nzbget: placed config, the build ace runs, its password a file, its API provided

The manifest named /services/nzbget/config and /var/lib/mesh/nzbget/config.json, host paths ADR 0112 takes out of definitions. The config dir is now pathless (${dir:config}); the runtime's config and route binding live in a placed state dir. The image is pinned to v26.0-ls233, the digest ace runs. The old pin (v26.3-ls261) is newer but unproven against ace's queue; moving up is a later, separate step. The password own-secret reached the tools and nothing else, so a fresh machine ran nzbget's well-known default while the tools held a minted value that matched nothing. The server now reads it too, through the image's FILE__NZBGET_PASS (a path in the environment, the value from a 0600 root file - ADR 0086), and both restart on it. An adopted machine accepts its existing ControlPassword. The tools assumed the control user is "nzbget"; they now read ControlUsername from nzbget.conf on the read-only config mount (ace's is not "nzbget"). sonarr, radarr, lidarr and bookshelf reached nzbget by container name on HAL's shared network. nzbget now provides nzbget-api (node scope: a download client must share the consumer's download spool) and serves scheme, port, url-base and username; the password is the operator-accepted pair credential, as for #156. The web endpoint is routed (label nzbget). The runtime dials ${port:6789}, the same line as #154. Verified: catalogue tests with MESH_CATALOGUE set (not skipped); rendered for ace with a pinned port and username setting; a throwaway of the pinned image on a fresh 0700 dir with the secret as a 0600 root file answered the secret (200), refused a wrong and the default password (401); the compiled client read the username from nzbget.conf and reached version/status/queue/history; strict typecheck and the module's Dockerfile build pass.
2026-09-30 12:00:31 +02:00
12 changed files with 78 additions and 878 deletions
@@ -48,6 +48,20 @@ function meshConfig(file?: string): Record<string, string> {
  catch { return {}; }
 }

+/** One key of nzbget's own nzbget.conf, from the config directory the mesh mounts read-only
+ *  (MESH_NZBGET_CONFIG_DIR). The software's file is the truth about who may log in, so the tools
+ *  ask it rather than a setting that could disagree. Absent, unreadable or unset yields undefined. */
+function confValue(dir: string | undefined, key: string): string | undefined {
+  if (!dir) return undefined;
+  try {
+    const line = readFileSync(`${dir.replace(/\/$/, "")}/nzbget.conf`, "utf8")
+      .split("\n")
+      .find((l) => l.startsWith(`${key}=`));
+    const value = line?.slice(key.length + 1).trim();
+    return value ? value : undefined;
+  } catch { return undefined; }
+}
+
 /** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
 *  absent or unreadable yields undefined so callers fall back rather than crash. */
 function readSecret(file?: string): string | undefined {
@@ -69,7 +83,9 @@ export class NzbgetClient {
   * Build from the module's resolved environment. URL and password are read from MESH_NZBGET_URL
   * and MESH_NZBGET_PASSWORD; both must be present — an unconfigured NZBGet throws rather than
   * pretend to be reachable, so the tools/events simply do not load (the harness treats the throw
-   * as "exposes nothing"). The control username defaults to "nzbget", NZBGet's own default.
+   * as "exposes nothing"). The password file is the same own-secret the server container is started
+   * with (FILE__NZBGET_PASS), so the two cannot disagree. The control username is read from
+   * nzbget.conf, falling back to "nzbget", NZBGet's own default.
   */
  static fromEnv(env: NodeJS.ProcessEnv = process.env): NzbgetClient {
    const cfg = meshConfig(env.MESH_NZBGET_CONFIG_FILE);
@@ -78,7 +94,9 @@ export class NzbgetClient {
    if (!url || !password) {
      throw new Error("NZBGet not configured — set MESH_NZBGET_URL and MESH_NZBGET_PASSWORD");
    }
-    const user = cfg.user ?? env.MESH_NZBGET_USER ?? "nzbget";
+    // The control username: a setting or the environment if one says so, else whatever
+    // nzbget.conf holds (an adopted machine keeps its own, e.g. not "nzbget"), else NZBGet's default.
+    const user = cfg.user ?? env.MESH_NZBGET_USER ?? confValue(env.MESH_NZBGET_CONFIG_DIR, "ControlUsername") ?? "nzbget";
    return new NzbgetClient(url, user, password);
  }

@@ -19,7 +19,7 @@
      "port": 6789,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the download client's pages"
+      "why": "the download client's pages, and the JSON-RPC API its consumers and its own tools call"
    }
  ],
  "accesses": [
@@ -35,10 +35,15 @@
      "path": "/var/lib/mesh/nzbget",
      "mode": "0700"
    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
    {
      "id": "config",
      "type": "directory",
-      "path": "/services/nzbget/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -46,24 +51,29 @@
      "id": "server",
      "type": "container",
      "name": "nzbget",
-      "image": "lscr.io/linuxserver/nzbget@sha256:5f3d3fa71029004156eff2cbf4ef4455ce4ce59517cf13fa7d1d7c8a4cd2c8a4",
+      "image": "lscr.io/linuxserver/nzbget@sha256:ec3ef0ae7dc410084086a7fdd447deda4747531154aa1cc5c7c48ac60794e277",
      "env": {
        "PUID": "1000",
        "PGID": "1000",
-        "TZ": "Etc/UTC"
+        "TZ": "Etc/UTC",
+        "FILE__NZBGET_PASS": "/run/secrets/password"
      },
      "ports": [
        "6789"
      ],
      "volumes": [
-        "/services/nzbget/config:/config",
-        "/services/media/downloads:/downloads"
+        "${dir:config}:/config",
+        "/services/media/downloads:/downloads",
+        "/var/lib/mesh/nzbget/password:/run/secrets/password:ro"
+      ],
+      "restart-on": [
+        "needs-password"
      ]
    },
    {
      "id": "runtime-config",
      "type": "file",
-      "path": "/var/lib/mesh/nzbget/config.json",
+      "path": "${dir:state}/config.json",
      "mode": "0600",
      "content": "{}\n",
      "merge": "json"
@@ -76,22 +86,46 @@
      "volumes": [
        "/var/lib/mesh/nzbget/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/nzbget/password:/run/secrets/password:ro",
-        "/var/lib/mesh/nzbget/config.json:/run/config/config.json:ro",
-        "/services/nzbget/config:/var/lib/nzbget/config:ro"
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:config}:/var/lib/nzbget/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
+        "MESH_NZBGET_URL": "http://127.0.0.1:${port:6789}",
        "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
        "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
        "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"
      },
      "restart-on": [
-        "runtime-config"
+        "runtime-config",
+        "needs-password"
      ],
      "artifact": "runtime"
    }
  ],
+  "provides": [
+    "nzbget-api"
+  ],
+  "serves": {
+    "nzbget-api": {
+      "scheme": "http",
+      "port": 6789,
+      "url-base": "",
+      "username": "nzbget"
+    }
+  },
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "nzbget",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
  "build": {
    "on": [
      {
@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/tautulli
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts plex/check.ts plex/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist

 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/tautulli/dist /app/modules/tautulli/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/tautulli/dist/index.js,/app/modules/tautulli/dist/tools/index.js
-# NOT dist/plex/index.js: that is a step the host runs to completion, named by the `plex`
-# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
-# serving sidecar too, and exit it.
