kometa: dial plex on the scheme plex-api serves

The url's scheme was typed as http while its host and port came from the
binding. plex now serves plex-api with its scheme (#162), so the whole
address is the mesh's: a plex that one day serves https is followed rather
than dialled on the wrong protocol.

modules/kometa/module.json

@@ -0,0 +1,66 @@
+{
+  "module": "kometa",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "plex-api",
+    "secret"
+  ],
+  "binds": {
+    "plex-api": "${dir:state}/plex-api.json"
+  },
+  "secrets": {
+    "plex-api": "${dir:state}/plex-api.secret",
+    "secret": {
+      "tmdb": "${dir:state}/tmdb.secret"
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "mode": "0700"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/config.yml",
+      "mode": "0600",
+      "merge": "json",
+      "content": "{\n  \"plex\": {\n    \"url\": \"${bound:plex-api:scheme}://${bound:plex-api:at}:${bound:plex-api:port}\",\n    \"token\": \"${secret:plex-api}\",\n    \"timeout\": 60,\n    \"clean_bundles\": false,\n    \"empty_trash\": false,\n    \"optimize\": false,\n    \"verify_ssl\": null,\n    \"db_cache\": null\n  },\n  \"tmdb\": {\n    \"apikey\": \"${secret:tmdb}\",\n    \"language\": \"en\",\n    \"cache_expiration\": 60,\n    \"region\": null\n  },\n  \"settings\": {\n    \"cache\": true,\n    \"cache_expiration\": 60,\n    \"asset_directory\": \"config/assets\",\n    \"sync_mode\": \"append\",\n    \"minimum_items\": 1,\n    \"delete_below_minimum\": false,\n    \"run_again_delay\": 2,\n    \"show_missing\": false,\n    \"save_report\": false,\n    \"run_order\": [\n      \"operations\",\n      \"metadata\",\n      \"collections\",\n      \"overlays\"\n    ],\n    \"asset_folders\": true,\n    \"asset_depth\": 0,\n    \"create_asset_folders\": false,\n    \"prioritize_assets\": false,\n    \"dimensional_asset_rename\": false,\n    \"download_url_assets\": false,\n    \"show_missing_assets\": true,\n    \"show_missing_season_assets\": false,\n    \"show_missing_episode_assets\": false,\n    \"show_asset_not_needed\": true,\n    \"default_collection_order\": null,\n    \"item_refresh_delay\": 0,\n    \"delete_not_scheduled\": false,\n    \"missing_only_released\": false,\n    \"only_filter_missing\": false,\n    \"show_unmanaged\": true,\n    \"show_unconfigured\": true,\n    \"show_filtered\": false,\n    \"show_unfiltered\": false,\n    \"show_options\": false,\n    \"tvdb_language\": \"default\",\n    \"ignore_ids\": null,\n    \"ignore_imdb_ids\": null,\n    \"playlist_sync_to_users\": null,\n    \"playlist_exclude_users\": null,\n    \"playlist_report\": true,\n    \"custom_repo\": null,\n    \"overlay_artwork_filetype\": \"webp_lossy\",\n    \"overlay_artwork_quality\": 90,\n    \"auto_sort_hubs\": null,\n    \"verify_ssl\": true\n  },\n  \"libraries\": {}\n}\n"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "kometa"
+    },
+    {
+      "id": "run",
+      "type": "container",
+      "name": "kometa",
+      "image": "kometateam/kometa@sha256:6c3971a4aaa928b045e5f22514196b6db7f9b2b186158ebfe3239f4b328dfb0a",
+      "network": "kometa",
+      "schedule": "0 3 * * *",
+      "args": [
+        "--run"
+      ],
+      "env": {
+        "TZ": "Etc/UTC",
+        "KOMETA_NO_MISSING": "true",
+        "KOMETA_READ_ONLY_CONFIG": "true"
+      },
+      "volumes": [
+        "${dir:config}:/config",
+        "${dir:state}/config.yml:/config/config.yml:ro"
+      ]
+    }
+  ]
+}

modules/nzbget/client.ts

@@ -48,20 +48,6 @@ function meshConfig(file?: string): Record<string, string> {
   catch { return {}; }
 }
 
