nzbget: placed config, the build ace runs, its password a file, its API provided

The manifest named /services/nzbget/config and /var/lib/mesh/nzbget/config.json, host paths ADR 0112 takes out of definitions. The config dir is now pathless (${dir:config}); the runtime's config and route binding live in a placed state dir. The image is pinned to v26.0-ls233, the digest ace runs. The old pin (v26.3-ls261) is newer but unproven against ace's queue; moving up is a later, separate step. The password own-secret reached the tools and nothing else, so a fresh machine ran nzbget's well-known default while the tools held a minted value that matched nothing. The server now reads it too, through the image's FILE__NZBGET_PASS (a path in the environment, the value from a 0600 root file - ADR 0086), and both restart on it. An adopted machine accepts its existing ControlPassword. The tools assumed the control user is "nzbget"; they now read ControlUsername from nzbget.conf on the read-only config mount (ace's is not "nzbget"). sonarr, radarr, lidarr and bookshelf reached nzbget by container name on HAL's shared network. nzbget now provides nzbget-api (node scope: a download client must share the consumer's download spool) and serves scheme, port, url-base and username; the password is the operator-accepted pair credential, as for #156. The web endpoint is routed (label nzbget). The runtime dials ${port:6789}, the same line as #154. Verified: catalogue tests with MESH_CATALOGUE set (not skipped); rendered for ace with a pinned port and username setting; a throwaway of the pinned image on a fresh 0700 dir with the secret as a 0600 root file answered the secret (200), refused a wrong and the default password (401); the compiled client read the username from nzbget.conf and reached version/status/queue/history; strict typecheck and the module's Dockerfile build pass.
2026-09-30 12:00:31 +02:00
4 changed files with 83 additions and 110 deletions
@@ -1,20 +0,0 @@
-# n8n with what its workflows reach for beyond the upstream image.
-#
-# The base is named, not pinned here (novox/hq issue 044): module.json's `build.on` declares N8N_BASE
-# as the upstream image by digest, and the mesh hands the build its own copy (ADR 0097).
-ARG N8N_BASE
-FROM ${N8N_BASE}
-
-USER root
-# - `media` (GID 2000), with `node` in it: the shared media library is group-writable by the
-#   operator's media group, and a workflow files downloads into it. A container resource cannot add
-#   a supplementary group, so the image's own /etc/group carries it. 2000 is the operator's media
-#   group today; novox/hq 153 proposes reading it from the accessed data (${access:<id>:gid}).
-# - uuid, pinned to the version the workflows were written against: Code nodes require() it
-#   (NODE_FUNCTION_ALLOW_EXTERNAL=*), and a Code node can only require what is installed.
-RUN apk add --no-cache shadow \
- && groupadd -g 2000 media \
- && usermod -aG media node \
- && npm install -g uuid@14.0.1
-
-USER node
@@ -18,60 +18,44 @@
    }
  },
  "binds": {
-    "postgres-database": "${dir:state}/database.json",
-    "route": "${dir:state}/route.json"
+    "postgres-database": "/var/lib/n8n/database.json",
+    "route": "/var/lib/n8n/route.json"
  },
  "secrets": {
-    "postgres-database": "${dir:state}/database.secret"
+    "postgres-database": "/var/lib/n8n/database.secret"
+  },
+  "own-secrets": {
+    "basic-auth": "/var/lib/n8n/basic-auth.secret"
  },
-  "accesses": [
-    {
-      "path": "/services/media",
-      "mode": "read-write"
-    }
-  ],
  "listens": [
    {
      "name": "web",
-      "port": 5678,
+      "port": 5682,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the n8n editor, its REST API and the webhook endpoints workflows are triggered through; a public name is the route's"
+      "why": "the n8n editor and webhook endpoints over http; the public name n8n.novox.be is a route grant, and route-proxy reaches it on this published port"
    }
  ],
  "resources": [
    {
      "id": "state",
      "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/n8n",
+      "mode": "0700"
    },
    {
      "id": "data",
      "type": "directory",
+      "path": "/services/n8n/n8n-data",
      "mode": "0700",
      "owner": "1000:1000"
    },
-    {
-      "id": "cache",
-      "type": "directory",
-      "mode": "0700",
-      "owner": "999:999"
-    },
-    {
-      "id": "database-secret",
-      "type": "file",
-      "path": "${dir:state}/n8n-database.secret",
-      "mode": "0400",
-      "owner": "1000:1000",