@@ -41,32 +41,6 @@ function meshConfig(file?: string): Record<string, string> {
  catch { return {}; }
 }

-/**
- * The API key Tautulli minted for itself, read from its own config.ini (mounted read-only).
- *
- * Tautulli owns this key: it writes it on first run and every client of its API — this runtime
- * included — must present the same one. So the mesh does not mint or hold it; the one place it
- * lives is the file Tautulli keeps, and a key regenerated in Tautulli's settings is simply read
- * again on the next start. Undefined when there is no file or no key yet (a fresh install whose
- * setup wizard has not run).
- */
-export function keyOfTautulli(dir?: string): string | undefined {
-  if (!dir) return undefined;
-  let ini: string;
-  try { ini = readFileSync(`${dir.replace(/\/$/, "")}/config.ini`, "utf8"); }
-  catch { return undefined; }
-  let section = "";
-  for (const raw of ini.split(/\r?\n/)) {
-    const line = raw.trim();
-    const header = /^\[(.+)\]$/.exec(line);
-    if (header) { section = header[1]; continue; }
-    if (section !== "General") continue;
-    const kv = /^api_key\s*=\s*"?([^"]*)"?$/.exec(line);
-    if (kv && kv[1]) return kv[1];
-  }
-  return undefined;
-}
-
 export class TautulliClient {
  readonly baseUrl: string;

@@ -78,16 +52,15 @@ export class TautulliClient {
  }

  /**
-   * Build from the module's resolved environment. The API key is the one Tautulli minted for
-   * itself (Settings → Web Interface), read from its config.ini under MESH_TAUTULLI_CONFIG_DIR;
-   * MESH_TAUTULLI_APIKEY still wins where it is set. The base URL defaults to the local container.
+   * Build from the module's resolved environment. The API key is read from MESH_TAUTULLI_APIKEY
+   * (Tautulli mints it in Settings → Web Interface); the base URL defaults to the local container.
   * Throws when no key is configured — the module then contributes nothing rather than failing.
   */
  static fromEnv(env: NodeJS.ProcessEnv = process.env): TautulliClient {
    const cfg = meshConfig(env.MESH_TAUTULLI_CONFIG_FILE);
    const url = cfg.url ?? (env.MESH_TAUTULLI_URL ?? `http://127.0.0.1:${env.TAUTULLI_PORT ?? "8181"}`);
-    const apiKey = cfg.apiKey ?? env.MESH_TAUTULLI_APIKEY ?? keyOfTautulli(env.MESH_TAUTULLI_CONFIG_DIR);
-    if (!apiKey) throw new Error("no Tautulli API key — Tautulli's config.ini has none yet (finish its setup and enable the API)");
+    const apiKey = cfg.apiKey ?? env.MESH_TAUTULLI_APIKEY;
+    if (!apiKey) throw new Error("no Tautulli API key — set MESH_TAUTULLI_APIKEY");
    return new TautulliClient(url, apiKey);
  }

@@ -4,11 +4,6 @@
  "description": "tautulli — Plex watch statistics. Its API client, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
-  "scripts": {
-    "build": "tsc client.ts index.ts tools/index.ts plex/check.ts plex/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
-  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.0"
  },
@@ -1,8 +0,0 @@
-#!/bin/bash
-# Run by the linuxserver image's custom-init each time Tautulli's container starts, as root, before
-# Tautulli: puts where the mesh says plex is into Tautulli's config.ini (mesh-plex.py says why).
-#
-# Written by the mesh from the tautulli module's manifest. Editing it here lasts until the next apply.
-PY=/lsiopy/bin/python3
-[ -x "$PY" ] || PY=python3
-exec "$PY" /run/mesh/mesh-plex.py
@@ -1,175 +0,0 @@
-// Whether Tautulli reaches Plex as the mesh says — the half of tautulli's plex-api consumer the
-// mesh can see fail.
