nodered: its MQTT broker comes from the mesh

Node-RED's one broker node pointed at zurag.be:1884, where nothing listens. nodered now requires
mqtt-topic (asking for every topic: flows follow the devices' own) and a run-once `mqtt` step —
declared last, restarted when the binding, credential or settings change — points the mesh's broker
nodes at the bound broker through Node-RED's admin API with the module's api-token: the node the
step makes itself when none is named, or the ones an assignment names in `mqtt.brokers`. Only host,
port, TLS and the login change; the broker is asked first whether it takes the login; the deploy is
against the revision read ("nodes", so only that node restarts) and a digest makes a rerun a no-op.
A broker node nobody named is never touched. settings.js keeps `mqtt` and `topics` out of Node-RED.

modules/bazarr/module.json

@@ -94,7 +94,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BAZARR_URL": "http://127.0.0.1:${port:6767}",
+        "MESH_BAZARR_URL": "http://127.0.0.1:6767",
         "MESH_BAZARR_API_KEY_FILE": "/run/secrets/api-key",
         "MESH_BAZARR_CONFIG_FILE": "/run/config/config.json",
         "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config"

modules/bookshelf/module.json

@@ -76,7 +76,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BOOKSHELF_URL": "http://127.0.0.1:${port:8787}",
+        "MESH_BOOKSHELF_URL": "http://127.0.0.1:8787",
         "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config"
       },
       "artifact": "runtime"

modules/lidarr/module.json

@@ -1,19 +1,6 @@
 {
   "module": "lidarr",
   "version": "1",
-  "provides": [
-    {
-      "name": "lidarr-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "lidarr-api": {
-      "scheme": "http",
-      "port": 8686,
-      "url-base": ""
-    }
-  },
   "capabilities": [
     "container-runtime"
   ],
@@ -88,7 +75,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_LIDARR_URL": "http://127.0.0.1:${port:8686}",
+        "MESH_LIDARR_URL": "http://127.0.0.1:8686",
         "MESH_LIDARR_CONFIG_DIR": "/var/lib/lidarr/config"
       },
       "artifact": "runtime"

modules/nodered/Dockerfile

@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/nodered
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts mqtt/probe.ts mqtt/connection.ts mqtt/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}
@@ -22,3 +22,6 @@ COPY --from=build /app/modules/nodered/dist /app/modules/nodered/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/nodered/dist/tools/index.js
+# NOT dist/mqtt/index.js: that is a step the host runs to completion, named by the `mqtt`
+# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
+# serving sidecar too, and exit it.

modules/nodered/client.ts

@@ -3,7 +3,8 @@
 //
 // Node-RED exposes a runtime admin API under its base URL: GET/POST /flows for the whole flow
 // configuration, GET /nodes for installed node modules. A default install has no auth; when
-// adminAuth is on, a bearer token (minted at /auth/token) is required.
+// adminAuth is on, a bearer token is required — the module's settings accept the mesh-minted
+// api-token, which the runtime config file carries as `token`.
 
 import { readFileSync } from "node:fs";
 
@@ -81,6 +82,35 @@ export class NodeRedClient {
     return modules.map((m) => ({ name: m.name, version: m.version, types: m.types ?? [] }));
   }
 
+  /** The whole flow configuration with its revision (API v2), for a deploy that must not clobber
+   *  a change made meanwhile. */
+  async flowsWithRev(): Promise<{ rev: string; flows: any[] }> {
+    const body = await this.req("/flows", { headers: this.headers({ "Node-RED-API-Version": "v2" }) });
+    return { rev: String(body?.rev ?? ""), flows: Array.isArray(body?.flows) ? body.flows : [] };
+  }
+
+  /** A node's stored credentials as Node-RED shows them: plain fields, and `has_<field>` for secret ones. */
+  async credentials(type: string, id: string): Promise<{ user?: string; has_password?: boolean }> {
+    return (await this.req(`/credentials/${encodeURIComponent(type)}/${encodeURIComponent(id)}`, { headers: this.headers() })) ?? {};
+  }
+
+  /**
+   * Deploy the flow configuration read at `rev`. Node-RED answers 409 when the flows changed since,
+   * rather than overwriting what someone deployed in between. A node carrying `credentials` has them
+   * stored (encrypted) and counts as changed, so a "nodes" deploy restarts it and nothing else.
+   */
+  async deployFlowsAt(rev: string, config: any[], type = "nodes"): Promise<void> {
+    await this.req("/flows", {
+      method: "POST",
+      headers: this.headers({
+        "Content-Type": "application/json",
+        "Node-RED-API-Version": "v2",
+        "Node-RED-Deployment-Type": type,
+      }),
+      body: JSON.stringify({ rev, flows: config }),
+    });
+  }
+
   /**
    * Replace the whole flow configuration and deploy. Returns the new revision. `type` maps to
    * Node-RED's deployment types — "full" (default), "nodes", or "flows".
@@ -88,8 +118,13 @@ export class NodeRedClient {
   async deployFlows(config: any[], type = "full"): Promise<{ rev?: string; nodeCount: number }> {
     const body = await this.req("/flows", {
       method: "POST",
-      headers: this.headers({ "Content-Type": "application/json", "Node-RED-Deployment-Type": type }),
+      // v2 answers { rev }; v1 answers 204 with no body, which req() cannot parse.
-      body: JSON.stringify(config),
+      headers: this.headers({
+        "Content-Type": "application/json",
+        "Node-RED-API-Version": "v2",
+        "Node-RED-Deployment-Type": type,
+      }),
+      body: JSON.stringify({ flows: config }),
     });
     return { rev: body?.rev, nodeCount: config.length };
   }

modules/nodered/module.json

@@ -5,6 +5,8 @@
     "flows.deployed"
   ],
   "own-secrets": {
+    "admin": "/var/lib/mesh/nodered/admin",
+    "api-token": "/var/lib/mesh/nodered/api-token",
     "broker": "/var/lib/mesh/nodered/broker"
   },
   "capabilities": [
@@ -26,26 +28,63 @@
       "path": "/var/lib/mesh/nodered",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "data",
       "type": "directory",
-      "path": "/services/nodered/data",
       "mode": "0700",
       "owner": "1000:1000"
     },
+    {
+      "id": "written",
+      "type": "directory",
+      "mode": "0700"
+    },
+    {
+      "id": "settings-code",
+      "type": "file",
+      "path": "${dir:state}/settings.js",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "content": "// Node-RED's settings, written by the mesh from the nodered module. What an assignment may change\n// is settings.json beside this file (merged key by key); the credentials are the mesh's secrets and\n// reach Node-RED only through this file. The flows' own credentials stay encrypted in the user\n// directory under the key Node-RED keeps there (.config.runtime.json), which is data, not this.\nconst fs = require(\"fs\");\nconst path = require(\"path\");\nconst crypto = require(\"crypto\");\n\nconst ADMIN_PASSWORD = \"${secret:admin}\";\nconst API_TOKEN = \"${secret:api-token}\";\nconst ADMIN = { username: \"admin\", permissions: \"*\" };\n\nconst settings = JSON.parse(fs.readFileSync(path.join(__dirname, \"settings.json\"), \"utf8\"));\n// The mesh's keys, not Node-RED's: endpoints lands in every merged file; timeZone is the\n// assignment's way to set the zone flows schedule and format in; mqtt names the broker nodes the\n// module's MQTT step keeps pointed at the mesh's broker; topics is what nodered asks the broker for.\nif (settings.timeZone) process.env.TZ = settings.timeZone;\ndelete settings.timeZone;\ndelete settings.endpoints;\ndelete settings.mqtt;\ndelete settings.topics;\n\nfunction same(a, b) {\n  const x = crypto.createHash(\"sha256\").update(String(a)).digest();\n  const y = crypto.createHash(\"sha256\").update(String(b)).digest();\n  return crypto.timingSafeEqual(x, y);\n}\n\n// The admin secret is a password, or, accepted from an existing install, the bcrypt hash its\n// settings held, so the password people already use keeps working.\nfunction passwordMatches(given) {\n  if (/^\\$2[aby]\\$\\d\\d\\$/.test(ADMIN_PASSWORD)) return require(\"bcryptjs\").compare(String(given), ADMIN_PASSWORD);\n  return Promise.resolve(same(given, ADMIN_PASSWORD));\n}\n\nmodule.exports = Object.assign(settings, {\n  uiPort: 1880,\n  adminAuth: {\n    type: \"credentials\",\n    users: (username) => Promise.resolve(username === ADMIN.username ? ADMIN : null),\n    authenticate: (username, password) =>\n      username === ADMIN.username\n        ? passwordMatches(password).then((ok) => (ok ? ADMIN : null))\n        : Promise.resolve(null),\n    // The module's own tools call the admin API with this bearer token.\n    tokens: (token) => Promise.resolve(same(token, API_TOKEN) ? { username: \"mesh\", permissions: \"*\" } : null),\n  },\n});\n"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "merge": "json",
+      "content": "{\n  \"flowFile\": \"flows.json\",\n  \"flowFilePretty\": true,\n  \"diagnostics\": { \"enabled\": true, \"ui\": true },\n  \"runtimeState\": { \"enabled\": false, \"ui\": false },\n  \"logging\": { \"console\": { \"level\": \"info\", \"metrics\": false, \"audit\": false } },\n  \"exportGlobalContextKeys\": false,\n  \"externalModules\": {},\n  \"editorTheme\": { \"projects\": { \"enabled\": false } },\n  \"functionExternalModules\": true,\n  \"debugMaxLength\": 1000,\n  \"mqttReconnectTime\": 15000,\n  \"serialReconnectTime\": 15000\n}\n"
+    },
     {
       "id": "server",
       "type": "container",
       "name": "nodered",
-      "image": "nodered/node-red@sha256:02a2b92a41b73d2bc388238b86e4fcaab7fb5466373adb24e1df6aa5845265ff",
+      "image": "nodered/node-red@sha256:a649dd711d55490151a2c39a8e48ad0c44325488fbc0e66315f2d2e19e5e1ace",
       "env": {
         "TZ": "Etc/UTC"
       },
       "ports": [
         "1880"
       ],
+      "args": [
+        "--settings",
+        "/config/settings.js"
+      ],
       "volumes": [
-        "/services/nodered/data:/data"
+        "${dir:data}:/data",
+        "${dir:state}/settings.js:/config/settings.js:ro",
+        "${dir:state}/settings.json:/config/settings.json:ro"
+      ],
+      "restart-on": [
+        "settings-code",
+        "settings"
       ]
     },
     {
@@ -53,8 +92,7 @@
       "type": "file",
       "path": "/var/lib/mesh/nodered/config.json",
       "mode": "0600",
-      "content": "{}\n",
+      "content": "{\n  \"token\": \"${secret:api-token}\"\n}\n"
-      "merge": "json"
     },
     {
       "id": "runtime",
@@ -67,26 +105,66 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NODERED_URL": "http://127.0.0.1:1880",
+        "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
         "MESH_NODERED_CONFIG_FILE": "/run/config/config.json"
       },
       "restart-on": [
         "runtime-config"
       ],
       "artifact": "runtime"
+    },
+    {
+      "id": "mqtt",
+      "type": "container",
+      "name": "mesh-nodered-mqtt",
+      "network": "host",
+      "run-once": true,
+      "volumes": [
+        "/var/lib/mesh/nodered/config.json:/run/config/config.json:ro",
+        "${dir:written}:/var/lib/nodered-provisions",
+        "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
+        "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",
+        "${dir:state}/settings.json:/run/provisions/settings.json:ro"
+      ],
+      "env": {
+        "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
+        "MESH_NODERED_CONFIG_FILE": "/run/config/config.json",
+        "MESH_PROVISIONS_DIR": "/run/provisions",
+        "MESH_WRITTEN_DIR": "/var/lib/nodered-provisions"
+      },
+      "args": [
+        "run",
+        "/app/modules/nodered/dist/mqtt/index.js"
+      ],
+      "restart-on": [
+        "bound-mqtt-topic",
+        "secret-mqtt-topic",
+        "settings"
+      ],
+      "artifact": "runtime"
     }
   ],
   "requires": [
+    "mqtt-topic",
     "route"
   ],
   "contributes": {
+    "mqtt-topic": {
+      "topics": [
+        "#"
+      ]
+    },
     "route": {
       "label": "nodered",
       "endpoint": "web"
     }
   },
   "binds": {
-    "route": "/var/lib/mesh/nodered/route.json"
+    "route": "${dir:state}/route.json",
+    "mqtt-topic": "${dir:state}/mqtt-topic.json"
+  },
+  "secrets": {
+    "mqtt-topic": "${dir:state}/mqtt-topic.secret"
   },
   "build": {
     "on": [

