sonarr: reach nzbget, qbittorrent and jackett through the mesh

sonarr reached its download clients as nzbget:6789 and qbittorrent:8112 and its indexers through jackett:9117 or indexers.zurag.be - HAL container names and a public route, typed into its database by hand. Nothing on the mesh answers those names. It now requires nzbget-api, qbittorrent-api and jackett-api. A run-once step (downloads/, declared last, restart-on its bindings, credentials and settings) writes host, port, TLS, base path, user and credential into sonarr through sonarr's own API: - A download client is the mesh's when its name is downloads.<provision>.name and its kind the provider's; it is registered when missing. A jackett feed is the mesh's when its host is the bound one, one the step bound before, or one in downloads.jackett-api.adopt-hosts; the jackett indexers in downloads.jackett-api.indexers are registered when missing. Every other entry is left alone, and nothing is ever deleted. - Only connection fields, only when they differ. The stored password is masked, so the app tests the entry with the credential it holds; only if that fails is the delivered one written. Categories, priorities and "enabled" are never touched. - Each credential is tried against its provider first. A minted value (nothing accepted yet) is never written; the step exits 1 naming the exact secret accept. The step is byte-identical in sonarr, radarr, lidarr and bookshelf (the same Servarr API, v3 or v1): each module builds from its own directory, so each carries a copy, and test/downloads.test.ts fails if a sibling's copy differs. Verified: strict typecheck, the Dockerfile build, 14 unit tests; and the compiled step against fresh pinned sonarr/radarr/lidarr/bookshelf with throwaway nzbget, qBittorrent and jackett - minted credentials refused with nothing written, accepted ones registered and tested by the app, a migration-shaped radarr repointed, reruns unchanged.
sonarr: its config dir is placed, its image is the one ace runs
2026-09-30 13:07:10 +02:00 · 2026-09-30 11:53:43 +02:00
11 changed files with 94 additions and 94 deletions
@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/radarr
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts downloads/settings.ts downloads/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist

 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/radarr/dist /app/modules/radarr/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/radarr/dist/index.js,/app/modules/radarr/dist/tools/index.js
-# NOT dist/downloads/index.js: that is a step the host runs to completion, named by the `downloads`
-# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
-# serving sidecar too, and exit it.
@@ -31,7 +31,7 @@
      "port": 7878,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "managing films: its web UI, and the API other modules reach as radarr-api"
+      "why": "managing films"
    }
  ],
  "accesses": [
@@ -51,15 +51,10 @@
      "path": "/var/lib/mesh/radarr",
      "mode": "0700"
    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
    {
      "id": "config",
      "type": "directory",
+      "path": "/services/radarr/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -67,7 +62,7 @@
      "id": "server",
      "type": "container",
      "name": "radarr",
-      "image": "lscr.io/linuxserver/radarr@sha256:c960f2b52ec6542dbe6707c5a21e696a7c74fd8b17997454f4d10a55dacee133",
+      "image": "lscr.io/linuxserver/radarr@sha256:119aaa4a4f7349bcd2a136c5373a0d7925b5479915c7dfe0c0ad352db2a6d438",
      "env": {
        "PUID": "1000",
        "PGID": "1000",
@@ -77,7 +72,7 @@
        "7878"
      ],
      "volumes": [
-        "${dir:config}:/config",
+        "/services/radarr/config:/config",
        "/services/media/movies:/movies",
        "/services/media/downloads:/downloads"
      ]
@@ -89,7 +84,7 @@
      "network": "host",
      "volumes": [
        "/var/lib/mesh/radarr/broker:/run/secrets/broker:ro",
-        "${dir:config}:/var/lib/radarr/config:ro"
+        "/services/radarr/config:/var/lib/radarr/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -97,66 +92,9 @@