-//
-// **The write is not here.** Tautulli keeps its Plex connection only in config.ini, rewrites that
-// file from memory on every shutdown, and has no API command that sets it; so the write happens in
-// the server container itself, before Tautulli starts (plex/mesh-plex.py, run by the image's
-// custom-init). A failure there is a line in Tautulli's log that nobody reads. This step runs after
-// the server, as a run-once container declared last, and fails the node's report when:
-//
-//   - the pair credential is one plex refuses — the mesh's own minted value, before the operator
-//     accepts the server's X-Plex-Token for this pair — naming the `secret accept` that fixes it;
-//   - Tautulli is not pointed where the binding says (the start-time write did not land);
-//   - Tautulli is pointed there and still not connected to plex (its own connection state).
-//
-// It writes nothing, to Tautulli or to plex. Pure logic and a small HTTP seam, tested against fakes
-// (test/plex.test.ts).
-
-/** What the mesh wrote at `binds.plex-api`: the binding document (controller's boundFile). */
-export interface Binding {
-  provision?: string;
-  from?: string;
-  at?: string;
-  as?: string;
-  serves?: Record<string, unknown>;
-}
-
-export const PROVISION = "plex-api";
-
-export interface Wanted {
-  url: string;
-  token: string;
-  from: string;
-}
-
-/** The HTTP the step needs, so a test can stand fakes in for Tautulli and plex. */
-export interface Http {
-  fetch(url: string, init?: { method?: string; headers?: Record<string, string> }): Promise<{
-    status: number;
-    text(): Promise<string>;
-  }>;
-}
-
-export type Outcome = { result: "connected"; url: string } | { result: "refused"; problem: string };
-
-function isLoopback(host: string): boolean {
-  const h = host.toLowerCase();
-  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
-}
-
-/** The URL Tautulli should hold as pms_url — the same one mesh-plex.py writes. */
-export function wanted(binding: Binding | undefined, credential: string | undefined): Wanted | { problem: string } {
-  if (!binding) return { problem: `no binding for ${PROVISION} was delivered — the mesh writes it before this step runs` };
-  const at = typeof binding.at === "string" ? binding.at.trim() : "";
-  const serves = binding.serves ?? {};
-  const port = Number(serves.port);
-  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
-  if (!at) return { problem: `the ${PROVISION} binding names no host (at)` };
-  if (isLoopback(at)) {
-    return {
-      problem:
-        `the ${PROVISION} binding says plex is at ${at}, which from Tautulli's container is Tautulli itself; ` +
-        `the mesh hands loopback to a machine that is not on the private network`,
-    };
-  }
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    return { problem: `the ${PROVISION} binding serves no usable port (${String(serves.port)})` };
-  }
-  if (scheme !== "http" && scheme !== "https") return { problem: `the ${PROVISION} binding serves scheme ${scheme}, which Tautulli cannot dial` };
-  const token = (credential ?? "").trim();
-  if (!token) return { problem: `the ${PROVISION} credential is empty or was not delivered` };
-  const host = at.includes(":") && !at.startsWith("[") ? `[${at}]` : at;
-  return { url: `${scheme}://${host}:${port}`, token, from: typeof binding.from === "string" ? binding.from : "" };
-}
-
-/** The remedy for a refused token, in the controller's own words (ADR 0092). */
-export function acceptRemedy(from: string): string {
-  return (
-    `plex refuses the ${PROVISION} credential the mesh delivered, so Tautulli was not given it. plex's ` +
-    `token is issued by plex.tv and the mesh cannot make it: accept the server's own token for this pair — ` +
-    `\`secret accept <this node> tautulli ${PROVISION} --provider ${from || "<its node>"} ` +
-    `--from <file holding the server's X-Plex-Token>\``
-  );
-}
-
-/** Does plex take the token? 401/403, or 400 on a network plex trusts, is a refusal. */
-export async function plexTakes(http: Http, want: Wanted): Promise<boolean> {
-  const res = await http.fetch(`${want.url}/`, { method: "GET", headers: { "X-Plex-Token": want.token, Accept: "application/json" } });
-  if (res.status === 400 || res.status === 401 || res.status === 403) return false;
-  if (res.status >= 200 && res.status < 300) return true;
-  throw new Error(`plex answered ${res.status} at /`);
-}
-
-export interface Tautulli {
-  url: string;
-  apiKey: string;
-}
-
-/** One Tautulli API command's `data`, or a thrown error. The error never carries the key. */
-export async function tautulliCmd(http: Http, t: Tautulli, cmd: string): Promise<any> {
-  const q = new URLSearchParams({ apikey: t.apiKey, cmd });
-  const res = await http.fetch(`${t.url.replace(/\/$/, "")}/api/v2?${q.toString()}`, { method: "GET" });
-  const text = await res.text();
-  if (res.status !== 200) throw new Error(`Tautulli ${cmd} answered ${res.status}`);
-  const body = (JSON.parse(text) as { response?: { result?: string; message?: string; data?: unknown } }).response ?? {};
-  if (body.result !== "success") throw new Error(`Tautulli ${cmd}: ${body.message ?? "error"}`);
-  return body.data;
-}
-
-/** Wait for Tautulli to answer, because the step runs right after its container starts. */
-export async function tautulliReady(http: Http, t: Tautulli, waitMs: number, pauseMs = 2000): Promise<boolean> {
-  const until = Date.now() + waitMs;
-  for (;;) {
-    try {
-      const res = await http.fetch(`${t.url.replace(/\/$/, "")}/status`, { method: "GET" });
-      if (res.status === 200) return true;
-    } catch {
-      // not listening yet
-    }
-    if (Date.now() >= until) return false;
-    await new Promise((r) => setTimeout(r, pauseMs));
-  }
-}
-
-/**
- * Check Tautulli against the mesh: the token plex takes, the URL Tautulli holds, and Tautulli's own
- * connection state, polled for `connectMs` because Tautulli connects to plex a moment after start.
- * Never throws.