-/** One key of nzbget's own nzbget.conf, from the config directory the mesh mounts read-only
- *  (MESH_NZBGET_CONFIG_DIR). The software's file is the truth about who may log in, so the tools
- *  ask it rather than a setting that could disagree. Absent, unreadable or unset yields undefined. */
-function confValue(dir: string | undefined, key: string): string | undefined {
-  if (!dir) return undefined;
-  try {
-    const line = readFileSync(`${dir.replace(/\/$/, "")}/nzbget.conf`, "utf8")
-      .split("\n")
-      .find((l) => l.startsWith(`${key}=`));
-    const value = line?.slice(key.length + 1).trim();
-    return value ? value : undefined;
-  } catch { return undefined; }
-}
-
 /** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
  *  absent or unreadable yields undefined so callers fall back rather than crash. */
 function readSecret(file?: string): string | undefined {
@@ -83,9 +69,7 @@ export class NzbgetClient {
    * Build from the module's resolved environment. URL and password are read from MESH_NZBGET_URL
    * and MESH_NZBGET_PASSWORD; both must be present — an unconfigured NZBGet throws rather than
    * pretend to be reachable, so the tools/events simply do not load (the harness treats the throw
-   * as "exposes nothing"). The password file is the same own-secret the server container is started
-   * with (FILE__NZBGET_PASS), so the two cannot disagree. The control username is read from
-   * nzbget.conf, falling back to "nzbget", NZBGet's own default.
+   * as "exposes nothing"). The control username defaults to "nzbget", NZBGet's own default.
    */
   static fromEnv(env: NodeJS.ProcessEnv = process.env): NzbgetClient {
     const cfg = meshConfig(env.MESH_NZBGET_CONFIG_FILE);
@@ -94,9 +78,7 @@ export class NzbgetClient {
     if (!url || !password) {
       throw new Error("NZBGet not configured — set MESH_NZBGET_URL and MESH_NZBGET_PASSWORD");
     }
-    // The control username: a setting or the environment if one says so, else whatever
-    // nzbget.conf holds (an adopted machine keeps its own, e.g. not "nzbget"), else NZBGet's default.
-    const user = cfg.user ?? env.MESH_NZBGET_USER ?? confValue(env.MESH_NZBGET_CONFIG_DIR, "ControlUsername") ?? "nzbget";
+    const user = cfg.user ?? env.MESH_NZBGET_USER ?? "nzbget";
     return new NzbgetClient(url, user, password);
   }
 

modules/nzbget/module.json

@@ -19,7 +19,7 @@
       "port": 6789,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the download client's pages, and the JSON-RPC API its consumers and its own tools call"
+      "why": "the download client's pages"
     }
   ],
   "accesses": [
@@ -35,15 +35,10 @@
       "path": "/var/lib/mesh/nzbget",
       "mode": "0700"
     },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
     {
       "id": "config",
       "type": "directory",
+      "path": "/services/nzbget/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -51,29 +46,24 @@
       "id": "server",
       "type": "container",
       "name": "nzbget",
-      "image": "lscr.io/linuxserver/nzbget@sha256:ec3ef0ae7dc410084086a7fdd447deda4747531154aa1cc5c7c48ac60794e277",
+      "image": "lscr.io/linuxserver/nzbget@sha256:5f3d3fa71029004156eff2cbf4ef4455ce4ce59517cf13fa7d1d7c8a4cd2c8a4",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
-        "TZ": "Etc/UTC",
-        "FILE__NZBGET_PASS": "/run/secrets/password"
+        "TZ": "Etc/UTC"
       },
       "ports": [
         "6789"
       ],
       "volumes": [
-        "${dir:config}:/config",
-        "/services/media/downloads:/downloads",
-        "/var/lib/mesh/nzbget/password:/run/secrets/password:ro"
-      ],
-      "restart-on": [
-        "needs-password"
+        "/services/nzbget/config:/config",
+        "/services/media/downloads:/downloads"
       ]
     },
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/mesh/nzbget/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -86,46 +76,22 @@
       "volumes": [
         "/var/lib/mesh/nzbget/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/nzbget/password:/run/secrets/password:ro",
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${dir:config}:/var/lib/nzbget/config:ro"
+        "/var/lib/mesh/nzbget/config.json:/run/config/config.json:ro",
+        "/services/nzbget/config:/var/lib/nzbget/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NZBGET_URL": "http://127.0.0.1:${port:6789}",
+        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
         "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
         "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
         "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"
       },
       "restart-on": [
-        "runtime-config",
-        "needs-password"
+        "runtime-config"
       ],
       "artifact": "runtime"
     }
   ],
-  "provides": [
-    "nzbget-api"
-  ],
-  "serves": {
-    "nzbget-api": {
-      "scheme": "http",
-      "port": 6789,
-      "url-base": "",
-      "username": "nzbget"
-    }
-  },
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "nzbget",
-      "endpoint": "web"
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
   "build": {
     "on": [
       {