret in settings. Tautulli mints and owns that key in its config.ini, so the
runtime now reads it from there. Nothing for the mesh to mint or accept.

Verified: catalogue tests with MESH_CATALOGUE pointing here (not skipped); the
pinned image started in a throwaway container on a dir owned 1001:2000 with
PUID/PGID 1000 answers /status 200 and re-owns /config to 1000:1000 on start;
client.ts, run under node, read the key from that instance's config.ini and got
success from get_activity and get_history; without a config.ini it throws, which
the tools and events entrypoints already treat as "not configured".

modules/influxdb/client.ts

@@ -24,13 +24,6 @@ function meshConfig(file?: string): Record<string, string> {
   catch { return {}; }
 }
 
-/** A secret delivered as a file, trimmed; undefined when there is none, so the caller can fall back. */
-function tokenFromFile(file?: string): string | undefined {
-  if (!file) return undefined;
-  try { return readFileSync(file, "utf8").trim() || undefined; }
-  catch { return undefined; }
-}
-
 export class InfluxDBClient {
   readonly baseUrl: string;
 
@@ -50,10 +43,8 @@ export class InfluxDBClient {
   static fromEnv(env: NodeJS.ProcessEnv = process.env): InfluxDBClient {
     const cfg = meshConfig(env.MESH_INFLUXDB_CONFIG_FILE);
     const url = cfg.url ?? env.MESH_INFLUXDB_URL ?? `http://127.0.0.1:${env.INFLUXDB_PORT ?? "8086"}`;
-    // The token reaches the process as a file (novox/hq ADR 0086); the environment variable stays
-    // only for a workstation running the tools by hand.
-    const token = cfg.token ?? tokenFromFile(env.MESH_INFLUXDB_TOKEN_FILE) ?? env.MESH_INFLUXDB_TOKEN;
-    if (!token) throw new Error("no InfluxDB token — set MESH_INFLUXDB_TOKEN_FILE");
+    const token = cfg.token ?? env.MESH_INFLUXDB_TOKEN;
+    if (!token) throw new Error("no InfluxDB token — set MESH_INFLUXDB_TOKEN");
     const org = cfg.org ?? env.MESH_INFLUXDB_ORG ?? "mesh";
     return new InfluxDBClient(url, token, org);
   }

modules/influxdb/module.json

@@ -13,7 +13,7 @@
       "port": 8086,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "queries, writes and the web UI, over http; a name is a route grant"
+      "why": "queries and writes, over http"
     }
   ],
   "resources": [
@@ -26,45 +26,46 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/influxdb-module",
+      "mode": "0700"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "/var/lib/influxdb-module/server.env",
+      "mode": "0600",
+      "content": "DOCKER_INFLUXDB_INIT_MODE=setup\nDOCKER_INFLUXDB_INIT_USERNAME=admin\nDOCKER_INFLUXDB_INIT_PASSWORD=${secret:admin}\nDOCKER_INFLUXDB_INIT_ADMIN_TOKEN=${secret:admin-token}\nDOCKER_INFLUXDB_INIT_ORG=mesh\nDOCKER_INFLUXDB_INIT_BUCKET=default\n"
     },
     {
       "id": "data",
       "type": "directory",
+      "path": "/services/influxdb/data",
       "mode": "0700",
       "owner": "1000:1000"
     },
     {
       "id": "config",
       "type": "directory",
+      "path": "/services/influxdb/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
-    {
-      "id": "server-env",
-      "type": "file",
-      "path": "${dir:state}/server.env",
-      "mode": "0600",
-      "content": "DOCKER_INFLUXDB_INIT_MODE=setup\nDOCKER_INFLUXDB_INIT_USERNAME=admin\nDOCKER_INFLUXDB_INIT_PASSWORD_FILE=/run/secrets/admin\nDOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE=/run/secrets/admin-token\nDOCKER_INFLUXDB_INIT_ORG=mesh\nDOCKER_INFLUXDB_INIT_BUCKET=default\n"
-    },
     {
       "id": "server",
       "type": "container",
       "name": "influxdb",
       "image": "influxdb@sha256:f75e48af0598e8aec7986e991a848d19a119101a7d563a2e5db1dfaac9c45daa",
       "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/influxdb-module/server.env"
       ],
       "ports": [
         "8086"
       ],
       "volumes": [
-        "${dir:data}:/var/lib/influxdb2",
-        "${dir:config}:/etc/influxdb2",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro"
-      ]
+        "/services/influxdb/data:/var/lib/influxdb2",
+        "/services/influxdb/config:/etc/influxdb2"
+      ],
+      "secrets-in-environment": "the image honours DOCKER_INFLUXDB_INIT_PASSWORD_FILE and _ADMIN_TOKEN_FILE; convertible, awaiting a bed that proves it"
     },
     {
       "id": "runtime-config",
@@ -82,13 +83,13 @@
       "volumes": [
         "/var/lib/mesh/influxdb/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/influxdb/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro"
+        "/services/influxdb/config:/var/lib/influxdb/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
+        "MESH_INFLUXDB_URL": "http://127.0.0.1:8086",
         "MESH_INFLUXDB_CONFIG_FILE": "/run/config/config.json",
-        "MESH_INFLUXDB_TOKEN_FILE": "/run/secrets/admin-token"
+        "MESH_INFLUXDB_CONFIG_DIR": "/var/lib/influxdb/config"
       },
       "restart-on": [
         "runtime-config"
@@ -96,22 +97,6 @@
       "artifact": "runtime"
     }
   ],
-  "requires": [
-    "route",
-    "secret"
-  ],
-  "contributes": {
-    "route": {
-      "label": "influxdb",
-      "endpoint": "api"
-    }
-  },
-  "secrets": {
-    "secret": {
-      "admin": "${dir:state}/admin.secret",
-      "admin-token": "${dir:state}/admin-token.secret"
-    }
-  },
   "build": {
     "on": [
       {
@@ -132,5 +117,14 @@
         "from": "Dockerfile"
       }
     ]
+  },
+  "requires": [
+    "secret"
+  ],
+  "secrets": {
+    "secret": {
+      "admin": "/var/lib/influxdb-module/admin.secret",
+      "admin-token": "/var/lib/influxdb-module/admin-token.secret"
+    }
   }
 }