- */
-export async function check(
-  http: Http,
-  t: Tautulli,
-  binding: Binding | undefined,
-  credential: string | undefined,
-  connectMs = 60_000,
-  pauseMs = 3000,
-): Promise<Outcome> {
-  const w = wanted(binding, credential);
-  if ("problem" in w) return { result: "refused", problem: w.problem };
-  try {
-    if (!(await plexTakes(http, w))) return { result: "refused", problem: acceptRemedy(w.from) };
-  } catch (err) {
-    return { result: "refused", problem: `plex could not be asked whether it takes the token at ${w.url}: ${message(err)}` };
-  }
-  try {
-    const info = (await tautulliCmd(http, t, "get_server_info")) as { pms_url?: unknown } | undefined;
-    const holds = typeof info?.pms_url === "string" ? info.pms_url : "";
-    if (holds.replace(/\/$/, "") !== w.url) {
-      return {
-        result: "refused",
-        problem:
-          `Tautulli reaches plex at ${holds || "nothing"}, not ${w.url} as the mesh says. Its container writes ` +
-          `this into config.ini as it starts (custom-init 50-mesh-plex); its log says why it did not`,
-      };
-    }
-    const until = Date.now() + connectMs;
-    for (;;) {
-      // server_status answers {connected}, not wrapped in `data` on every version: accept both.
-      const status = (await tautulliCmd(http, t, "server_status")) as { connected?: unknown } | undefined;
-      if (status?.connected === true) return { result: "connected", url: w.url };
-      if (Date.now() >= until) {
-        return {
-          result: "refused",
-          problem: `Tautulli holds ${w.url} and is not connected to plex there — its log says why (a token plex no longer takes, or plex down)`,
-        };
-      }
-      await new Promise((r) => setTimeout(r, pauseMs));
-    }
-  } catch (err) {
-    return { result: "refused", problem: message(err) };
-  }
-}
-
-function message(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
-}
@@ -1,47 +0,0 @@
-// tautulli's plex step — run once by the host after Tautulli's server container, and again whenever
-// its binding, its pair credential or the server changed (the container's `restart-on`, novox/hq
-// ADR 0099). It checks; it writes nothing (plex/check.ts says why, and where the write is).
-//
-// Exits non-zero when Tautulli does not reach plex as the mesh says, so the node reports the step
-// failed. Declared last in the manifest, so its failing gates nothing else of tautulli's (novox/hq
-// ADR 0136). Never prints a key or a token.
-
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-
-import { keyOfTautulli } from "../client.js";
-import { check, tautulliReady, PROVISION, type Binding, type Http } from "./check.js";
-
-const dir = process.env.MESH_PLEX_DIR ?? "/run/plex";
-const url = process.env.MESH_TAUTULLI_URL ?? "http://127.0.0.1:8181";
-const waitSeconds = Number(process.env.MESH_TAUTULLI_WAIT_SECONDS ?? "180");
-
-const http: Http = { fetch: (u, init) => fetch(u, init) };
-const read = (path: string) => readFile(path, "utf8").catch(() => undefined);
-
-const apiKey = keyOfTautulli(process.env.MESH_TAUTULLI_CONFIG_DIR);
-if (!apiKey) {
-  console.error("[tautulli-plex] Tautulli's config.ini holds no API key yet — it writes one on its first start");
-  process.exit(1);
-}
-const tautulli = { url, apiKey };
-
-if (!(await tautulliReady(http, tautulli, waitSeconds * 1000))) {
-  console.error(`[tautulli-plex] Tautulli did not answer at ${url} within ${waitSeconds}s`);
-  process.exit(1);
-}
-
-let binding: Binding | undefined;
-try {
-  const raw = await read(join(dir, `${PROVISION}.json`));
-  binding = raw === undefined ? undefined : (JSON.parse(raw) as Binding);
-} catch {
-  binding = undefined;
-}
-const outcome = await check(http, tautulli, binding, await read(join(dir, `${PROVISION}.secret`)));
-if (outcome.result === "connected") {
-  console.log(`[tautulli-plex] Tautulli reaches plex at ${outcome.url} as the mesh says; connected`);
-} else {
-  console.error(`[tautulli-plex] ${outcome.problem}`);
-  process.exitCode = 1;
-}
@@ -1,260 +0,0 @@
-# Where Tautulli reaches Plex — decided by the mesh, written into Tautulli's config.ini before
-# Tautulli starts.
-#
-# Written by the mesh from the tautulli module's manifest, and run by the linuxserver image's
-# custom-init (50-mesh-plex) each time the `server` container starts, as root, before Tautulli.
-# Editing it here lasts until the next apply.
-#
-# WHY BEFORE START, AND NOT A STEP AFTER IT. Tautulli keeps its Plex connection only in config.ini
-# ([PMS]), reads that file at start, and writes its whole in-memory config back on every shutdown.
-# A step editing the file while Tautulli runs is overwritten the moment the container is recreated;
-# its API has no command that sets the connection, and its settings form needs an admin login. The
-# one moment the file is Tautulli's to read and nobody's to overwrite is here: after the old
-# container stopped (and wrote), before the new one reads. The container restarts on its binding
-# and credential (`restart-on`), so a plex that moves or a token that is accepted lands here.
-#
-# WHAT IT WRITES, AND WHEN. Only [PMS] keys, and only when they differ from what the mesh says:
-#   pms_ip, pms_port, pms_ssl, pms_url   - from the binding; always, when the binding is usable
-#   pms_identifier                       - plex's own machineIdentifier, when plex answers /identity
-#   pms_token                            - the pair credential, ONLY when plex takes it
-# Every other key and section, comment and ordering stays as it was, byte for byte.
