tautulli: placed config, the build ace runs, and a runtime that reads its own key

Conversation 2 Commits 2 Files Changed 10

+865 -13

2 Commits

Author	SHA1	Message	Date
jschoubben	991e33f749	tautulli: reach plex through the mesh, written before Tautulli starts Tautulli reached plex at 172.18.0.1, the gateway of a HAL network that goes away with HAL, and the plan was to retype it by hand in the window. Tautulli now requires plex-api, and where plex is comes from the binding. Tautulli keeps the connection only in config.ini, reads it at start and writes its whole config back on every shutdown; its API cannot set it and its settings form needs an admin login. So a step after start would be overwritten the moment the container is recreated. The write is made where nothing can overwrite it: the linuxserver image's custom-init runs plex/mesh-plex.py as root before Tautulli starts, and the server restarts on its binding and credential, so a moved plex or an accepted token lands. It writes only [PMS] keys, only when they differ, every other line byte for byte: pms_ip, pms_port, pms_ssl and pms_url from the binding; pms_identifier from plex's /identity; pms_token only when plex takes it. A minted value - before the operator accepts the server's X-Plex-Token for this pair - is never written, while the address still is, so Tautulli's own working token keeps working at plex's new address. A failure in custom-init is a log line nobody reads, so a run-once `plex` step, declared last so it gates nothing (ADR 0136), checks what the mesh can report: plex takes the credential (else it names the secret accept), Tautulli holds the bound URL, and Tautulli says it is connected. It writes nothing. The script is kept as plex/mesh-plex.py and plex/50-mesh-plex; module.json carries copies, and a test fails when they differ. Tests run the script with python3 against a fake plex (skipped where there is none) and the step against fakes; `npm test` builds first.	2026-09-30 13:09:43 +02:00
jschoubben	3e378170df	tautulli: its config is placed, it runs the build in use, and its runtime finds its own key The module stated /services/tautulli/config and /var/lib/mesh/tautulli/route.json, novox's layout, which no definition may carry (ADR 0112). Tautulli's config dir is now a placed directory (${dir:config}) and the route binds into the placed state (${dir:state}), as searxng and mosquitto do. The image was pinned to v2.18.1-ls242; ace runs ls244 (2026-09-11), and Tautulli migrates its own database schema, so the pin moves to the digest ace runs. The runtime called http://127.0.0.1:8181, which is the software's port, not the machine port the mesh assigns; it now asks with ${port:8181}, as gitea does. The runtime mounted Tautulli's config dir read-only but never read it: its API key could only come from MESH_TAUTULLI_APIKEY or the settings-merged config.json, i.e. a secret in settings. Tautulli mints and owns that key in its config.ini, so the runtime now reads it from there. Nothing for the mesh to mint or accept. Verified: catalogue tests with MESH_CATALOGUE pointing here (not skipped); the pinned image started in a throwaway container on a dir owned 1001:2000 with PUID/PGID 1000 answers /status 200 and re-owns /config to 1000:1000 on start; client.ts, run under node, read the key from that instance's config.ini and got success from get_activity and get_history; without a config.ini it throws, which the tools and events entrypoints already treat as "not configured".	2026-09-29 23:41:47 +02:00

Author

SHA1

Message

Date

jschoubben

991e33f749

tautulli: reach plex through the mesh, written before Tautulli starts

Tautulli reached plex at 172.18.0.1, the gateway of a HAL network that goes
away with HAL, and the plan was to retype it by hand in the window. Tautulli
now requires plex-api, and where plex is comes from the binding.

Tautulli keeps the connection only in config.ini, reads it at start and
writes its whole config back on every shutdown; its API cannot set it and
its settings form needs an admin login. So a step after start would be
overwritten the moment the container is recreated. The write is made where
nothing can overwrite it: the linuxserver image's custom-init runs
plex/mesh-plex.py as root before Tautulli starts, and the server restarts on
its binding and credential, so a moved plex or an accepted token lands.

It writes only [PMS] keys, only when they differ, every other line byte for
byte: pms_ip, pms_port, pms_ssl and pms_url from the binding; pms_identifier
from plex's /identity; pms_token only when plex takes it. A minted value -
before the operator accepts the server's X-Plex-Token for this pair - is
never written, while the address still is, so Tautulli's own working token
keeps working at plex's new address.

A failure in custom-init is a log line nobody reads, so a run-once `plex`
step, declared last so it gates nothing (ADR 0136), checks what the mesh can
report: plex takes the credential (else it names the secret accept), Tautulli
holds the bound URL, and Tautulli says it is connected. It writes nothing.

The script is kept as plex/mesh-plex.py and plex/50-mesh-plex; module.json
carries copies, and a test fails when they differ. Tests run the script with
python3 against a fake plex (skipped where there is none) and the step
against fakes; `npm test` builds first.

2026-09-30 13:09:43 +02:00

jschoubben

3e378170df

tautulli: its config is placed, it runs the build in use, and its runtime finds its own key

The module stated /services/tautulli/config and /var/lib/mesh/tautulli/route.json,
novox's layout, which no definition may carry (ADR 0112). Tautulli's config dir is
now a placed directory (${dir:config}) and the route binds into the placed state
(${dir:state}), as searxng and mosquitto do.

The image was pinned to v2.18.1-ls242; ace runs ls244 (2026-09-11), and Tautulli
migrates its own database schema, so the pin moves to the digest ace runs.

The runtime called http://127.0.0.1:8181, which is the software's port, not the
machine port the mesh assigns; it now asks with ${port:8181}, as gitea does.

The runtime mounted Tautulli's config dir read-only but never read it: its API key
could only come from MESH_TAUTULLI_APIKEY or the settings-merged config.json, i.e.
a secret in settings. Tautulli mints and owns that key in its config.ini, so the
runtime now reads it from there. Nothing for the mesh to mint or accept.

Verified: catalogue tests with MESH_CATALOGUE pointing here (not skipped); the
pinned image started in a throwaway container on a dir owned 1001:2000 with
PUID/PGID 1000 answers /status 200 and re-owns /config to 1000:1000 on start;
client.ts, run under node, read the key from that instance's config.ini and got
success from get_activity and get_history; without a config.ini it throws, which
the tools and events entrypoints already treat as "not configured".

2026-09-29 23:41:47 +02:00

tautulli: placed config, the build ace runs, and a runtime that reads its own key #151