modules/nodered/mqtt/connection.ts

@@ -0,0 +1,232 @@
+// Node-RED's MQTT broker config node, pointed at the broker the mesh bound — `mqtt-topic`.
+//
+// **Why a step.** Node-RED keeps a broker as a config node in its flows (`flows.json`) and the login
+// and password in its encrypted credentials file, both of them Node-RED's to write. So this reads the
+// binding and the pair credential and makes the broker node say the same thing through Node-RED's
+// admin API — `GET /flows`, then `POST /flows` with the changed node and its `credentials`, deployed
+// as "nodes" so only what changed restarts — with the module's own `api-token`.
+//
+// **Which broker nodes are the mesh's.** Never guessed: a flow may talk to a broker that has nothing
+// to do with this mesh. The step owns the node it creates itself (id `mesh-mqtt-topic`, "mesh:
+// mqtt-topic") and the ones an assignment names in settings (`mqtt.brokers`: node ids — how ace's
+// existing broker node, which every one of its MQTT flows uses, is handed over). With none named and
+// none made yet, it makes one, so a fresh Node-RED has a broker the flows can pick.
+//
+// **Only the connection, and only when it differs.** Host, port, TLS off (the broker serves plain
+// MQTT), login, password. Every other field of the node — client id, keepalive, birth/close/will
+// messages — is left as it is. Node-RED never hands a stored password back, so the step keeps a
+// digest of what it last wrote: equal host/port/login and an equal digest is "already as the mesh
+// says".
+//
+// **Nothing loses its connection without someone seeing it.** The broker is asked first whether it
+// takes the delivered login; if not, nothing is written and the step fails saying why.
+//
+// Pure logic over two seams (Node-RED, the broker), tested against fakes (test/mqtt.test.ts).
+
+import { createHash } from "node:crypto";
+
+import type { Probe } from "./probe.js";
+
+export const PROVISION = "mqtt-topic";
+/** The id and name of the broker node the step makes when none is named. */
+export const MESH_BROKER_ID = "mesh-mqtt-topic";
+export const MESH_BROKER_NAME = "mesh: mqtt-topic";
+
+/** What the mesh wrote at `binds.mqtt-topic`. */
+export interface Binding {
+  provision?: string;
+  from?: string;
+  at?: string;
+  as?: string;
+  serves?: Record<string, unknown>;
+}
+
+export type Outcome =
+  | { what: string; result: "unchanged"; note?: string }
+  | { what: string; result: "written"; fields: string[]; note?: string }
+  | { what: string; result: "refused"; problem: string };
+
+/** A flow node; a broker config node carries `broker`, `port`, `usetls`. */
+export interface FlowNode {
+  id: string;
+  type: string;
+  [key: string]: unknown;
+}
+
+/** Node-RED's admin API, as the step uses it. */
+export interface NodeRed {
+  /** The whole flow configuration and its revision (API v2). */
+  flows(): Promise<{ rev: string; flows: FlowNode[] }>;
+  /** A node's stored credentials as Node-RED shows them: the user, and only whether a password is set. */
+  credentials(type: string, id: string): Promise<{ user?: string; has_password?: boolean }>;
+  /** Deploy the configuration against the revision it was read at; "nodes" restarts only what changed. */
+  deploy(rev: string, flows: FlowNode[]): Promise<void>;
+}
+
+export interface Marks {
+  get(name: string): Promise<string | undefined>;
+  set(name: string, digest: string): Promise<void>;
+}
+
+export interface Deps {
+  nodered: NodeRed;
+  probe: Probe;
+  marks: Marks;
+}
+
+export interface Wanted {
+  host: string;
+  port: number;
+  user: string;
+  password: string;
+}
+
+export function digest(...parts: (string | number)[]): string {
+  return createHash("sha256").update(parts.map(String).join("\u0000")).digest("hex");
+}
+
+function isLoopback(host: string): boolean {
+  const h = host.toLowerCase();
+  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
+}
+
+/**
+ * The broker and login the mesh says Node-RED uses. A loopback `at` — what the mesh hands a machine
+ * that is not on the private network — is refused: from Node-RED's own container it is Node-RED.
+ */
+export function wanted(binding: Binding | undefined, credential: string | undefined): { ok: true; want: Wanted } | { ok: false; problem: string } {
+  if (!binding) return { ok: false, problem: `no binding for ${PROVISION} was delivered — the mesh writes it before this step runs` };
+  const host = typeof binding.at === "string" ? binding.at.trim() : "";
+  if (!host) return { ok: false, problem: `the ${PROVISION} binding names no host (at)` };
+  if (isLoopback(host)) {
+    return {
+      ok: false,
+      problem:
+        `the ${PROVISION} binding says the broker is at ${host}, which from Node-RED's own container is Node-RED ` +
+        `itself; put the machine on the private network so the broker has an address Node-RED can dial`,
+    };
+  }
+  const port = Number(binding.serves?.port);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    return { ok: false, problem: `the ${PROVISION} binding serves no usable port (${String(binding.serves?.port)})` };
+  }
+  const scheme = binding.serves?.scheme;
+  if (scheme !== undefined && scheme !== "mqtt") return { ok: false, problem: `the ${PROVISION} binding serves scheme ${String(scheme)}; this step writes plain MQTT` };
+  const user = typeof binding.as === "string" ? binding.as.trim() : "";
+  if (!user) return { ok: false, problem: `the ${PROVISION} binding names no login (as)` };
+  const password = (credential ?? "").replace(/\n$/, "");
+  if (!password) return { ok: false, problem: `the ${PROVISION} credential is empty or was not delivered` };
+  return { ok: true, want: { host, port, user, password } };
+}
+
+/** The broker node ids an assignment named in settings (`mqtt.brokers`), or none. */
+export function namedBrokers(settings: unknown): string[] {
+  const brokers = (settings as { mqtt?: { brokers?: unknown } } | undefined)?.mqtt?.brokers;
+  return Array.isArray(brokers) ? brokers.filter((b): b is string => typeof b === "string" && b.length > 0) : [];
+}
+
+/** A new broker node, Node-RED 5's defaults, pointed at the broker. */
+export function newBrokerNode(want: Wanted): FlowNode {
+  return {
+    id: MESH_BROKER_ID, type: "mqtt-broker", name: MESH_BROKER_NAME,
+    broker: want.host, port: String(want.port), clientid: "", autoConnect: true, usetls: false,
+    protocolVersion: "4", keepalive: "60", cleansession: true, autoUnsubscribe: true,
+    birthTopic: "", birthQos: "0", birthRetain: "false", birthPayload: "", birthMsg: {},
+    closeTopic: "", closeQos: "0", closeRetain: "false", closePayload: "", closeMsg: {},
+    willTopic: "", willQos: "0", willRetain: "false", willPayload: "", willMsg: {},
+    userProps: "", sessionExpiry: "",
+  };
+}
+
+const markFor = (id: string, w: Wanted): string => digest("nodered-mqtt", id, w.host, w.port, w.user, w.password);
+
+function scrub(err: unknown, secret: string): string {
+  let text = err instanceof Error ? err.message : String(err);
+  for (const form of new Set([secret, encodeURIComponent(secret)])) text = text.split(form).join("***");
+  return text;
+}
+
+/**
+ * Bring the mesh's broker nodes in line with the binding: one outcome per node. Never throws. A node
+ * the settings name that is not in the flows is refused (the others are still put right).
+ */
+export async function reconcileBrokers(deps: Deps, binding: Binding | undefined, credential: string | undefined, named: readonly string[]): Promise<Outcome[]> {
+  const w = wanted(binding, credential);
+  if ("problem" in w) return [{ what: "mqtt", result: "refused", problem: w.problem }];
+  const want = w.want;
+
+  let note: string | undefined;
+  try {
+    const probe = await deps.probe(want.host, want.port, want.user, want.password, "#");
+    if (probe.connack === 4 || probe.connack === 5) {
+      return [{
+        what: "mqtt",
+        result: "refused",
+        problem:
+          `the broker at ${want.host}:${want.port} does not (yet) take the login ${want.user} with the delivered password ` +
+          `(CONNACK ${probe.connack}); mosquitto's provisioner creates it from the grant — nothing was written`,
+      }];
+    }
+    if (probe.connack !== 0) return [{ what: "mqtt", result: "refused", problem: `the broker at ${want.host}:${want.port} answered CONNACK ${probe.connack}; nothing was written` }];
+    if (probe.suback === 0x80) note = `warning: ${want.user} may not subscribe to every topic; flows subscribing outside its grant will get nothing`;
+  } catch (err) {
+    return [{ what: "mqtt", result: "refused", problem: `the broker at ${want.host}:${want.port} could not be asked: ${scrub(err, want.password)}; nothing was written` }];
+  }
+
+  const outcomes: Outcome[] = [];
+  for (let attempt = 0; attempt < 2; attempt++) {
+    outcomes.length = 0;
+    try {
+      const { rev, flows } = await deps.nodered.flows();
+      const targets = named.length > 0 ? [...named] : [MESH_BROKER_ID];
+      const changed: { id: string; fields: string[] }[] = [];
+      for (const id of targets) {
+        let node = flows.find((n) => n.id === id);
+        if (node && node.type !== "mqtt-broker") {
+          outcomes.push({ what: `broker ${id}`, result: "refused", problem: `node ${id} is a ${node.type}, not an mqtt-broker` });
+          continue;
+        }
+        if (!node) {
+          if (id !== MESH_BROKER_ID) {
+            outcomes.push({ what: `broker ${id}`, result: "refused", problem: `the settings name broker node ${id}, and Node-RED's flows have no such node` });
+            continue;
+          }
+          node = newBrokerNode(want);
+          flows.push(node);
+          node.credentials = { user: want.user, password: want.password };
+          changed.push({ id, fields: ["node"] });
+          continue;
+        }
+        const fields: string[] = [];
+        if (String(node.broker ?? "") !== want.host) fields.push("broker");
+        if (Number(node.port ?? 0) !== want.port) fields.push("port");
+        if (node.usetls === true) fields.push("usetls");
+        const creds = await deps.nodered.credentials("mqtt-broker", id);
+        if ((creds.user ?? "") !== want.user) fields.push("user");
+        if (!creds.has_password || (await deps.marks.get(`broker-${id}`)) !== markFor(id, want)) fields.push("password");
+        if (fields.length === 0) {
+          outcomes.push(note ? { what: `broker ${id}`, result: "unchanged", note } : { what: `broker ${id}`, result: "unchanged" });
+          continue;
+        }
+        node.broker = want.host;
+        node.port = String(want.port);
+        node.usetls = false;
+        node.credentials = { user: want.user, password: want.password };
+        changed.push({ id, fields });
+      }
+      if (changed.length > 0) {
+        await deps.nodered.deploy(rev, flows);
+        for (const c of changed) {
+          await deps.marks.set(`broker-${c.id}`, markFor(c.id, want));
+          outcomes.push({ what: `broker ${c.id}`, result: "written", fields: c.fields, ...(note ? { note } : {}) });
+        }
+      }
+      return outcomes;
+    } catch (err) {
+      // A deploy against a revision someone else changed meanwhile (409) is read again once.
+      if (attempt === 0 && /\b409\b/.test(String(err))) continue;
+      return [...outcomes, { what: "mqtt", result: "refused", problem: scrub(err, want.password) }];
+    }
+  }
+  return outcomes;
+}

