jackett: provide its Torznab API as jackett-api

sonarr, radarr, lidarr and bookshelf reached jackett as http://jackett:9117 (a HAL
container name) or https://indexers.zurag.be (its public route), typed into each app by
hand. The mesh has neither: an app now requires jackett-api and its downloads step writes
the bound address into the app.

Serves scheme, port and url-base; `at` and the machine port come from the binding. Mesh
scope, like sonarr-api: an indexer proxy shares no files with its consumers.

The pair credential is jackett's one API key. The mesh cannot mint it, so the operator
accepts it per consumer pair (ADR 0092), as #156 does for sonarr-api; a consumer's step
refuses a minted value and names the accept.

modules/jackett/client.ts

@@ -2,7 +2,8 @@
 // an indexer proxy: it normalises many torrent trackers behind one Torznab surface. This client
 // talks its /api/v2.0 REST API, and only jackett's tools import it.
 
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 
 export interface JackettIndexer {
   id: string;
@@ -43,18 +44,36 @@ export class JackettClient {
 
   /**
    * Build from the module's resolved environment. Jackett's REST API is keyed, so both the URL and
-   * the key must be present — without them there is nothing to talk to, so this throws and the
-   * module contributes no tools rather than failing half-configured.
+   * the key must be present. The key is read from the settings-merged config or MESH_JACKETT_API_KEY,
+   * or, failing those, discovered from Jackett's own ServerConfig.json under MESH_JACKETT_CONFIG_DIR
+   * — the file Jackett writes it to, as sonarr/radarr read theirs from config.xml — so a running
+   * server needs no key configured by hand and no secret has to be put in an assignment. Without a
+   * URL or key there is nothing to talk to, so this throws and the module contributes no tools
+   * rather than failing half-configured.
    */
   static fromEnv(env: NodeJS.ProcessEnv = process.env): JackettClient {
     const cfg = meshConfig(env.MESH_JACKETT_CONFIG_FILE);
     const url = cfg.url ?? env.MESH_JACKETT_URL;
-    const apiKey = cfg.apiKey ?? env.MESH_JACKETT_API_KEY;
+    const apiKey = cfg.apiKey ?? env.MESH_JACKETT_API_KEY
+      ?? JackettClient.detectApiKey(env.MESH_JACKETT_CONFIG_DIR ?? "/config");
     if (!url) throw new Error("no Jackett URL — set MESH_JACKETT_URL");
-    if (!apiKey) throw new Error("no Jackett API key — set MESH_JACKETT_API_KEY");
+    if (!apiKey) throw new Error("no Jackett API key — set MESH_JACKETT_API_KEY or make the config dir readable");
     return new JackettClient(url, apiKey);
   }
 
+  /** Discover the API key from Jackett's ServerConfig.json (the linuxserver image keeps it at
+   *  <config>/Jackett/ServerConfig.json), falling back to null. */
+  static detectApiKey(configDir: string): string | null {
+    for (const file of [join(configDir, "Jackett", "ServerConfig.json"), join(configDir, "ServerConfig.json")]) {
+      if (!existsSync(file)) continue;
+      try {
+        const key = (JSON.parse(readFileSync(file, "utf8")) as { APIKey?: unknown }).APIKey;
+        if (typeof key === "string" && key) return key;
+      } catch { /* unreadable or mid-write: try the next, then give up */ }
+    }
+    return null;
+  }
+
   private async get(path: string, params: Record<string, string> = {}): Promise<any> {
     const url = new URL(`${this.baseUrl}${path}`);
     url.searchParams.set("apikey", this.apiKey);
@@ -64,18 +83,36 @@ export class JackettClient {
     return res.json();
   }
 
-  /** The configured indexers Jackett proxies. `configured=false` also lists the ones not set up. */
+  /**
+   * The configured indexers Jackett proxies. `configured=false` also lists the ones not set up.
+   * Read from the Torznab `t=indexers` feed, not /api/v2.0/indexers: that one is the web UI's and
+   * wants a login cookie (it answers an API-key request with a redirect), while the Torznab feed is
+   * what the key is for. The feed carries no last error, so `lastError` stays unset.
+   */
   async getIndexers(configuredOnly = true): Promise<JackettIndexer[]> {
-    const raw = await this.get("/api/v2.0/indexers", { configured: configuredOnly ? "true" : "false" });
-    const list = Array.isArray(raw) ? raw : [];
-    return list.map((i: any) => ({
-      id: i.id,
-      name: i.name,
-      type: i.type,
-      configured: i.configured ?? false,
-      siteLink: i.site_link,
-      lastError: i.last_error || undefined,
-    }));
+    const url = new URL(`${this.baseUrl}/api/v2.0/indexers/all/results/torznab/api`);
+    url.searchParams.set("apikey", this.apiKey);
+    url.searchParams.set("t", "indexers");
+    url.searchParams.set("configured", configuredOnly ? "true" : "false");
+    const res = await fetch(url.toString(), { headers: { Accept: "application/xml" } });
+    if (!res.ok) throw new Error(`Jackett API torznab t=indexers: ${res.status} ${await res.text()}`);
+    const xml = await res.text();
+    // Torznab reports failures (a wrong key among them) as 200 with an <error> body.
+    const err = xml.match(/<error code="(\d+)" description="([^"]*)"/);
+    if (err) throw new Error(`Jackett API torznab t=indexers: error ${err[1]} ${err[2]}`);
+    const text = (block: string, tag: string) =>
+      block.match(new RegExp(`<${tag}>([^<]*)</${tag}>`))?.[1];
+    const out: JackettIndexer[] = [];
+    for (const m of xml.matchAll(/<indexer id="([^"]+)" configured="([^"]+)">([\s\S]*?)<\/indexer>/g)) {
+      out.push({
+        id: m[1],
+        name: text(m[3], "title") ?? m[1],
+        type: text(m[3], "type") ?? "unknown",
+        configured: m[2] === "true",
+        siteLink: text(m[3], "link"),
+      });
+    }
+    return out;
   }
 
   /**

modules/jackett/module.json

@@ -1,6 +1,19 @@
 {
   "module": "jackett",
   "version": "1",
+  "provides": [
+    {
+      "name": "jackett-api",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "jackett-api": {
+      "scheme": "http",
+      "port": 9117,
+      "url-base": ""
+    }
+  },
   "capabilities": [
     "container-runtime"
   ],
@@ -10,7 +23,7 @@
       "port": 9117,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the indexer proxy"
+      "why": "the indexer proxy: its web UI, and the Torznab feeds the *arr apps search through, which other modules reach as jackett-api"
     }
   ],
   "resources": [
@@ -20,10 +33,15 @@
       "path": "/var/lib/mesh/jackett",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "config",
       "type": "directory",
-      "path": "/services/jackett/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -31,7 +49,7 @@
       "id": "server",
       "type": "container",
       "name": "jackett",
-      "image": "lscr.io/linuxserver/jackett@sha256:fd72d42b731ebf750b5de9711127251cf3b3f609419c32083ea8b3b3ee840b77",
+      "image": "lscr.io/linuxserver/jackett@sha256:7b19f4f6ac33d855ca9226600ecbd096ee678f66da28b13a7c09980b035ff583",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
@@ -41,13 +59,13 @@
         "9117"
       ],
       "volumes": [
-        "/services/jackett/config:/config"
+        "${dir:config}:/config"
       ]
     },
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/jackett/config.json",
+      "path": "${dir:state}/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -59,12 +77,12 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/jackett/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/jackett/config.json:/run/config/config.json:ro",
-        "/services/jackett/config:/var/lib/jackett/config:ro"
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:config}:/var/lib/jackett/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_JACKETT_URL": "http://127.0.0.1:9117",
+        "MESH_JACKETT_URL": "http://127.0.0.1:${port:9117}",
         "MESH_JACKETT_CONFIG_FILE": "/run/config/config.json",
         "MESH_JACKETT_CONFIG_DIR": "/var/lib/jackett/config"
       },
@@ -87,7 +105,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/mesh/jackett/route.json"
+    "route": "${dir:state}/route.json"
   },
   "build": {
     "on": [

modules/jackett/tools/index.ts

@@ -9,7 +9,7 @@ export function getJackettTools(jackett: JackettClient): ToolDefinition[] {
   return [
     {
       name: "jackett_indexers",
-      description: "List the indexers Jackett proxies, with their type and any last error.",
+      description: "List the indexers Jackett proxies, with their type and site.",
       input: { all: { type: "boolean", description: "include indexers not yet configured (default false)" } },
       run: async (args) => {
         const indexers = await jackett.getIndexers(!args.all);

modules/letta/client.ts

@@ -1,10 +1,10 @@
 // The Letta API client — letta's own code, living in the module (novox/hq ADR 0039). Its tools
 // import it; nothing outside letta does.
 //
-// Letta authenticates with a single server password. That password is a mesh own-secret handed to
-// both the server (LETTA_SERVER_PASSWORD) and this client, through the runtime config file the mesh
-// mounts (its `password` key) — so the module's tools are live without anything configured by hand.
-// Where a server already has clients, the password is accepted rather than minted.
+// Letta authenticates with a single server password, presented as a Bearer token. That password is
+// a mesh own-secret, minted once and handed to both the server (LETTA_SERVER_PASSWORD) and this
+// client (MESH_LETTA_PASSWORD) — so the module's tools are live without anything configured by hand.
+// The runtime config file may still override the URL or password.
 
 import { readFileSync } from "node:fs";
 
@@ -58,10 +58,6 @@ export class LettaClient {
       ...options,
       headers: {
         "Content-Type": "application/json",
-        // The server's --secure mode checks X-BARE-PASSWORD ("password <it>") and answers a Bearer
-        // token alone with 401 (letta/server/rest_api/app.py, 0.6.x). Both are sent: Bearer is what
-        // later servers read.
-        "X-BARE-PASSWORD": `password ${this.password}`,
         Authorization: `Bearer ${this.password}`,
         ...(options.headers as Record<string, string> | undefined),
       },

modules/letta/module.json

@@ -5,28 +5,21 @@
     "container-runtime"
   ],
   "requires": [
-    "postgres-database",
-    "route"
+    "postgres-database"
   ],
   "contributes": {
     "postgres-database": {
       "name": "letta"
-    },
-    "route": {
-      "label": "letta",
-      "endpoint": "web"
     }
   },
   "binds": {
-    "postgres-database": "${dir:state}/database.json",
-    "route": "${dir:state}/route.json"
+    "postgres-database": "/var/lib/letta/database.json"
   },
   "secrets": {
-    "postgres-database": "${dir:state}/database.secret"
+    "postgres-database": "/var/lib/letta/database.secret"
   },
   "own-secrets": {
-    "server-password": "${dir:state}/server-password.secret",
-    "openai-api-key": "${dir:state}/openai-api-key.secret",
+    "server-password": "/var/lib/letta/server-password.secret",
     "broker": "/var/lib/mesh/letta/broker"
   },
   "listens": [
@@ -35,7 +28,7 @@
       "port": 8283,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the Letta agent server REST API and web UI, password-protected (--secure); a public name is the route's"
+      "why": "the Letta agent server REST API and web UI; a public name is a route grant later"
     }
   ],
   "resources": [
@@ -48,15 +41,15 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/letta",
+      "mode": "0700"
     },
     {
       "id": "server-env",
       "type": "file",
-      "path": "${dir:state}/server.env",
+      "path": "/var/lib/letta/server.env",
       "mode": "0600",
-      "content": "LETTA_PG_URI=postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nLETTA_SERVER_PASSWORD=${secret:server-password}\nOPENAI_API_KEY=${secret:openai-api-key}\nSECURE=true\nTZ=Europe/Brussels\n"
+      "content": "LETTA_PG_URI=postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nLETTA_SERVER_PASSWORD=${secret:server-password}\nSECURE=true\nTZ=Europe/Brussels\n"
     },
     {
       "id": "net",
@@ -67,24 +60,31 @@
       "id": "server",
       "type": "container",
       "name": "letta",
-      "image": "letta/letta@sha256:bfd1e49ce45b9a208c941e832c1d1d194017ff210a3784b0ca6c323aed767a29",
+      "image": "letta/letta@sha256:1d2e0692514287c5ed1a483e14e16ed945f8632d315539f5e66373bb7d7c471b",
       "network": "letta",
       "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/letta/server.env"
       ],
       "ports": [
         "8283"
       ],
-      "secrets-in-environment": "letta 0.6.x reads its settings from the environment only (pydantic settings, no secrets_dir or _FILE twin), and its startup.sh starts an embedded PostgreSQL unless LETTA_PG_URI is set - so the database password travels inside that URI (startup.sh also echoes it to the log); LETTA_SERVER_PASSWORD and OPENAI_API_KEY have no file source either"
+      "secrets-in-environment": "the letta image is env-driven and its file-source support could not be verified; the mesh runtime can take its password from config.json (client.ts) \u2014 not yet converted"
     },
     {
       "id": "runtime-config",
       "type": "file",
       "path": "/var/lib/mesh/letta/config.json",
       "mode": "0600",
-      "content": "{\n  \"password\": \"${secret:server-password}\"\n}\n",
+      "content": "{}\n",
       "merge": "json"
     },
+    {
+      "id": "runtime-env",
+      "type": "file",
+      "path": "/var/lib/letta/runtime.env",
+      "mode": "0600",
+      "content": "MESH_LETTA_PASSWORD=${secret:server-password}\n"
+    },
     {
       "id": "runtime",
       "type": "container",
@@ -99,10 +99,14 @@
         "MESH_LETTA_URL": "http://letta:8283",
         "MESH_LETTA_CONFIG_FILE": "/run/config/config.json"
       },
+      "env-file": [
+        "/var/lib/letta/runtime.env"
+      ],
       "restart-on": [
         "runtime-config"
       ],
-      "artifact": "runtime"
+      "artifact": "runtime",
+      "secrets-in-environment": "the letta image is env-driven and its file-source support could not be verified; the mesh runtime can take its password from config.json (client.ts) \u2014 not yet converted"
     }
   ],
   "build": {