grafana: its directories are placed, its admin password is a file, and it runs the build in use

The module stated /var/lib/grafana-module and /services/grafana/data, a
layout no definition may carry (ADR 0112). State and data are now placed
directories; the admin secret lives beside the broker account under the
mesh's own state.

The admin password reached grafana through an env-file. Grafana honours
GF_SECURITY_ADMIN_PASSWORD__FILE, so it is now a 0400 file owned by the
image's user (472) and mounted, and "secrets-in-environment" is gone
(ADR 0086).

The runtime sidecar was given no credential at all - its config file was
"{}", so GrafanaClient.fromEnv threw and the tools and the alert watcher
did nothing. It now carries user/password from the same secret, and it
calls grafana on the machine port the mesh assigned (${port:3000}) rather
than a literal 3000.

Image pinned to the 13.2.2 build ace's predecessor runs; the old pin was
13.2.1, older than the data it would open.

Verified: catalogue tests with MESH_CATALOGUE pointing here; a throwaway
container of the pinned image with the file-mounted secret answers
/api/health and authenticates admin with the file's value (default
admin/admin refused); restarted over the same data with a different file
value, the original password still holds - so a migrated instance's
password must be accepted, not minted; data owned by another uid fails to
start, so a moved data directory must be chowned to 472.

modules/bazarr/module.json

@@ -94,7 +94,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BAZARR_URL": "http://127.0.0.1:${port:6767}",
+        "MESH_BAZARR_URL": "http://127.0.0.1:6767",
         "MESH_BAZARR_API_KEY_FILE": "/run/secrets/api-key",
         "MESH_BAZARR_CONFIG_FILE": "/run/config/config.json",
         "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config"

modules/bookshelf/module.json

@@ -76,7 +76,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BOOKSHELF_URL": "http://127.0.0.1:${port:8787}",
+        "MESH_BOOKSHELF_URL": "http://127.0.0.1:8787",
         "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config"
       },
       "artifact": "runtime"

modules/grafana/module.json

@@ -5,7 +5,7 @@
     "alert.firing"
   ],
   "own-secrets": {
-    "admin": "/var/lib/grafana-module/admin.secret",
+    "admin": "/var/lib/mesh/grafana/admin",
     "broker": "/var/lib/mesh/grafana/broker"
   },
   "capabilities": [
@@ -30,45 +30,45 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/grafana-module",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "data",
       "type": "directory",
-      "path": "/services/grafana/data",
       "mode": "0700",
       "owner": "472:472"
     },
     {
-      "id": "server-env",
+      "id": "admin-secret",
       "type": "file",
-      "path": "/var/lib/grafana-module/server.env",
-      "mode": "0600",
-      "content": "GF_SECURITY_ADMIN_PASSWORD=${secret:admin}\n"
+      "path": "${dir:state}/admin.secret",
+      "mode": "0400",
+      "owner": "472:472",
+      "content": "${secret:admin}"
     },
     {
       "id": "server",
       "type": "container",
       "name": "grafana",
-      "image": "grafana/grafana@sha256:f772d434e8fab0049deb2b1b30abd43342bcfca1537614aa8d36080232cf4283",
+      "image": "grafana/grafana@sha256:ac461fb352abc50da10a51c7d02462e9c05488f11f53f14b3ad79a8145f638a0",
       "ports": [
         "3000"
       ],
       "volumes": [
-        "/services/grafana/data:/var/lib/grafana"
+        "${dir:data}:/var/lib/grafana",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro"
       ],
-      "env-file": [
-        "/var/lib/grafana-module/server.env"
-      ],
-      "secrets-in-environment": "grafana honours GF_SECURITY_ADMIN_PASSWORD__FILE; convertible, awaiting a bed that exercises the admin password (assigned-grafana serves tools only)"
+      "env": {
+        "GF_SECURITY_ADMIN_PASSWORD__FILE": "/run/secrets/admin"
+      }
     },
     {
       "id": "runtime-config",
       "type": "file",
       "path": "/var/lib/mesh/grafana/config.json",
       "mode": "0600",
-      "content": "{}\n",
+      "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
       "merge": "json"
     },
     {
@@ -82,7 +82,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_GRAFANA_URL": "http://127.0.0.1:3000",
+        "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
         "MESH_GRAFANA_CONFIG_FILE": "/run/config/config.json"
       },
       "restart-on": [
@@ -101,7 +101,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/mesh/grafana/route.json"
+    "route": "${dir:state}/route.json"
   },
   "build": {
     "on": [