modules/nodered/mqtt/index.ts

@@ -0,0 +1,102 @@
+// nodered's MQTT step — run once by the host after Node-RED starts, and again whenever the
+// `mqtt-topic` binding, its pair credential or the settings change (the container's `restart-on`,
+// novox/hq ADR 0099). It points the mesh's broker config nodes at the broker the mesh bound, through
+// Node-RED's admin API (connection.ts). It connects to no mesh broker.
+//
+// Exits non-zero when anything could not be put right, so the node reports the step failed and the
+// host runs it again on the next apply. Declared last in the manifest, so its failing gates nothing
+// else of nodered's (novox/hq ADR 0136). Never prints a password.
+
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import { NodeRedClient } from "../client.js";
+import { namedBrokers, reconcileBrokers, type Binding, type Marks } from "./connection.js";
+import { probeBroker } from "./probe.js";
+
+const dir = process.env.MESH_PROVISIONS_DIR ?? "/run/provisions";
+const writtenDir = process.env.MESH_WRITTEN_DIR ?? "/var/lib/nodered-provisions";
+const waitSeconds = Number(process.env.MESH_NODERED_WAIT_SECONDS ?? "180");
+
+const readIfThere = (path: string): Promise<string | undefined> => readFile(path, "utf8").catch(() => undefined);
+const parse = <T>(raw: string | undefined): T | undefined => {
+  if (raw === undefined) return undefined;
+  try {
+    return JSON.parse(raw) as T;
+  } catch {
+    return undefined;
+  }
+};
+
+const marks: Marks = {
+  async get(name) {
+    return (await readIfThere(join(writtenDir, `${name}.digest`)))?.trim() || undefined;
+  },
+  async set(name, value) {
+    await mkdir(writtenDir, { recursive: true, mode: 0o700 });
+    const path = join(writtenDir, `${name}.digest`);
+    await writeFile(`${path}.tmp`, `${value}\n`, { mode: 0o600 });
+    await rename(`${path}.tmp`, path);
+  },
+};
+
+let client: NodeRedClient;
+try {
+  client = NodeRedClient.fromEnv();
+} catch (err) {
+  console.error(`[nodered-mqtt] ${err instanceof Error ? err.message : String(err)}`);
+  process.exit(1);
+}
+
+/** Node-RED answers the admin API once its flows are loaded and the token is good. */
+async function ready(): Promise<boolean> {
+  const until = Date.now() + waitSeconds * 1000;
+  for (;;) {
+    try {
+      await client.flowsWithRev();
+      return true;
+    } catch (err) {
+      if (/\b(401|403)\b/.test(String(err))) {
+        console.error("[nodered-mqtt] Node-RED refuses the api-token — settings.js and this step disagree");
+        return false;
+      }
+    }
+    if (Date.now() >= until) return false;
+    await new Promise((r) => setTimeout(r, 2000));
+  }
+}
+
+if (!(await ready())) {
+  console.error(`[nodered-mqtt] Node-RED's admin API did not answer at ${client.baseUrl} within ${waitSeconds}s`);
+  process.exit(1);
+}
+
+const binding = parse<Binding>(await readIfThere(join(dir, "mqtt-topic.json")));
+const secret = await readIfThere(join(dir, "mqtt-topic.secret"));
+const settings = parse<unknown>(await readIfThere(join(dir, "settings.json")));
+
+const outcomes = await reconcileBrokers(
+  {
+    nodered: {
+      flows: () => client.flowsWithRev(),
+      credentials: (type, id) => client.credentials(type, id),
+      deploy: (rev, flows) => client.deployFlowsAt(rev, flows, "nodes"),
+    },
+    probe: probeBroker,
+    marks,
+  },
+  binding,
+  secret,
+  namedBrokers(settings),
+);
+
+let failed = 0;
+for (const o of outcomes) {
+  if (o.result === "unchanged") console.log(`[nodered-mqtt] ${o.what}: already as the mesh says${o.note ? ` — ${o.note}` : ""}`);
+  else if (o.result === "written") console.log(`[nodered-mqtt] ${o.what}: wrote ${o.fields.join(", ")}${o.note ? ` — ${o.note}` : ""}`);
+  else {
+    failed++;
+    console.error(`[nodered-mqtt] ${o.what}: ${o.problem}`);
+  }
+}
+process.exitCode = failed > 0 ? 1 : 0;

modules/nodered/mqtt/probe.ts

@@ -0,0 +1,117 @@
+// Ask the broker, before Node-RED is told anything, whether it takes the login and password the
+// mesh delivered — and whether that login may subscribe to every topic, as flows expect.
+//
+// One MQTT 3.1.1 session: CONNECT (clean, a throwaway client id, so no flow's session is taken
+// over), read the CONNACK, optionally SUBSCRIBE once and read the SUBACK, DISCONNECT. No dependency:
+// the handful of bytes MQTT needs for this are written here.
+
+import { randomBytes } from "node:crypto";
+import { connect } from "node:net";
+
+export interface ProbeResult {
+  /** 0 accepted; 4 bad username or password; 5 not authorised. */
+  connack: number;
+  /** The SUBACK return code for the filter asked about: 0–2 granted, 0x80 refused. */
+  suback?: number;
+}
+
+export type Probe = (host: string, port: number, username: string, password: string, subscribe?: string) => Promise<ProbeResult>;
+
+function str(v: string): Buffer {
+  const b = Buffer.from(v, "utf8");
+  const len = Buffer.alloc(2);
+  len.writeUInt16BE(b.length);
+  return Buffer.concat([len, b]);
+}
+
+function packet(type: number, body: Buffer): Buffer {
+  let remaining = body.length;
+  const lenBytes: number[] = [];
+  do {
+    let byte = remaining % 128;
+    remaining = Math.floor(remaining / 128);
+    if (remaining > 0) byte |= 0x80;
+    lenBytes.push(byte);
+  } while (remaining > 0);
+  return Buffer.concat([Buffer.from([type, ...lenBytes]), body]);
+}
+
+/** The first complete packet in `buf`: its type byte, its body, and how many bytes it took. */
+export function firstPacket(buf: Buffer): { type: number; body: Buffer; used: number } | undefined {
+  if (buf.length < 2) return undefined;
+  let length = 0;
+  let multiplier = 1;
+  let i = 1;
+  for (;;) {
+    if (i >= buf.length) return undefined;
+    const byte = buf[i++];
+    length += (byte & 0x7f) * multiplier;
+    if ((byte & 0x80) === 0) break;
+    multiplier *= 128;
+    if (i > 4) throw new Error("malformed MQTT remaining length");
+  }
+  if (buf.length < i + length) return undefined;
+  return { type: buf[0], body: buf.subarray(i, i + length), used: i + length };
+}
+
+export const probeBroker: Probe = (host, port, username, password, subscribe) => {
+  const connectBody = Buffer.concat([
+    str("MQTT"),
+    Buffer.from([4, 0xc2, 0, 10]), // level 4 (3.1.1); username + password + clean session; keepalive 10s
+    str(`mesh-probe-${randomBytes(6).toString("hex")}`),
+    str(username),
+    str(password),
+  ]);
+  return new Promise((resolve, reject) => {
+    const socket = connect({ host, port });
+    let buf = Buffer.alloc(0);
+    const result: ProbeResult = { connack: -1 };
+    const timer = setTimeout(() => {
+      socket.destroy();
+      reject(new Error(`no answer from the broker at ${host}:${port} within 10s`));
+    }, 10_000);
+    const finish = (): void => {
+      clearTimeout(timer);
+      if (result.connack === 0) socket.end(Buffer.from([0xe0, 0]));
+      else socket.destroy();
+      resolve(result);
+    };
+    socket.on("connect", () => socket.write(packet(0x10, connectBody)));
+    socket.on("data", (chunk) => {
+      buf = Buffer.concat([buf, chunk]);
+      for (;;) {
+        let p;
+        try {
+          p = firstPacket(buf);
+        } catch (err) {
+          clearTimeout(timer);
+          socket.destroy();
+          reject(err);
+          return;
+        }
+        if (!p) return;
+        buf = buf.subarray(p.used);
+        const kind = p.type >> 4;
+        if (kind === 2) {
+          result.connack = p.body[1] ?? -1;
+          if (result.connack !== 0 || !subscribe) return finish();
+          // SUBSCRIBE, packet id 1, one filter at QoS 0.
+          socket.write(packet(0x82, Buffer.concat([Buffer.from([0, 1]), str(subscribe), Buffer.from([0])])));
+        } else if (kind === 9) {
+          result.suback = p.body[2];
+          return finish();
+        }
+      }
+    });
+    socket.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+    socket.on("close", () => {
+      if (result.connack === -1) {
+        clearTimeout(timer);
+        reject(new Error(`the broker at ${host}:${port} closed the connection without answering`));
+      }
+    });
+  });
+};

modules/nodered/package.json

@@ -1,9 +1,14 @@
 {
   "name": "@novox/module-nodered",
   "version": "0.1.0",
-  "description": "nodered — flow-based automation. Its client and tools live here (novox/hq ADR 0039).",
+  "description": "nodered \u2014 flow-based automation. Its client and tools live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
+  "scripts": {
+    "build": "tsc client.ts tools/index.ts mqtt/probe.ts mqtt/connection.ts mqtt/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
+  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.0"
   },