-#
-# A TOKEN PLEX REFUSES IS NEVER WRITTEN. Until the operator accepts the server's X-Plex-Token for
-# this pair, the mesh delivers a value it minted, which plex answers with 401 (400 on a network it
-# trusts). Writing it would replace a working token with a dead one. The address is still written:
-# it is right whatever the token, and Tautulli's existing token keeps working at the new address.
-# The refusal is loud here and in the `plex` step, which fails naming the `secret accept`.
-#
-# Never prints the token. Exits 0 even on a refusal: custom-init ignores the code, and Tautulli
-# starting on what it had is better than not starting. The step after the server is what fails.
-
-import json
-import os
-import re
-import sys
-import tempfile
-import time
-import urllib.error
-import urllib.request
-
-BINDING = os.environ.get("MESH_PLEX_BINDING", "/run/mesh/plex-api.json")
-SECRET = os.environ.get("MESH_PLEX_SECRET", "/run/mesh/plex-api.secret")
-CONFIG = os.environ.get("MESH_TAUTULLI_CONFIG", "/config/config.ini")
-WAIT = float(os.environ.get("MESH_PLEX_WAIT_SECONDS", "60"))
-PROVISION = "plex-api"
-
-
-def say(message):
-    print("[mesh-plex] " + message, flush=True)
-
-
-def is_loopback(host):
-    h = host.lower()
-    return h in ("localhost", "::1", "[::1]") or h.startswith("127.")
-
-
-def wanted_address(binding):
-    """The [PMS] address keys the binding says, or a reason it cannot say them."""
-    if not isinstance(binding, dict):
-        return None, "no binding for %s was delivered" % PROVISION
-    at = binding.get("at")
-    at = at.strip() if isinstance(at, str) else ""
-    serves = binding.get("serves") if isinstance(binding.get("serves"), dict) else {}
-    try:
-        port = int(serves.get("port"))
-    except (TypeError, ValueError):
-        port = 0
-    scheme = serves.get("scheme") or "http"
-    if not at:
-        return None, "the %s binding names no host (at)" % PROVISION
-    if is_loopback(at):
-        return None, (
-            "the %s binding says plex is at %s, which from Tautulli's container is Tautulli itself; "
-            "the mesh hands loopback to a machine that is not on the private network" % (PROVISION, at))
-    if not 0 < port < 65536:
-        return None, "the %s binding serves no usable port (%r)" % (PROVISION, serves.get("port"))
-    if scheme not in ("http", "https"):
-        return None, "the %s binding serves scheme %s, which Tautulli cannot dial" % (PROVISION, scheme)
-    host = "[%s]" % at if ":" in at and not at.startswith("[") else at
-    url = "%s://%s:%d" % (scheme, host, port)
-    return {"pms_ip": at, "pms_port": str(port), "pms_ssl": "1" if scheme == "https" else "0", "pms_url": url}, None
-
-
-def plex_get(url, path, token=None):
-    """(status, parsed JSON or None); raises OSError when plex cannot be asked."""
-    headers = {"Accept": "application/json"}
-    if token is not None:
-        headers["X-Plex-Token"] = token
-    request = urllib.request.Request(url + path, headers=headers)
-    try:
-        with urllib.request.urlopen(request, timeout=10) as response:
-            body = response.read()
-            try:
-                return response.status, json.loads(body)
-            except ValueError:
-                return response.status, None
-    except urllib.error.HTTPError as err:
-        return err.code, None
-
-
-def ask_plex(url, token):
-    """(takes: True/False/None, machineIdentifier or None). None: plex could not be asked in time."""
-    deadline = time.monotonic() + WAIT
-    while True:
-        try:
-            status, _ = plex_get(url, "/", token)
-            if status in (400, 401, 403):
-                takes = False
-            elif 200 <= status < 300:
-                takes = True
-            else:
-                raise OSError("plex answered %d at /" % status)
-            identifier = None
-            status, body = plex_get(url, "/identity")
-            if status == 200 and isinstance(body, dict):
-                value = (body.get("MediaContainer") or {}).get("machineIdentifier")
-                identifier = value if isinstance(value, str) and value else None
-            return takes, identifier
-        except OSError as err:
-            if time.monotonic() >= deadline:
-                say("plex could not be asked at %s: %s" % (url, err))
-                return None, None
-            time.sleep(3)
-
-
-SECTION = re.compile(r"^\s*\[([^\]]+)\]\s*$")
-KEY = re.compile(r"^(\s*)([A-Za-z0-9_]+)(\s*=\s*)(.*?)\s*$")
-
-
-def unquoted(value):
-    if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
-        return value[1:-1]
-    return value
-
-
-def plain(value):
-    """ConfigObj reads a value unquoted unless it holds one of these; none of ours should."""
-    return not re.search(r"[#,\"'\r\n]", value) and value == value.strip()
-
-
-def laid_over(text, wanted):
-    """config.ini's text with [PMS] saying `wanted`, and the names of the keys that changed."""
-    lines = text.splitlines(True)
-    if lines and not lines[-1].endswith("\n"):
-        lines[-1] += "\n"
-    changed = []
-    start = end = None
-    for i, line in enumerate(lines):
-        m = SECTION.match(line)
-        if m:
-            if start is not None:
-                end = i
-                break
-            if m.group(1).strip() == "PMS":
-                start = i
-    if start is None:
-        if lines and lines[-1].strip():
-            lines.append("\n")
-        lines.append("[PMS]\n")
-        start, end = len(lines) - 1, len(lines)
-    elif end is None:
-        end = len(lines)
-    seen = set()
-    for i in range(start + 1, end):
-        m = KEY.match(lines[i])
-        if not m or m.group(2) not in wanted:
-            continue
-        key = m.group(2)
-        seen.add(key)
-        if unquoted(m.group(4)) != wanted[key]:
-            lines[i] = "%s%s%s%s\n" % (m.group(1), key, m.group(3), wanted[key])
-            changed.append(key)
-    missing = [k for k in wanted if k not in seen]
-    # Insert after the section's last key, not after the blank lines that separate it from the next.