        "MESH_RADARR_CONFIG_DIR": "/var/lib/radarr/config"
      },
      "artifact": "runtime"
-    },
-    {
-      "id": "downloads-config",
-      "type": "file",
-      "path": "${dir:state}/downloads.json",
-      "mode": "0600",
-      "content": "{\n  \"node\": \"${machine:name}\",\n  \"downloads\": {\n    \"nzbget-api\": {\n      \"name\": \"nzbget\"\n    },\n    \"qbittorrent-api\": {\n      \"name\": \"qbittorrent\"\n    },\n    \"jackett-api\": {\n      \"adopt-hosts\": [],\n      \"indexers\": []\n    }\n  }\n}\n",
-      "merge": "json"
-    },
-    {
-      "id": "downloads-memory",
-      "type": "directory",
-      "mode": "0700"
-    },
-    {
-      "id": "downloads",
-      "type": "container",
-      "name": "mesh-radarr-downloads",
-      "network": "host",
-      "run-once": true,
-      "volumes": [
-        "${dir:state}/downloads.json:/run/downloads/downloads.json:ro",
-        "${dir:state}/nzbget-api.json:/run/downloads/nzbget-api.json:ro",
-        "${dir:state}/nzbget-api.secret:/run/downloads/nzbget-api.secret:ro",
-        "${dir:state}/qbittorrent-api.json:/run/downloads/qbittorrent-api.json:ro",
-        "${dir:state}/qbittorrent-api.secret:/run/downloads/qbittorrent-api.secret:ro",
-        "${dir:state}/jackett-api.json:/run/downloads/jackett-api.json:ro",
-        "${dir:state}/jackett-api.secret:/run/downloads/jackett-api.secret:ro",
-        "${dir:config}:/var/lib/radarr/config:ro",
-        "${dir:downloads-memory}:/var/lib/downloads"
-      ],
-      "env": {
-        "MESH_DOWNLOADS_APP": "radarr",
-        "MESH_DOWNLOADS_API": "v3",
-        "MESH_DOWNLOADS_APP_URL": "http://127.0.0.1:${port:7878}",
-        "MESH_DOWNLOADS_APP_CONFIG": "/var/lib/radarr/config/config.xml",
-        "MESH_DOWNLOADS_DIR": "/run/downloads",
-        "MESH_DOWNLOADS_SETTINGS": "/run/downloads/downloads.json",
-        "MESH_DOWNLOADS_MEMORY": "/var/lib/downloads/memory.json"
-      },
-      "args": [
-        "run",
-        "/app/modules/radarr/dist/downloads/index.js"
-      ],
-      "restart-on": [
-        "downloads-config",
-        "bound-nzbget-api",
-        "secret-nzbget-api",
-        "bound-qbittorrent-api",
-        "secret-qbittorrent-api",
-        "bound-jackett-api",
-        "secret-jackett-api"
-      ],
-      "artifact": "runtime"
    }
  ],
  "requires": [
-    "jackett-api",
-    "nzbget-api",
-    "qbittorrent-api",
    "route"
  ],
  "contributes": {
@@ -166,15 +104,7 @@
    }
  },
  "binds": {
-    "route": "${dir:state}/route.json",
-    "nzbget-api": "${dir:state}/nzbget-api.json",
-    "qbittorrent-api": "${dir:state}/qbittorrent-api.json",
-    "jackett-api": "${dir:state}/jackett-api.json"
-  },
-  "secrets": {
-    "nzbget-api": "${dir:state}/nzbget-api.secret",
-    "qbittorrent-api": "${dir:state}/qbittorrent-api.secret",
-    "jackett-api": "${dir:state}/jackett-api.secret"
+    "route": "/var/lib/mesh/radarr/route.json"
  },
  "build": {
    "on": [
@@ -4,11 +4,6 @@
  "description": "radarr — movie management. Its API client, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
-  "scripts": {
-    "build": "tsc client.ts index.ts tools/index.ts downloads/settings.ts downloads/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
-  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.0"
  },
@@ -8,5 +8,5 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "index.ts", "tools/index.ts", "downloads/settings.ts", "downloads/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }
@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/sonarr
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts downloads/settings.ts downloads/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist

 FROM ${RUNTIME_BASE}
@@ -22,3 +22,6 @@ COPY --from=build /app/modules/sonarr/dist /app/modules/sonarr/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/sonarr/dist/index.js,/app/modules/sonarr/dist/tools/index.js
+# NOT dist/downloads/index.js: that is a step the host runs to completion, named by the `downloads`
+# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
+# serving sidecar too, and exit it.