modules/nodered/test/mqtt.test.ts

@@ -0,0 +1,124 @@
+// What holds nodered's MQTT step (mqtt/connection.ts): the broker nodes the mesh owns — the one it
+// makes, or the ones settings name — are made to use the broker and login the mesh bound, only after
+// the broker takes that login; every other field of a node is kept; nothing is deployed when nothing
+// differs; a node that is not named is never touched; a loopback broker address is refused.
+//
+// Node-RED and the broker are fakes answering as the real ones do (admin API v2 of nodered/node-red
+// 5.0.7, the build ace runs).
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { MESH_BROKER_ID, namedBrokers, reconcileBrokers, type Binding, type FlowNode, type Marks, type NodeRed } from "../mqtt/connection.ts";
+import type { Probe } from "../mqtt/probe.ts";
+
+const MINTED = "mesh-minted-password";
+const binding = (at = "ace.internal"): Binding => ({ provision: "mqtt-topic", from: "ace", at, as: "mesh_ace_nodered", serves: { scheme: "mqtt", port: 1883 } });
+
+/** ace's flows, reduced: its one broker node (dead, zurag.be:1884) and a node that uses it. */
+function aceFlows(): FlowNode[] {
+  return [
+    { id: "2b0aece9c5f3b307", type: "mqtt-broker", name: "MQTT Broker", broker: "zurag.be", port: "1884", clientid: "", usetls: false, protocolVersion: "4", keepalive: "60" },
+    { id: "fe0cae96f1e3ae4d", type: "mqtt in", topic: "stat/sonoff_office_light_switch/RESULT", broker: "2b0aece9c5f3b307", z: "t" },
+    { id: "other-broker", type: "mqtt-broker", name: "someone else's", broker: "test.mosquitto.org", port: "1883" },
+  ];
+}
+
+function fakeNodeRed(flows: FlowNode[], creds: Record<string, { user?: string; password?: string }> = {}) {
+  let rev = "r1";
+  const deploys: FlowNode[][] = [];
+  const nodered: NodeRed = {
+    async flows() {
+      return { rev, flows: structuredClone(flows) };
+    },
+    async credentials(_type, id) {
+      const c = creds[id] ?? {};
+      return { user: c.user, has_password: Boolean(c.password) };
+    },
+    async deploy(at, next) {
+      if (at !== rev) throw new Error("Node-RED /flows: 409 version_mismatch");
+      for (const n of next) {
+        if (n.credentials) creds[n.id] = { ...(creds[n.id] ?? {}), ...(n.credentials as object) };
+      }
+      flows.splice(0, flows.length, ...next.map(({ credentials: _c, ...n }) => n as FlowNode));
+      deploys.push(next);
+      rev = `r${deploys.length + 1}`;
+    },
+  };
+  return { nodered, deploys, flows, creds };
+}
+
+const marks = (): Marks & { store: Map<string, string> } => {
+  const store = new Map<string, string>();
+  return { store, get: async (k) => store.get(k), set: async (k, v) => void store.set(k, v) };
+};
+const takes: Probe = async (_h, _p, user, pass) => ({ connack: user === "mesh_ace_nodered" && pass === MINTED ? 0 : 5, suback: 0 });
+
+test("ace: the named broker node is moved to the bound broker and login; the other broker is not touched", async () => {
+  const f = fakeNodeRed(aceFlows(), { "2b0aece9c5f3b307": { user: "luffy", password: "old" }, "other-broker": { user: "x", password: "y" } });
+  const m = marks();
+  const out = await reconcileBrokers({ nodered: f.nodered, probe: takes, marks: m }, binding(), `${MINTED}\n`, ["2b0aece9c5f3b307"]);
+  assert.deepEqual(out, [{ what: "broker 2b0aece9c5f3b307", result: "written", fields: ["broker", "port", "user", "password"] }]);
+  const node = f.flows.find((n) => n.id === "2b0aece9c5f3b307");
+  assert.deepEqual(node, { ...aceFlows()[0], broker: "ace.internal", port: "1883", usetls: false });
+  assert.deepEqual(f.creds["2b0aece9c5f3b307"], { user: "mesh_ace_nodered", password: MINTED });
+  assert.deepEqual(f.flows.find((n) => n.id === "other-broker"), aceFlows()[2]);
+  assert.deepEqual(f.creds["other-broker"], { user: "x", password: "y" });
+  // Only the changed node carried credentials in the deploy.
+  assert.deepEqual(f.deploys[0].filter((n) => n.credentials).map((n) => n.id), ["2b0aece9c5f3b307"]);
+
+  // Again: nothing differs, nothing is deployed.
+  const again = await reconcileBrokers({ nodered: f.nodered, probe: takes, marks: m }, binding(), MINTED, ["2b0aece9c5f3b307"]);
+  assert.deepEqual(again, [{ what: "broker 2b0aece9c5f3b307", result: "unchanged" }]);
+  assert.equal(f.deploys.length, 1);
+});
+
+test("fresh: with nothing named, the step makes its own broker node", async () => {
+  const f = fakeNodeRed([]);
+  const out = await reconcileBrokers({ nodered: f.nodered, probe: takes, marks: marks() }, binding(), MINTED, []);
+  assert.deepEqual(out, [{ what: `broker ${MESH_BROKER_ID}`, result: "written", fields: ["node"] }]);
+  assert.equal(f.flows[0].type, "mqtt-broker");
+  assert.equal(f.flows[0].broker, "ace.internal");
+  assert.deepEqual(f.creds[MESH_BROKER_ID], { user: "mesh_ace_nodered", password: MINTED });
+});
+
+test("a login the broker does not take is never written", async () => {
+  const f = fakeNodeRed(aceFlows());
+  const out = await reconcileBrokers({ nodered: f.nodered, probe: async () => ({ connack: 5 }), marks: marks() }, binding(), MINTED, ["2b0aece9c5f3b307"]);
+  assert.equal(out[0].result, "refused");
+  assert.equal(f.deploys.length, 0);
+});
+
+test("a named node that is not there, or a loopback broker, is refused", async () => {
+  const f = fakeNodeRed(aceFlows());
+  const out = await reconcileBrokers({ nodered: f.nodered, probe: takes, marks: marks() }, binding(), MINTED, ["gone"]);
+  assert.match((out[0] as { problem: string }).problem, /no such node/);
+  const lo = await reconcileBrokers({ nodered: f.nodered, probe: takes, marks: marks() }, binding("127.0.0.1"), MINTED, []);
+  assert.match((lo[0] as { problem: string }).problem, /Node-RED itself/);
+  assert.equal(f.deploys.length, 0);
+});
+
+test("a deploy that raced another is read again once", async () => {
+  const f = fakeNodeRed(aceFlows());
+  let first = true;
+  const racing: NodeRed = {
+    ...f.nodered,
+    async flows() {
+      const got = await f.nodered.flows();
+      if (first) {
+        first = false;
+        return { ...got, rev: "stale" };
+      }
+      return got;
+    },
+  };
+  const out = await reconcileBrokers({ nodered: racing, probe: takes, marks: marks() }, binding(), MINTED, ["2b0aece9c5f3b307"]);
+  assert.equal(out[0].result, "written");
+  assert.equal(f.deploys.length, 1);
+});
+
+test("settings name broker nodes under mqtt.brokers", () => {
+  assert.deepEqual(namedBrokers({ mqtt: { brokers: ["a", "", 3, "b"] } }), ["a", "b"]);
+  assert.deepEqual(namedBrokers({ endpoints: {} }), []);
+  assert.deepEqual(namedBrokers(undefined), []);
+});

modules/nodered/tsconfig.json

@@ -8,5 +8,11 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["client.ts", "tools/index.ts"]
+  "include": [
+    "client.ts",
+    "tools/index.ts",
+    "mqtt/probe.ts",
+    "mqtt/connection.ts",
+    "mqtt/index.ts"
+  ]
 }

modules/nzbget/module.json

@@ -81,7 +81,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NZBGET_URL": "http://127.0.0.1:${port:6789}",
+        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
         "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
         "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
         "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"

modules/ombi/Dockerfile

@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/ombi
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts servarr/settings.ts plex/settings.ts connections/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/ombi/dist /app/modules/ombi/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/ombi/dist/index.js,/app/modules/ombi/dist/tools/index.js
-# NOT dist/connections/index.js: that is a step the host runs to completion, named by the `connections`
-# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
-# serving sidecar too, and exit it.

modules/ombi/connections/index.ts

@@ -1,66 +0,0 @@
-// ombi's connections step — run once by the host after ombi's server starts, and run again whenever
-// a binding or pair credential it reads changes (the container's `restart-on`, novox/hq ADR 0099).
-// It brings ombi's connections to Sonarr, Radarr, Lidarr (servarr/settings.ts) and Plex
-// (plex/settings.ts) in line with what the mesh bound.
-//
-// **A step, not a loop**, for the reason route-adapter gives: everything it does is a function of
-// files the mesh writes, and the host already knows when they change. It connects to no broker.
-//
-// Exits non-zero when any app could not be put right — a refused credential, an unreachable app, an
-// ombi that cannot reach it — so the node reports the step failed and the host runs it again on the
-// next apply. It is declared last in the manifest, so its failing gates nothing else of ombi's
-// (novox/hq ADR 0136). One app failing does not stop the others being put right.
-//
-// Reads, per provision, `<dir>/<provision>.json` (the binding) and `<dir>/<provision>.secret` (the
-// pair credential), where <dir> is MESH_CONNECTIONS_DIR. Never prints a key or a token.
-
-import { join } from "node:path";
-
-import { PLEX_PROVISION, reconcilePlex } from "../plex/settings.js";
-import { APPS, ombiReady, readBinding, readIfThere, reconcileApp, type Http, type Outcome } from "../servarr/settings.js";
-
-const dir = process.env.MESH_CONNECTIONS_DIR ?? "/run/connections";
-const url = process.env.MESH_OMBI_URL ?? "http://127.0.0.1:3579";
-const apiKey = (await readIfThere(process.env.MESH_OMBI_API_KEY_FILE))?.trim() ?? process.env.MESH_OMBI_API_KEY ?? "";
-const waitSeconds = Number(process.env.MESH_OMBI_WAIT_SECONDS ?? "180");
-
-// Every call bounded: an entry ombi keeps may name a host that no longer answers, and a step that
-// hangs on it holds the apply.
-const http: Http = { fetch: (u, init) => fetch(u, { ...init, signal: AbortSignal.timeout(20_000) }) };
-
-if (!apiKey) {
-  console.error("[ombi-connections] no ombi API key — ombi's own `api-key` secret has not been accepted");
-  process.exit(1);
-}
-const ombi = { url, apiKey };
-
-if (!(await ombiReady(http, ombi, waitSeconds * 1000))) {
-  console.error(`[ombi-connections] ombi did not answer at ${url} within ${waitSeconds}s`);
-  process.exit(1);
-}
-
-const inputs = async (provision: string) =>
-  [await readBinding(join(dir, `${provision}.json`)), await readIfThere(join(dir, `${provision}.secret`))] as const;
-
-const outcomes: Outcome[] = [];
-for (const spec of APPS) {
-  outcomes.push(await reconcileApp(http, ombi, spec, ...(await inputs(spec.provision))));
-}
-outcomes.push(await reconcilePlex(http, ombi, ...(await inputs(PLEX_PROVISION))));
-
-let failed = 0;
-for (const outcome of outcomes) {
-  switch (outcome.result) {
-    case "unchanged":
-      console.log(`[ombi-connections] ${outcome.app}: already as the mesh says; connection tested`);
-      break;
-    case "written":
-      console.log(`[ombi-connections] ${outcome.app}: wrote ${outcome.fields.join(", ")}; connection tested`);
-      break;
-    case "refused":
-      failed++;
-      console.error(`[ombi-connections] ${outcome.app}: ${outcome.problem}`);
-      break;
-  }
-}
-process.exitCode = failed > 0 ? 1 : 0;

modules/ombi/module.json

@@ -28,15 +28,10 @@
       "path": "/var/lib/mesh/ombi",
       "mode": "0700"
     },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
     {
       "id": "config",
       "type": "directory",
+      "path": "/services/ombi/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -44,7 +39,7 @@
       "id": "server",
       "type": "container",
       "name": "ombi",
-      "image": "lscr.io/linuxserver/ombi@sha256:22d6ebadbaaa728571353e74dc2173719e0fb02d4eaec551a7e9d2ee99ef68ac",
+      "image": "lscr.io/linuxserver/ombi@sha256:a6f76ac521ba01eee2e9f0c23a3fed22e56630d97a04d5eeaeaa36c1e681640d",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
@@ -54,7 +49,7 @@
         "3579"
       ],
       "volumes": [
-        "${dir:config}:/config"
+        "/services/ombi/config:/config"
       ]
     },
     {
@@ -73,64 +68,24 @@
       "volumes": [
         "/var/lib/mesh/ombi/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro",
-        "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro",
+        "/services/ombi/config:/var/lib/ombi/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_OMBI_URL": "http://127.0.0.1:${port:3579}",
+        "MESH_OMBI_URL": "http://127.0.0.1:3579",
         "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key",
-        "MESH_OMBI_CONFIG_FILE": "/run/config/config.json"
+        "MESH_OMBI_CONFIG_FILE": "/run/config/config.json",
+        "MESH_OMBI_CONFIG_DIR": "/var/lib/ombi/config"
       },
       "restart-on": [
         "runtime-config"
       ],
       "artifact": "runtime"
-    },
-    {
-      "id": "connections",
-      "type": "container",
-      "name": "mesh-ombi-connections",
-      "network": "host",
-      "run-once": true,
-      "volumes": [
-        "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro",
-        "${dir:state}/sonarr-api.json:/run/connections/sonarr-api.json:ro",
-        "${dir:state}/sonarr-api.secret:/run/connections/sonarr-api.secret:ro",
-        "${dir:state}/radarr-api.json:/run/connections/radarr-api.json:ro",
-        "${dir:state}/radarr-api.secret:/run/connections/radarr-api.secret:ro",
-        "${dir:state}/lidarr-api.json:/run/connections/lidarr-api.json:ro",
-        "${dir:state}/lidarr-api.secret:/run/connections/lidarr-api.secret:ro",
-        "${dir:state}/plex-api.json:/run/connections/plex-api.json:ro",
-        "${dir:state}/plex-api.secret:/run/connections/plex-api.secret:ro"
-      ],
-      "env": {
-        "MESH_OMBI_URL": "http://127.0.0.1:${port:3579}",
-        "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key",
-        "MESH_CONNECTIONS_DIR": "/run/connections"
-      },
-      "args": [
-        "run",
-        "/app/modules/ombi/dist/connections/index.js"
-      ],
-      "restart-on": [
-        "bound-sonarr-api",
-        "secret-sonarr-api",
-        "bound-radarr-api",
-        "secret-radarr-api",
-        "bound-lidarr-api",
-        "secret-lidarr-api",
-        "bound-plex-api",
-        "secret-plex-api"
-      ],
-      "artifact": "runtime"
     }
   ],
   "requires": [
-    "lidarr-api",
+    "route"
-    "plex-api",
-    "radarr-api",
-    "route",
-    "sonarr-api"
   ],
   "contributes": {
     "route": {
@@ -139,17 +94,7 @@
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json",
+    "route": "/var/lib/mesh/ombi/route.json"
-    "sonarr-api": "${dir:state}/sonarr-api.json",
-    "radarr-api": "${dir:state}/radarr-api.json",
-    "lidarr-api": "${dir:state}/lidarr-api.json",
-    "plex-api": "${dir:state}/plex-api.json"
-  },
-  "secrets": {
-    "sonarr-api": "${dir:state}/sonarr-api.secret",
-    "radarr-api": "${dir:state}/radarr-api.secret",
-    "lidarr-api": "${dir:state}/lidarr-api.secret",
-    "plex-api": "${dir:state}/plex-api.secret"
   },
   "build": {
     "on": [

