Merge remote-tracking branch 'origin/fix/sidecars-dial-the-port-they-were-given' into feat/qbittorrent-for-ace

# Conflicts: # modules/qbittorrent/module.json
qbittorrent: it listens on the port the mesh gave it, rather than fixing it
2026-09-30 13:18:00 +02:00 · 2026-09-30 12:32:16 +02:00 · 2026-09-30 12:00:41 +02:00
14 changed files with 108 additions and 1153 deletions
@@ -1,19 +1,6 @@
 {
  "module": "lidarr",
  "version": "1",
-  "provides": [
-    {
-      "name": "lidarr-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "lidarr-api": {
-      "scheme": "http",
-      "port": 8686,
-      "url-base": ""
-    }
-  },
  "capabilities": [
    "container-runtime"
  ],
@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/ombi
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts servarr/settings.ts plex/settings.ts connections/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist

 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/ombi/dist /app/modules/ombi/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/ombi/dist/index.js,/app/modules/ombi/dist/tools/index.js
-# NOT dist/connections/index.js: that is a step the host runs to completion, named by the `connections`
-# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
-# serving sidecar too, and exit it.
@@ -1,66 +0,0 @@
-// ombi's connections step — run once by the host after ombi's server starts, and run again whenever
-// a binding or pair credential it reads changes (the container's `restart-on`, novox/hq ADR 0099).
-// It brings ombi's connections to Sonarr, Radarr, Lidarr (servarr/settings.ts) and Plex
-// (plex/settings.ts) in line with what the mesh bound.
-//
-// **A step, not a loop**, for the reason route-adapter gives: everything it does is a function of
-// files the mesh writes, and the host already knows when they change. It connects to no broker.
-//
-// Exits non-zero when any app could not be put right — a refused credential, an unreachable app, an
-// ombi that cannot reach it — so the node reports the step failed and the host runs it again on the
-// next apply. It is declared last in the manifest, so its failing gates nothing else of ombi's
-// (novox/hq ADR 0136). One app failing does not stop the others being put right.
-//
-// Reads, per provision, `<dir>/<provision>.json` (the binding) and `<dir>/<provision>.secret` (the
-// pair credential), where <dir> is MESH_CONNECTIONS_DIR. Never prints a key or a token.
-
-import { join } from "node:path";
-
-import { PLEX_PROVISION, reconcilePlex } from "../plex/settings.js";
-import { APPS, ombiReady, readBinding, readIfThere, reconcileApp, type Http, type Outcome } from "../servarr/settings.js";
-
-const dir = process.env.MESH_CONNECTIONS_DIR ?? "/run/connections";
-const url = process.env.MESH_OMBI_URL ?? "http://127.0.0.1:3579";
-const apiKey = (await readIfThere(process.env.MESH_OMBI_API_KEY_FILE))?.trim() ?? process.env.MESH_OMBI_API_KEY ?? "";
-const waitSeconds = Number(process.env.MESH_OMBI_WAIT_SECONDS ?? "180");
-
-// Every call bounded: an entry ombi keeps may name a host that no longer answers, and a step that
-// hangs on it holds the apply.
-const http: Http = { fetch: (u, init) => fetch(u, { ...init, signal: AbortSignal.timeout(20_000) }) };
-
-if (!apiKey) {
-  console.error("[ombi-connections] no ombi API key — ombi's own `api-key` secret has not been accepted");
-  process.exit(1);
-}
-const ombi = { url, apiKey };
-
-if (!(await ombiReady(http, ombi, waitSeconds * 1000))) {
-  console.error(`[ombi-connections] ombi did not answer at ${url} within ${waitSeconds}s`);
-  process.exit(1);
-}
-
-const inputs = async (provision: string) =>
-  [await readBinding(join(dir, `${provision}.json`)), await readIfThere(join(dir, `${provision}.secret`))] as const;
-
-const outcomes: Outcome[] = [];
-for (const spec of APPS) {
-  outcomes.push(await reconcileApp(http, ombi, spec, ...(await inputs(spec.provision))));
-}
-outcomes.push(await reconcilePlex(http, ombi, ...(await inputs(PLEX_PROVISION))));
-
-let failed = 0;
-for (const outcome of outcomes) {
-  switch (outcome.result) {
-    case "unchanged":
-      console.log(`[ombi-connections] ${outcome.app}: already as the mesh says; connection tested`);
-      break;
-    case "written":
-      console.log(`[ombi-connections] ${outcome.app}: wrote ${outcome.fields.join(", ")}; connection tested`);
-      break;
-    case "refused":
-      failed++;
-      console.error(`[ombi-connections] ${outcome.app}: ${outcome.problem}`);
-      break;
-  }
-}
-process.exitCode = failed > 0 ? 1 : 0;
@@ -28,15 +28,10 @@
      "path": "/var/lib/mesh/ombi",
      "mode": "0700"
    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
    {
      "id": "config",
      "type": "directory",
+      "path": "/services/ombi/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -44,7 +39,7 @@
      "id": "server",
      "type": "container",
      "name": "ombi",
-      "image": "lscr.io/linuxserver/ombi@sha256:22d6ebadbaaa728571353e74dc2173719e0fb02d4eaec551a7e9d2ee99ef68ac",
+      "image": "lscr.io/linuxserver/ombi@sha256:a6f76ac521ba01eee2e9f0c23a3fed22e56630d97a04d5eeaeaa36c1e681640d",
      "env": {
        "PUID": "1000",
        "PGID": "1000",
@@ -54,7 +49,7 @@
        "3579"
      ],
      "volumes": [
-        "${dir:config}:/config"
+        "/services/ombi/config:/config"
      ]
    },
    {
@@ -73,64 +68,24 @@
      "volumes": [
        "/var/lib/mesh/ombi/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro",
-        "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro",
+        "/services/ombi/config:/var/lib/ombi/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_OMBI_URL": "http://127.0.0.1:${port:3579}",
+        "MESH_OMBI_URL": "http://127.0.0.1:3579",
        "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key",
-        "MESH_OMBI_CONFIG_FILE": "/run/config/config.json"
+        "MESH_OMBI_CONFIG_FILE": "/run/config/config.json",
+        "MESH_OMBI_CONFIG_DIR": "/var/lib/ombi/config"
      },
      "restart-on": [
        "runtime-config"
      ],
      "artifact": "runtime"
-    },
-    {
-      "id": "connections",
-      "type": "container",
-      "name": "mesh-ombi-connections",
-      "network": "host",
-      "run-once": true,
-      "volumes": [
-        "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro",
-        "${dir:state}/sonarr-api.json:/run/connections/sonarr-api.json:ro",
-        "${dir:state}/sonarr-api.secret:/run/connections/sonarr-api.secret:ro",
-        "${dir:state}/radarr-api.json:/run/connections/radarr-api.json:ro",
-        "${dir:state}/radarr-api.secret:/run/connections/radarr-api.secret:ro",
-        "${dir:state}/lidarr-api.json:/run/connections/lidarr-api.json:ro",
-        "${dir:state}/lidarr-api.secret:/run/connections/lidarr-api.secret:ro",
-        "${dir:state}/plex-api.json:/run/connections/plex-api.json:ro",
-        "${dir:state}/plex-api.secret:/run/connections/plex-api.secret:ro"
-      ],
-      "env": {
-        "MESH_OMBI_URL": "http://127.0.0.1:${port:3579}",
-        "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key",
-        "MESH_CONNECTIONS_DIR": "/run/connections"
-      },
-      "args": [
-        "run",
-        "/app/modules/ombi/dist/connections/index.js"
-      ],
-      "restart-on": [
-        "bound-sonarr-api",
-        "secret-sonarr-api",
-        "bound-radarr-api",
-        "secret-radarr-api",
-        "bound-lidarr-api",
-        "secret-lidarr-api",
-        "bound-plex-api",
-        "secret-plex-api"
-      ],
-      "artifact": "runtime"
    }
  ],
  "requires": [
-    "lidarr-api",
-    "plex-api",
-    "radarr-api",
-    "route",
-    "sonarr-api"
+    "route"
  ],
  "contributes": {
    "route": {
@@ -139,17 +94,7 @@
    }
  },
  "binds": {
-    "route": "${dir:state}/route.json",
-    "sonarr-api": "${dir:state}/sonarr-api.json",
-    "radarr-api": "${dir:state}/radarr-api.json",
-    "lidarr-api": "${dir:state}/lidarr-api.json",
-    "plex-api": "${dir:state}/plex-api.json"
-  },
-  "secrets": {
-    "sonarr-api": "${dir:state}/sonarr-api.secret",
-    "radarr-api": "${dir:state}/radarr-api.secret",
-    "lidarr-api": "${dir:state}/lidarr-api.secret",
-    "plex-api": "${dir:state}/plex-api.secret"
+    "route": "/var/lib/mesh/ombi/route.json"
  },
  "build": {
    "on": [
@@ -4,11 +4,6 @@
  "description": "ombi — media requests. Its API client, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
-  "scripts": {
-    "build": "tsc client.ts index.ts tools/index.ts servarr/settings.ts plex/settings.ts connections/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
-  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.0"
  },
@@ -1,271 +0,0 @@
-// Where ombi reaches Plex — decided by the mesh, written into ombi by ombi's own API.