modules/tautulli/client.ts

@@ -41,6 +41,32 @@ function meshConfig(file?: string): Record<string, string> {
   catch { return {}; }
 }
 
+/**
+ * The API key Tautulli minted for itself, read from its own config.ini (mounted read-only).
+ *
+ * Tautulli owns this key: it writes it on first run and every client of its API — this runtime
+ * included — must present the same one. So the mesh does not mint or hold it; the one place it
+ * lives is the file Tautulli keeps, and a key regenerated in Tautulli's settings is simply read
+ * again on the next start. Undefined when there is no file or no key yet (a fresh install whose
+ * setup wizard has not run).
+ */
+function keyOfTautulli(dir?: string): string | undefined {
+  if (!dir) return undefined;
+  let ini: string;
+  try { ini = readFileSync(`${dir.replace(/\/$/, "")}/config.ini`, "utf8"); }
+  catch { return undefined; }
+  let section = "";
+  for (const raw of ini.split(/\r?\n/)) {
+    const line = raw.trim();
+    const header = /^\[(.+)\]$/.exec(line);
+    if (header) { section = header[1]; continue; }
+    if (section !== "General") continue;
+    const kv = /^api_key\s*=\s*"?([^"]*)"?$/.exec(line);
+    if (kv && kv[1]) return kv[1];
+  }
+  return undefined;
+}
+
 export class TautulliClient {
   readonly baseUrl: string;
 
@@ -52,15 +78,16 @@ export class TautulliClient {
   }
 
   /**
-   * Build from the module's resolved environment. The API key is read from MESH_TAUTULLI_APIKEY
-   * (Tautulli mints it in Settings → Web Interface); the base URL defaults to the local container.
+   * Build from the module's resolved environment. The API key is the one Tautulli minted for
+   * itself (Settings → Web Interface), read from its config.ini under MESH_TAUTULLI_CONFIG_DIR;
+   * MESH_TAUTULLI_APIKEY still wins where it is set. The base URL defaults to the local container.
    * Throws when no key is configured — the module then contributes nothing rather than failing.
    */
   static fromEnv(env: NodeJS.ProcessEnv = process.env): TautulliClient {
     const cfg = meshConfig(env.MESH_TAUTULLI_CONFIG_FILE);
     const url = cfg.url ?? (env.MESH_TAUTULLI_URL ?? `http://127.0.0.1:${env.TAUTULLI_PORT ?? "8181"}`);
-    const apiKey = cfg.apiKey ?? env.MESH_TAUTULLI_APIKEY;
-    if (!apiKey) throw new Error("no Tautulli API key — set MESH_TAUTULLI_APIKEY");
+    const apiKey = cfg.apiKey ?? env.MESH_TAUTULLI_APIKEY ?? keyOfTautulli(env.MESH_TAUTULLI_CONFIG_DIR);
+    if (!apiKey) throw new Error("no Tautulli API key — Tautulli's config.ini has none yet (finish its setup and enable the API)");
     return new TautulliClient(url, apiKey);
   }
 

modules/tautulli/module.json

@@ -16,7 +16,7 @@
       "port": 8181,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "watch statistics"
+      "why": "the watch statistics pages and API"
     }
   ],
   "resources": [
@@ -26,10 +26,15 @@
       "path": "/var/lib/mesh/tautulli",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "config",
       "type": "directory",
-      "path": "/services/tautulli/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -37,7 +42,7 @@
       "id": "server",
       "type": "container",
       "name": "tautulli",
-      "image": "lscr.io/linuxserver/tautulli@sha256:13f03ecfc61a7af89d492677389771ac29682a72153ce08a5cd4faffbc0197e8",
+      "image": "lscr.io/linuxserver/tautulli@sha256:e35570d636471f8aabfac7044057712679f954844a763ba735baa9659ea142b5",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
@@ -47,7 +52,7 @@
         "8181"
       ],
       "volumes": [
-        "/services/tautulli/config:/config"
+        "${dir:config}:/config"
       ]
     },
     {
@@ -66,11 +71,11 @@
       "volumes": [
         "/var/lib/mesh/tautulli/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/tautulli/config.json:/run/config/config.json:ro",
-        "/services/tautulli/config:/var/lib/tautulli/config:ro"
+        "${dir:config}:/var/lib/tautulli/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_TAUTULLI_URL": "http://127.0.0.1:8181",
+        "MESH_TAUTULLI_URL": "http://127.0.0.1:${port:8181}",
         "MESH_TAUTULLI_CONFIG_FILE": "/run/config/config.json",
         "MESH_TAUTULLI_CONFIG_DIR": "/var/lib/tautulli/config"
       },
@@ -90,7 +95,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/mesh/tautulli/route.json"
+    "route": "${dir:state}/route.json"
   },
   "build": {
     "on": [