modules/ombi/package.json

@@ -4,11 +4,6 @@
   "description": "ombi — media requests. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc client.ts index.ts tools/index.ts servarr/settings.ts plex/settings.ts connections/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.0"
   },

modules/ombi/plex/settings.ts

@@ -1,271 +0,0 @@
-// Where ombi reaches Plex — decided by the mesh, written into ombi by ombi's own API.
-//
-// **Why this exists.** ombi keeps its Plex servers in its own database (OmbiSettings.db), so the
-// mesh has no file to write `${bound:plex-api:at}` into. ombi requires `plex-api`; the mesh delivers
-// a binding (where plex is: `at`, and what it serves: `port`, `scheme`) and a pair credential (the
-// server owner's X-Plex-Token, accepted by the operator — plex.tv issues it and the mesh cannot
-// mint it). This step makes ombi's Plex settings say the same thing, beside its Servarr ones.
-//
-// **Which entry is plex's.** ombi may list several Plex servers. The one this provision names is
-// found by the server's own machineIdentifier, which plex answers at /identity — the same value
-// ombi stored when an operator loaded the server in its settings screen. That entry's connection is
-// brought in line; an entry for any other server is never touched.
-//
-// When no entry carries that identifier, an entry may still be this server reached another way:
-// ace's ombi holds one loaded from an older server and later retyped to plex's public name, so its
-// stored identifier is stale while its address answers as this plex. Each entry's OWN address is
-// asked for /identity, and an entry plex itself answers for is this server's — adopted: its
-// connection laid over and its identifier corrected (ombi builds its "view in Plex" links from it).
-// Nothing is guessed: an entry whose address is unreachable, or answers as another server, is left
-// as it was. Only when no entry is this server's either way is one added, named as plex names
-// itself — it is the mesh's, so later runs keep it true.
-//
-// **Only the connection, and only when it differs.** Host, port, TLS, base path and token — and the
-// identifier of an adopted entry. Whether Plex is enabled in ombi, watchlist import, the selected
-// libraries, the batch size and everything else an operator chose are left exactly as they are.
-//
-// **A token plex refuses is never written.** Until the operator accepts the server's token for this
-// pair, the mesh delivers a value it minted itself, which plex answers with 401 (or 400 on its own
-// network). Writing it would replace a working token in ombi with a dead one, so the token is tried
-// against plex first; refused, nothing is written and the step fails naming the `secret accept`.
-
-import { isLoopback, ombiCall, type Binding, type Http, type Ombi, type Outcome } from "../servarr/settings.js";
-
-/** The provision ombi requires for Plex — the manifest's `requires`, `binds` and `secrets` key. */
-export const PLEX_PROVISION = "plex-api";
-
-/** The connection fields ombi keeps for a Plex server — the only ones this step ever writes. */
-export interface PlexConnection {
-  ip: string;
-  port: number;
-  ssl: boolean;
-  subDir: string | null;
-  plexAuthToken: string;
-}
-
-export type PlexWanted = { ok: true; connection: PlexConnection; from: string } | { ok: false; problem: string };
-
-/** The connection the mesh says ombi should use, from the binding and the pair credential. */
-export function wantedPlex(binding: Binding | undefined, credential: string | undefined): PlexWanted {
-  if (!binding) {
-    return { ok: false, problem: `no binding for ${PLEX_PROVISION} was delivered — the mesh writes it before this step runs` };
-  }
-  const at = typeof binding.at === "string" ? binding.at.trim() : "";
-  const serves = binding.serves ?? {};
-  const port = Number(serves.port);
-  if (!at) return { ok: false, problem: `the ${PLEX_PROVISION} binding names no host (at)` };
-  if (isLoopback(at)) {
-    return {
-      ok: false,
-      problem:
-        `the ${PLEX_PROVISION} binding says plex is at ${at}, which from ombi's own container is ombi itself. ` +
-        `The mesh hands loopback to a machine that is not on the private network; put it on the private ` +
-        `network so plex has an address ombi can dial`,
-    };
-  }
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    return { ok: false, problem: `the ${PLEX_PROVISION} binding serves no usable port (${String(serves.port)})` };
-  }
-  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
-  if (scheme !== "http" && scheme !== "https") {
-    return { ok: false, problem: `the ${PLEX_PROVISION} binding serves scheme ${scheme}, which ombi cannot dial` };
-  }
-  const token = (credential ?? "").trim();
-  if (!token) return { ok: false, problem: `the ${PLEX_PROVISION} credential is empty or was not delivered` };
-  return {
-    ok: true,
-    from: typeof binding.from === "string" ? binding.from : "",
-    connection: { ip: at, port, ssl: scheme === "https", subDir: null, plexAuthToken: token },
-  };
-}
-
-/** plex's base URL as the step dials it — the same host and port ombi will be given. */
-export function plexUrl(want: PlexConnection): string {
-  const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip;
-  return `${want.ssl ? "https" : "http"}://${host}:${want.port}`;
-}
-
-/** Which connection fields differ between an entry ombi holds and what the mesh says. Names only. */
-export function differingPlex(current: Record<string, unknown> | undefined, want: PlexConnection): (keyof PlexConnection)[] {
-  const now = current ?? {};
-  const out: (keyof PlexConnection)[] = [];
-  if (String(now.ip ?? "") !== want.ip) out.push("ip");
-  if (Number(now.port ?? 0) !== want.port) out.push("port");
-  if (Boolean(now.ssl) !== want.ssl) out.push("ssl");
-  const sub = typeof now.subDir === "string" && now.subDir.trim() !== "" ? now.subDir : null;
-  if (sub !== want.subDir) out.push("subDir");
-  if (String(now.plexAuthToken ?? "") !== want.plexAuthToken) out.push("plexAuthToken");
-  return out;
-}
-
-async function plexGet(http: Http, want: PlexConnection, path: string, withToken: boolean) {
-  const headers: Record<string, string> = { Accept: "application/json" };
-  if (withToken) headers["X-Plex-Token"] = want.plexAuthToken;
-  return http.fetch(`${plexUrl(want)}${path}`, { method: "GET", headers });
-}
-
-/**
- * Does plex take this token? `true` it does; `false` it refused it — 401 or 403, or 400, which is
- * what plex answers a token it never issued on a network it trusts. A thrown error when plex could
- * not be asked.
- */
-export async function plexTakes(http: Http, want: PlexConnection): Promise<{ takes: boolean; friendlyName?: string }> {
-  const res = await plexGet(http, want, "/", true);
-  if (res.status === 400 || res.status === 401 || res.status === 403) return { takes: false };
-  if (res.status < 200 || res.status >= 300) throw new Error(`plex answered ${res.status} at /`);
-  let friendlyName: string | undefined;
-  try {
-    const body = JSON.parse(await res.text()) as { MediaContainer?: { friendlyName?: unknown } };
-    if (typeof body.MediaContainer?.friendlyName === "string") friendlyName = body.MediaContainer.friendlyName;
-  } catch {
-    // a name is a nicety for a new entry, not a condition
-  }
-  return { takes: true, friendlyName };
-}
-
-/** The server's own machineIdentifier, which plex answers without a token. */
-export async function plexIdentity(http: Http, want: Pick<PlexConnection, "ip" | "port" | "ssl" | "subDir">): Promise<string> {
-  const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip;
-  const base = `${want.ssl ? "https" : "http"}://${host}:${want.port}${want.subDir ? `/${want.subDir.replace(/^\/+|\/+$/g, "")}` : ""}`;
-  const res = await http.fetch(`${base}/identity`, { method: "GET", headers: { Accept: "application/json" } });
-  if (res.status !== 200) throw new Error(`plex answered ${res.status} at /identity`);
-  const body = JSON.parse(await res.text()) as { MediaContainer?: { machineIdentifier?: unknown } };
-  const id = body.MediaContainer?.machineIdentifier;
-  if (typeof id !== "string" || id === "") throw new Error("plex's /identity names no machineIdentifier");
-  return id;
-}
-
-/** The remedy for a refused token, in the controller's own words (ADR 0092). */
-export function plexAcceptRemedy(from: string): string {
-  return (
-    `plex refuses the ${PLEX_PROVISION} credential the mesh delivered, so it was not written into ombi. ` +
-    `plex's token is issued by plex.tv and the mesh cannot make it: accept the server's own token for ` +
-    `this pair — \`secret accept <this node> ombi ${PLEX_PROVISION} --provider ${from || "<its node>"} ` +
-    `--from <file holding the server's X-Plex-Token>\``
-  );
-}
-
-/** The batch size ombi's settings screen fills in for a server it adds ("150 by default"). */
-const EPISODE_BATCH_SIZE = 150;
-
-/** ombi's server entries, as its settings document holds them (null on a fresh ombi). */
-export function serversOf(document: Record<string, unknown> | undefined): Record<string, unknown>[] {
-  const servers = document?.servers;
-  return Array.isArray(servers) ? (servers as Record<string, unknown>[]) : [];
-}
-
-/**
- * Which entries, holding another identifier, plex answers for at their own address — this server,
- * reached another way. Asked only when no entry carries the identifier. An entry that cannot be
- * asked is not this server's: nothing is guessed.
- */
-export async function answeringAs(http: Http, servers: Record<string, unknown>[], machineIdentifier: string): Promise<Set<number>> {
-  const out = new Set<number>();
-  if (servers.some((s) => s?.machineIdentifier === machineIdentifier)) return out;
-  for (const [i, s] of servers.entries()) {
-    const ip = typeof s?.ip === "string" ? s.ip.trim() : "";
-    const port = Number(s?.port);
-    if (!ip || !Number.isInteger(port) || port <= 0 || port > 65535) continue;
-    const subDir = typeof s.subDir === "string" && s.subDir.trim() !== "" ? s.subDir : null;
-    try {
-      if ((await plexIdentity(http, { ip, port, ssl: Boolean(s.ssl), subDir })) === machineIdentifier) out.add(i);
-    } catch {
-      // unreachable, or not a plex: not this server's
-    }
-  }
-  return out;
-}
-
-/**
- * ombi's Plex settings with this server's connection laid over them: every entry naming the
- * server's machineIdentifier — or adopted, its address answering as this server — gets the
- * connection (an adopted one also the identifier), every other entry is left as it was, and when
- * none is this server's one is added. Returns the document to save and the fields that changed.
- */
-export function withPlexServer(
-  document: Record<string, unknown> | undefined,
-  machineIdentifier: string,
-  want: PlexConnection,
-  name: string,
-  adopted: ReadonlySet<number> = new Set(),
-): { next: Record<string, unknown>; fields: string[]; added: boolean; entry: Record<string, unknown> } {
-  const doc = document ?? {};
-  const servers = serversOf(doc);
-  const fields = new Set<string>();
-  let entry: Record<string, unknown> | undefined;
-  const next = servers.map((s, i) => {
-    const adopt = adopted.has(i) && s?.machineIdentifier !== machineIdentifier;
-    if (s?.machineIdentifier !== machineIdentifier && !adopt) return s;
-    for (const f of differingPlex(s, want)) fields.add(f);
-    if (adopt) fields.add("machineIdentifier");
-    const laid = { ...s, machineIdentifier, ip: want.ip, port: want.port, ssl: want.ssl, subDir: want.subDir, plexAuthToken: want.plexAuthToken };
-    entry ??= laid;
-    return laid;
-  });
-  if (entry) return { next: { ...doc, servers: next }, fields: [...fields], added: false, entry };
-  const added: Record<string, unknown> = {
-    name,
-    machineIdentifier,
-    ip: want.ip,
-    port: want.port,
-    ssl: want.ssl,
-    subDir: want.subDir,
-    plexAuthToken: want.plexAuthToken,
-    episodeBatchSize: EPISODE_BATCH_SIZE,
-    plexSelectedLibraries: [],
-  };
-  return { next: { ...doc, servers: [...next, added] }, fields: ["server"], added: true, entry: added };
-}
-
-/**
- * Bring ombi's connection to plex in line with the mesh: check the token against plex, find the
- * server's entry by its machineIdentifier, write only the connection fields when they differ (or add
- * the entry), then have ombi test the connection from its own container. Never throws.
- */
-export async function reconcilePlex(http: Http, ombi: Ombi, binding: Binding | undefined, credential: string | undefined): Promise<Outcome> {
-  const app = "plex";
-  const w = wantedPlex(binding, credential);
-  // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not
-  // narrow.
-  if ("problem" in w) return { app, result: "refused", problem: w.problem };
-  const want = w.connection;
-
-  let name: string;
-  let machineIdentifier: string;
-  try {
-    const taken = await plexTakes(http, want);
-    if (!taken.takes) return { app, result: "refused", problem: plexAcceptRemedy(w.from) };
-    machineIdentifier = await plexIdentity(http, want);
-    name = taken.friendlyName || "Plex";
-  } catch (err) {
-    return { app, result: "refused", problem: `plex could not be asked whether it takes the token at ${want.ip}:${want.port}: ${message(err)}` };
-  }
-
-  try {
-    const document = (await ombiCall(http, ombi, "GET", "/Settings/Plex")) as Record<string, unknown> | undefined;
-    const adopted = await answeringAs(http, serversOf(document), machineIdentifier);
-    const laid = withPlexServer(document, machineIdentifier, want, name, adopted);
-    if (laid.fields.length > 0) {
-      const saved = await ombiCall(http, ombi, "POST", "/Settings/Plex", laid.next);
-      if (saved === false) return { app, result: "refused", problem: "ombi declined to save its Plex settings" };
-    }
-    // ombi's own test, from ombi's own container — the path the step's check above did not take.
-    const tested = await ombiCall(http, ombi, "POST", "/Tester/plex", laid.entry);
-    if (tested !== true) {
-      return {
-        app,
-        result: "refused",
-        problem:
-          `ombi cannot reach plex at ${want.ip}:${want.port} from its own container` +
-          (laid.fields.length > 0 ? `; its settings were written (${laid.fields.join(", ")})` : ""),
-      };
-    }
-    return laid.fields.length > 0 ? { app, result: "written", fields: laid.fields } : { app, result: "unchanged" };
-  } catch (err) {
-    return { app, result: "refused", problem: message(err) };
-  }
-}
-
-function message(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
-}