-    at = end
-    while at > start + 1 and not lines[at - 1].strip():
-        at -= 1
-    for key in missing:
-        lines.insert(at, "%s = %s\n" % (key, wanted[key]))
-        at += 1
-        changed.append(key)
-    return "".join(lines), changed
-
-
-def write_config(text):
-    """Replace config.ini whole, keeping its owner and mode; a new one takes the directory's owner."""
-    directory = os.path.dirname(CONFIG) or "."
-    try:
-        st = os.stat(CONFIG)
-        uid, gid, mode = st.st_uid, st.st_gid, st.st_mode & 0o7777
-    except FileNotFoundError:
-        st = os.stat(directory)
-        uid, gid, mode = st.st_uid, st.st_gid, 0o644
-    fd, tmp = tempfile.mkstemp(prefix=".config.ini.", dir=directory)
-    try:
-        with os.fdopen(fd, "w", encoding="utf-8") as f:
-            f.write(text)
-        os.chmod(tmp, mode)
-        try:
-            os.chown(tmp, uid, gid)
-        except PermissionError:
-            pass
-        os.replace(tmp, CONFIG)
-    except BaseException:
-        if os.path.exists(tmp):
-            os.unlink(tmp)
-        raise
-
-
-def read(path):
-    try:
-        with open(path, encoding="utf-8") as f:
-            return f.read()
-    except FileNotFoundError:
-        return None
-
-
-def main():
-    raw = read(BINDING)
-    try:
-        binding = json.loads(raw) if raw is not None else None
-    except ValueError:
-        binding = None
-    address, problem = wanted_address(binding)
-    if problem:
-        say("left Tautulli's Plex connection as it was: " + problem)
-        return 0
-    wanted = dict(address)
-    token = (read(SECRET) or "").strip()
-    takes, identifier = ask_plex(address["pms_url"], token) if token else (False, None)
-    if identifier:
-        wanted["pms_identifier"] = identifier
-    frm = binding.get("from") or "<its node>"
-    if not token:
-        say("no %s credential was delivered; only the address was written" % PROVISION)
-    elif takes and plain(token):
-        wanted["pms_token"] = token
-    elif takes is False:
-        say("plex refuses the %s credential the mesh delivered, so it was not written; the address was. "
-            "plex's token is issued by plex.tv and the mesh cannot make it: accept the server's own token "
-            "for this pair - `secret accept <this node> tautulli %s --provider %s --from <file holding the "
-            "server's X-Plex-Token>`" % (PROVISION, PROVISION, frm))
-    elif takes:
-        say("the %s credential holds characters config.ini cannot carry unquoted; it was not written" % PROVISION)
-    else:
-        say("plex could not be asked whether it takes the %s credential; only the address was written" % PROVISION)
-    if not all(plain(v) for v in wanted.values()):
-        say("the %s binding holds characters config.ini cannot carry unquoted; nothing was written" % PROVISION)
-        return 0
-    before = read(CONFIG)
-    after, changed = laid_over(before or "", wanted)
-    if not changed:
-        say("Tautulli's Plex connection is already as the mesh says (%s)" % address["pms_url"])
-        return 0
-    write_config(after)
-    say("wrote %s into Tautulli's [PMS] (%s)" % (", ".join(changed), address["pms_url"]))
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
@@ -1,266 +0,0 @@
-// What holds tautulli's plex-api consumer — both halves.
-//
-// The write (plex/mesh-plex.py, run in the server container before Tautulli starts): [PMS] is made
-// to say what the mesh bound and every other line of config.ini stays byte for byte; nothing is
-// written when nothing differs; a token plex refuses is never written, while the address still is;
-// a config.ini that does not exist yet is started with [PMS] alone. Run with the machine's python3
-// against a fake plex; skipped where there is no python3.
-//
-// The check (plex/check.ts, the step declared last): a refused token fails naming the `secret
-// accept`; a Tautulli pointed elsewhere, or not connected, fails; one pointed where the binding says
-// and connected passes.
-//
-// And the manifest carries exactly the files in plex/ — they are the source, module.json the copy.
-//
-// Fakes answer as the real ones do (checked against lscr.io/linuxserver/tautulli 2.18.1-ls244 and
-// plexinc/pms-docker 1.43.4: plex answers 401 to an unknown token from another network, 400 on one
-// it trusts). Imports the compiled step, as keycloak's tests do.
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { execFile, spawnSync } from "node:child_process";
-import { createServer, type Server } from "node:http";
-import { mkdtempSync, readFileSync, statSync, writeFileSync, existsSync } from "node:fs";
-import { networkInterfaces, tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { check, type Binding, type Http } from "../dist/plex/check.js";
-
-const here = fileURLToPath(new URL("..", import.meta.url));
-const TOKEN = "the-servers-own-token";
-const MACHINE = "5c47d9a165d10b622995d55b3ae1f168242f33bd";
-
-// ---- the manifest carries the files ------------------------------------------------------------
-
-test("module.json carries plex/mesh-plex.py and plex/50-mesh-plex exactly", () => {
-  const m = JSON.parse(readFileSync(join(here, "module.json"), "utf8")) as { resources: { id: string; content?: string }[] };
-  const byId = (id: string) => m.resources.find((r) => r.id === id)?.content;
-  assert.equal(byId("plex-init-code"), readFileSync(join(here, "plex/mesh-plex.py"), "utf8"));
-  assert.equal(byId("plex-init"), readFileSync(join(here, "plex/50-mesh-plex"), "utf8"));
-  // Nothing in them the mesh would read as a placeholder.
