grafana: its directories are placed, its admin password is a file, and it runs the build in use

The module stated /var/lib/grafana-module and /services/grafana/data, a layout no definition may carry (ADR 0112). State and data are now placed directories; the admin secret lives beside the broker account under the mesh's own state. The admin password reached grafana through an env-file. Grafana honours GF_SECURITY_ADMIN_PASSWORD__FILE, so it is now a 0400 file owned by the image's user (472) and mounted, and "secrets-in-environment" is gone (ADR 0086). The runtime sidecar was given no credential at all - its config file was "{}", so GrafanaClient.fromEnv threw and the tools and the alert watcher did nothing. It now carries user/password from the same secret, and it calls grafana on the machine port the mesh assigned (${port:3000}) rather than a literal 3000. Image pinned to the 13.2.2 build ace's predecessor runs; the old pin was 13.2.1, older than the data it would open. Verified: catalogue tests with MESH_CATALOGUE pointing here; a throwaway container of the pinned image with the file-mounted secret answers /api/health and authenticates admin with the file's value (default admin/admin refused); restarted over the same data with a different file value, the original password still holds - so a migrated instance's password must be accepted, not minted; data owned by another uid fails to start, so a moved data directory must be chowned to 472.
2026-09-29 23:43:00 +02:00
3 changed files with 30 additions and 82 deletions
@@ -5,7 +5,7 @@
    "alert.firing"
  ],
  "own-secrets": {
-    "admin": "/var/lib/grafana-module/admin.secret",
+    "admin": "/var/lib/mesh/grafana/admin",
    "broker": "/var/lib/mesh/grafana/broker"
  },
  "capabilities": [
@@ -30,45 +30,45 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/grafana-module",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
    },
    {
      "id": "data",
      "type": "directory",
-      "path": "/services/grafana/data",
      "mode": "0700",
      "owner": "472:472"
    },
    {
-      "id": "server-env",
+      "id": "admin-secret",
      "type": "file",
-      "path": "/var/lib/grafana-module/server.env",
-      "mode": "0600",
-      "content": "GF_SECURITY_ADMIN_PASSWORD=${secret:admin}\n"
+      "path": "${dir:state}/admin.secret",
+      "mode": "0400",
+      "owner": "472:472",
+      "content": "${secret:admin}"
    },
    {
      "id": "server",
      "type": "container",
      "name": "grafana",
-      "image": "grafana/grafana@sha256:f772d434e8fab0049deb2b1b30abd43342bcfca1537614aa8d36080232cf4283",
+      "image": "grafana/grafana@sha256:ac461fb352abc50da10a51c7d02462e9c05488f11f53f14b3ad79a8145f638a0",
      "ports": [
        "3000"
      ],
      "volumes": [
-        "/services/grafana/data:/var/lib/grafana"
+        "${dir:data}:/var/lib/grafana",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro"
      ],
-      "env-file": [
-        "/var/lib/grafana-module/server.env"
-      ],
-      "secrets-in-environment": "grafana honours GF_SECURITY_ADMIN_PASSWORD__FILE; convertible, awaiting a bed that exercises the admin password (assigned-grafana serves tools only)"
+      "env": {
+        "GF_SECURITY_ADMIN_PASSWORD__FILE": "/run/secrets/admin"
+      }
    },
    {
      "id": "runtime-config",
      "type": "file",
      "path": "/var/lib/mesh/grafana/config.json",
      "mode": "0600",
-      "content": "{}\n",
+      "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
      "merge": "json"
    },
    {
@@ -82,7 +82,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_GRAFANA_URL": "http://127.0.0.1:3000",
+        "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
        "MESH_GRAFANA_CONFIG_FILE": "/run/config/config.json"
      },
      "restart-on": [
@@ -101,7 +101,7 @@
    }
  },
  "binds": {
-    "route": "/var/lib/mesh/grafana/route.json"
+    "route": "${dir:state}/route.json"
  },
  "build": {
    "on": [
@@ -48,20 +48,6 @@ function meshConfig(file?: string): Record<string, string> {
  catch { return {}; }
 }