modules/ombi/servarr/settings.ts

@@ -1,304 +0,0 @@
-// Where ombi reaches Sonarr, Radarr and Lidarr — decided by the mesh, written into ombi by ombi's
-// own API.
-//
-// **Why this exists.** ombi keeps its connection to each Servarr app in its own database
-// (OmbiSettings.db), not in a file, so the mesh has nowhere to write `${bound:sonarr-api:at}` for it.
-// ombi requires `sonarr-api`, `radarr-api` and `lidarr-api`; the mesh delivers, for each, a binding
-// (where the app is: `at`, and what it serves: `port`, `scheme`, `url-base`) and a pair credential
-// (the app's API key, accepted by the operator — a Servarr app has exactly one key and the mesh
-// cannot mint it). This step reads those files and makes ombi's settings say the same thing.
-//
-// **Only the connection, and only when it differs.** Host, port, TLS, base path and API key. The
-// quality profile, root folder, language profile, tags, "enabled" and every other choice an operator
-// made in ombi's settings screen are left exactly as they are: the mesh knows where the app is, not
-// what ombi should do with it. Radarr's 4K instance is a different Radarr and is not touched.
-//
-// **A credential the app refuses is never written.** Until the operator accepts the app's API key
-// for this pair, the mesh delivers a value it minted itself, which no Servarr app will ever accept
-// (novox/hq ADR 0092). Writing it would replace a working key in ombi with a dead one. So the key is
-// tried against the app first; refused, nothing for that app is written and the step fails naming
-// the `secret accept` that fixes it.
-//
-// Pure logic and a small HTTP seam, so it is tested against fake servers (test/servarr.test.ts).
-
-import { readFile } from "node:fs/promises";
-
-/** One Servarr app ombi connects to, and the shape of that connection in ombi's API. */
-export interface ServarrApp {
-  /** The app, as ombi's API names it: /Settings/<app>, /Tester/<app>. */
-  app: "sonarr" | "radarr" | "lidarr";
-  /** The provision it is required as — the manifest's `requires`, `binds` and `secrets` key. */
-  provision: string;
-  /** The app's own status endpoint, which answers 401 to a wrong key. */
-  statusPath: string;
-  /**
-   * Where the one connection sits in ombi's settings document. Radarr's is `{radarr, radarr4K}`
-   * (two Radarr instances); only `radarr` is this provision's.
-   */
-  within?: string;
-}
-
-export const APPS: readonly ServarrApp[] = [
-  { app: "sonarr", provision: "sonarr-api", statusPath: "/api/v3/system/status" },
-  { app: "radarr", provision: "radarr-api", statusPath: "/api/v3/system/status", within: "radarr" },
-  { app: "lidarr", provision: "lidarr-api", statusPath: "/api/v1/system/status" },
-];
-
-/** The connection fields ombi keeps for an app — the only ones this step ever writes. */
-export interface Connection {
-  ip: string;
-  port: number;
-  ssl: boolean;
-  /** ombi's name for the app's URL base; null when the app is served at the root. */
-  subDir: string | null;
-  apiKey: string;
-}
-
-/** What the mesh wrote at `binds.<provision>`: the binding document (controller's boundFile). */
-export interface Binding {
-  provision?: string;
-  from?: string;
-  at?: string;
-  as?: string;
-  serves?: Record<string, unknown>;
-}
-
-export type Wanted = { ok: true; connection: Connection; from: string } | { ok: false; problem: string };
-
-/**
- * The connection the mesh says ombi should use, from the binding and the pair credential.
- *
- * Refused rather than guessed when the binding cannot be dialled from ombi's own container: a
- * loopback `at` — what the mesh hands a machine that is not on the private network — is ombi's
- * container itself, not the app.
- */
-export function wanted(spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): Wanted {
-  if (!binding) {
-    return { ok: false, problem: `no binding for ${spec.provision} was delivered — the mesh writes it before this step runs` };
-  }
-  const at = typeof binding.at === "string" ? binding.at.trim() : "";
-  const serves = binding.serves ?? {};
-  const port = Number(serves.port);
-  if (!at) {
-    return { ok: false, problem: `the ${spec.provision} binding names no host (at)` };
-  }
-  if (isLoopback(at)) {
-    return {
-      ok: false,
-      problem:
-        `the ${spec.provision} binding says ${spec.app} is at ${at}, which from ombi's own container is ` +
-        `ombi itself. The mesh hands loopback to a machine that is not on the private network; put it ` +
-        `on the private network so ${spec.app} has an address ombi can dial`,
-    };
-  }
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    return { ok: false, problem: `the ${spec.provision} binding serves no usable port (${String(serves.port)})` };
-  }
-  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
-  if (scheme !== "http" && scheme !== "https") {
-    return { ok: false, problem: `the ${spec.provision} binding serves scheme ${scheme}, which ombi cannot dial` };
-  }
-  const key = (credential ?? "").trim();
-  if (!key) {
-    return { ok: false, problem: `the ${spec.provision} credential is empty or was not delivered` };
-  }
-  return {
-    ok: true,
-    from: typeof binding.from === "string" ? binding.from : "",
-    connection: { ip: at, port, ssl: scheme === "https", subDir: subDirOf(serves["url-base"]), apiKey: key },
-  };
-}
-
-/** ombi's `subDir`: the URL base with its slashes trimmed, null when there is none. */
-export function subDirOf(urlBase: unknown): string | null {
-  const trimmed = typeof urlBase === "string" ? urlBase.trim().replace(/^\/+|\/+$/g, "") : "";
-  return trimmed === "" ? null : trimmed;
-}
-
-export function isLoopback(host: string): boolean {
-  const h = host.toLowerCase();
-  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
-}
-
-/** Which connection fields differ between what ombi holds and what the mesh says. Names only. */
-export function differing(current: Record<string, unknown> | undefined, want: Connection): (keyof Connection)[] {
-  const now = current ?? {};
-  const out: (keyof Connection)[] = [];
-  if (String(now.ip ?? "") !== want.ip) out.push("ip");
-  if (Number(now.port ?? 0) !== want.port) out.push("port");
-  if (Boolean(now.ssl) !== want.ssl) out.push("ssl");
-  if (subDirOf(now.subDir) !== want.subDir) out.push("subDir");
-  if (String(now.apiKey ?? "") !== want.apiKey) out.push("apiKey");
-  return out;
-}
-
-/** ombi's settings for the app with the connection laid over them and nothing else changed. */
-export function withConnection(current: Record<string, unknown> | undefined, want: Connection): Record<string, unknown> {
-  return { ...(current ?? {}), ip: want.ip, port: want.port, ssl: want.ssl, subDir: want.subDir, apiKey: want.apiKey };
-}
-
-/** The app's base URL as the step dials it — the same host and port ombi will be given. */
-export function appUrl(want: Connection): string {
-  const scheme = want.ssl ? "https" : "http";
-  const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip;
-  return `${scheme}://${host}:${want.port}${want.subDir ? `/${want.subDir}` : ""}`;
-}
-
-/** How one app came out. */
-export type Outcome =
-  | { app: string; result: "unchanged" }
-  | { app: string; result: "written"; fields: string[] }
-  | { app: string; result: "refused"; problem: string };
-
-/** The HTTP the step needs, so a test can stand fakes in for ombi and the apps. */
-export interface Http {
-  fetch(url: string, init?: { method?: string; headers?: Record<string, string>; body?: string }): Promise<{
-    status: number;
-    text(): Promise<string>;
-  }>;
-}
-
-export interface Ombi {
-  url: string;
-  apiKey: string;
-}
-
-export async function ombiCall(http: Http, ombi: Ombi, method: string, path: string, body?: unknown): Promise<unknown> {
-  const res = await http.fetch(`${ombi.url.replace(/\/$/, "")}/api/v1${path}`, {
-    method,
-    headers: {
-      ApiKey: ombi.apiKey,
-      Accept: "application/json",
-      ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
-    },
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-  });
-  const text = await res.text();
-  if (res.status < 200 || res.status >= 300) {
-    // The body is ombi's error, never a request echo, so it carries no key.
-    throw new Error(`ombi ${method} ${path} answered ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
-  }
-  return text ? (JSON.parse(text) as unknown) : undefined;
-}
-
-/**
- * Does the app take this key? `true` it does, `false` it refused it (401/403), and a thrown error
- * when it could not be asked — unreachable, or answering something that is neither.
- */
-export async function appTakes(http: Http, spec: ServarrApp, want: Connection): Promise<boolean> {
-  const res = await http.fetch(`${appUrl(want)}${spec.statusPath}`, {
-    method: "GET",
-    headers: { "X-Api-Key": want.apiKey, Accept: "application/json" },
-  });
-  if (res.status === 401 || res.status === 403) return false;
-  if (res.status >= 200 && res.status < 300) return true;
-  throw new Error(`${spec.app} answered ${res.status} at ${spec.statusPath}`);
-}
-
-/** The remedy for a refused key, in the controller's own words (ADR 0092). */
-export function acceptRemedy(spec: ServarrApp, from: string): string {
-  return (
-    `${spec.app} refuses the ${spec.provision} credential the mesh delivered, so it was not written ` +
-    `into ombi. A Servarr app has one API key and the mesh cannot make it: accept ${spec.app}'s own ` +
-    `key for this pair — \`secret accept <this node> ombi ${spec.provision} --provider ${from || "<its node>"} ` +
-    `--from <file holding ${spec.app}'s ApiKey>\``
-  );
-}
-
-/**
- * Bring ombi's connection to one app in line with the mesh: check the key against the app, compare,
- * write only the connection fields when they differ, then have ombi test the connection from its own
- * container. Never throws: every failure is an outcome with a reason.
- */
-export async function reconcileApp(
-  http: Http,
-  ombi: Ombi,
-  spec: ServarrApp,
-  binding: Binding | undefined,
-  credential: string | undefined,
-): Promise<Outcome> {
-  const w = wanted(spec, binding, credential);
-  // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not
-  // narrow.
-  if ("problem" in w) return { app: spec.app, result: "refused", problem: w.problem };
-  const want = w.connection;
-
-  try {
-    if (!(await appTakes(http, spec, want))) {
-      return { app: spec.app, result: "refused", problem: acceptRemedy(spec, w.from) };
-    }
-  } catch (err) {
-    return {
-      app: spec.app,
-      result: "refused",
-      problem: `${spec.app} could not be asked whether it takes the key at ${want.ip}:${want.port}: ${message(err)}`,
-    };
-  }
-
-  try {
-    const document = (await ombiCall(http, ombi, "GET", `/Settings/${spec.app}`)) as Record<string, unknown> | undefined;
-    const current = spec.within ? (document?.[spec.within] as Record<string, unknown> | undefined) : document;
-    const fields = differing(current, want);
-    if (fields.length > 0) {
-      const next = withConnection(current, want);
-      const body = spec.within ? { ...(document ?? {}), [spec.within]: next } : next;
-      const saved = await ombiCall(http, ombi, "POST", `/Settings/${spec.app}`, body);
-      if (saved === false) {
-        return { app: spec.app, result: "refused", problem: `ombi declined to save its ${spec.app} settings` };
-      }
-    }
-    // ombi's own test, from ombi's own container — the path the step's check above did not take.
-    const tested = (await ombiCall(http, ombi, "POST", `/Tester/${spec.app}`, withConnection(current, want))) as
-      | { isValid?: boolean; expectedSubDir?: string | null }
-      | undefined;
-    if (!tested?.isValid) {
-      const hint = tested?.expectedSubDir ? ` (ombi expected the base path ${tested.expectedSubDir})` : "";
-      return {
-        app: spec.app,
-        result: "refused",
-        problem:
-          `ombi cannot reach ${spec.app} at ${want.ip}:${want.port} from its own container${hint}` +
-          (fields.length > 0 ? `; its settings were written (${fields.join(", ")})` : ""),
-      };
-    }
-    return fields.length > 0 ? { app: spec.app, result: "written", fields } : { app: spec.app, result: "unchanged" };
-  } catch (err) {
-    return { app: spec.app, result: "refused", problem: message(err) };
-  }
-}
-
-/** Wait for ombi to answer, because the step runs right after its container starts. */
-export async function ombiReady(http: Http, ombi: Ombi, waitMs: number, pauseMs = 2000): Promise<boolean> {
-  const until = Date.now() + waitMs;
-  for (;;) {
-    try {
-      const res = await http.fetch(`${ombi.url.replace(/\/$/, "")}/api/v1/Status`, { method: "GET" });
-      if (res.status === 200) return true;
-    } catch {
-      // not listening yet
-    }
-    if (Date.now() >= until) return false;
-    await new Promise((r) => setTimeout(r, pauseMs));
-  }
-}
-
-/** A file the mesh wrote, or undefined when it is not there. */
-export async function readIfThere(path: string | undefined): Promise<string | undefined> {
-  if (!path) return undefined;
-  return readFile(path, "utf8").catch(() => undefined);
-}
-
-/** A binding file parsed, or undefined when absent or not JSON. */
-export async function readBinding(path: string | undefined): Promise<Binding | undefined> {
-  const raw = await readIfThere(path);
-  if (raw === undefined) return undefined;
-  try {
-    return JSON.parse(raw) as Binding;
-  } catch {
-    return undefined;
-  }
-}
-
-function message(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
-}