modules/lidarr/module.json

@@ -75,7 +75,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_LIDARR_URL": "http://127.0.0.1:${port:8686}",
+        "MESH_LIDARR_URL": "http://127.0.0.1:8686",
         "MESH_LIDARR_CONFIG_DIR": "/var/lib/lidarr/config"
       },
       "artifact": "runtime"

modules/nzbget/module.json

@@ -81,7 +81,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NZBGET_URL": "http://127.0.0.1:${port:6789}",
+        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
         "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
         "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
         "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"

modules/qbittorrent/client.ts

@@ -3,10 +3,8 @@
 // qbittorrent. Both this module's tools and its events entrypoint import it, and nothing outside
 // qbittorrent does.
 //
-// The WebUI authenticates with a session cookie obtained by POSTing credentials, and guards
-// against CSRF by checking the Referer header. The cookie was `SID` before qBittorrent 5.2 and is
-// `QBT_SID_<port>` since, and a successful login answers 200 "Ok." before and 204 with no body
-// since — both are accepted. Node's fetch keeps no cookie jar, so the cookie is
+// The WebUI authenticates with a session cookie (SID) obtained by POSTing credentials, and guards
+// against CSRF by checking the Referer header. Node's fetch keeps no cookie jar, so the SID is
 // captured on login and carried by hand on every later call, with a single re-login on expiry.
 
 import { readFileSync } from "node:fs";
@@ -41,21 +39,6 @@ function meshConfig(file?: string): Record<string, string> {
   catch { return {}; }
 }
 
-/** The WebUI username from qBittorrent's own qBittorrent.conf, in the config directory the mesh
- *  mounts read-only (MESH_QBITTORRENT_CONFIG_DIR, which is the container's /config). The software's
- *  file is the truth about who may log in, so the tools ask it rather than a setting that could
- *  disagree. Absent, unreadable or unset yields undefined. */
-function confUsername(dir: string | undefined): string | undefined {
-  if (!dir) return undefined;
-  try {
-    const line = readFileSync(`${dir.replace(/\/$/, "")}/qBittorrent/qBittorrent.conf`, "utf8")
-      .split(/\r?\n/)
-      .find((l) => l.startsWith("WebUI\\Username="));
-    const value = line?.slice("WebUI\\Username=".length).trim();
-    return value ? value : undefined;
-  } catch { return undefined; }
-}
-
 /** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
  *  absent or unreadable yields undefined so callers fall back rather than crash. */
 function readSecret(file?: string): string | undefined {
@@ -66,8 +49,7 @@ function readSecret(file?: string): string | undefined {
 
 export class QbittorrentClient {
   readonly baseUrl: string;
-  /** The session cookie as `name=value`, sent back exactly as it was set. */
-  private session: string | null = null;
+  private sid: string | null = null;
 