-  assert.doesNotMatch(byId("plex-init-code") ?? "", /\$\{/);
-  assert.doesNotMatch(byId("plex-init") ?? "", /\$\{/);
-});
-
-// ---- the write: mesh-plex.py -------------------------------------------------------------------
-
-const python = spawnSync("python3", ["--version"]).status === 0 ? "python3" : undefined;
-
-/** An address of this machine that is not loopback, which the script refuses as plex's. */
-function outwardAddress(): string | undefined {
-  for (const list of Object.values(networkInterfaces())) {
-    for (const a of list ?? []) if (a.family === "IPv4" && !a.internal) return a.address;
-  }
-  return undefined;
-}
-const outward = outwardAddress();
-
-function fakePlex(opts: { trusted?: boolean } = {}): Promise<{ server: Server; port: number }> {
-  const server = createServer((req, res) => {
-    if (req.url === "/identity") {
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ MediaContainer: { machineIdentifier: MACHINE } }));
-      return;
-    }
-    if (req.headers["x-plex-token"] !== TOKEN) {
-      res.writeHead(opts.trusted ? 400 : 401);
-      res.end();
-      return;
-    }
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ MediaContainer: { friendlyName: "ace" } }));
-  });
-  return new Promise((resolve) => server.listen(0, "0.0.0.0", () => resolve({ server, port: (server.address() as { port: number }).port })));
-}
-
-// An operator's config.ini, shaped as Tautulli writes it: plex at HAL's network gateway.
-const OPERATOR_INI = [
-  "[General]",
-  "first_run_complete = 1",
-  "api_key = 0123456789abcdef0123456789abcdef",
-  "",
-  "[PMS]",
-  "pms_identifier = " + MACHINE,
-  "pms_ip = 172.18.0.1",
-  "pms_is_remote = 0",
-  "pms_name = ace",
-  "pms_port = 32400",
-  'pms_token = "' + TOKEN + '"',
-  "pms_ssl = 0",
-  "pms_url = http://172.18.0.1:32400",
-  "pms_url_manual = 0",
-  "",
-  "[Monitoring]",
-  "monitor_pms_updates = 0",
-  "",
-].join("\n");
-
-function runScript(dir: string, at: string, port: number, credential: string, wait = "5") {
-  writeFileSync(join(dir, "plex-api.json"), JSON.stringify({ binding: 1, provision: "plex-api", from: "ace", at, serves: { scheme: "http", port } }));
-  writeFileSync(join(dir, "plex-api.secret"), credential + "\n");
-  // Asynchronously: the fake plex answers from this same process, so a blocking spawn would starve it.
-  return new Promise<{ status: number; out: string }>((resolve) => {
-    execFile(python as string, [join(here, "plex/mesh-plex.py")], {
-    env: {
-      ...process.env,
-      MESH_PLEX_BINDING: join(dir, "plex-api.json"),
-      MESH_PLEX_SECRET: join(dir, "plex-api.secret"),
-      MESH_TAUTULLI_CONFIG: join(dir, "config.ini"),
-      MESH_PLEX_WAIT_SECONDS: wait,
-    },
-    encoding: "utf8",
-    }, (err, stdout, stderr) => resolve({ status: err ? Number((err as { code?: unknown }).code ?? 1) : 0, out: `${stdout}${stderr}` }));
-  });
-}
-
-const skip = !python ? "no python3 here" : !outward ? "no non-loopback address to serve a fake plex on" : false;
-
-test("the write: [PMS] says what the mesh bound, and every other line stays", { skip }, async () => {
-  const { server, port } = await fakePlex();
-  try {
-    const dir = mkdtempSync(join(tmpdir(), "mesh-plex-"));
-    writeFileSync(join(dir, "config.ini"), OPERATOR_INI);
-    const r = await runScript(dir, outward as string, port, TOKEN);
-    assert.equal(r.status, 0);
-    // The token was already the server's (quoted, as ConfigObj may write it): not rewritten.
-    assert.match(r.out, /wrote pms_ip, pms_port, pms_url into Tautulli's \[PMS\]/);
-    const url = `http://${outward}:${port}`;
-    const expected = OPERATOR_INI
-      .replace("pms_ip = 172.18.0.1", `pms_ip = ${outward}`)
-      .replace("pms_port = 32400", `pms_port = ${port}`)
-      .replace("pms_url = http://172.18.0.1:32400", `pms_url = ${url}`);
-    assert.equal(readFileSync(join(dir, "config.ini"), "utf8"), expected);
-    assert.doesNotMatch(r.out, new RegExp(TOKEN));
-
-    // Again: nothing differs, nothing is written.