modules/ombi/test/plex.test.ts

@@ -1,223 +0,0 @@
-// What holds ombi's Plex step (plex/settings.ts): the entry for the server plex says it is — found
-// by machineIdentifier — is made to say what the mesh bound (host, port, TLS, token) and nothing
-// else it keeps is touched; an entry for another server is left alone; an ombi with no entry for it
-// gets one; nothing is written when nothing differs; and a token plex refuses (the mesh's own minted
-// value, before the operator accepts the server's token) is never written, with the `secret accept`
-// that fixes it named.
-//
-// ombi and plex are fakes answering the routes the step touches as the real ones do (checked against
-// lscr.io/linuxserver/ombi 4.53.10 and plexinc/pms-docker 1.43.4: plex answers 401 to an unknown
-// token from another network and 400 on one it trusts; ombi's /Tester/plex answers a bare boolean).
-//
-// Imports the compiled step, as keycloak's tests do: plex/settings.ts imports its sibling with the
-// `.js` specifier the build needs, which Node's type stripping does not resolve to a `.ts` file.
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { differingPlex, reconcilePlex, wantedPlex, withPlexServer } from "../dist/plex/settings.js";
-import type { Binding, Http } from "../servarr/settings.ts";
-
-const TOKEN = "the-servers-own-token";
-const MACHINE = "5c47d9a165d10b622995d55b3ae1f168242f33bd";
-const OMBI = { url: "http://127.0.0.1:3579", apiKey: "ombi-key" };
-
-function binding(port = 32400, at = "ace.internal", scheme = "http"): Binding {
-  return { binding: 1, provision: "plex-api", from: "ace", at, as: "mesh_ace_ombi", serves: { scheme, port } } as Binding;
-}
-
-interface Call {
-  method: string;
-  url: string;
-  body?: unknown;
-}
-
-function fakes(plexSettings: Record<string, unknown>, opts: { reachable?: boolean; trusted?: boolean } = {}) {
-  const calls: Call[] = [];
-  const store = { plex: plexSettings };
-  const http: Http = {
-    async fetch(url, init) {
-      const method = init?.method ?? "GET";
-      const body = init?.body ? (JSON.parse(init.body) as unknown) : undefined;
-      calls.push({ method, url, body });
-      const reply = (status: number, value?: unknown) => ({
-        status,
-        text: async () => (value === undefined ? "" : JSON.stringify(value)),
-      });
-      const u = new URL(url);
-      // Other servers an entry may name: a friend's, and plex's own public name (the same server).
-      if (u.hostname === "10.0.0.9") return reply(200, { MediaContainer: { machineIdentifier: "another-server" } });
-      if (u.hostname === "gone.example") throw new Error("getaddrinfo ENOTFOUND");
-      if (u.hostname === "plex.zurag.be") {
-        if (u.pathname === "/identity") return reply(200, { MediaContainer: { machineIdentifier: MACHINE } });
-        return reply(401);
-      }
-      if (u.port === "32400" || u.hostname === "ace.internal") {
-        if (opts.reachable === false) throw new Error("connect ECONNREFUSED");
-        if (u.pathname === "/identity") return reply(200, { MediaContainer: { machineIdentifier: MACHINE } });
-        const token = init?.headers?.["X-Plex-Token"];
-        if (token !== TOKEN) return reply(opts.trusted ? 400 : 401);
-        return reply(200, { MediaContainer: { friendlyName: "ace", machineIdentifier: MACHINE } });
-      }
-      if (init?.headers?.ApiKey !== "ombi-key") return reply(401);
-      if (u.pathname === "/api/v1/Settings/Plex" && method === "GET") return reply(200, store.plex);
-      if (u.pathname === "/api/v1/Settings/Plex" && method === "POST") {
-        store.plex = body as Record<string, unknown>;
-        return reply(200, true);
-      }
-      if (u.pathname === "/api/v1/Tester/plex") {
-        const tried = body as { plexAuthToken?: string; ip?: string };
-        return reply(200, tried.plexAuthToken === TOKEN && tried.ip === "ace.internal");
-      }
-      return reply(404);
-    },
-  };
-  return { http, calls, store };
-}
-
-// What an operator's ombi holds: plex loaded through its public name, plus a friend's server.
-const operatorPlex = () => ({
-  enable: true,
-  enableWatchlistImport: true,
-  monitorAll: false,
-  installId: "b358a2a2-2ab0-4025-a3f3-450313c3c418",
-  servers: [
-    {
-      name: "ace", plexAuthToken: TOKEN, machineIdentifier: MACHINE, episodeBatchSize: 150,
-      serverHostname: "https://app.plex.tv", plexSelectedLibraries: [{ key: "1", title: "Films", enabled: true }],
-      ssl: true, subDir: null, ip: "plex.zurag.be", port: 443, id: 1,
-    },
-    {
-      name: "a friend", plexAuthToken: "their-token", machineIdentifier: "another-server", episodeBatchSize: 150,
-      plexSelectedLibraries: [], ssl: false, subDir: null, ip: "10.0.0.9", port: 32400, id: 2,
-    },
-  ],
-  id: 4,
-});
-
-test("the server's own entry gets the bound connection; its libraries and every other setting stay", async () => {
-  const f = fakes(operatorPlex());
-  const out = await reconcilePlex(f.http, OMBI, binding(), `${TOKEN}\n`);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["ip", "port", "ssl"] });
-  const want = operatorPlex();
-  Object.assign(want.servers[0], { ip: "ace.internal", port: 32400, ssl: false });
-  assert.deepEqual(f.store.plex, want);
-});
-
-test("another server's entry is never touched", async () => {
-  const f = fakes(operatorPlex());
-  await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  const servers = f.store.plex.servers as Record<string, unknown>[];
-  assert.deepEqual(servers[1], operatorPlex().servers[1]);
-});
-
-test("nothing is written when ombi already says what the mesh says", async () => {
-  const doc = operatorPlex();
-  Object.assign(doc.servers[0], { ip: "ace.internal", port: 32400, ssl: false });
-  const f = fakes(doc);
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "unchanged" });
-  assert.equal(f.calls.filter((c) => c.method === "POST" && c.url.includes("/Settings/")).length, 0);
-});
-
-test("an ombi with no entry for this server gets one, named as plex names itself", async () => {
-  const fresh = { enable: false, enableWatchlistImport: false, monitorAll: false, installId: "x", servers: null, id: 0 };
-  const f = fakes(fresh);
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["server"] });
-  assert.deepEqual(f.store.plex, {
-    ...fresh,
-    servers: [{
-      name: "ace", machineIdentifier: MACHINE, ip: "ace.internal", port: 32400, ssl: false, subDir: null,
-      plexAuthToken: TOKEN, episodeBatchSize: 150, plexSelectedLibraries: [],
-    }],
-  });
-  assert.equal(f.store.plex.enable, false, "whether plex is enabled in ombi is the operator's choice");
-});
-
-test("a token plex refuses is never written, and the accept that fixes it is named", async () => {
-  for (const trusted of [false, true]) {
-    const f = fakes(operatorPlex(), { trusted });
-    const out = await reconcilePlex(f.http, OMBI, binding(), "a-value-the-mesh-minted");
-    assert.equal(out.result, "refused");
-    const problem = (out as { problem: string }).problem;
-    assert.match(problem, /secret accept <this node> ombi plex-api --provider ace/);
-    assert.doesNotMatch(problem, /a-value-the-mesh-minted/);
-    assert.deepEqual(f.store.plex, operatorPlex(), "ombi's working settings were left alone");
-    assert.equal(f.calls.some((c) => c.url.includes("/api/v1/")), false, "ombi was not even asked");
-  }
-});
-
-test("a plex it cannot reach is reported, and ombi is left alone", async () => {
-  const f = fakes(operatorPlex(), { reachable: false });
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /could not be asked.*ECONNREFUSED/);
-  assert.deepEqual(f.store.plex, operatorPlex());
-});
-
-test("a loopback binding is refused: from ombi's container it is ombi itself", () => {
-  const w = wantedPlex(binding(32400, "127.0.0.1"), TOKEN);
-  assert.equal(w.ok, false);
-  assert.match((w as { problem: string }).problem, /private network/);
-});
-
-test("an https binding sets ombi's ssl flag; an empty subDir is none", () => {
-  const w = wantedPlex(binding(32400, "ace.internal", "https"), TOKEN);
-  assert.equal(w.ok && w.connection.ssl, true);
-  assert.deepEqual(
-    differingPlex({ ip: "h", port: 1, ssl: false, subDir: "", plexAuthToken: "k" }, { ip: "h", port: 1, ssl: false, subDir: null, plexAuthToken: "k" }),
-    [],
-  );
-});
-
-test("every entry naming the server is laid over, not only the first", () => {
-  const doc = { servers: [{ machineIdentifier: MACHINE, ip: "a" }, { machineIdentifier: MACHINE, ip: "b" }] };
-  const want = { ip: "ace.internal", port: 32400, ssl: false, subDir: null, plexAuthToken: TOKEN };
-  const laid = withPlexServer(doc, MACHINE, want, "ace");
-  assert.equal(laid.added, false);
-  assert.deepEqual((laid.next.servers as { ip: string }[]).map((s) => s.ip), ["ace.internal", "ace.internal"]);
-});
-
-// ace's own ombi: its one entry was loaded from an older server (a stale identifier) and retyped to
-// plex's public name, so it IS this server, reached another way (read from ace, 2026-09-30).
-const acesOmbi = () => ({
-  enable: true,
-  enableWatchlistImport: true,
-  servers: [{
-    name: "Nami", plexAuthToken: TOKEN, machineIdentifier: "76562198623e708eef85b46aedb72c8f2fe671aa", episodeBatchSize: 0,
-    plexSelectedLibraries: [1, 2, 3, 4, 5, 6].map((k) => ({ key: String(k), enabled: true })), ssl: true, subDir: null,
-    ip: "plex.zurag.be", port: 443, id: 1,
-  }],
-  id: 4,
-});
-
-test("an entry whose own address answers as this server is adopted: connection and identifier, nothing else", async () => {
-  const f = fakes(acesOmbi());
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["ip", "port", "ssl", "machineIdentifier"] });
-  const want = acesOmbi();
-  Object.assign(want.servers[0], { ip: "ace.internal", port: 32400, ssl: false, machineIdentifier: MACHINE });
-  assert.deepEqual(f.store.plex, want, "one entry, still named Nami, its six libraries kept; none added");
-});
-
-test("an entry answering as another server, or not at all, is not adopted; this server gets its own", async () => {
-  const doc = {
-    servers: [
-      { name: "a friend", machineIdentifier: "stale-1", ip: "10.0.0.9", port: 32400, ssl: false, plexAuthToken: "theirs" },
-      { name: "gone", machineIdentifier: "stale-2", ip: "gone.example", port: 32400, ssl: false, plexAuthToken: "old" },
-    ],
-  };
-  const f = fakes(structuredClone(doc));
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["server"] });
-  const servers = f.store.plex.servers as Record<string, unknown>[];
-  assert.deepEqual(servers.slice(0, 2), doc.servers, "both left exactly as they were");
-  assert.equal(servers[2].machineIdentifier, MACHINE);
-});
-
-test("no entry is probed once one carries the server's identifier", async () => {
-  const f = fakes(operatorPlex());
-  await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.equal(f.calls.some((c) => c.url.startsWith("http://10.0.0.9")), false, "the friend's server was not asked");
-});

modules/ombi/test/servarr.test.ts

@@ -1,147 +0,0 @@
-// What holds ombi's Servarr step (servarr/settings.ts): the connection ombi keeps for each app is
-// made to say what the mesh bound — host, port, TLS, base path, key — and nothing else it keeps is
-// touched; nothing is written when nothing differs; Radarr's 4K instance is left alone; and a key the
-// app refuses (the mesh's own minted value, before the operator accepts the app's key) is never
-// written, with the `secret accept` that fixes it named.
-//
-// ombi and the apps are fakes: the routes the step touches, answering as the real ones do (checked
-// against lscr.io/linuxserver/ombi 4.53.10 and the catalogue's pinned sonarr/radarr/lidarr).
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { APPS, differing, reconcileApp, subDirOf, wanted, type Binding, type Http, type ServarrApp } from "../servarr/settings.ts";
-
-const SONARR = APPS.find((a) => a.app === "sonarr") as ServarrApp;
-const RADARR = APPS.find((a) => a.app === "radarr") as ServarrApp;
-const LIDARR = APPS.find((a) => a.app === "lidarr") as ServarrApp;
-const THE_KEY = "the-apps-own-key";
-
-function binding(provision: string, port: number, at = "ace.internal"): Binding {
-  return { binding: 1, provision, from: "ace", at, as: "mesh_ace_ombi", serves: { scheme: "http", port, "url-base": "" } } as Binding;
-}
-
-interface Call {
-  method: string;
-  url: string;
-  body?: unknown;
-}
-
-/** ombi's settings store and the apps' key check, behind one fetch. */
-function fakes(settings: Record<string, unknown>, opts: { appKey?: string; reachable?: boolean } = {}) {
-  const calls: Call[] = [];
-  const appKey = opts.appKey ?? THE_KEY;
-  const http: Http = {
-    async fetch(url, init) {
-      const method = init?.method ?? "GET";
-      const body = init?.body ? (JSON.parse(init.body) as unknown) : undefined;
-      calls.push({ method, url, body });
-      const reply = (status: number, value?: unknown) => ({
-        status,
-        text: async () => (value === undefined ? "" : JSON.stringify(value)),
-      });
-      const u = new URL(url);
-      if (u.pathname.endsWith("/system/status")) {
-        if (opts.reachable === false) throw new Error("connect ECONNREFUSED");
-        return init?.headers?.["X-Api-Key"] === appKey ? reply(200, { version: "4" }) : reply(401);
-      }
-      if (init?.headers?.ApiKey !== "ombi-key") return reply(401);
-      const m = u.pathname.match(/^\/api\/v1\/(Settings|Tester)\/(\w+)$/);
-      if (!m) return reply(404);
-      const [, kind, app] = m;
-      if (kind === "Settings" && method === "GET") return reply(200, settings[app]);
-      if (kind === "Settings" && method === "POST") {
-        settings[app] = body;
-        return reply(200, true);
-      }
-      const tried = body as { apiKey?: string };
-      return reply(200, { isValid: tried.apiKey === appKey, expectedSubDir: null });
-    },
-  };
-  return { http, calls, settings };
-}
-
-const OMBI = { url: "http://127.0.0.1:3579", apiKey: "ombi-key" };
-
-const operatorSonarr = () => ({
-  enabled: true, apiKey: "old-key", qualityProfile: "3", seasonFolders: true, rootPath: "10",
-  qualityProfileAnime: "7", rootPathAnime: "9", languageProfile: 1, ssl: false, subDir: null,
-  ip: "sonarr", port: 8989, id: 5,
-});
-
-test("it writes the connection the mesh bound, and keeps every other setting ombi had", async () => {
-  const f = fakes({ sonarr: operatorSonarr() });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), `${THE_KEY}\n`);
-  assert.deepEqual(out, { app: "sonarr", result: "written", fields: ["ip", "port", "apiKey"] });
-  assert.deepEqual(f.settings.sonarr, {
-    ...operatorSonarr(), ip: "ace.internal", port: 20101, apiKey: THE_KEY, ssl: false, subDir: null,
-  });
-  // Checked against the app itself, at the bound address, before anything was written.
-  assert.equal(f.calls[0].url, "http://ace.internal:20101/api/v3/system/status");
-});
-
-test("nothing is written when ombi already says what the mesh says", async () => {
-  const f = fakes({ sonarr: { ...operatorSonarr(), ip: "ace.internal", port: 20101, apiKey: THE_KEY } });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), THE_KEY);
-  assert.deepEqual(out, { app: "sonarr", result: "unchanged" });
-  assert.equal(f.calls.filter((c) => c.method === "POST" && c.url.includes("/Settings/")).length, 0);
-});
-
-test("a key the app refuses is never written, and the accept that fixes it is named", async () => {
-  const f = fakes({ sonarr: operatorSonarr() });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), "a-value-the-mesh-minted");
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /secret accept <this node> ombi sonarr-api --provider ace/);
-  assert.doesNotMatch((out as { problem: string }).problem, /a-value-the-mesh-minted/);
-  assert.deepEqual(f.settings.sonarr, operatorSonarr(), "ombi's working settings were left alone");
-  assert.equal(f.calls.some((c) => c.url.includes("/api/v1/")), false, "ombi was not even asked");
-});
-
-test("an app it cannot reach is reported, and ombi is left alone", async () => {
-  const f = fakes({ sonarr: operatorSonarr() }, { reachable: false });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), THE_KEY);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /could not be asked.*ECONNREFUSED/);
-  assert.deepEqual(f.settings.sonarr, operatorSonarr());
-});
-
-test("radarr's connection is written inside its combined document, and the 4K instance is untouched", async () => {
-  const fourK = { enabled: true, apiKey: "4k-key", ip: "radarr4k", port: 7879, defaultQualityProfile: "9", id: 7 };
-  const f = fakes({ radarr: { radarr: { enabled: true, apiKey: "old", ip: "radarr", port: 7878, defaultRootPath: "/movies", id: 6 }, radarr4K: fourK } });
-  const out = await reconcileApp(f.http, OMBI, RADARR, binding("radarr-api", 20102), THE_KEY);
-  assert.equal(out.result, "written");
-  const doc = f.settings.radarr as { radarr: Record<string, unknown>; radarr4K: unknown };
-  assert.deepEqual(doc.radarr4K, fourK);
-  assert.equal(doc.radarr.ip, "ace.internal");
-  assert.equal(doc.radarr.port, 20102);
-  assert.equal(doc.radarr.defaultRootPath, "/movies");
-});
-
-test("lidarr is checked on its own API version", async () => {
-  const f = fakes({ lidarr: { enabled: true, apiKey: null, ip: null, port: 0, id: 0 } });
-  const out = await reconcileApp(f.http, OMBI, LIDARR, binding("lidarr-api", 20103), THE_KEY);
-  assert.equal(out.result, "written");
-  assert.equal(f.calls[0].url, "http://ace.internal:20103/api/v1/system/status");
-});
-
-test("a loopback binding is refused: from ombi's container it is ombi itself", () => {
-  const w = wanted(SONARR, binding("sonarr-api", 20101, "127.0.0.1"), THE_KEY);
-  assert.equal(w.ok, false);
-  assert.match((w as { problem: string }).problem, /private network/);
-});
-
-test("the base path is ombi's subDir, slashes trimmed; empty is none", () => {
-  assert.equal(subDirOf(""), null);
-  assert.equal(subDirOf("/sonarr/"), "sonarr");
-  assert.deepEqual(
-    differing({ ip: "h", port: 1, ssl: false, subDir: "", apiKey: "k" }, { ip: "h", port: 1, ssl: false, subDir: null, apiKey: "k" }),
-    [],
-  );
-});
-
-test("an https binding sets ombi's ssl flag", () => {
-  const b = binding("sonarr-api", 443);
-  (b.serves as Record<string, unknown>).scheme = "https";
-  const w = wanted(SONARR, b, THE_KEY);
-  assert.equal(w.ok && w.connection.ssl, true);
-});

modules/ombi/tsconfig.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["client.ts", "index.ts", "tools/index.ts", "servarr/settings.ts", "plex/settings.ts", "connections/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }

modules/qbittorrent/module.json

@@ -82,7 +82,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_QBITTORRENT_URL": "http://127.0.0.1:${port:8080}",
+        "MESH_QBITTORRENT_URL": "http://127.0.0.1:8080",
         "MESH_QBITTORRENT_PASSWORD_FILE": "/run/secrets/password",
         "MESH_QBITTORRENT_CONFIG_FILE": "/run/config/config.json",
         "MESH_QBITTORRENT_CONFIG_DIR": "/var/lib/qbittorrent/config"

modules/radarr/module.json

@@ -1,19 +1,6 @@
 {
   "module": "radarr",
   "version": "1",
-  "provides": [
-    {
-      "name": "radarr-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "radarr-api": {
-      "scheme": "http",
-      "port": 7878,
-      "url-base": ""
-    }
-  },
   "capabilities": [
     "container-runtime"
   ],
@@ -88,7 +75,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RADARR_URL": "http://127.0.0.1:${port:7878}",
+        "MESH_RADARR_URL": "http://127.0.0.1:7878",
         "MESH_RADARR_CONFIG_DIR": "/var/lib/radarr/config"
       },
       "artifact": "runtime"

modules/searxng/module.json

@@ -100,7 +100,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_SEARXNG_URL": "http://127.0.0.1:${port:8080}",
+        "MESH_SEARXNG_URL": "http://127.0.0.1:8080",
         "MESH_SEARXNG_CONFIG_FILE": "/run/config/config.json"
       },
       "restart-on": [

modules/sonarr/module.json

@@ -1,19 +1,6 @@
 {
   "module": "sonarr",
   "version": "1",
-  "provides": [
-    {
-      "name": "sonarr-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "sonarr-api": {
-      "scheme": "http",
-      "port": 8989,
-      "url-base": ""
-    }
-  },
   "capabilities": [
     "container-runtime"
   ],
@@ -93,7 +80,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_SONARR_URL": "http://127.0.0.1:${port:8989}",
+        "MESH_SONARR_URL": "http://127.0.0.1:8989",
         "MESH_SONARR_CONFIG_DIR": "/var/lib/sonarr/config"
       },
       "artifact": "runtime"