   constructor(
     baseUrl: string,
@@ -81,9 +63,7 @@ export class QbittorrentClient {
    * Build from the module's resolved environment. URL and password are read from
    * MESH_QBITTORRENT_URL and MESH_QBITTORRENT_PASSWORD; both must be present — an unconfigured
    * qBittorrent throws rather than pretend to be reachable, so the tools/events simply do not load
-   * (the harness treats the throw as "exposes nothing"). The user is read from qBittorrent.conf,
-   * falling back to "admin", the image's default. The password cannot be read there — qBittorrent
-   * keeps only a PBKDF2 hash — so it is the own-secret the operator accepts.
+   * (the harness treats the throw as "exposes nothing"). The user defaults to "admin".
    */
   static fromEnv(env: NodeJS.ProcessEnv = process.env): QbittorrentClient {
     const cfg = meshConfig(env.MESH_QBITTORRENT_CONFIG_FILE);
@@ -92,9 +72,7 @@ export class QbittorrentClient {
     if (!url || !password) {
       throw new Error("qBittorrent not configured — set MESH_QBITTORRENT_URL and MESH_QBITTORRENT_PASSWORD");
     }
-    // The WebUI username: a setting or the environment if one says so, else whatever
-    // qBittorrent.conf holds (an adopted machine keeps its own), else the image's "admin".
-    const user = cfg.user ?? env.MESH_QBITTORRENT_USER ?? confUsername(env.MESH_QBITTORRENT_CONFIG_DIR) ?? "admin";
+    const user = cfg.user ?? env.MESH_QBITTORRENT_USER ?? "admin";
     return new QbittorrentClient(url, user, password);
   }
 
@@ -104,22 +82,19 @@ export class QbittorrentClient {
       headers: { "Content-Type": "application/x-www-form-urlencoded", Referer: this.baseUrl },
       body: new URLSearchParams({ username: this.user, password: this.password }),
     });
-    if (res.status === 401) throw new Error("qBittorrent login rejected — check credentials");
     if (!res.ok) throw new Error(`qBittorrent login: ${res.status} ${await res.text()}`);
-    // 4.x/5.0/5.1 answer 200 "Ok." or 200 "Fails."; 5.2 answers 204 with no body, or 401.
-    const body = (await res.text()).trim();
-    if (res.status !== 204 && body !== "Ok.") {
+    if ((await res.text()).trim() !== "Ok.") {
       throw new Error("qBittorrent login rejected — check credentials");
     }
-    const match = res.headers.get("set-cookie")?.match(/((?:QBT_)?SID(?:_\d+)?)=([^;]+)/);
-    if (!match) throw new Error("qBittorrent login returned no session cookie");
-    this.session = `${match[1]}=${match[2]}`;
+    const match = res.headers.get("set-cookie")?.match(/SID=([^;]+)/);
+    if (!match) throw new Error("qBittorrent login returned no SID cookie");
+    this.sid = match[1];
   }
 
   private async call(method: "GET" | "POST", path: string, form?: Record<string, string>): Promise<Response> {
-    if (!this.session) await this.login();
+    if (!this.sid) await this.login();
     const doFetch = (): Promise<Response> => {
-      const headers: Record<string, string> = { Referer: this.baseUrl, Cookie: this.session ?? "" };
+      const headers: Record<string, string> = { Referer: this.baseUrl, Cookie: `SID=${this.sid}` };
       const init: RequestInit = { method, headers };
       if (form) {
         headers["Content-Type"] = "application/x-www-form-urlencoded";
@@ -128,8 +103,8 @@ export class QbittorrentClient {
       return fetch(`${this.baseUrl}/api/v2/${path}`, init);
     };
     let res = await doFetch();
-    if (res.status === 403 || res.status === 401) {
-      // The session expired — re-authenticate once and retry, rather than fail a routine call.
+    if (res.status === 403) {
+      // The SID expired — re-authenticate once and retry, rather than fail a routine call.
       await this.login();
       res = await doFetch();
     }

