grafana: its directories are placed, its admin password is a file, and it runs the build in use

The module stated /var/lib/grafana-module and /services/grafana/data, a
layout no definition may carry (ADR 0112). State and data are now placed
directories; the admin secret lives beside the broker account under the
mesh's own state.

The admin password reached grafana through an env-file. Grafana honours
GF_SECURITY_ADMIN_PASSWORD__FILE, so it is now a 0400 file owned by the
image's user (472) and mounted, and "secrets-in-environment" is gone
(ADR 0086).

The runtime sidecar was given no credential at all - its config file was
"{}", so GrafanaClient.fromEnv threw and the tools and the alert watcher
did nothing. It now carries user/password from the same secret, and it
calls grafana on the machine port the mesh assigned (${port:3000}) rather
than a literal 3000.

Image pinned to the 13.2.2 build ace's predecessor runs; the old pin was
13.2.1, older than the data it would open.

Verified: catalogue tests with MESH_CATALOGUE pointing here; a throwaway
container of the pinned image with the file-mounted secret answers
/api/health and authenticates admin with the file's value (default
admin/admin refused); restarted over the same data with a different file
value, the original password still holds - so a migrated instance's
password must be accepted, not minted; data owned by another uid fails to
start, so a moved data directory must be chowned to 472.

modules/grafana/module.json

@@ -5,7 +5,7 @@
     "alert.firing"
   ],
   "own-secrets": {
-    "admin": "/var/lib/grafana-module/admin.secret",
+    "admin": "/var/lib/mesh/grafana/admin",
     "broker": "/var/lib/mesh/grafana/broker"
   },
   "capabilities": [
@@ -30,45 +30,45 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/grafana-module",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "data",
       "type": "directory",
-      "path": "/services/grafana/data",
       "mode": "0700",
       "owner": "472:472"
     },
     {
-      "id": "server-env",
+      "id": "admin-secret",
       "type": "file",
-      "path": "/var/lib/grafana-module/server.env",
-      "mode": "0600",
-      "content": "GF_SECURITY_ADMIN_PASSWORD=${secret:admin}\n"
+      "path": "${dir:state}/admin.secret",
+      "mode": "0400",
+      "owner": "472:472",
+      "content": "${secret:admin}"
     },
     {
       "id": "server",
       "type": "container",
       "name": "grafana",
-      "image": "grafana/grafana@sha256:f772d434e8fab0049deb2b1b30abd43342bcfca1537614aa8d36080232cf4283",
+      "image": "grafana/grafana@sha256:ac461fb352abc50da10a51c7d02462e9c05488f11f53f14b3ad79a8145f638a0",
       "ports": [
         "3000"
       ],
       "volumes": [
-        "/services/grafana/data:/var/lib/grafana"
+        "${dir:data}:/var/lib/grafana",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro"
       ],
-      "env-file": [
-        "/var/lib/grafana-module/server.env"
-      ],
-      "secrets-in-environment": "grafana honours GF_SECURITY_ADMIN_PASSWORD__FILE; convertible, awaiting a bed that exercises the admin password (assigned-grafana serves tools only)"
+      "env": {
+        "GF_SECURITY_ADMIN_PASSWORD__FILE": "/run/secrets/admin"
+      }
     },
     {
       "id": "runtime-config",
       "type": "file",
       "path": "/var/lib/mesh/grafana/config.json",
       "mode": "0600",
-      "content": "{}\n",
+      "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
       "merge": "json"
     },
     {
@@ -82,7 +82,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_GRAFANA_URL": "http://127.0.0.1:3000",
+        "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
         "MESH_GRAFANA_CONFIG_FILE": "/run/config/config.json"
       },
       "restart-on": [
@@ -101,7 +101,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/mesh/grafana/route.json"
+    "route": "${dir:state}/route.json"
   },
   "build": {
     "on": [

modules/tautulli/client.ts

@@ -41,32 +41,6 @@ function meshConfig(file?: string): Record<string, string> {
   catch { return {}; }
 }
 