-/** One key of nzbget's own nzbget.conf, from the config directory the mesh mounts read-only
- *  (MESH_NZBGET_CONFIG_DIR). The software's file is the truth about who may log in, so the tools
- *  ask it rather than a setting that could disagree. Absent, unreadable or unset yields undefined. */
-function confValue(dir: string | undefined, key: string): string | undefined {
-  if (!dir) return undefined;
-  try {
-    const line = readFileSync(`${dir.replace(/\/$/, "")}/nzbget.conf`, "utf8")
-      .split("\n")
-      .find((l) => l.startsWith(`${key}=`));
-    const value = line?.slice(key.length + 1).trim();
-    return value ? value : undefined;
-  } catch { return undefined; }
-}
-
 /** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
 *  absent or unreadable yields undefined so callers fall back rather than crash. */
 function readSecret(file?: string): string | undefined {
@@ -83,9 +69,7 @@ export class NzbgetClient {
   * Build from the module's resolved environment. URL and password are read from MESH_NZBGET_URL
   * and MESH_NZBGET_PASSWORD; both must be present — an unconfigured NZBGet throws rather than
   * pretend to be reachable, so the tools/events simply do not load (the harness treats the throw
-   * as "exposes nothing"). The password file is the same own-secret the server container is started
-   * with (FILE__NZBGET_PASS), so the two cannot disagree. The control username is read from
-   * nzbget.conf, falling back to "nzbget", NZBGet's own default.
+   * as "exposes nothing"). The control username defaults to "nzbget", NZBGet's own default.
   */
  static fromEnv(env: NodeJS.ProcessEnv = process.env): NzbgetClient {
    const cfg = meshConfig(env.MESH_NZBGET_CONFIG_FILE);
@@ -94,9 +78,7 @@ export class NzbgetClient {
    if (!url || !password) {
      throw new Error("NZBGet not configured — set MESH_NZBGET_URL and MESH_NZBGET_PASSWORD");
    }
-    // The control username: a setting or the environment if one says so, else whatever
-    // nzbget.conf holds (an adopted machine keeps its own, e.g. not "nzbget"), else NZBGet's default.
-    const user = cfg.user ?? env.MESH_NZBGET_USER ?? confValue(env.MESH_NZBGET_CONFIG_DIR, "ControlUsername") ?? "nzbget";
+    const user = cfg.user ?? env.MESH_NZBGET_USER ?? "nzbget";
    return new NzbgetClient(url, user, password);
  }

@@ -19,7 +19,7 @@
      "port": 6789,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the download client's pages, and the JSON-RPC API its consumers and its own tools call"
+      "why": "the download client's pages"
    }
  ],
  "accesses": [
@@ -35,15 +35,10 @@
      "path": "/var/lib/mesh/nzbget",
      "mode": "0700"
    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
    {
      "id": "config",
      "type": "directory",
+      "path": "/services/nzbget/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -51,29 +46,24 @@
      "id": "server",
      "type": "container",
      "name": "nzbget",
-      "image": "lscr.io/linuxserver/nzbget@sha256:ec3ef0ae7dc410084086a7fdd447deda4747531154aa1cc5c7c48ac60794e277",
+      "image": "lscr.io/linuxserver/nzbget@sha256:5f3d3fa71029004156eff2cbf4ef4455ce4ce59517cf13fa7d1d7c8a4cd2c8a4",
      "env": {
        "PUID": "1000",
        "PGID": "1000",
-        "TZ": "Etc/UTC",
-        "FILE__NZBGET_PASS": "/run/secrets/password"
+        "TZ": "Etc/UTC"
      },
      "ports": [
        "6789"
      ],
      "volumes": [
-        "${dir:config}:/config",
-        "/services/media/downloads:/downloads",
-        "/var/lib/mesh/nzbget/password:/run/secrets/password:ro"
-      ],
-      "restart-on": [
-        "needs-password"
+        "/services/nzbget/config:/config",
+        "/services/media/downloads:/downloads"
      ]
    },
    {
      "id": "runtime-config",
      "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/mesh/nzbget/config.json",
      "mode": "0600",
      "content": "{}\n",
      "merge": "json"
@@ -86,46 +76,22 @@
      "volumes": [
        "/var/lib/mesh/nzbget/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/nzbget/password:/run/secrets/password:ro",
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${dir:config}:/var/lib/nzbget/config:ro"
+        "/var/lib/mesh/nzbget/config.json:/run/config/config.json:ro",
+        "/services/nzbget/config:/var/lib/nzbget/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NZBGET_URL": "http://127.0.0.1:${port:6789}",
+        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
        "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
        "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
        "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"
      },
      "restart-on": [
-        "runtime-config",
-        "needs-password"
+        "runtime-config"
      ],
      "artifact": "runtime"
    }
  ],
-  "provides": [
-    "nzbget-api"
-  ],
-  "serves": {
-    "nzbget-api": {
-      "scheme": "http",
-      "port": 6789,
-      "url-base": "",
-      "username": "nzbget"
-    }
-  },
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "nzbget",
-      "endpoint": "web"
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
  "build": {
    "on": [
      {