modules/qbittorrent/module.json

@@ -17,24 +17,10 @@
   "listens": [
     {
       "name": "web",
-      "port": 8112,
+      "port": 8080,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the download client's pages, and the WebUI API its consumers and its own tools call. qBittorrent refuses a request whose Host names a port other than the one it listens on, so it listens on the machine port itself (host network, WEBUI_PORT=${port:8112}) and the two cannot differ on any machine"
-    },
-    {
-      "name": "peers",
-      "port": 6881,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "incoming BitTorrent peer connections; announced to trackers and peers, so qBittorrent listens on the machine port itself (TORRENTING_PORT=${port:6881})"
-    },
-    {
-      "name": "peers-udp",
-      "port": 6881,
-      "protocol": "udp",
-      "from": "mesh",
-      "why": "DHT and uTP on the same number as the peer port"
+      "why": "the download client's pages"
     }
   ],
   "accesses": [
@@ -50,15 +36,10 @@
       "path": "/var/lib/mesh/qbittorrent",
       "mode": "0700"
     },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
     {
       "id": "config",
       "type": "directory",
+      "path": "/services/qbittorrent/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -66,24 +47,24 @@
       "id": "server",
       "type": "container",
       "name": "qbittorrent",
-      "image": "lscr.io/linuxserver/qbittorrent@sha256:457e4eec2ee3f5e4ef59f237ad51f6143deba9f7445ab48bb5204a98888ef9aa",
+      "image": "lscr.io/linuxserver/qbittorrent@sha256:a00b6a597a3832a1814cde0ef60abc55c94644f3f80902c3432f6af6de8d4a96",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
-        "TZ": "Etc/UTC",
-        "WEBUI_PORT": "${port:8112}",
-        "TORRENTING_PORT": "${port:6881}"
+        "TZ": "Etc/UTC"
       },
-      "volumes": [
-        "${dir:config}:/config",
-        "/services/media/downloads:/downloads"
+      "ports": [
+        "8080"
       ],
-      "network": "host"
+      "volumes": [
+        "/services/qbittorrent/config:/config",
+        "/services/media/downloads:/downloads"
+      ]
     },
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/mesh/qbittorrent/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -96,46 +77,22 @@
       "volumes": [
         "/var/lib/mesh/qbittorrent/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/qbittorrent/password:/run/secrets/password:ro",
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${dir:config}:/var/lib/qbittorrent/config:ro"
+        "/var/lib/mesh/qbittorrent/config.json:/run/config/config.json:ro",
+        "/services/qbittorrent/config:/var/lib/qbittorrent/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_QBITTORRENT_URL": "http://127.0.0.1:${port:8112}",
+        "MESH_QBITTORRENT_URL": "http://127.0.0.1:8080",
         "MESH_QBITTORRENT_PASSWORD_FILE": "/run/secrets/password",
         "MESH_QBITTORRENT_CONFIG_FILE": "/run/config/config.json",
         "MESH_QBITTORRENT_CONFIG_DIR": "/var/lib/qbittorrent/config"
       },
       "restart-on": [
-        "runtime-config",
-        "needs-password"
+        "runtime-config"
       ],
       "artifact": "runtime"
     }
   ],
-  "provides": [
-    "qbittorrent-api"
-  ],
-  "serves": {
-    "qbittorrent-api": {
-      "scheme": "http",
-      "port": 8112,
-      "url-base": "",
-      "username": "admin"
-    }
-  },
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "qbittorrent",
-      "endpoint": "web"
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
   "build": {
     "on": [
       {

modules/radarr/module.json

@@ -75,7 +75,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RADARR_URL": "http://127.0.0.1:${port:7878}",
+        "MESH_RADARR_URL": "http://127.0.0.1:7878",
         "MESH_RADARR_CONFIG_DIR": "/var/lib/radarr/config"
       },
       "artifact": "runtime"

modules/searxng/module.json

@@ -100,7 +100,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_SEARXNG_URL": "http://127.0.0.1:${port:8080}",
+        "MESH_SEARXNG_URL": "http://127.0.0.1:8080",
         "MESH_SEARXNG_CONFIG_FILE": "/run/config/config.json"
       },
       "restart-on": [

modules/sonarr/module.json

@@ -80,7 +80,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_SONARR_URL": "http://127.0.0.1:${port:8989}",
+        "MESH_SONARR_URL": "http://127.0.0.1:8989",
         "MESH_SONARR_CONFIG_DIR": "/var/lib/sonarr/config"
       },
       "artifact": "runtime"