@@ -31,7 +31,7 @@
      "port": 8989,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "managing series"
+      "why": "managing series: its web UI, and the API other modules reach as sonarr-api"
    }
  ],
  "accesses": [
@@ -55,10 +55,15 @@
      "path": "/var/lib/mesh/sonarr",
      "mode": "0700"
    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
    {
      "id": "config",
      "type": "directory",
-      "path": "/services/sonarr/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -66,7 +71,7 @@
      "id": "server",
      "type": "container",
      "name": "sonarr",
-      "image": "lscr.io/linuxserver/sonarr@sha256:c19aa4ecdf03d73e1d5c901da33744cb7eb4d921f89bafed1ca264601d7fa224",
+      "image": "lscr.io/linuxserver/sonarr@sha256:a5c1a5fecbef946927ab90ad68df319ac5fe644057e5fc18cd993f01ac07b2b2",
      "env": {
        "PUID": "1000",
        "PGID": "1000",
@@ -76,7 +81,7 @@
        "8989"
      ],
      "volumes": [
-        "/services/sonarr/config:/config",
+        "${dir:config}:/config",
        "/services/media/series:/series",
        "/services/media/anime:/anime",
        "/services/media/downloads:/downloads"
@@ -89,7 +94,7 @@
      "network": "host",
      "volumes": [
        "/var/lib/mesh/sonarr/broker:/run/secrets/broker:ro",
-        "/services/sonarr/config:/var/lib/sonarr/config:ro"
+        "${dir:config}:/var/lib/sonarr/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -97,9 +102,66 @@
        "MESH_SONARR_CONFIG_DIR": "/var/lib/sonarr/config"
      },
      "artifact": "runtime"
+    },
+    {
+      "id": "downloads-config",
+      "type": "file",
+      "path": "${dir:state}/downloads.json",
+      "mode": "0600",
+      "content": "{\n  \"node\": \"${machine:name}\",\n  \"downloads\": {\n    \"nzbget-api\": {\n      \"name\": \"nzbget\"\n    },\n    \"qbittorrent-api\": {\n      \"name\": \"qbittorrent\"\n    },\n    \"jackett-api\": {\n      \"adopt-hosts\": [],\n      \"indexers\": []\n    }\n  }\n}\n",
+      "merge": "json"
+    },
+    {
+      "id": "downloads-memory",
+      "type": "directory",
+      "mode": "0700"
+    },
+    {
+      "id": "downloads",
+      "type": "container",
+      "name": "mesh-sonarr-downloads",
+      "network": "host",
+      "run-once": true,
+      "volumes": [
+        "${dir:state}/downloads.json:/run/downloads/downloads.json:ro",
+        "${dir:state}/nzbget-api.json:/run/downloads/nzbget-api.json:ro",
+        "${dir:state}/nzbget-api.secret:/run/downloads/nzbget-api.secret:ro",
+        "${dir:state}/qbittorrent-api.json:/run/downloads/qbittorrent-api.json:ro",
+        "${dir:state}/qbittorrent-api.secret:/run/downloads/qbittorrent-api.secret:ro",
+        "${dir:state}/jackett-api.json:/run/downloads/jackett-api.json:ro",
+        "${dir:state}/jackett-api.secret:/run/downloads/jackett-api.secret:ro",
+        "${dir:config}:/var/lib/sonarr/config:ro",
+        "${dir:downloads-memory}:/var/lib/downloads"
+      ],
+      "env": {
+        "MESH_DOWNLOADS_APP": "sonarr",
+        "MESH_DOWNLOADS_API": "v3",
+        "MESH_DOWNLOADS_APP_URL": "http://127.0.0.1:${port:8989}",
+        "MESH_DOWNLOADS_APP_CONFIG": "/var/lib/sonarr/config/config.xml",
+        "MESH_DOWNLOADS_DIR": "/run/downloads",
+        "MESH_DOWNLOADS_SETTINGS": "/run/downloads/downloads.json",
+        "MESH_DOWNLOADS_MEMORY": "/var/lib/downloads/memory.json"
+      },
+      "args": [
+        "run",
+        "/app/modules/sonarr/dist/downloads/index.js"
+      ],
+      "restart-on": [
+        "downloads-config",
+        "bound-nzbget-api",
+        "secret-nzbget-api",
+        "bound-qbittorrent-api",
+        "secret-qbittorrent-api",
+        "bound-jackett-api",
+        "secret-jackett-api"
+      ],
+      "artifact": "runtime"
    }
  ],
  "requires": [
+    "jackett-api",
+    "nzbget-api",
+    "qbittorrent-api",
    "route"
  ],
  "contributes": {
@@ -109,7 +171,15 @@
    }
  },
  "binds": {
-    "route": "/var/lib/mesh/sonarr/route.json"
+    "route": "${dir:state}/route.json",
+    "nzbget-api": "${dir:state}/nzbget-api.json",
+    "qbittorrent-api": "${dir:state}/qbittorrent-api.json",
+    "jackett-api": "${dir:state}/jackett-api.json"
+  },
+  "secrets": {
+    "nzbget-api": "${dir:state}/nzbget-api.secret",
+    "qbittorrent-api": "${dir:state}/qbittorrent-api.secret",
+    "jackett-api": "${dir:state}/jackett-api.secret"
  },
  "build": {
    "on": [
@@ -4,6 +4,11 @@
  "description": "sonarr — TV series management. Its API client, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
+  "scripts": {
+    "build": "tsc client.ts index.ts tools/index.ts downloads/settings.ts downloads/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
+  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.0"
  },
@@ -8,5 +8,5 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "index.ts", "tools/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts", "downloads/settings.ts", "downloads/index.ts"]
 }