-//
-// **Why this exists.** ombi keeps its Plex servers in its own database (OmbiSettings.db), so the
-// mesh has no file to write `${bound:plex-api:at}` into. ombi requires `plex-api`; the mesh delivers
-// a binding (where plex is: `at`, and what it serves: `port`, `scheme`) and a pair credential (the
-// server owner's X-Plex-Token, accepted by the operator — plex.tv issues it and the mesh cannot
-// mint it). This step makes ombi's Plex settings say the same thing, beside its Servarr ones.
-//
-// **Which entry is plex's.** ombi may list several Plex servers. The one this provision names is
-// found by the server's own machineIdentifier, which plex answers at /identity — the same value
-// ombi stored when an operator loaded the server in its settings screen. That entry's connection is
-// brought in line; an entry for any other server is never touched.
-//
-// When no entry carries that identifier, an entry may still be this server reached another way:
-// ace's ombi holds one loaded from an older server and later retyped to plex's public name, so its
-// stored identifier is stale while its address answers as this plex. Each entry's OWN address is
-// asked for /identity, and an entry plex itself answers for is this server's — adopted: its
-// connection laid over and its identifier corrected (ombi builds its "view in Plex" links from it).
-// Nothing is guessed: an entry whose address is unreachable, or answers as another server, is left
-// as it was. Only when no entry is this server's either way is one added, named as plex names
-// itself — it is the mesh's, so later runs keep it true.
-//
-// **Only the connection, and only when it differs.** Host, port, TLS, base path and token — and the
-// identifier of an adopted entry. Whether Plex is enabled in ombi, watchlist import, the selected
-// libraries, the batch size and everything else an operator chose are left exactly as they are.
-//
-// **A token plex refuses is never written.** Until the operator accepts the server's token for this
-// pair, the mesh delivers a value it minted itself, which plex answers with 401 (or 400 on its own
-// network). Writing it would replace a working token in ombi with a dead one, so the token is tried
-// against plex first; refused, nothing is written and the step fails naming the `secret accept`.
-
-import { isLoopback, ombiCall, type Binding, type Http, type Ombi, type Outcome } from "../servarr/settings.js";
-
-/** The provision ombi requires for Plex — the manifest's `requires`, `binds` and `secrets` key. */
-export const PLEX_PROVISION = "plex-api";
-
-/** The connection fields ombi keeps for a Plex server — the only ones this step ever writes. */
-export interface PlexConnection {
-  ip: string;
-  port: number;
-  ssl: boolean;
-  subDir: string | null;
-  plexAuthToken: string;
-}
-
-export type PlexWanted = { ok: true; connection: PlexConnection; from: string } | { ok: false; problem: string };
-
-/** The connection the mesh says ombi should use, from the binding and the pair credential. */
-export function wantedPlex(binding: Binding | undefined, credential: string | undefined): PlexWanted {
-  if (!binding) {
-    return { ok: false, problem: `no binding for ${PLEX_PROVISION} was delivered — the mesh writes it before this step runs` };
-  }
-  const at = typeof binding.at === "string" ? binding.at.trim() : "";
-  const serves = binding.serves ?? {};
-  const port = Number(serves.port);
-  if (!at) return { ok: false, problem: `the ${PLEX_PROVISION} binding names no host (at)` };
-  if (isLoopback(at)) {
-    return {
-      ok: false,
-      problem:
-        `the ${PLEX_PROVISION} binding says plex is at ${at}, which from ombi's own container is ombi itself. ` +
-        `The mesh hands loopback to a machine that is not on the private network; put it on the private ` +
-        `network so plex has an address ombi can dial`,
-    };
-  }
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    return { ok: false, problem: `the ${PLEX_PROVISION} binding serves no usable port (${String(serves.port)})` };
-  }
-  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
-  if (scheme !== "http" && scheme !== "https") {
-    return { ok: false, problem: `the ${PLEX_PROVISION} binding serves scheme ${scheme}, which ombi cannot dial` };
-  }
-  const token = (credential ?? "").trim();
-  if (!token) return { ok: false, problem: `the ${PLEX_PROVISION} credential is empty or was not delivered` };
-  return {
-    ok: true,
-    from: typeof binding.from === "string" ? binding.from : "",
-    connection: { ip: at, port, ssl: scheme === "https", subDir: null, plexAuthToken: token },
-  };
-}
-
-/** plex's base URL as the step dials it — the same host and port ombi will be given. */
-export function plexUrl(want: PlexConnection): string {
-  const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip;
-  return `${want.ssl ? "https" : "http"}://${host}:${want.port}`;
-}
-
-/** Which connection fields differ between an entry ombi holds and what the mesh says. Names only. */
-export function differingPlex(current: Record<string, unknown> | undefined, want: PlexConnection): (keyof PlexConnection)[] {
-  const now = current ?? {};
-  const out: (keyof PlexConnection)[] = [];
-  if (String(now.ip ?? "") !== want.ip) out.push("ip");
-  if (Number(now.port ?? 0) !== want.port) out.push("port");
-  if (Boolean(now.ssl) !== want.ssl) out.push("ssl");
-  const sub = typeof now.subDir === "string" && now.subDir.trim() !== "" ? now.subDir : null;
-  if (sub !== want.subDir) out.push("subDir");
-  if (String(now.plexAuthToken ?? "") !== want.plexAuthToken) out.push("plexAuthToken");
-  return out;
-}
-
-async function plexGet(http: Http, want: PlexConnection, path: string, withToken: boolean) {
-  const headers: Record<string, string> = { Accept: "application/json" };
-  if (withToken) headers["X-Plex-Token"] = want.plexAuthToken;
-  return http.fetch(`${plexUrl(want)}${path}`, { method: "GET", headers });
-}
-
-/**
- * Does plex take this token? `true` it does; `false` it refused it — 401 or 403, or 400, which is
- * what plex answers a token it never issued on a network it trusts. A thrown error when plex could
- * not be asked.
- */
-export async function plexTakes(http: Http, want: PlexConnection): Promise<{ takes: boolean; friendlyName?: string }> {
-  const res = await plexGet(http, want, "/", true);
-  if (res.status === 400 || res.status === 401 || res.status === 403) return { takes: false };
-  if (res.status < 200 || res.status >= 300) throw new Error(`plex answered ${res.status} at /`);
-  let friendlyName: string | undefined;
-  try {
-    const body = JSON.parse(await res.text()) as { MediaContainer?: { friendlyName?: unknown } };
-    if (typeof body.MediaContainer?.friendlyName === "string") friendlyName = body.MediaContainer.friendlyName;
-  } catch {
-    // a name is a nicety for a new entry, not a condition
-  }
-  return { takes: true, friendlyName };
-}
-
-/** The server's own machineIdentifier, which plex answers without a token. */
-export async function plexIdentity(http: Http, want: Pick<PlexConnection, "ip" | "port" | "ssl" | "subDir">): Promise<string> {
-  const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip;
-  const base = `${want.ssl ? "https" : "http"}://${host}:${want.port}${want.subDir ? `/${want.subDir.replace(/^\/+|\/+$/g, "")}` : ""}`;
-  const res = await http.fetch(`${base}/identity`, { method: "GET", headers: { Accept: "application/json" } });
-  if (res.status !== 200) throw new Error(`plex answered ${res.status} at /identity`);
-  const body = JSON.parse(await res.text()) as { MediaContainer?: { machineIdentifier?: unknown } };
-  const id = body.MediaContainer?.machineIdentifier;
-  if (typeof id !== "string" || id === "") throw new Error("plex's /identity names no machineIdentifier");
-  return id;
-}
-
-/** The remedy for a refused token, in the controller's own words (ADR 0092). */
-export function plexAcceptRemedy(from: string): string {
-  return (
-    `plex refuses the ${PLEX_PROVISION} credential the mesh delivered, so it was not written into ombi. ` +
-    `plex's token is issued by plex.tv and the mesh cannot make it: accept the server's own token for ` +
-    `this pair — \`secret accept <this node> ombi ${PLEX_PROVISION} --provider ${from || "<its node>"} ` +
-    `--from <file holding the server's X-Plex-Token>\``
-  );
-}
-
-/** The batch size ombi's settings screen fills in for a server it adds ("150 by default"). */
-const EPISODE_BATCH_SIZE = 150;
-
-/** ombi's server entries, as its settings document holds them (null on a fresh ombi). */
-export function serversOf(document: Record<string, unknown> | undefined): Record<string, unknown>[] {
-  const servers = document?.servers;
-  return Array.isArray(servers) ? (servers as Record<string, unknown>[]) : [];
-}
-
-/**
- * Which entries, holding another identifier, plex answers for at their own address — this server,
- * reached another way. Asked only when no entry carries the identifier. An entry that cannot be
- * asked is not this server's: nothing is guessed.