-/**
- * The API key Tautulli minted for itself, read from its own config.ini (mounted read-only).
- *
- * Tautulli owns this key: it writes it on first run and every client of its API — this runtime
- * included — must present the same one. So the mesh does not mint or hold it; the one place it
- * lives is the file Tautulli keeps, and a key regenerated in Tautulli's settings is simply read
- * again on the next start. Undefined when there is no file or no key yet (a fresh install whose
- * setup wizard has not run).
- */
-function keyOfTautulli(dir?: string): string | undefined {
-  if (!dir) return undefined;
-  let ini: string;
-  try { ini = readFileSync(`${dir.replace(/\/$/, "")}/config.ini`, "utf8"); }
-  catch { return undefined; }
-  let section = "";
-  for (const raw of ini.split(/\r?\n/)) {
-    const line = raw.trim();
-    const header = /^\[(.+)\]$/.exec(line);
-    if (header) { section = header[1]; continue; }
-    if (section !== "General") continue;
-    const kv = /^api_key\s*=\s*"?([^"]*)"?$/.exec(line);
-    if (kv && kv[1]) return kv[1];
-  }
-  return undefined;
-}
-
 export class TautulliClient {
   readonly baseUrl: string;
 
@@ -78,16 +52,15 @@ export class TautulliClient {
   }
 
   /**
-   * Build from the module's resolved environment. The API key is the one Tautulli minted for
-   * itself (Settings → Web Interface), read from its config.ini under MESH_TAUTULLI_CONFIG_DIR;
-   * MESH_TAUTULLI_APIKEY still wins where it is set. The base URL defaults to the local container.
+   * Build from the module's resolved environment. The API key is read from MESH_TAUTULLI_APIKEY
+   * (Tautulli mints it in Settings → Web Interface); the base URL defaults to the local container.
    * Throws when no key is configured — the module then contributes nothing rather than failing.
    */
   static fromEnv(env: NodeJS.ProcessEnv = process.env): TautulliClient {
     const cfg = meshConfig(env.MESH_TAUTULLI_CONFIG_FILE);
     const url = cfg.url ?? (env.MESH_TAUTULLI_URL ?? `http://127.0.0.1:${env.TAUTULLI_PORT ?? "8181"}`);
-    const apiKey = cfg.apiKey ?? env.MESH_TAUTULLI_APIKEY ?? keyOfTautulli(env.MESH_TAUTULLI_CONFIG_DIR);
-    if (!apiKey) throw new Error("no Tautulli API key — Tautulli's config.ini has none yet (finish its setup and enable the API)");
+    const apiKey = cfg.apiKey ?? env.MESH_TAUTULLI_APIKEY;
+    if (!apiKey) throw new Error("no Tautulli API key — set MESH_TAUTULLI_APIKEY");
     return new TautulliClient(url, apiKey);
   }
 

modules/tautulli/module.json

@@ -16,7 +16,7 @@
       "port": 8181,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the watch statistics pages and API"
+      "why": "watch statistics"
     }
   ],
   "resources": [
@@ -26,15 +26,10 @@
       "path": "/var/lib/mesh/tautulli",
       "mode": "0700"
     },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
     {
       "id": "config",
       "type": "directory",
+      "path": "/services/tautulli/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -42,7 +37,7 @@
       "id": "server",
       "type": "container",
       "name": "tautulli",
-      "image": "lscr.io/linuxserver/tautulli@sha256:e35570d636471f8aabfac7044057712679f954844a763ba735baa9659ea142b5",
+      "image": "lscr.io/linuxserver/tautulli@sha256:13f03ecfc61a7af89d492677389771ac29682a72153ce08a5cd4faffbc0197e8",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
@@ -52,7 +47,7 @@
         "8181"
       ],
       "volumes": [
-        "${dir:config}:/config"
+        "/services/tautulli/config:/config"
       ]
     },
     {
@@ -71,11 +66,11 @@
       "volumes": [
         "/var/lib/mesh/tautulli/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/tautulli/config.json:/run/config/config.json:ro",
-        "${dir:config}:/var/lib/tautulli/config:ro"
+        "/services/tautulli/config:/var/lib/tautulli/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_TAUTULLI_URL": "http://127.0.0.1:${port:8181}",
+        "MESH_TAUTULLI_URL": "http://127.0.0.1:8181",
         "MESH_TAUTULLI_CONFIG_FILE": "/run/config/config.json",
         "MESH_TAUTULLI_CONFIG_DIR": "/var/lib/tautulli/config"
       },
@@ -95,7 +90,7 @@
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json"
+    "route": "/var/lib/mesh/tautulli/route.json"
   },
   "build": {
     "on": [