-      "content": "${secret:postgres-database}"
-    },
    {
      "id": "server-env",
      "type": "file",
-      "path": "${dir:state}/server.env",
+      "path": "/var/lib/n8n/server.env",
      "mode": "0600",
-      "content": "N8N_HOST=${bound:route:name}\nN8N_PORT=5678\nN8N_PROTOCOL=https\nWEBHOOK_URL=https://${bound:route:name}/\nNODE_FUNCTION_ALLOW_BUILTIN=*\nNODE_FUNCTION_ALLOW_EXTERNAL=*\nDB_TYPE=postgresdb\nDB_POSTGRESDB_HOST=${bound:postgres-database:at}\nDB_POSTGRESDB_PORT=${bound:postgres-database:port}\nDB_POSTGRESDB_DATABASE=${bound:postgres-database:as}\nDB_POSTGRESDB_USER=${bound:postgres-database:as}\nDB_POSTGRESDB_PASSWORD_FILE=/run/secrets/database\n"
+      "content": "N8N_HOST=n8n.novox.be\nN8N_PORT=5678\nN8N_PROTOCOL=https\nWEBHOOK_URL=https://n8n.novox.be/\nN8N_BASIC_AUTH_ACTIVE=true\nN8N_BASIC_AUTH_USER=admin\nN8N_BASIC_AUTH_PASSWORD=${secret:basic-auth}\nNODE_FUNCTION_ALLOW_BUILTIN=*\nNODE_FUNCTION_ALLOW_EXTERNAL=*\nDB_TYPE=postgresdb\nDB_POSTGRESDB_HOST=${bound:postgres-database:at}\nDB_POSTGRESDB_PORT=${bound:postgres-database:port}\nDB_POSTGRESDB_DATABASE=${bound:postgres-database:as}\nDB_POSTGRESDB_USER=${bound:postgres-database:as}\nDB_POSTGRESDB_PASSWORD=${secret:postgres-database}\n"
    },
    {
      "id": "net",
@@ -82,61 +66,18 @@
      "id": "server",
      "type": "container",
      "name": "n8n",
-      "artifact": "server",
+      "image": "n8nio/n8n@sha256:4846eb2f4b874ab04cde7fc1e249d2ddaec66e9aea64439beb2972cfea88e3c0",
      "network": "n8n",
      "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/n8n/server.env"
      ],
      "ports": [
        "5678"
      ],
      "volumes": [
-        "${dir:data}:/home/node/.n8n",
-        "${dir:state}/n8n-database.secret:/run/secrets/database:ro",
-        "/services/media:/media-library"
-      ]
-    },
-    {
-      "id": "cache-server",
-      "type": "container",
-      "name": "n8n-redis",
-      "image": "redis@sha256:8a1efc5f479551822b47424ccae982026b633f28818eab0387348120a61e10e2",
-      "network": "n8n",
-      "args": [
-        "redis-server",
-        "--appendonly",
-        "yes"
+        "/services/n8n/n8n-data:/home/node/.n8n"
      ],
-      "volumes": [
-        "${dir:cache}:/data"
-      ]
-    },
-    {
-      "id": "browser",
-      "type": "container",
-      "name": "n8n-selenium",
-      "image": "selenium/standalone-chrome@sha256:9ae1c78e9b2ca9fe4b22e57873b5ee34aeb8e814e3122293eef4c3abe4c5f448",
-      "network": "n8n",
-      "env": {
-        "SE_ENABLE_TRACING": "false",
-        "SE_NODE_MAX_SESSIONS": "5",
-        "SE_NODE_OVERRIDE_MAX_SESSIONS": "true"
-      }
+      "secrets-in-environment": "n8n's loader honours <VAR>_FILE for every setting; convertible, awaiting a bed that proves it (N8N_BASIC_AUTH_* was removed in n8n 1.0 and is likely dead)"
    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "N8N_BASE",
-        "image": "n8nio/n8n@sha256:4846eb2f4b874ab04cde7fc1e249d2ddaec66e9aea64439beb2972cfea88e3c0"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "server",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
+  ]
 }
@@ -48,6 +48,20 @@ function meshConfig(file?: string): Record<string, string> {
  catch { return {}; }
 }

+/** One key of nzbget's own nzbget.conf, from the config directory the mesh mounts read-only
+ *  (MESH_NZBGET_CONFIG_DIR). The software's file is the truth about who may log in, so the tools
+ *  ask it rather than a setting that could disagree. Absent, unreadable or unset yields undefined. */
+function confValue(dir: string | undefined, key: string): string | undefined {
+  if (!dir) return undefined;
+  try {
+    const line = readFileSync(`${dir.replace(/\/$/, "")}/nzbget.conf`, "utf8")
+      .split("\n")
+      .find((l) => l.startsWith(`${key}=`));
+    const value = line?.slice(key.length + 1).trim();
+    return value ? value : undefined;
+  } catch { return undefined; }
+}
+
 /** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
 *  absent or unreadable yields undefined so callers fall back rather than crash. */
 function readSecret(file?: string): string | undefined {
@@ -69,7 +83,9 @@ export class NzbgetClient {
   * Build from the module's resolved environment. URL and password are read from MESH_NZBGET_URL
   * and MESH_NZBGET_PASSWORD; both must be present — an unconfigured NZBGet throws rather than
   * pretend to be reachable, so the tools/events simply do not load (the harness treats the throw
-   * as "exposes nothing"). The control username defaults to "nzbget", NZBGet's own default.
+   * as "exposes nothing"). The password file is the same own-secret the server container is started
+   * with (FILE__NZBGET_PASS), so the two cannot disagree. The control username is read from
+   * nzbget.conf, falling back to "nzbget", NZBGet's own default.
   */
  static fromEnv(env: NodeJS.ProcessEnv = process.env): NzbgetClient {
    const cfg = meshConfig(env.MESH_NZBGET_CONFIG_FILE);
@@ -78,7 +94,9 @@ export class NzbgetClient {
    if (!url || !password) {
      throw new Error("NZBGet not configured — set MESH_NZBGET_URL and MESH_NZBGET_PASSWORD");
    }
-    const user = cfg.user ?? env.MESH_NZBGET_USER ?? "nzbget";
+    // The control username: a setting or the environment if one says so, else whatever
+    // nzbget.conf holds (an adopted machine keeps its own, e.g. not "nzbget"), else NZBGet's default.
+    const user = cfg.user ?? env.MESH_NZBGET_USER ?? confValue(env.MESH_NZBGET_CONFIG_DIR, "ControlUsername") ?? "nzbget";
    return new NzbgetClient(url, user, password);
  }

@@ -19,7 +19,7 @@
      "port": 6789,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the download client's pages"
+      "why": "the download client's pages, and the JSON-RPC API its consumers and its own tools call"
    }
  ],
  "accesses": [
@@ -35,10 +35,15 @@
      "path": "/var/lib/mesh/nzbget",
      "mode": "0700"
    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
    {
      "id": "config",
      "type": "directory",
-      "path": "/services/nzbget/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -46,24 +51,29 @@
      "id": "server",
      "type": "container",
      "name": "nzbget",
-      "image": "lscr.io/linuxserver/nzbget@sha256:5f3d3fa71029004156eff2cbf4ef4455ce4ce59517cf13fa7d1d7c8a4cd2c8a4",
+      "image": "lscr.io/linuxserver/nzbget@sha256:ec3ef0ae7dc410084086a7fdd447deda4747531154aa1cc5c7c48ac60794e277",
      "env": {
        "PUID": "1000",
        "PGID": "1000",
-        "TZ": "Etc/UTC"
+        "TZ": "Etc/UTC",
+        "FILE__NZBGET_PASS": "/run/secrets/password"
      },
      "ports": [
        "6789"
      ],
      "volumes": [
-        "/services/nzbget/config:/config",
-        "/services/media/downloads:/downloads"
+        "${dir:config}:/config",
+        "/services/media/downloads:/downloads",
+        "/var/lib/mesh/nzbget/password:/run/secrets/password:ro"
+      ],
+      "restart-on": [
+        "needs-password"
      ]
    },
    {
      "id": "runtime-config",
      "type": "file",
-      "path": "/var/lib/mesh/nzbget/config.json",
+      "path": "${dir:state}/config.json",
      "mode": "0600",
      "content": "{}\n",
      "merge": "json"
@@ -76,22 +86,46 @@
      "volumes": [
        "/var/lib/mesh/nzbget/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/nzbget/password:/run/secrets/password:ro",
-        "/var/lib/mesh/nzbget/config.json:/run/config/config.json:ro",
-        "/services/nzbget/config:/var/lib/nzbget/config:ro"
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:config}:/var/lib/nzbget/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
+        "MESH_NZBGET_URL": "http://127.0.0.1:${port:6789}",
        "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
        "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
        "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"
      },
      "restart-on": [
-        "runtime-config"
+        "runtime-config",
+        "needs-password"
      ],
      "artifact": "runtime"
    }
  ],
+  "provides": [
+    "nzbget-api"
+  ],
+  "serves": {
+    "nzbget-api": {
+      "scheme": "http",
+      "port": 6789,
+      "url-base": "",
+      "username": "nzbget"
+    }
+  },
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "nzbget",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
  "build": {
    "on": [
      {