- */
-export async function answeringAs(http: Http, servers: Record<string, unknown>[], machineIdentifier: string): Promise<Set<number>> {
-  const out = new Set<number>();
-  if (servers.some((s) => s?.machineIdentifier === machineIdentifier)) return out;
-  for (const [i, s] of servers.entries()) {
-    const ip = typeof s?.ip === "string" ? s.ip.trim() : "";
-    const port = Number(s?.port);
-    if (!ip || !Number.isInteger(port) || port <= 0 || port > 65535) continue;
-    const subDir = typeof s.subDir === "string" && s.subDir.trim() !== "" ? s.subDir : null;
-    try {
-      if ((await plexIdentity(http, { ip, port, ssl: Boolean(s.ssl), subDir })) === machineIdentifier) out.add(i);
-    } catch {
-      // unreachable, or not a plex: not this server's
-    }
-  }
-  return out;
-}
-
-/**
- * ombi's Plex settings with this server's connection laid over them: every entry naming the
- * server's machineIdentifier — or adopted, its address answering as this server — gets the
- * connection (an adopted one also the identifier), every other entry is left as it was, and when
- * none is this server's one is added. Returns the document to save and the fields that changed.
- */
-export function withPlexServer(
-  document: Record<string, unknown> | undefined,
-  machineIdentifier: string,
-  want: PlexConnection,
-  name: string,
-  adopted: ReadonlySet<number> = new Set(),
-): { next: Record<string, unknown>; fields: string[]; added: boolean; entry: Record<string, unknown> } {
-  const doc = document ?? {};
-  const servers = serversOf(doc);
-  const fields = new Set<string>();
-  let entry: Record<string, unknown> | undefined;
-  const next = servers.map((s, i) => {
-    const adopt = adopted.has(i) && s?.machineIdentifier !== machineIdentifier;
-    if (s?.machineIdentifier !== machineIdentifier && !adopt) return s;
-    for (const f of differingPlex(s, want)) fields.add(f);
-    if (adopt) fields.add("machineIdentifier");
-    const laid = { ...s, machineIdentifier, ip: want.ip, port: want.port, ssl: want.ssl, subDir: want.subDir, plexAuthToken: want.plexAuthToken };
-    entry ??= laid;
-    return laid;
-  });
-  if (entry) return { next: { ...doc, servers: next }, fields: [...fields], added: false, entry };
-  const added: Record<string, unknown> = {
-    name,
-    machineIdentifier,
-    ip: want.ip,
-    port: want.port,
-    ssl: want.ssl,
-    subDir: want.subDir,
-    plexAuthToken: want.plexAuthToken,
-    episodeBatchSize: EPISODE_BATCH_SIZE,
-    plexSelectedLibraries: [],
-  };
-  return { next: { ...doc, servers: [...next, added] }, fields: ["server"], added: true, entry: added };
-}
-
-/**
- * Bring ombi's connection to plex in line with the mesh: check the token against plex, find the
- * server's entry by its machineIdentifier, write only the connection fields when they differ (or add
- * the entry), then have ombi test the connection from its own container. Never throws.
- */
-export async function reconcilePlex(http: Http, ombi: Ombi, binding: Binding | undefined, credential: string | undefined): Promise<Outcome> {
-  const app = "plex";
-  const w = wantedPlex(binding, credential);
-  // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not
-  // narrow.
-  if ("problem" in w) return { app, result: "refused", problem: w.problem };
-  const want = w.connection;
-
-  let name: string;
-  let machineIdentifier: string;
-  try {
-    const taken = await plexTakes(http, want);
-    if (!taken.takes) return { app, result: "refused", problem: plexAcceptRemedy(w.from) };
-    machineIdentifier = await plexIdentity(http, want);
-    name = taken.friendlyName || "Plex";
-  } catch (err) {
-    return { app, result: "refused", problem: `plex could not be asked whether it takes the token at ${want.ip}:${want.port}: ${message(err)}` };
-  }
-
-  try {
-    const document = (await ombiCall(http, ombi, "GET", "/Settings/Plex")) as Record<string, unknown> | undefined;
-    const adopted = await answeringAs(http, serversOf(document), machineIdentifier);
-    const laid = withPlexServer(document, machineIdentifier, want, name, adopted);
-    if (laid.fields.length > 0) {
-      const saved = await ombiCall(http, ombi, "POST", "/Settings/Plex", laid.next);
-      if (saved === false) return { app, result: "refused", problem: "ombi declined to save its Plex settings" };
-    }
-    // ombi's own test, from ombi's own container — the path the step's check above did not take.
-    const tested = await ombiCall(http, ombi, "POST", "/Tester/plex", laid.entry);
-    if (tested !== true) {
-      return {
-        app,
-        result: "refused",
-        problem:
-          `ombi cannot reach plex at ${want.ip}:${want.port} from its own container` +
-          (laid.fields.length > 0 ? `; its settings were written (${laid.fields.join(", ")})` : ""),
-      };
-    }
-    return laid.fields.length > 0 ? { app, result: "written", fields: laid.fields } : { app, result: "unchanged" };
-  } catch (err) {
-    return { app, result: "refused", problem: message(err) };
-  }
-}
-
-function message(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
-}
@@ -1,304 +0,0 @@
-// Where ombi reaches Sonarr, Radarr and Lidarr — decided by the mesh, written into ombi by ombi's
-// own API.
-//
-// **Why this exists.** ombi keeps its connection to each Servarr app in its own database
-// (OmbiSettings.db), not in a file, so the mesh has nowhere to write `${bound:sonarr-api:at}` for it.
-// ombi requires `sonarr-api`, `radarr-api` and `lidarr-api`; the mesh delivers, for each, a binding
-// (where the app is: `at`, and what it serves: `port`, `scheme`, `url-base`) and a pair credential
-// (the app's API key, accepted by the operator — a Servarr app has exactly one key and the mesh
-// cannot mint it). This step reads those files and makes ombi's settings say the same thing.
-//
-// **Only the connection, and only when it differs.** Host, port, TLS, base path and API key. The
-// quality profile, root folder, language profile, tags, "enabled" and every other choice an operator
-// made in ombi's settings screen are left exactly as they are: the mesh knows where the app is, not
-// what ombi should do with it. Radarr's 4K instance is a different Radarr and is not touched.
-//
-// **A credential the app refuses is never written.** Until the operator accepts the app's API key
-// for this pair, the mesh delivers a value it minted itself, which no Servarr app will ever accept
-// (novox/hq ADR 0092). Writing it would replace a working key in ombi with a dead one. So the key is
-// tried against the app first; refused, nothing for that app is written and the step fails naming
-// the `secret accept` that fixes it.
-//
-// Pure logic and a small HTTP seam, so it is tested against fake servers (test/servarr.test.ts).
-
-import { readFile } from "node:fs/promises";
-
-/** One Servarr app ombi connects to, and the shape of that connection in ombi's API. */
-export interface ServarrApp {
-  /** The app, as ombi's API names it: /Settings/<app>, /Tester/<app>. */
-  app: "sonarr" | "radarr" | "lidarr";
-  /** The provision it is required as — the manifest's `requires`, `binds` and `secrets` key. */
-  provision: string;
-  /** The app's own status endpoint, which answers 401 to a wrong key. */
-  statusPath: string;
-  /**
-   * Where the one connection sits in ombi's settings document. Radarr's is `{radarr, radarr4K}`
-   * (two Radarr instances); only `radarr` is this provision's.
-   */
-  within?: string;
-}
-
-export const APPS: readonly ServarrApp[] = [
-  { app: "sonarr", provision: "sonarr-api", statusPath: "/api/v3/system/status" },
-  { app: "radarr", provision: "radarr-api", statusPath: "/api/v3/system/status", within: "radarr" },
-  { app: "lidarr", provision: "lidarr-api", statusPath: "/api/v1/system/status" },
-];
-
-/** The connection fields ombi keeps for an app — the only ones this step ever writes. */
-export interface Connection {
-  ip: string;
-  port: number;
-  ssl: boolean;
-  /** ombi's name for the app's URL base; null when the app is served at the root. */
-  subDir: string | null;
-  apiKey: string;
-}
-
-/** What the mesh wrote at `binds.<provision>`: the binding document (controller's boundFile). */
-export interface Binding {
-  provision?: string;
-  from?: string;
-  at?: string;
-  as?: string;
-  serves?: Record<string, unknown>;
-}
-
-export type Wanted = { ok: true; connection: Connection; from: string } | { ok: false; problem: string };
-
-/**
- * The connection the mesh says ombi should use, from the binding and the pair credential.
- *
- * Refused rather than guessed when the binding cannot be dialled from ombi's own container: a
- * loopback `at` — what the mesh hands a machine that is not on the private network — is ombi's
- * container itself, not the app.
- */
-export function wanted(spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): Wanted {
-  if (!binding) {
-    return { ok: false, problem: `no binding for ${spec.provision} was delivered — the mesh writes it before this step runs` };
-  }
-  const at = typeof binding.at === "string" ? binding.at.trim() : "";
-  const serves = binding.serves ?? {};
-  const port = Number(serves.port);
-  if (!at) {
-    return { ok: false, problem: `the ${spec.provision} binding names no host (at)` };
-  }
-  if (isLoopback(at)) {
-    return {
-      ok: false,
-      problem:
-        `the ${spec.provision} binding says ${spec.app} is at ${at}, which from ombi's own container is ` +
-        `ombi itself. The mesh hands loopback to a machine that is not on the private network; put it ` +
-        `on the private network so ${spec.app} has an address ombi can dial`,
-    };
-  }
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    return { ok: false, problem: `the ${spec.provision} binding serves no usable port (${String(serves.port)})` };
-  }
-  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
-  if (scheme !== "http" && scheme !== "https") {
-    return { ok: false, problem: `the ${spec.provision} binding serves scheme ${scheme}, which ombi cannot dial` };
-  }
-  const key = (credential ?? "").trim();
-  if (!key) {
-    return { ok: false, problem: `the ${spec.provision} credential is empty or was not delivered` };
-  }
-  return {
-    ok: true,
-    from: typeof binding.from === "string" ? binding.from : "",
-    connection: { ip: at, port, ssl: scheme === "https", subDir: subDirOf(serves["url-base"]), apiKey: key },
-  };
-}
-
-/** ombi's `subDir`: the URL base with its slashes trimmed, null when there is none. */
-export function subDirOf(urlBase: unknown): string | null {
-  const trimmed = typeof urlBase === "string" ? urlBase.trim().replace(/^\/+|\/+$/g, "") : "";
-  return trimmed === "" ? null : trimmed;
-}
-
-export function isLoopback(host: string): boolean {
-  const h = host.toLowerCase();
-  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
-}
-
-/** Which connection fields differ between what ombi holds and what the mesh says. Names only. */
-export function differing(current: Record<string, unknown> | undefined, want: Connection): (keyof Connection)[] {
-  const now = current ?? {};
-  const out: (keyof Connection)[] = [];
-  if (String(now.ip ?? "") !== want.ip) out.push("ip");
-  if (Number(now.port ?? 0) !== want.port) out.push("port");
-  if (Boolean(now.ssl) !== want.ssl) out.push("ssl");
-  if (subDirOf(now.subDir) !== want.subDir) out.push("subDir");
-  if (String(now.apiKey ?? "") !== want.apiKey) out.push("apiKey");
-  return out;
-}
-
-/** ombi's settings for the app with the connection laid over them and nothing else changed. */
-export function withConnection(current: Record<string, unknown> | undefined, want: Connection): Record<string, unknown> {
-  return { ...(current ?? {}), ip: want.ip, port: want.port, ssl: want.ssl, subDir: want.subDir, apiKey: want.apiKey };
-}
-
-/** The app's base URL as the step dials it — the same host and port ombi will be given. */
-export function appUrl(want: Connection): string {
-  const scheme = want.ssl ? "https" : "http";
-  const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip;
-  return `${scheme}://${host}:${want.port}${want.subDir ? `/${want.subDir}` : ""}`;
-}
-
-/** How one app came out. */
-export type Outcome =
-  | { app: string; result: "unchanged" }
-  | { app: string; result: "written"; fields: string[] }
-  | { app: string; result: "refused"; problem: string };
-
-/** The HTTP the step needs, so a test can stand fakes in for ombi and the apps. */
-export interface Http {
-  fetch(url: string, init?: { method?: string; headers?: Record<string, string>; body?: string }): Promise<{
-    status: number;
-    text(): Promise<string>;
-  }>;
-}
-
-export interface Ombi {
-  url: string;
-  apiKey: string;
-}
-
-export async function ombiCall(http: Http, ombi: Ombi, method: string, path: string, body?: unknown): Promise<unknown> {
-  const res = await http.fetch(`${ombi.url.replace(/\/$/, "")}/api/v1${path}`, {
-    method,
-    headers: {
-      ApiKey: ombi.apiKey,
-      Accept: "application/json",
-      ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
-    },
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-  });
-  const text = await res.text();
-  if (res.status < 200 || res.status >= 300) {
-    // The body is ombi's error, never a request echo, so it carries no key.
-    throw new Error(`ombi ${method} ${path} answered ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
-  }
-  return text ? (JSON.parse(text) as unknown) : undefined;
-}
-
-/**
- * Does the app take this key? `true` it does, `false` it refused it (401/403), and a thrown error
- * when it could not be asked — unreachable, or answering something that is neither.
- */
-export async function appTakes(http: Http, spec: ServarrApp, want: Connection): Promise<boolean> {
-  const res = await http.fetch(`${appUrl(want)}${spec.statusPath}`, {
-    method: "GET",
-    headers: { "X-Api-Key": want.apiKey, Accept: "application/json" },
-  });
-  if (res.status === 401 || res.status === 403) return false;
-  if (res.status >= 200 && res.status < 300) return true;
-  throw new Error(`${spec.app} answered ${res.status} at ${spec.statusPath}`);
-}
-
-/** The remedy for a refused key, in the controller's own words (ADR 0092). */
-export function acceptRemedy(spec: ServarrApp, from: string): string {
-  return (
-    `${spec.app} refuses the ${spec.provision} credential the mesh delivered, so it was not written ` +
-    `into ombi. A Servarr app has one API key and the mesh cannot make it: accept ${spec.app}'s own ` +
-    `key for this pair — \`secret accept <this node> ombi ${spec.provision} --provider ${from || "<its node>"} ` +
-    `--from <file holding ${spec.app}'s ApiKey>\``
-  );
-}
-
-/**
- * Bring ombi's connection to one app in line with the mesh: check the key against the app, compare,
- * write only the connection fields when they differ, then have ombi test the connection from its own
- * container. Never throws: every failure is an outcome with a reason.
- */
-export async function reconcileApp(
-  http: Http,
-  ombi: Ombi,
-  spec: ServarrApp,
-  binding: Binding | undefined,
-  credential: string | undefined,
-): Promise<Outcome> {
-  const w = wanted(spec, binding, credential);
-  // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not
-  // narrow.
-  if ("problem" in w) return { app: spec.app, result: "refused", problem: w.problem };
-  const want = w.connection;
-
-  try {
-    if (!(await appTakes(http, spec, want))) {
-      return { app: spec.app, result: "refused", problem: acceptRemedy(spec, w.from) };
-    }
-  } catch (err) {
-    return {
-      app: spec.app,
-      result: "refused",
-      problem: `${spec.app} could not be asked whether it takes the key at ${want.ip}:${want.port}: ${message(err)}`,
-    };
-  }
-
-  try {
-    const document = (await ombiCall(http, ombi, "GET", `/Settings/${spec.app}`)) as Record<string, unknown> | undefined;
-    const current = spec.within ? (document?.[spec.within] as Record<string, unknown> | undefined) : document;
-    const fields = differing(current, want);
-    if (fields.length > 0) {
-      const next = withConnection(current, want);
-      const body = spec.within ? { ...(document ?? {}), [spec.within]: next } : next;
-      const saved = await ombiCall(http, ombi, "POST", `/Settings/${spec.app}`, body);
-      if (saved === false) {
-        return { app: spec.app, result: "refused", problem: `ombi declined to save its ${spec.app} settings` };
-      }
-    }
-    // ombi's own test, from ombi's own container — the path the step's check above did not take.
-    const tested = (await ombiCall(http, ombi, "POST", `/Tester/${spec.app}`, withConnection(current, want))) as
-      | { isValid?: boolean; expectedSubDir?: string | null }
-      | undefined;
-    if (!tested?.isValid) {
-      const hint = tested?.expectedSubDir ? ` (ombi expected the base path ${tested.expectedSubDir})` : "";
-      return {
-        app: spec.app,
-        result: "refused",
-        problem:
-          `ombi cannot reach ${spec.app} at ${want.ip}:${want.port} from its own container${hint}` +
-          (fields.length > 0 ? `; its settings were written (${fields.join(", ")})` : ""),
-      };
-    }
-    return fields.length > 0 ? { app: spec.app, result: "written", fields } : { app: spec.app, result: "unchanged" };
-  } catch (err) {
-    return { app: spec.app, result: "refused", problem: message(err) };
-  }
-}
-
-/** Wait for ombi to answer, because the step runs right after its container starts. */
-export async function ombiReady(http: Http, ombi: Ombi, waitMs: number, pauseMs = 2000): Promise<boolean> {
-  const until = Date.now() + waitMs;
-  for (;;) {
-    try {
-      const res = await http.fetch(`${ombi.url.replace(/\/$/, "")}/api/v1/Status`, { method: "GET" });
-      if (res.status === 200) return true;
-    } catch {
-      // not listening yet
-    }
-    if (Date.now() >= until) return false;
-    await new Promise((r) => setTimeout(r, pauseMs));
-  }
-}
-
-/** A file the mesh wrote, or undefined when it is not there. */
-export async function readIfThere(path: string | undefined): Promise<string | undefined> {
-  if (!path) return undefined;
-  return readFile(path, "utf8").catch(() => undefined);
-}
-
-/** A binding file parsed, or undefined when absent or not JSON. */
-export async function readBinding(path: string | undefined): Promise<Binding | undefined> {
-  const raw = await readIfThere(path);
-  if (raw === undefined) return undefined;
-  try {
-    return JSON.parse(raw) as Binding;
-  } catch {
-    return undefined;
-  }
-}
-
-function message(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
-}
@@ -1,223 +0,0 @@
-// What holds ombi's Plex step (plex/settings.ts): the entry for the server plex says it is — found
-// by machineIdentifier — is made to say what the mesh bound (host, port, TLS, token) and nothing
-// else it keeps is touched; an entry for another server is left alone; an ombi with no entry for it
-// gets one; nothing is written when nothing differs; and a token plex refuses (the mesh's own minted
-// value, before the operator accepts the server's token) is never written, with the `secret accept`
-// that fixes it named.
-//
-// ombi and plex are fakes answering the routes the step touches as the real ones do (checked against
-// lscr.io/linuxserver/ombi 4.53.10 and plexinc/pms-docker 1.43.4: plex answers 401 to an unknown
-// token from another network and 400 on one it trusts; ombi's /Tester/plex answers a bare boolean).
-//
-// Imports the compiled step, as keycloak's tests do: plex/settings.ts imports its sibling with the
-// `.js` specifier the build needs, which Node's type stripping does not resolve to a `.ts` file.
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { differingPlex, reconcilePlex, wantedPlex, withPlexServer } from "../dist/plex/settings.js";
-import type { Binding, Http } from "../servarr/settings.ts";
-
-const TOKEN = "the-servers-own-token";
-const MACHINE = "5c47d9a165d10b622995d55b3ae1f168242f33bd";
-const OMBI = { url: "http://127.0.0.1:3579", apiKey: "ombi-key" };
-
-function binding(port = 32400, at = "ace.internal", scheme = "http"): Binding {
-  return { binding: 1, provision: "plex-api", from: "ace", at, as: "mesh_ace_ombi", serves: { scheme, port } } as Binding;
-}
-
-interface Call {
-  method: string;
-  url: string;
-  body?: unknown;
-}
-
-function fakes(plexSettings: Record<string, unknown>, opts: { reachable?: boolean; trusted?: boolean } = {}) {
-  const calls: Call[] = [];
-  const store = { plex: plexSettings };
-  const http: Http = {
-    async fetch(url, init) {
-      const method = init?.method ?? "GET";
-      const body = init?.body ? (JSON.parse(init.body) as unknown) : undefined;
-      calls.push({ method, url, body });
-      const reply = (status: number, value?: unknown) => ({
-        status,
-        text: async () => (value === undefined ? "" : JSON.stringify(value)),
-      });
-      const u = new URL(url);
-      // Other servers an entry may name: a friend's, and plex's own public name (the same server).
-      if (u.hostname === "10.0.0.9") return reply(200, { MediaContainer: { machineIdentifier: "another-server" } });
-      if (u.hostname === "gone.example") throw new Error("getaddrinfo ENOTFOUND");
-      if (u.hostname === "plex.zurag.be") {
-        if (u.pathname === "/identity") return reply(200, { MediaContainer: { machineIdentifier: MACHINE } });
-        return reply(401);
-      }
-      if (u.port === "32400" || u.hostname === "ace.internal") {
-        if (opts.reachable === false) throw new Error("connect ECONNREFUSED");
-        if (u.pathname === "/identity") return reply(200, { MediaContainer: { machineIdentifier: MACHINE } });
-        const token = init?.headers?.["X-Plex-Token"];
-        if (token !== TOKEN) return reply(opts.trusted ? 400 : 401);
-        return reply(200, { MediaContainer: { friendlyName: "ace", machineIdentifier: MACHINE } });
-      }
-      if (init?.headers?.ApiKey !== "ombi-key") return reply(401);
-      if (u.pathname === "/api/v1/Settings/Plex" && method === "GET") return reply(200, store.plex);
-      if (u.pathname === "/api/v1/Settings/Plex" && method === "POST") {
-        store.plex = body as Record<string, unknown>;
-        return reply(200, true);
-      }
-      if (u.pathname === "/api/v1/Tester/plex") {
-        const tried = body as { plexAuthToken?: string; ip?: string };
-        return reply(200, tried.plexAuthToken === TOKEN && tried.ip === "ace.internal");
-      }
-      return reply(404);
-    },
-  };
-  return { http, calls, store };
-}
-
-// What an operator's ombi holds: plex loaded through its public name, plus a friend's server.
-const operatorPlex = () => ({
-  enable: true,
-  enableWatchlistImport: true,
-  monitorAll: false,
-  installId: "b358a2a2-2ab0-4025-a3f3-450313c3c418",
-  servers: [
-    {
-      name: "ace", plexAuthToken: TOKEN, machineIdentifier: MACHINE, episodeBatchSize: 150,
-      serverHostname: "https://app.plex.tv", plexSelectedLibraries: [{ key: "1", title: "Films", enabled: true }],
-      ssl: true, subDir: null, ip: "plex.zurag.be", port: 443, id: 1,
-    },
-    {
-      name: "a friend", plexAuthToken: "their-token", machineIdentifier: "another-server", episodeBatchSize: 150,
-      plexSelectedLibraries: [], ssl: false, subDir: null, ip: "10.0.0.9", port: 32400, id: 2,
-    },
-  ],
-  id: 4,
-});
-
-test("the server's own entry gets the bound connection; its libraries and every other setting stay", async () => {
-  const f = fakes(operatorPlex());
-  const out = await reconcilePlex(f.http, OMBI, binding(), `${TOKEN}\n`);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["ip", "port", "ssl"] });
-  const want = operatorPlex();
-  Object.assign(want.servers[0], { ip: "ace.internal", port: 32400, ssl: false });
-  assert.deepEqual(f.store.plex, want);
-});
-
-test("another server's entry is never touched", async () => {
-  const f = fakes(operatorPlex());
-  await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  const servers = f.store.plex.servers as Record<string, unknown>[];
-  assert.deepEqual(servers[1], operatorPlex().servers[1]);
-});
-
-test("nothing is written when ombi already says what the mesh says", async () => {
-  const doc = operatorPlex();
-  Object.assign(doc.servers[0], { ip: "ace.internal", port: 32400, ssl: false });
-  const f = fakes(doc);
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "unchanged" });
-  assert.equal(f.calls.filter((c) => c.method === "POST" && c.url.includes("/Settings/")).length, 0);
-});
-
-test("an ombi with no entry for this server gets one, named as plex names itself", async () => {
-  const fresh = { enable: false, enableWatchlistImport: false, monitorAll: false, installId: "x", servers: null, id: 0 };
-  const f = fakes(fresh);
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["server"] });
-  assert.deepEqual(f.store.plex, {
-    ...fresh,
-    servers: [{
-      name: "ace", machineIdentifier: MACHINE, ip: "ace.internal", port: 32400, ssl: false, subDir: null,
-      plexAuthToken: TOKEN, episodeBatchSize: 150, plexSelectedLibraries: [],
-    }],
-  });
-  assert.equal(f.store.plex.enable, false, "whether plex is enabled in ombi is the operator's choice");
-});
-
-test("a token plex refuses is never written, and the accept that fixes it is named", async () => {
-  for (const trusted of [false, true]) {
-    const f = fakes(operatorPlex(), { trusted });
-    const out = await reconcilePlex(f.http, OMBI, binding(), "a-value-the-mesh-minted");
-    assert.equal(out.result, "refused");
-    const problem = (out as { problem: string }).problem;
-    assert.match(problem, /secret accept <this node> ombi plex-api --provider ace/);
-    assert.doesNotMatch(problem, /a-value-the-mesh-minted/);
-    assert.deepEqual(f.store.plex, operatorPlex(), "ombi's working settings were left alone");
-    assert.equal(f.calls.some((c) => c.url.includes("/api/v1/")), false, "ombi was not even asked");
-  }
-});
-
-test("a plex it cannot reach is reported, and ombi is left alone", async () => {
-  const f = fakes(operatorPlex(), { reachable: false });
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /could not be asked.*ECONNREFUSED/);
-  assert.deepEqual(f.store.plex, operatorPlex());
-});
-
-test("a loopback binding is refused: from ombi's container it is ombi itself", () => {
-  const w = wantedPlex(binding(32400, "127.0.0.1"), TOKEN);
-  assert.equal(w.ok, false);
-  assert.match((w as { problem: string }).problem, /private network/);
-});
-
-test("an https binding sets ombi's ssl flag; an empty subDir is none", () => {
-  const w = wantedPlex(binding(32400, "ace.internal", "https"), TOKEN);
-  assert.equal(w.ok && w.connection.ssl, true);
-  assert.deepEqual(
-    differingPlex({ ip: "h", port: 1, ssl: false, subDir: "", plexAuthToken: "k" }, { ip: "h", port: 1, ssl: false, subDir: null, plexAuthToken: "k" }),
-    [],
-  );
-});
-
-test("every entry naming the server is laid over, not only the first", () => {
-  const doc = { servers: [{ machineIdentifier: MACHINE, ip: "a" }, { machineIdentifier: MACHINE, ip: "b" }] };
-  const want = { ip: "ace.internal", port: 32400, ssl: false, subDir: null, plexAuthToken: TOKEN };
-  const laid = withPlexServer(doc, MACHINE, want, "ace");
-  assert.equal(laid.added, false);
-  assert.deepEqual((laid.next.servers as { ip: string }[]).map((s) => s.ip), ["ace.internal", "ace.internal"]);
-});
-
-// ace's own ombi: its one entry was loaded from an older server (a stale identifier) and retyped to
-// plex's public name, so it IS this server, reached another way (read from ace, 2026-09-30).
-const acesOmbi = () => ({
-  enable: true,
-  enableWatchlistImport: true,
-  servers: [{
-    name: "Nami", plexAuthToken: TOKEN, machineIdentifier: "76562198623e708eef85b46aedb72c8f2fe671aa", episodeBatchSize: 0,
-    plexSelectedLibraries: [1, 2, 3, 4, 5, 6].map((k) => ({ key: String(k), enabled: true })), ssl: true, subDir: null,
-    ip: "plex.zurag.be", port: 443, id: 1,
-  }],
-  id: 4,
-});
-
-test("an entry whose own address answers as this server is adopted: connection and identifier, nothing else", async () => {
-  const f = fakes(acesOmbi());
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["ip", "port", "ssl", "machineIdentifier"] });
-  const want = acesOmbi();
-  Object.assign(want.servers[0], { ip: "ace.internal", port: 32400, ssl: false, machineIdentifier: MACHINE });
-  assert.deepEqual(f.store.plex, want, "one entry, still named Nami, its six libraries kept; none added");
-});
-
-test("an entry answering as another server, or not at all, is not adopted; this server gets its own", async () => {
-  const doc = {
-    servers: [
-      { name: "a friend", machineIdentifier: "stale-1", ip: "10.0.0.9", port: 32400, ssl: false, plexAuthToken: "theirs" },
-      { name: "gone", machineIdentifier: "stale-2", ip: "gone.example", port: 32400, ssl: false, plexAuthToken: "old" },
-    ],
-  };
-  const f = fakes(structuredClone(doc));
-  const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.deepEqual(out, { app: "plex", result: "written", fields: ["server"] });
-  const servers = f.store.plex.servers as Record<string, unknown>[];
-  assert.deepEqual(servers.slice(0, 2), doc.servers, "both left exactly as they were");
-  assert.equal(servers[2].machineIdentifier, MACHINE);
-});
-
-test("no entry is probed once one carries the server's identifier", async () => {
-  const f = fakes(operatorPlex());
-  await reconcilePlex(f.http, OMBI, binding(), TOKEN);
-  assert.equal(f.calls.some((c) => c.url.startsWith("http://10.0.0.9")), false, "the friend's server was not asked");
-});
@@ -1,147 +0,0 @@
-// What holds ombi's Servarr step (servarr/settings.ts): the connection ombi keeps for each app is
-// made to say what the mesh bound — host, port, TLS, base path, key — and nothing else it keeps is
-// touched; nothing is written when nothing differs; Radarr's 4K instance is left alone; and a key the
-// app refuses (the mesh's own minted value, before the operator accepts the app's key) is never
-// written, with the `secret accept` that fixes it named.
-//
-// ombi and the apps are fakes: the routes the step touches, answering as the real ones do (checked
-// against lscr.io/linuxserver/ombi 4.53.10 and the catalogue's pinned sonarr/radarr/lidarr).
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { APPS, differing, reconcileApp, subDirOf, wanted, type Binding, type Http, type ServarrApp } from "../servarr/settings.ts";
-
-const SONARR = APPS.find((a) => a.app === "sonarr") as ServarrApp;
-const RADARR = APPS.find((a) => a.app === "radarr") as ServarrApp;
-const LIDARR = APPS.find((a) => a.app === "lidarr") as ServarrApp;
-const THE_KEY = "the-apps-own-key";
-
-function binding(provision: string, port: number, at = "ace.internal"): Binding {
-  return { binding: 1, provision, from: "ace", at, as: "mesh_ace_ombi", serves: { scheme: "http", port, "url-base": "" } } as Binding;
-}
-
-interface Call {
-  method: string;
-  url: string;
-  body?: unknown;
-}
-
-/** ombi's settings store and the apps' key check, behind one fetch. */
-function fakes(settings: Record<string, unknown>, opts: { appKey?: string; reachable?: boolean } = {}) {
-  const calls: Call[] = [];
-  const appKey = opts.appKey ?? THE_KEY;
-  const http: Http = {
-    async fetch(url, init) {
-      const method = init?.method ?? "GET";
-      const body = init?.body ? (JSON.parse(init.body) as unknown) : undefined;
-      calls.push({ method, url, body });
-      const reply = (status: number, value?: unknown) => ({
-        status,
-        text: async () => (value === undefined ? "" : JSON.stringify(value)),
-      });
-      const u = new URL(url);
-      if (u.pathname.endsWith("/system/status")) {
-        if (opts.reachable === false) throw new Error("connect ECONNREFUSED");
-        return init?.headers?.["X-Api-Key"] === appKey ? reply(200, { version: "4" }) : reply(401);
-      }
-      if (init?.headers?.ApiKey !== "ombi-key") return reply(401);
-      const m = u.pathname.match(/^\/api\/v1\/(Settings|Tester)\/(\w+)$/);
-      if (!m) return reply(404);
-      const [, kind, app] = m;
-      if (kind === "Settings" && method === "GET") return reply(200, settings[app]);
-      if (kind === "Settings" && method === "POST") {
-        settings[app] = body;
-        return reply(200, true);
-      }
-      const tried = body as { apiKey?: string };
-      return reply(200, { isValid: tried.apiKey === appKey, expectedSubDir: null });
-    },
-  };
-  return { http, calls, settings };
-}
-
-const OMBI = { url: "http://127.0.0.1:3579", apiKey: "ombi-key" };
-
-const operatorSonarr = () => ({
-  enabled: true, apiKey: "old-key", qualityProfile: "3", seasonFolders: true, rootPath: "10",
-  qualityProfileAnime: "7", rootPathAnime: "9", languageProfile: 1, ssl: false, subDir: null,
-  ip: "sonarr", port: 8989, id: 5,
-});
-
-test("it writes the connection the mesh bound, and keeps every other setting ombi had", async () => {
-  const f = fakes({ sonarr: operatorSonarr() });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), `${THE_KEY}\n`);
-  assert.deepEqual(out, { app: "sonarr", result: "written", fields: ["ip", "port", "apiKey"] });
-  assert.deepEqual(f.settings.sonarr, {
-    ...operatorSonarr(), ip: "ace.internal", port: 20101, apiKey: THE_KEY, ssl: false, subDir: null,
-  });
-  // Checked against the app itself, at the bound address, before anything was written.
-  assert.equal(f.calls[0].url, "http://ace.internal:20101/api/v3/system/status");
-});
-
-test("nothing is written when ombi already says what the mesh says", async () => {
-  const f = fakes({ sonarr: { ...operatorSonarr(), ip: "ace.internal", port: 20101, apiKey: THE_KEY } });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), THE_KEY);
-  assert.deepEqual(out, { app: "sonarr", result: "unchanged" });
-  assert.equal(f.calls.filter((c) => c.method === "POST" && c.url.includes("/Settings/")).length, 0);
-});
-
-test("a key the app refuses is never written, and the accept that fixes it is named", async () => {
-  const f = fakes({ sonarr: operatorSonarr() });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), "a-value-the-mesh-minted");
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /secret accept <this node> ombi sonarr-api --provider ace/);
-  assert.doesNotMatch((out as { problem: string }).problem, /a-value-the-mesh-minted/);
-  assert.deepEqual(f.settings.sonarr, operatorSonarr(), "ombi's working settings were left alone");
-  assert.equal(f.calls.some((c) => c.url.includes("/api/v1/")), false, "ombi was not even asked");
-});
-
-test("an app it cannot reach is reported, and ombi is left alone", async () => {
-  const f = fakes({ sonarr: operatorSonarr() }, { reachable: false });
-  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), THE_KEY);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /could not be asked.*ECONNREFUSED/);
-  assert.deepEqual(f.settings.sonarr, operatorSonarr());
-});
-
-test("radarr's connection is written inside its combined document, and the 4K instance is untouched", async () => {
-  const fourK = { enabled: true, apiKey: "4k-key", ip: "radarr4k", port: 7879, defaultQualityProfile: "9", id: 7 };
-  const f = fakes({ radarr: { radarr: { enabled: true, apiKey: "old", ip: "radarr", port: 7878, defaultRootPath: "/movies", id: 6 }, radarr4K: fourK } });
-  const out = await reconcileApp(f.http, OMBI, RADARR, binding("radarr-api", 20102), THE_KEY);
-  assert.equal(out.result, "written");
-  const doc = f.settings.radarr as { radarr: Record<string, unknown>; radarr4K: unknown };
-  assert.deepEqual(doc.radarr4K, fourK);
-  assert.equal(doc.radarr.ip, "ace.internal");
-  assert.equal(doc.radarr.port, 20102);
-  assert.equal(doc.radarr.defaultRootPath, "/movies");
-});
-
-test("lidarr is checked on its own API version", async () => {
-  const f = fakes({ lidarr: { enabled: true, apiKey: null, ip: null, port: 0, id: 0 } });
-  const out = await reconcileApp(f.http, OMBI, LIDARR, binding("lidarr-api", 20103), THE_KEY);
-  assert.equal(out.result, "written");
-  assert.equal(f.calls[0].url, "http://ace.internal:20103/api/v1/system/status");
-});
-
-test("a loopback binding is refused: from ombi's container it is ombi itself", () => {
-  const w = wanted(SONARR, binding("sonarr-api", 20101, "127.0.0.1"), THE_KEY);
-  assert.equal(w.ok, false);
-  assert.match((w as { problem: string }).problem, /private network/);
-});
-
-test("the base path is ombi's subDir, slashes trimmed; empty is none", () => {
-  assert.equal(subDirOf(""), null);
-  assert.equal(subDirOf("/sonarr/"), "sonarr");
-  assert.deepEqual(
-    differing({ ip: "h", port: 1, ssl: false, subDir: "", apiKey: "k" }, { ip: "h", port: 1, ssl: false, subDir: null, apiKey: "k" }),
-    [],
-  );
-});
-
-test("an https binding sets ombi's ssl flag", () => {
-  const b = binding("sonarr-api", 443);
-  (b.serves as Record<string, unknown>).scheme = "https";
-  const w = wanted(SONARR, b, THE_KEY);
-  assert.equal(w.ok && w.connection.ssl, true);
-});
@@ -8,5 +8,5 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "index.ts", "tools/index.ts", "servarr/settings.ts", "plex/settings.ts", "connections/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }
@@ -3,8 +3,10 @@
 // qbittorrent. Both this module's tools and its events entrypoint import it, and nothing outside
 // qbittorrent does.
 //
-// The WebUI authenticates with a session cookie (SID) obtained by POSTing credentials, and guards
-// against CSRF by checking the Referer header. Node's fetch keeps no cookie jar, so the SID is
+// The WebUI authenticates with a session cookie obtained by POSTing credentials, and guards
+// against CSRF by checking the Referer header. The cookie was `SID` before qBittorrent 5.2 and is
+// `QBT_SID_<port>` since, and a successful login answers 200 "Ok." before and 204 with no body
+// since — both are accepted. Node's fetch keeps no cookie jar, so the cookie is
 // captured on login and carried by hand on every later call, with a single re-login on expiry.

 import { readFileSync } from "node:fs";
@@ -39,6 +41,21 @@ function meshConfig(file?: string): Record<string, string> {
  catch { return {}; }
 }

+/** The WebUI username from qBittorrent's own qBittorrent.conf, in the config directory the mesh
+ *  mounts read-only (MESH_QBITTORRENT_CONFIG_DIR, which is the container's /config). The software's
+ *  file is the truth about who may log in, so the tools ask it rather than a setting that could
+ *  disagree. Absent, unreadable or unset yields undefined. */
+function confUsername(dir: string | undefined): string | undefined {
+  if (!dir) return undefined;
+  try {
+    const line = readFileSync(`${dir.replace(/\/$/, "")}/qBittorrent/qBittorrent.conf`, "utf8")
+      .split(/\r?\n/)
+      .find((l) => l.startsWith("WebUI\\Username="));
+    const value = line?.slice("WebUI\\Username=".length).trim();
+    return value ? value : undefined;
+  } catch { return undefined; }
+}
+
 /** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
 *  absent or unreadable yields undefined so callers fall back rather than crash. */
 function readSecret(file?: string): string | undefined {
@@ -49,7 +66,8 @@ function readSecret(file?: string): string | undefined {

 export class QbittorrentClient {
  readonly baseUrl: string;
-  private sid: string | null = null;
+  /** The session cookie as `name=value`, sent back exactly as it was set. */
+  private session: string | null = null;

  constructor(
    baseUrl: string,
@@ -63,7 +81,9 @@ export class QbittorrentClient {
   * Build from the module's resolved environment. URL and password are read from
   * MESH_QBITTORRENT_URL and MESH_QBITTORRENT_PASSWORD; both must be present — an unconfigured
   * qBittorrent throws rather than pretend to be reachable, so the tools/events simply do not load
-   * (the harness treats the throw as "exposes nothing"). The user defaults to "admin".
+   * (the harness treats the throw as "exposes nothing"). The user is read from qBittorrent.conf,
+   * falling back to "admin", the image's default. The password cannot be read there — qBittorrent
+   * keeps only a PBKDF2 hash — so it is the own-secret the operator accepts.
   */
  static fromEnv(env: NodeJS.ProcessEnv = process.env): QbittorrentClient {
    const cfg = meshConfig(env.MESH_QBITTORRENT_CONFIG_FILE);
@@ -72,7 +92,9 @@ export class QbittorrentClient {
    if (!url || !password) {
      throw new Error("qBittorrent not configured — set MESH_QBITTORRENT_URL and MESH_QBITTORRENT_PASSWORD");
    }
-    const user = cfg.user ?? env.MESH_QBITTORRENT_USER ?? "admin";
+    // The WebUI username: a setting or the environment if one says so, else whatever
+    // qBittorrent.conf holds (an adopted machine keeps its own), else the image's "admin".
+    const user = cfg.user ?? env.MESH_QBITTORRENT_USER ?? confUsername(env.MESH_QBITTORRENT_CONFIG_DIR) ?? "admin";
    return new QbittorrentClient(url, user, password);
  }

@@ -82,19 +104,22 @@ export class QbittorrentClient {
      headers: { "Content-Type": "application/x-www-form-urlencoded", Referer: this.baseUrl },
      body: new URLSearchParams({ username: this.user, password: this.password }),
    });
+    if (res.status === 401) throw new Error("qBittorrent login rejected — check credentials");
    if (!res.ok) throw new Error(`qBittorrent login: ${res.status} ${await res.text()}`);
-    if ((await res.text()).trim() !== "Ok.") {
+    // 4.x/5.0/5.1 answer 200 "Ok." or 200 "Fails."; 5.2 answers 204 with no body, or 401.
+    const body = (await res.text()).trim();
+    if (res.status !== 204 && body !== "Ok.") {
      throw new Error("qBittorrent login rejected — check credentials");
    }
-    const match = res.headers.get("set-cookie")?.match(/SID=([^;]+)/);
-    if (!match) throw new Error("qBittorrent login returned no SID cookie");
-    this.sid = match[1];
+    const match = res.headers.get("set-cookie")?.match(/((?:QBT_)?SID(?:_\d+)?)=([^;]+)/);
+    if (!match) throw new Error("qBittorrent login returned no session cookie");
+    this.session = `${match[1]}=${match[2]}`;
  }

  private async call(method: "GET" | "POST", path: string, form?: Record<string, string>): Promise<Response> {
-    if (!this.sid) await this.login();
+    if (!this.session) await this.login();
    const doFetch = (): Promise<Response> => {
-      const headers: Record<string, string> = { Referer: this.baseUrl, Cookie: `SID=${this.sid}` };
+      const headers: Record<string, string> = { Referer: this.baseUrl, Cookie: this.session ?? "" };
      const init: RequestInit = { method, headers };
      if (form) {
        headers["Content-Type"] = "application/x-www-form-urlencoded";
@@ -103,8 +128,8 @@ export class QbittorrentClient {
      return fetch(`${this.baseUrl}/api/v2/${path}`, init);
    };
    let res = await doFetch();
-    if (res.status === 403) {
-      // The SID expired — re-authenticate once and retry, rather than fail a routine call.
+    if (res.status === 403 || res.status === 401) {
+      // The session expired — re-authenticate once and retry, rather than fail a routine call.
      await this.login();
      res = await doFetch();
    }
@@ -17,10 +17,24 @@
  "listens": [
    {
      "name": "web",
-      "port": 8080,
+      "port": 8112,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the download client's pages"
+      "why": "the download client's pages, and the WebUI API its consumers and its own tools call. qBittorrent refuses a request whose Host names a port other than the one it listens on, so it listens on the machine port itself (host network, WEBUI_PORT=${port:8112}) and the two cannot differ on any machine"
+    },
+    {
+      "name": "peers",
+      "port": 6881,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "incoming BitTorrent peer connections; announced to trackers and peers, so qBittorrent listens on the machine port itself (TORRENTING_PORT=${port:6881})"
+    },
+    {
+      "name": "peers-udp",
+      "port": 6881,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "DHT and uTP on the same number as the peer port"
    }
  ],
  "accesses": [
@@ -36,10 +50,15 @@
      "path": "/var/lib/mesh/qbittorrent",
      "mode": "0700"
    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
    {
      "id": "config",
      "type": "directory",
-      "path": "/services/qbittorrent/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -47,24 +66,24 @@
      "id": "server",
      "type": "container",
      "name": "qbittorrent",
-      "image": "lscr.io/linuxserver/qbittorrent@sha256:a00b6a597a3832a1814cde0ef60abc55c94644f3f80902c3432f6af6de8d4a96",
+      "image": "lscr.io/linuxserver/qbittorrent@sha256:457e4eec2ee3f5e4ef59f237ad51f6143deba9f7445ab48bb5204a98888ef9aa",
      "env": {
        "PUID": "1000",
        "PGID": "1000",
-        "TZ": "Etc/UTC"
+        "TZ": "Etc/UTC",
+        "WEBUI_PORT": "${port:8112}",
+        "TORRENTING_PORT": "${port:6881}"
      },
-      "ports": [
-        "8080"
-      ],
      "volumes": [
-        "/services/qbittorrent/config:/config",
+        "${dir:config}:/config",
        "/services/media/downloads:/downloads"
-      ]
+      ],
+      "network": "host"
    },
    {
      "id": "runtime-config",
      "type": "file",
-      "path": "/var/lib/mesh/qbittorrent/config.json",
+      "path": "${dir:state}/config.json",
      "mode": "0600",
      "content": "{}\n",
      "merge": "json"
@@ -77,22 +96,46 @@
      "volumes": [
        "/var/lib/mesh/qbittorrent/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/qbittorrent/password:/run/secrets/password:ro",
-        "/var/lib/mesh/qbittorrent/config.json:/run/config/config.json:ro",
-        "/services/qbittorrent/config:/var/lib/qbittorrent/config:ro"
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:config}:/var/lib/qbittorrent/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_QBITTORRENT_URL": "http://127.0.0.1:${port:8080}",
+        "MESH_QBITTORRENT_URL": "http://127.0.0.1:${port:8112}",
        "MESH_QBITTORRENT_PASSWORD_FILE": "/run/secrets/password",
        "MESH_QBITTORRENT_CONFIG_FILE": "/run/config/config.json",
        "MESH_QBITTORRENT_CONFIG_DIR": "/var/lib/qbittorrent/config"
      },
      "restart-on": [
-        "runtime-config"
+        "runtime-config",
+        "needs-password"
      ],
      "artifact": "runtime"
    }
  ],
+  "provides": [
+    "qbittorrent-api"
+  ],
+  "serves": {
+    "qbittorrent-api": {
+      "scheme": "http",
+      "port": 8112,
+      "url-base": "",
+      "username": "admin"
+    }
+  },
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "qbittorrent",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
  "build": {
    "on": [
      {
@@ -1,19 +1,6 @@
 {
  "module": "radarr",
  "version": "1",
-  "provides": [
-    {
-      "name": "radarr-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "radarr-api": {
-      "scheme": "http",
-      "port": 7878,
-      "url-base": ""
-    }
-  },
  "capabilities": [
    "container-runtime"
  ],
@@ -1,19 +1,6 @@
 {
  "module": "sonarr",
  "version": "1",
-  "provides": [
-    {
-      "name": "sonarr-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "sonarr-api": {
-      "scheme": "http",
-      "port": 8989,
-      "url-base": ""
-    }
-  },
  "capabilities": [
    "container-runtime"
  ],