-    const before = statSync(join(dir, "config.ini")).mtimeMs;
-    const again = await runScript(dir, outward as string, port, TOKEN);
-    assert.match(again.out, /already as the mesh says/);
-    assert.equal(statSync(join(dir, "config.ini")).mtimeMs, before);
-  } finally {
-    server.close();
-  }
-});
-
-test("the write: a token plex refuses is never written; the address still is", { skip }, async () => {
-  for (const trusted of [false, true]) {
-    const { server, port } = await fakePlex({ trusted });
-    try {
-      const dir = mkdtempSync(join(tmpdir(), "mesh-plex-"));
-      writeFileSync(join(dir, "config.ini"), OPERATOR_INI);
-      const r = await runScript(dir, outward as string, port, "a-value-the-mesh-minted");
-      assert.equal(r.status, 0, "custom-init ignores the code; Tautulli starts on what it had");
-      assert.match(r.out, /secret accept <this node> tautulli plex-api --provider ace/);
-      assert.doesNotMatch(r.out, /a-value-the-mesh-minted/);
-      const ini = readFileSync(join(dir, "config.ini"), "utf8");
-      assert.match(ini, new RegExp(`pms_token = "${TOKEN}"`), "the working token stays");
-      assert.match(ini, new RegExp(`pms_ip = ${outward!.replace(/\./g, "\\.")}\n`));
-    } finally {
-      server.close();
-    }
-  }
-});
-
-test("the write: a Tautulli with no config.ini yet is started with [PMS] alone", { skip }, async () => {
-  const { server, port } = await fakePlex();
-  try {
-    const dir = mkdtempSync(join(tmpdir(), "mesh-plex-"));
-    await runScript(dir, outward as string, port, TOKEN);
-    assert.equal(
-      readFileSync(join(dir, "config.ini"), "utf8"),
-      `[PMS]\npms_ip = ${outward}\npms_port = ${port}\npms_ssl = 0\npms_url = http://${outward}:${port}\n` +
-        `pms_identifier = ${MACHINE}\npms_token = ${TOKEN}\n`,
-    );
-  } finally {
-    server.close();
-  }
-});
-
-test("the write: a plex that cannot be asked gets its address written and no token", { skip }, async () => {
-  const { server, port } = await fakePlex();
-  await new Promise((r) => server.close(r)); // nothing listens there now
-  const dir = mkdtempSync(join(tmpdir(), "mesh-plex-"));
-  writeFileSync(join(dir, "config.ini"), OPERATOR_INI);
-  const r = await runScript(dir, outward as string, port, TOKEN, "0");
-  assert.match(r.out, /could not be asked/);
-  const ini = readFileSync(join(dir, "config.ini"), "utf8");
-  assert.match(ini, new RegExp(`pms_url = http://${outward!.replace(/\./g, "\\.")}:${port}\n`));
-  assert.match(ini, new RegExp(`pms_token = "${TOKEN}"`), "left exactly as it was");
-});
-
-test("the write: a loopback binding writes nothing", { skip: !python ? "no python3 here" : false }, async () => {
-  const dir = mkdtempSync(join(tmpdir(), "mesh-plex-"));
-  writeFileSync(join(dir, "config.ini"), OPERATOR_INI);
-  const r = await runScript(dir, "127.0.0.1", 32400, TOKEN, "0");
-  assert.match(r.out, /private network/);
-  assert.equal(readFileSync(join(dir, "config.ini"), "utf8"), OPERATOR_INI);
-  assert.equal(existsSync(join(dir, "config.ini")), true);
-});
-
-// ---- the check: plex/check.ts ------------------------------------------------------------------
-
-function binding(at = "ace.internal", port = 32400): Binding {
-  return { provision: "plex-api", from: "ace", at, serves: { scheme: "http", port } };
-}
-
-function fakes(opts: { holds?: string; connected?: boolean; trusted?: boolean } = {}) {
-  const calls: string[] = [];
-  const http: Http = {
-    async fetch(url, init) {
-      calls.push(url);
-      const reply = (status: number, value?: unknown) => ({ status, text: async () => (value === undefined ? "" : JSON.stringify(value)) });
-      const u = new URL(url);
-      if (u.hostname === "ace.internal") {
-        return init?.headers?.["X-Plex-Token"] === TOKEN ? reply(200, {}) : reply(opts.trusted ? 400 : 401);
-      }
-      if (u.searchParams.get("apikey") !== "tautulli-key") return reply(401);
-      const cmd = u.searchParams.get("cmd");
-      if (cmd === "get_server_info") {
-        return reply(200, { response: { result: "success", data: { pms_url: opts.holds ?? "http://ace.internal:32400", pms_ip: "ace.internal" } } });
-      }
-      if (cmd === "server_status") {
-        return reply(200, { response: { result: "success", data: { result: "success", connected: opts.connected ?? true } } });
-      }
-      return reply(404);
-    },
-  };
-  return { http, calls };
-}
-
-const TAUTULLI = { url: "http://127.0.0.1:8181", apiKey: "tautulli-key" };
-
-test("the check: pointed where the binding says and connected passes", async () => {
-  const f = fakes();
-  assert.deepEqual(await check(f.http, TAUTULLI, binding(), TOKEN, 0, 0), { result: "connected", url: "http://ace.internal:32400" });
-});
-
-test("the check: a token plex refuses fails naming the accept, and never prints it", async () => {
-  for (const trusted of [false, true]) {
-    const f = fakes({ trusted });
-    const out = await check(f.http, TAUTULLI, binding(), "a-value-the-mesh-minted", 0, 0);
-    assert.equal(out.result, "refused");
-    const problem = (out as { problem: string }).problem;
-    assert.match(problem, /secret accept <this node> tautulli plex-api --provider ace/);
-    assert.doesNotMatch(problem, /a-value-the-mesh-minted/);
-    assert.equal(f.calls.some((c) => c.includes("/api/v2")), false, "Tautulli was not even asked");
-  }
-});
-
-test("the check: a Tautulli pointed elsewhere fails, naming where it points", async () => {
-  const out = await check(fakes({ holds: "http://172.18.0.1:32400" }).http, TAUTULLI, binding(), TOKEN, 0, 0);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /at http:\/\/172\.18\.0\.1:32400, not http:\/\/ace\.internal:32400/);
-});
-
-test("the check: pointed right but not connected fails", async () => {
-  const out = await check(fakes({ connected: false }).http, TAUTULLI, binding(), TOKEN, 0, 0);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /not connected/);
-});
-
-test("the check: a loopback binding is refused", async () => {
-  const out = await check(fakes().http, TAUTULLI, binding("127.0.0.1"), TOKEN, 0, 0);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /private network/);
-});
@@ -8,5 +8,5 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "index.ts", "tools/index.ts", "plex/check.ts", "plex/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }