diff --git a/modules/bazarr/module.json b/modules/bazarr/module.json index 1171144..abe03c9 100644 --- a/modules/bazarr/module.json +++ b/modules/bazarr/module.json @@ -94,7 +94,7 @@ ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", - "MESH_BAZARR_URL": "http://127.0.0.1:6767", + "MESH_BAZARR_URL": "http://127.0.0.1:${port:6767}", "MESH_BAZARR_API_KEY_FILE": "/run/secrets/api-key", "MESH_BAZARR_CONFIG_FILE": "/run/config/config.json", "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config" diff --git a/modules/bookshelf/module.json b/modules/bookshelf/module.json index 4447e4b..ed17aff 100644 --- a/modules/bookshelf/module.json +++ b/modules/bookshelf/module.json @@ -76,7 +76,7 @@ ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", - "MESH_BOOKSHELF_URL": "http://127.0.0.1:8787", + "MESH_BOOKSHELF_URL": "http://127.0.0.1:${port:8787}", "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config" }, "artifact": "runtime" diff --git a/modules/lidarr/module.json b/modules/lidarr/module.json index 30c71fa..fb47a06 100644 --- a/modules/lidarr/module.json +++ b/modules/lidarr/module.json @@ -1,6 +1,19 @@ { "module": "lidarr", "version": "1", + "provides": [ + { + "name": "lidarr-api", + "scope": "mesh" + } + ], + "serves": { + "lidarr-api": { + "scheme": "http", + "port": 8686, + "url-base": "" + } + }, "capabilities": [ "container-runtime" ], @@ -75,7 +88,7 @@ ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", - "MESH_LIDARR_URL": "http://127.0.0.1:8686", + "MESH_LIDARR_URL": "http://127.0.0.1:${port:8686}", "MESH_LIDARR_CONFIG_DIR": "/var/lib/lidarr/config" }, "artifact": "runtime" diff --git a/modules/nzbget/module.json b/modules/nzbget/module.json index ce3c33d..a73984d 100644 --- a/modules/nzbget/module.json +++ b/modules/nzbget/module.json @@ -81,7 +81,7 @@ ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", - "MESH_NZBGET_URL": "http://127.0.0.1:6789", + "MESH_NZBGET_URL": "http://127.0.0.1:${port:6789}", "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password", "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json", "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config" diff --git a/modules/ombi/Dockerfile b/modules/ombi/Dockerfile index fb96f72..d2ccf38 100644 --- a/modules/ombi/Dockerfile +++ b/modules/ombi/Dockerfile @@ -13,7 +13,7 @@ ARG RUNTIME_BASE FROM ${BUILD_BASE} AS build WORKDIR /app/modules/ombi COPY . . -RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \ +RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts servarr/settings.ts plex/settings.ts connections/index.ts \ --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist FROM ${RUNTIME_BASE} @@ -22,3 +22,6 @@ COPY --from=build /app/modules/ombi/dist /app/modules/ombi/dist # provider's provisioner runs its reconcile loop in the same process, with the broker connected — # the convention novox/hq issues 060/061 settled. ENV MESH_TOOL_MODULES=/app/modules/ombi/dist/index.js,/app/modules/ombi/dist/tools/index.js +# NOT dist/connections/index.js: that is a step the host runs to completion, named by the `connections` +# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the +# serving sidecar too, and exit it. diff --git a/modules/ombi/connections/index.ts b/modules/ombi/connections/index.ts new file mode 100644 index 0000000..356e597 --- /dev/null +++ b/modules/ombi/connections/index.ts @@ -0,0 +1,66 @@ +// ombi's connections step — run once by the host after ombi's server starts, and run again whenever +// a binding or pair credential it reads changes (the container's `restart-on`, novox/hq ADR 0099). +// It brings ombi's connections to Sonarr, Radarr, Lidarr (servarr/settings.ts) and Plex +// (plex/settings.ts) in line with what the mesh bound. +// +// **A step, not a loop**, for the reason route-adapter gives: everything it does is a function of +// files the mesh writes, and the host already knows when they change. It connects to no broker. +// +// Exits non-zero when any app could not be put right — a refused credential, an unreachable app, an +// ombi that cannot reach it — so the node reports the step failed and the host runs it again on the +// next apply. It is declared last in the manifest, so its failing gates nothing else of ombi's +// (novox/hq ADR 0136). One app failing does not stop the others being put right. +// +// Reads, per provision, `/.json` (the binding) and `/.secret` (the +// pair credential), where is MESH_CONNECTIONS_DIR. Never prints a key or a token. + +import { join } from "node:path"; + +import { PLEX_PROVISION, reconcilePlex } from "../plex/settings.js"; +import { APPS, ombiReady, readBinding, readIfThere, reconcileApp, type Http, type Outcome } from "../servarr/settings.js"; + +const dir = process.env.MESH_CONNECTIONS_DIR ?? "/run/connections"; +const url = process.env.MESH_OMBI_URL ?? "http://127.0.0.1:3579"; +const apiKey = (await readIfThere(process.env.MESH_OMBI_API_KEY_FILE))?.trim() ?? process.env.MESH_OMBI_API_KEY ?? ""; +const waitSeconds = Number(process.env.MESH_OMBI_WAIT_SECONDS ?? "180"); + +// Every call bounded: an entry ombi keeps may name a host that no longer answers, and a step that +// hangs on it holds the apply. +const http: Http = { fetch: (u, init) => fetch(u, { ...init, signal: AbortSignal.timeout(20_000) }) }; + +if (!apiKey) { + console.error("[ombi-connections] no ombi API key — ombi's own `api-key` secret has not been accepted"); + process.exit(1); +} +const ombi = { url, apiKey }; + +if (!(await ombiReady(http, ombi, waitSeconds * 1000))) { + console.error(`[ombi-connections] ombi did not answer at ${url} within ${waitSeconds}s`); + process.exit(1); +} + +const inputs = async (provision: string) => + [await readBinding(join(dir, `${provision}.json`)), await readIfThere(join(dir, `${provision}.secret`))] as const; + +const outcomes: Outcome[] = []; +for (const spec of APPS) { + outcomes.push(await reconcileApp(http, ombi, spec, ...(await inputs(spec.provision)))); +} +outcomes.push(await reconcilePlex(http, ombi, ...(await inputs(PLEX_PROVISION)))); + +let failed = 0; +for (const outcome of outcomes) { + switch (outcome.result) { + case "unchanged": + console.log(`[ombi-connections] ${outcome.app}: already as the mesh says; connection tested`); + break; + case "written": + console.log(`[ombi-connections] ${outcome.app}: wrote ${outcome.fields.join(", ")}; connection tested`); + break; + case "refused": + failed++; + console.error(`[ombi-connections] ${outcome.app}: ${outcome.problem}`); + break; + } +} +process.exitCode = failed > 0 ? 1 : 0; diff --git a/modules/ombi/module.json b/modules/ombi/module.json index e70cd3d..d40ba5d 100644 --- a/modules/ombi/module.json +++ b/modules/ombi/module.json @@ -28,10 +28,15 @@ "path": "/var/lib/mesh/ombi", "mode": "0700" }, + { + "id": "state", + "type": "directory", + "mode": "0700", + "place": "." + }, { "id": "config", "type": "directory", - "path": "/services/ombi/config", "mode": "0700", "owner": "1000:1000" }, @@ -39,7 +44,7 @@ "id": "server", "type": "container", "name": "ombi", - "image": "lscr.io/linuxserver/ombi@sha256:a6f76ac521ba01eee2e9f0c23a3fed22e56630d97a04d5eeaeaa36c1e681640d", + "image": "lscr.io/linuxserver/ombi@sha256:22d6ebadbaaa728571353e74dc2173719e0fb02d4eaec551a7e9d2ee99ef68ac", "env": { "PUID": "1000", "PGID": "1000", @@ -49,7 +54,7 @@ "3579" ], "volumes": [ - "/services/ombi/config:/config" + "${dir:config}:/config" ] }, { @@ -68,24 +73,64 @@ "volumes": [ "/var/lib/mesh/ombi/broker:/run/secrets/broker:ro", "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro", - "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro", - "/services/ombi/config:/var/lib/ombi/config:ro" + "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro" ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", - "MESH_OMBI_URL": "http://127.0.0.1:3579", + "MESH_OMBI_URL": "http://127.0.0.1:${port:3579}", "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key", - "MESH_OMBI_CONFIG_FILE": "/run/config/config.json", - "MESH_OMBI_CONFIG_DIR": "/var/lib/ombi/config" + "MESH_OMBI_CONFIG_FILE": "/run/config/config.json" }, "restart-on": [ "runtime-config" ], "artifact": "runtime" + }, + { + "id": "connections", + "type": "container", + "name": "mesh-ombi-connections", + "network": "host", + "run-once": true, + "volumes": [ + "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro", + "${dir:state}/sonarr-api.json:/run/connections/sonarr-api.json:ro", + "${dir:state}/sonarr-api.secret:/run/connections/sonarr-api.secret:ro", + "${dir:state}/radarr-api.json:/run/connections/radarr-api.json:ro", + "${dir:state}/radarr-api.secret:/run/connections/radarr-api.secret:ro", + "${dir:state}/lidarr-api.json:/run/connections/lidarr-api.json:ro", + "${dir:state}/lidarr-api.secret:/run/connections/lidarr-api.secret:ro", + "${dir:state}/plex-api.json:/run/connections/plex-api.json:ro", + "${dir:state}/plex-api.secret:/run/connections/plex-api.secret:ro" + ], + "env": { + "MESH_OMBI_URL": "http://127.0.0.1:${port:3579}", + "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key", + "MESH_CONNECTIONS_DIR": "/run/connections" + }, + "args": [ + "run", + "/app/modules/ombi/dist/connections/index.js" + ], + "restart-on": [ + "bound-sonarr-api", + "secret-sonarr-api", + "bound-radarr-api", + "secret-radarr-api", + "bound-lidarr-api", + "secret-lidarr-api", + "bound-plex-api", + "secret-plex-api" + ], + "artifact": "runtime" } ], "requires": [ - "route" + "lidarr-api", + "plex-api", + "radarr-api", + "route", + "sonarr-api" ], "contributes": { "route": { @@ -94,7 +139,17 @@ } }, "binds": { - "route": "/var/lib/mesh/ombi/route.json" + "route": "${dir:state}/route.json", + "sonarr-api": "${dir:state}/sonarr-api.json", + "radarr-api": "${dir:state}/radarr-api.json", + "lidarr-api": "${dir:state}/lidarr-api.json", + "plex-api": "${dir:state}/plex-api.json" + }, + "secrets": { + "sonarr-api": "${dir:state}/sonarr-api.secret", + "radarr-api": "${dir:state}/radarr-api.secret", + "lidarr-api": "${dir:state}/lidarr-api.secret", + "plex-api": "${dir:state}/plex-api.secret" }, "build": { "on": [ diff --git a/modules/ombi/package.json b/modules/ombi/package.json index a1f9d58..d8a3c44 100644 --- a/modules/ombi/package.json +++ b/modules/ombi/package.json @@ -4,6 +4,11 @@ "description": "ombi — media requests. Its API client, tools and events live here (novox/hq ADR 0039).", "type": "module", "private": true, + "scripts": { + "build": "tsc client.ts index.ts tools/index.ts servarr/settings.ts plex/settings.ts connections/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist", + "typecheck": "tsc -p tsconfig.json", + "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'" + }, "dependencies": { "@novox/mesh-sdk": "^0.1.0" }, diff --git a/modules/ombi/plex/settings.ts b/modules/ombi/plex/settings.ts new file mode 100644 index 0000000..b9dac91 --- /dev/null +++ b/modules/ombi/plex/settings.ts @@ -0,0 +1,271 @@ +// Where ombi reaches Plex — decided by the mesh, written into ombi by ombi's own API. +// +// **Why this exists.** ombi keeps its Plex servers in its own database (OmbiSettings.db), so the +// mesh has no file to write `${bound:plex-api:at}` into. ombi requires `plex-api`; the mesh delivers +// a binding (where plex is: `at`, and what it serves: `port`, `scheme`) and a pair credential (the +// server owner's X-Plex-Token, accepted by the operator — plex.tv issues it and the mesh cannot +// mint it). This step makes ombi's Plex settings say the same thing, beside its Servarr ones. +// +// **Which entry is plex's.** ombi may list several Plex servers. The one this provision names is +// found by the server's own machineIdentifier, which plex answers at /identity — the same value +// ombi stored when an operator loaded the server in its settings screen. That entry's connection is +// brought in line; an entry for any other server is never touched. +// +// When no entry carries that identifier, an entry may still be this server reached another way: +// ace's ombi holds one loaded from an older server and later retyped to plex's public name, so its +// stored identifier is stale while its address answers as this plex. Each entry's OWN address is +// asked for /identity, and an entry plex itself answers for is this server's — adopted: its +// connection laid over and its identifier corrected (ombi builds its "view in Plex" links from it). +// Nothing is guessed: an entry whose address is unreachable, or answers as another server, is left +// as it was. Only when no entry is this server's either way is one added, named as plex names +// itself — it is the mesh's, so later runs keep it true. +// +// **Only the connection, and only when it differs.** Host, port, TLS, base path and token — and the +// identifier of an adopted entry. Whether Plex is enabled in ombi, watchlist import, the selected +// libraries, the batch size and everything else an operator chose are left exactly as they are. +// +// **A token plex refuses is never written.** Until the operator accepts the server's token for this +// pair, the mesh delivers a value it minted itself, which plex answers with 401 (or 400 on its own +// network). Writing it would replace a working token in ombi with a dead one, so the token is tried +// against plex first; refused, nothing is written and the step fails naming the `secret accept`. + +import { isLoopback, ombiCall, type Binding, type Http, type Ombi, type Outcome } from "../servarr/settings.js"; + +/** The provision ombi requires for Plex — the manifest's `requires`, `binds` and `secrets` key. */ +export const PLEX_PROVISION = "plex-api"; + +/** The connection fields ombi keeps for a Plex server — the only ones this step ever writes. */ +export interface PlexConnection { + ip: string; + port: number; + ssl: boolean; + subDir: string | null; + plexAuthToken: string; +} + +export type PlexWanted = { ok: true; connection: PlexConnection; from: string } | { ok: false; problem: string }; + +/** The connection the mesh says ombi should use, from the binding and the pair credential. */ +export function wantedPlex(binding: Binding | undefined, credential: string | undefined): PlexWanted { + if (!binding) { + return { ok: false, problem: `no binding for ${PLEX_PROVISION} was delivered — the mesh writes it before this step runs` }; + } + const at = typeof binding.at === "string" ? binding.at.trim() : ""; + const serves = binding.serves ?? {}; + const port = Number(serves.port); + if (!at) return { ok: false, problem: `the ${PLEX_PROVISION} binding names no host (at)` }; + if (isLoopback(at)) { + return { + ok: false, + problem: + `the ${PLEX_PROVISION} binding says plex is at ${at}, which from ombi's own container is ombi itself. ` + + `The mesh hands loopback to a machine that is not on the private network; put it on the private ` + + `network so plex has an address ombi can dial`, + }; + } + if (!Number.isInteger(port) || port <= 0 || port > 65535) { + return { ok: false, problem: `the ${PLEX_PROVISION} binding serves no usable port (${String(serves.port)})` }; + } + const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http"; + if (scheme !== "http" && scheme !== "https") { + return { ok: false, problem: `the ${PLEX_PROVISION} binding serves scheme ${scheme}, which ombi cannot dial` }; + } + const token = (credential ?? "").trim(); + if (!token) return { ok: false, problem: `the ${PLEX_PROVISION} credential is empty or was not delivered` }; + return { + ok: true, + from: typeof binding.from === "string" ? binding.from : "", + connection: { ip: at, port, ssl: scheme === "https", subDir: null, plexAuthToken: token }, + }; +} + +/** plex's base URL as the step dials it — the same host and port ombi will be given. */ +export function plexUrl(want: PlexConnection): string { + const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip; + return `${want.ssl ? "https" : "http"}://${host}:${want.port}`; +} + +/** Which connection fields differ between an entry ombi holds and what the mesh says. Names only. */ +export function differingPlex(current: Record | undefined, want: PlexConnection): (keyof PlexConnection)[] { + const now = current ?? {}; + const out: (keyof PlexConnection)[] = []; + if (String(now.ip ?? "") !== want.ip) out.push("ip"); + if (Number(now.port ?? 0) !== want.port) out.push("port"); + if (Boolean(now.ssl) !== want.ssl) out.push("ssl"); + const sub = typeof now.subDir === "string" && now.subDir.trim() !== "" ? now.subDir : null; + if (sub !== want.subDir) out.push("subDir"); + if (String(now.plexAuthToken ?? "") !== want.plexAuthToken) out.push("plexAuthToken"); + return out; +} + +async function plexGet(http: Http, want: PlexConnection, path: string, withToken: boolean) { + const headers: Record = { Accept: "application/json" }; + if (withToken) headers["X-Plex-Token"] = want.plexAuthToken; + return http.fetch(`${plexUrl(want)}${path}`, { method: "GET", headers }); +} + +/** + * Does plex take this token? `true` it does; `false` it refused it — 401 or 403, or 400, which is + * what plex answers a token it never issued on a network it trusts. A thrown error when plex could + * not be asked. + */ +export async function plexTakes(http: Http, want: PlexConnection): Promise<{ takes: boolean; friendlyName?: string }> { + const res = await plexGet(http, want, "/", true); + if (res.status === 400 || res.status === 401 || res.status === 403) return { takes: false }; + if (res.status < 200 || res.status >= 300) throw new Error(`plex answered ${res.status} at /`); + let friendlyName: string | undefined; + try { + const body = JSON.parse(await res.text()) as { MediaContainer?: { friendlyName?: unknown } }; + if (typeof body.MediaContainer?.friendlyName === "string") friendlyName = body.MediaContainer.friendlyName; + } catch { + // a name is a nicety for a new entry, not a condition + } + return { takes: true, friendlyName }; +} + +/** The server's own machineIdentifier, which plex answers without a token. */ +export async function plexIdentity(http: Http, want: Pick): Promise { + const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip; + const base = `${want.ssl ? "https" : "http"}://${host}:${want.port}${want.subDir ? `/${want.subDir.replace(/^\/+|\/+$/g, "")}` : ""}`; + const res = await http.fetch(`${base}/identity`, { method: "GET", headers: { Accept: "application/json" } }); + if (res.status !== 200) throw new Error(`plex answered ${res.status} at /identity`); + const body = JSON.parse(await res.text()) as { MediaContainer?: { machineIdentifier?: unknown } }; + const id = body.MediaContainer?.machineIdentifier; + if (typeof id !== "string" || id === "") throw new Error("plex's /identity names no machineIdentifier"); + return id; +} + +/** The remedy for a refused token, in the controller's own words (ADR 0092). */ +export function plexAcceptRemedy(from: string): string { + return ( + `plex refuses the ${PLEX_PROVISION} credential the mesh delivered, so it was not written into ombi. ` + + `plex's token is issued by plex.tv and the mesh cannot make it: accept the server's own token for ` + + `this pair — \`secret accept ombi ${PLEX_PROVISION} --provider ${from || ""} ` + + `--from \`` + ); +} + +/** The batch size ombi's settings screen fills in for a server it adds ("150 by default"). */ +const EPISODE_BATCH_SIZE = 150; + +/** ombi's server entries, as its settings document holds them (null on a fresh ombi). */ +export function serversOf(document: Record | undefined): Record[] { + const servers = document?.servers; + return Array.isArray(servers) ? (servers as Record[]) : []; +} + +/** + * Which entries, holding another identifier, plex answers for at their own address — this server, + * reached another way. Asked only when no entry carries the identifier. An entry that cannot be + * asked is not this server's: nothing is guessed. + */ +export async function answeringAs(http: Http, servers: Record[], machineIdentifier: string): Promise> { + const out = new Set(); + if (servers.some((s) => s?.machineIdentifier === machineIdentifier)) return out; + for (const [i, s] of servers.entries()) { + const ip = typeof s?.ip === "string" ? s.ip.trim() : ""; + const port = Number(s?.port); + if (!ip || !Number.isInteger(port) || port <= 0 || port > 65535) continue; + const subDir = typeof s.subDir === "string" && s.subDir.trim() !== "" ? s.subDir : null; + try { + if ((await plexIdentity(http, { ip, port, ssl: Boolean(s.ssl), subDir })) === machineIdentifier) out.add(i); + } catch { + // unreachable, or not a plex: not this server's + } + } + return out; +} + +/** + * ombi's Plex settings with this server's connection laid over them: every entry naming the + * server's machineIdentifier — or adopted, its address answering as this server — gets the + * connection (an adopted one also the identifier), every other entry is left as it was, and when + * none is this server's one is added. Returns the document to save and the fields that changed. + */ +export function withPlexServer( + document: Record | undefined, + machineIdentifier: string, + want: PlexConnection, + name: string, + adopted: ReadonlySet = new Set(), +): { next: Record; fields: string[]; added: boolean; entry: Record } { + const doc = document ?? {}; + const servers = serversOf(doc); + const fields = new Set(); + let entry: Record | undefined; + const next = servers.map((s, i) => { + const adopt = adopted.has(i) && s?.machineIdentifier !== machineIdentifier; + if (s?.machineIdentifier !== machineIdentifier && !adopt) return s; + for (const f of differingPlex(s, want)) fields.add(f); + if (adopt) fields.add("machineIdentifier"); + const laid = { ...s, machineIdentifier, ip: want.ip, port: want.port, ssl: want.ssl, subDir: want.subDir, plexAuthToken: want.plexAuthToken }; + entry ??= laid; + return laid; + }); + if (entry) return { next: { ...doc, servers: next }, fields: [...fields], added: false, entry }; + const added: Record = { + name, + machineIdentifier, + ip: want.ip, + port: want.port, + ssl: want.ssl, + subDir: want.subDir, + plexAuthToken: want.plexAuthToken, + episodeBatchSize: EPISODE_BATCH_SIZE, + plexSelectedLibraries: [], + }; + return { next: { ...doc, servers: [...next, added] }, fields: ["server"], added: true, entry: added }; +} + +/** + * Bring ombi's connection to plex in line with the mesh: check the token against plex, find the + * server's entry by its machineIdentifier, write only the connection fields when they differ (or add + * the entry), then have ombi test the connection from its own container. Never throws. + */ +export async function reconcilePlex(http: Http, ombi: Ombi, binding: Binding | undefined, credential: string | undefined): Promise { + const app = "plex"; + const w = wantedPlex(binding, credential); + // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not + // narrow. + if ("problem" in w) return { app, result: "refused", problem: w.problem }; + const want = w.connection; + + let name: string; + let machineIdentifier: string; + try { + const taken = await plexTakes(http, want); + if (!taken.takes) return { app, result: "refused", problem: plexAcceptRemedy(w.from) }; + machineIdentifier = await plexIdentity(http, want); + name = taken.friendlyName || "Plex"; + } catch (err) { + return { app, result: "refused", problem: `plex could not be asked whether it takes the token at ${want.ip}:${want.port}: ${message(err)}` }; + } + + try { + const document = (await ombiCall(http, ombi, "GET", "/Settings/Plex")) as Record | undefined; + const adopted = await answeringAs(http, serversOf(document), machineIdentifier); + const laid = withPlexServer(document, machineIdentifier, want, name, adopted); + if (laid.fields.length > 0) { + const saved = await ombiCall(http, ombi, "POST", "/Settings/Plex", laid.next); + if (saved === false) return { app, result: "refused", problem: "ombi declined to save its Plex settings" }; + } + // ombi's own test, from ombi's own container — the path the step's check above did not take. + const tested = await ombiCall(http, ombi, "POST", "/Tester/plex", laid.entry); + if (tested !== true) { + return { + app, + result: "refused", + problem: + `ombi cannot reach plex at ${want.ip}:${want.port} from its own container` + + (laid.fields.length > 0 ? `; its settings were written (${laid.fields.join(", ")})` : ""), + }; + } + return laid.fields.length > 0 ? { app, result: "written", fields: laid.fields } : { app, result: "unchanged" }; + } catch (err) { + return { app, result: "refused", problem: message(err) }; + } +} + +function message(err: unknown): string { + return err instanceof Error ? err.message : String(err); +} diff --git a/modules/ombi/servarr/settings.ts b/modules/ombi/servarr/settings.ts new file mode 100644 index 0000000..34d8854 --- /dev/null +++ b/modules/ombi/servarr/settings.ts @@ -0,0 +1,304 @@ +// Where ombi reaches Sonarr, Radarr and Lidarr — decided by the mesh, written into ombi by ombi's +// own API. +// +// **Why this exists.** ombi keeps its connection to each Servarr app in its own database +// (OmbiSettings.db), not in a file, so the mesh has nowhere to write `${bound:sonarr-api:at}` for it. +// ombi requires `sonarr-api`, `radarr-api` and `lidarr-api`; the mesh delivers, for each, a binding +// (where the app is: `at`, and what it serves: `port`, `scheme`, `url-base`) and a pair credential +// (the app's API key, accepted by the operator — a Servarr app has exactly one key and the mesh +// cannot mint it). This step reads those files and makes ombi's settings say the same thing. +// +// **Only the connection, and only when it differs.** Host, port, TLS, base path and API key. The +// quality profile, root folder, language profile, tags, "enabled" and every other choice an operator +// made in ombi's settings screen are left exactly as they are: the mesh knows where the app is, not +// what ombi should do with it. Radarr's 4K instance is a different Radarr and is not touched. +// +// **A credential the app refuses is never written.** Until the operator accepts the app's API key +// for this pair, the mesh delivers a value it minted itself, which no Servarr app will ever accept +// (novox/hq ADR 0092). Writing it would replace a working key in ombi with a dead one. So the key is +// tried against the app first; refused, nothing for that app is written and the step fails naming +// the `secret accept` that fixes it. +// +// Pure logic and a small HTTP seam, so it is tested against fake servers (test/servarr.test.ts). + +import { readFile } from "node:fs/promises"; + +/** One Servarr app ombi connects to, and the shape of that connection in ombi's API. */ +export interface ServarrApp { + /** The app, as ombi's API names it: /Settings/, /Tester/. */ + app: "sonarr" | "radarr" | "lidarr"; + /** The provision it is required as — the manifest's `requires`, `binds` and `secrets` key. */ + provision: string; + /** The app's own status endpoint, which answers 401 to a wrong key. */ + statusPath: string; + /** + * Where the one connection sits in ombi's settings document. Radarr's is `{radarr, radarr4K}` + * (two Radarr instances); only `radarr` is this provision's. + */ + within?: string; +} + +export const APPS: readonly ServarrApp[] = [ + { app: "sonarr", provision: "sonarr-api", statusPath: "/api/v3/system/status" }, + { app: "radarr", provision: "radarr-api", statusPath: "/api/v3/system/status", within: "radarr" }, + { app: "lidarr", provision: "lidarr-api", statusPath: "/api/v1/system/status" }, +]; + +/** The connection fields ombi keeps for an app — the only ones this step ever writes. */ +export interface Connection { + ip: string; + port: number; + ssl: boolean; + /** ombi's name for the app's URL base; null when the app is served at the root. */ + subDir: string | null; + apiKey: string; +} + +/** What the mesh wrote at `binds.`: the binding document (controller's boundFile). */ +export interface Binding { + provision?: string; + from?: string; + at?: string; + as?: string; + serves?: Record; +} + +export type Wanted = { ok: true; connection: Connection; from: string } | { ok: false; problem: string }; + +/** + * The connection the mesh says ombi should use, from the binding and the pair credential. + * + * Refused rather than guessed when the binding cannot be dialled from ombi's own container: a + * loopback `at` — what the mesh hands a machine that is not on the private network — is ombi's + * container itself, not the app. + */ +export function wanted(spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): Wanted { + if (!binding) { + return { ok: false, problem: `no binding for ${spec.provision} was delivered — the mesh writes it before this step runs` }; + } + const at = typeof binding.at === "string" ? binding.at.trim() : ""; + const serves = binding.serves ?? {}; + const port = Number(serves.port); + if (!at) { + return { ok: false, problem: `the ${spec.provision} binding names no host (at)` }; + } + if (isLoopback(at)) { + return { + ok: false, + problem: + `the ${spec.provision} binding says ${spec.app} is at ${at}, which from ombi's own container is ` + + `ombi itself. The mesh hands loopback to a machine that is not on the private network; put it ` + + `on the private network so ${spec.app} has an address ombi can dial`, + }; + } + if (!Number.isInteger(port) || port <= 0 || port > 65535) { + return { ok: false, problem: `the ${spec.provision} binding serves no usable port (${String(serves.port)})` }; + } + const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http"; + if (scheme !== "http" && scheme !== "https") { + return { ok: false, problem: `the ${spec.provision} binding serves scheme ${scheme}, which ombi cannot dial` }; + } + const key = (credential ?? "").trim(); + if (!key) { + return { ok: false, problem: `the ${spec.provision} credential is empty or was not delivered` }; + } + return { + ok: true, + from: typeof binding.from === "string" ? binding.from : "", + connection: { ip: at, port, ssl: scheme === "https", subDir: subDirOf(serves["url-base"]), apiKey: key }, + }; +} + +/** ombi's `subDir`: the URL base with its slashes trimmed, null when there is none. */ +export function subDirOf(urlBase: unknown): string | null { + const trimmed = typeof urlBase === "string" ? urlBase.trim().replace(/^\/+|\/+$/g, "") : ""; + return trimmed === "" ? null : trimmed; +} + +export function isLoopback(host: string): boolean { + const h = host.toLowerCase(); + return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h); +} + +/** Which connection fields differ between what ombi holds and what the mesh says. Names only. */ +export function differing(current: Record | undefined, want: Connection): (keyof Connection)[] { + const now = current ?? {}; + const out: (keyof Connection)[] = []; + if (String(now.ip ?? "") !== want.ip) out.push("ip"); + if (Number(now.port ?? 0) !== want.port) out.push("port"); + if (Boolean(now.ssl) !== want.ssl) out.push("ssl"); + if (subDirOf(now.subDir) !== want.subDir) out.push("subDir"); + if (String(now.apiKey ?? "") !== want.apiKey) out.push("apiKey"); + return out; +} + +/** ombi's settings for the app with the connection laid over them and nothing else changed. */ +export function withConnection(current: Record | undefined, want: Connection): Record { + return { ...(current ?? {}), ip: want.ip, port: want.port, ssl: want.ssl, subDir: want.subDir, apiKey: want.apiKey }; +} + +/** The app's base URL as the step dials it — the same host and port ombi will be given. */ +export function appUrl(want: Connection): string { + const scheme = want.ssl ? "https" : "http"; + const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip; + return `${scheme}://${host}:${want.port}${want.subDir ? `/${want.subDir}` : ""}`; +} + +/** How one app came out. */ +export type Outcome = + | { app: string; result: "unchanged" } + | { app: string; result: "written"; fields: string[] } + | { app: string; result: "refused"; problem: string }; + +/** The HTTP the step needs, so a test can stand fakes in for ombi and the apps. */ +export interface Http { + fetch(url: string, init?: { method?: string; headers?: Record; body?: string }): Promise<{ + status: number; + text(): Promise; + }>; +} + +export interface Ombi { + url: string; + apiKey: string; +} + +export async function ombiCall(http: Http, ombi: Ombi, method: string, path: string, body?: unknown): Promise { + const res = await http.fetch(`${ombi.url.replace(/\/$/, "")}/api/v1${path}`, { + method, + headers: { + ApiKey: ombi.apiKey, + Accept: "application/json", + ...(body !== undefined ? { "Content-Type": "application/json" } : {}), + }, + body: body !== undefined ? JSON.stringify(body) : undefined, + }); + const text = await res.text(); + if (res.status < 200 || res.status >= 300) { + // The body is ombi's error, never a request echo, so it carries no key. + throw new Error(`ombi ${method} ${path} answered ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`); + } + return text ? (JSON.parse(text) as unknown) : undefined; +} + +/** + * Does the app take this key? `true` it does, `false` it refused it (401/403), and a thrown error + * when it could not be asked — unreachable, or answering something that is neither. + */ +export async function appTakes(http: Http, spec: ServarrApp, want: Connection): Promise { + const res = await http.fetch(`${appUrl(want)}${spec.statusPath}`, { + method: "GET", + headers: { "X-Api-Key": want.apiKey, Accept: "application/json" }, + }); + if (res.status === 401 || res.status === 403) return false; + if (res.status >= 200 && res.status < 300) return true; + throw new Error(`${spec.app} answered ${res.status} at ${spec.statusPath}`); +} + +/** The remedy for a refused key, in the controller's own words (ADR 0092). */ +export function acceptRemedy(spec: ServarrApp, from: string): string { + return ( + `${spec.app} refuses the ${spec.provision} credential the mesh delivered, so it was not written ` + + `into ombi. A Servarr app has one API key and the mesh cannot make it: accept ${spec.app}'s own ` + + `key for this pair — \`secret accept ombi ${spec.provision} --provider ${from || ""} ` + + `--from \`` + ); +} + +/** + * Bring ombi's connection to one app in line with the mesh: check the key against the app, compare, + * write only the connection fields when they differ, then have ombi test the connection from its own + * container. Never throws: every failure is an outcome with a reason. + */ +export async function reconcileApp( + http: Http, + ombi: Ombi, + spec: ServarrApp, + binding: Binding | undefined, + credential: string | undefined, +): Promise { + const w = wanted(spec, binding, credential); + // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not + // narrow. + if ("problem" in w) return { app: spec.app, result: "refused", problem: w.problem }; + const want = w.connection; + + try { + if (!(await appTakes(http, spec, want))) { + return { app: spec.app, result: "refused", problem: acceptRemedy(spec, w.from) }; + } + } catch (err) { + return { + app: spec.app, + result: "refused", + problem: `${spec.app} could not be asked whether it takes the key at ${want.ip}:${want.port}: ${message(err)}`, + }; + } + + try { + const document = (await ombiCall(http, ombi, "GET", `/Settings/${spec.app}`)) as Record | undefined; + const current = spec.within ? (document?.[spec.within] as Record | undefined) : document; + const fields = differing(current, want); + if (fields.length > 0) { + const next = withConnection(current, want); + const body = spec.within ? { ...(document ?? {}), [spec.within]: next } : next; + const saved = await ombiCall(http, ombi, "POST", `/Settings/${spec.app}`, body); + if (saved === false) { + return { app: spec.app, result: "refused", problem: `ombi declined to save its ${spec.app} settings` }; + } + } + // ombi's own test, from ombi's own container — the path the step's check above did not take. + const tested = (await ombiCall(http, ombi, "POST", `/Tester/${spec.app}`, withConnection(current, want))) as + | { isValid?: boolean; expectedSubDir?: string | null } + | undefined; + if (!tested?.isValid) { + const hint = tested?.expectedSubDir ? ` (ombi expected the base path ${tested.expectedSubDir})` : ""; + return { + app: spec.app, + result: "refused", + problem: + `ombi cannot reach ${spec.app} at ${want.ip}:${want.port} from its own container${hint}` + + (fields.length > 0 ? `; its settings were written (${fields.join(", ")})` : ""), + }; + } + return fields.length > 0 ? { app: spec.app, result: "written", fields } : { app: spec.app, result: "unchanged" }; + } catch (err) { + return { app: spec.app, result: "refused", problem: message(err) }; + } +} + +/** Wait for ombi to answer, because the step runs right after its container starts. */ +export async function ombiReady(http: Http, ombi: Ombi, waitMs: number, pauseMs = 2000): Promise { + const until = Date.now() + waitMs; + for (;;) { + try { + const res = await http.fetch(`${ombi.url.replace(/\/$/, "")}/api/v1/Status`, { method: "GET" }); + if (res.status === 200) return true; + } catch { + // not listening yet + } + if (Date.now() >= until) return false; + await new Promise((r) => setTimeout(r, pauseMs)); + } +} + +/** A file the mesh wrote, or undefined when it is not there. */ +export async function readIfThere(path: string | undefined): Promise { + if (!path) return undefined; + return readFile(path, "utf8").catch(() => undefined); +} + +/** A binding file parsed, or undefined when absent or not JSON. */ +export async function readBinding(path: string | undefined): Promise { + const raw = await readIfThere(path); + if (raw === undefined) return undefined; + try { + return JSON.parse(raw) as Binding; + } catch { + return undefined; + } +} + +function message(err: unknown): string { + return err instanceof Error ? err.message : String(err); +} diff --git a/modules/ombi/test/plex.test.ts b/modules/ombi/test/plex.test.ts new file mode 100644 index 0000000..45d8a28 --- /dev/null +++ b/modules/ombi/test/plex.test.ts @@ -0,0 +1,223 @@ +// What holds ombi's Plex step (plex/settings.ts): the entry for the server plex says it is — found +// by machineIdentifier — is made to say what the mesh bound (host, port, TLS, token) and nothing +// else it keeps is touched; an entry for another server is left alone; an ombi with no entry for it +// gets one; nothing is written when nothing differs; and a token plex refuses (the mesh's own minted +// value, before the operator accepts the server's token) is never written, with the `secret accept` +// that fixes it named. +// +// ombi and plex are fakes answering the routes the step touches as the real ones do (checked against +// lscr.io/linuxserver/ombi 4.53.10 and plexinc/pms-docker 1.43.4: plex answers 401 to an unknown +// token from another network and 400 on one it trusts; ombi's /Tester/plex answers a bare boolean). +// +// Imports the compiled step, as keycloak's tests do: plex/settings.ts imports its sibling with the +// `.js` specifier the build needs, which Node's type stripping does not resolve to a `.ts` file. + +import { test } from "node:test"; +import assert from "node:assert/strict"; + +import { differingPlex, reconcilePlex, wantedPlex, withPlexServer } from "../dist/plex/settings.js"; +import type { Binding, Http } from "../servarr/settings.ts"; + +const TOKEN = "the-servers-own-token"; +const MACHINE = "5c47d9a165d10b622995d55b3ae1f168242f33bd"; +const OMBI = { url: "http://127.0.0.1:3579", apiKey: "ombi-key" }; + +function binding(port = 32400, at = "ace.internal", scheme = "http"): Binding { + return { binding: 1, provision: "plex-api", from: "ace", at, as: "mesh_ace_ombi", serves: { scheme, port } } as Binding; +} + +interface Call { + method: string; + url: string; + body?: unknown; +} + +function fakes(plexSettings: Record, opts: { reachable?: boolean; trusted?: boolean } = {}) { + const calls: Call[] = []; + const store = { plex: plexSettings }; + const http: Http = { + async fetch(url, init) { + const method = init?.method ?? "GET"; + const body = init?.body ? (JSON.parse(init.body) as unknown) : undefined; + calls.push({ method, url, body }); + const reply = (status: number, value?: unknown) => ({ + status, + text: async () => (value === undefined ? "" : JSON.stringify(value)), + }); + const u = new URL(url); + // Other servers an entry may name: a friend's, and plex's own public name (the same server). + if (u.hostname === "10.0.0.9") return reply(200, { MediaContainer: { machineIdentifier: "another-server" } }); + if (u.hostname === "gone.example") throw new Error("getaddrinfo ENOTFOUND"); + if (u.hostname === "plex.zurag.be") { + if (u.pathname === "/identity") return reply(200, { MediaContainer: { machineIdentifier: MACHINE } }); + return reply(401); + } + if (u.port === "32400" || u.hostname === "ace.internal") { + if (opts.reachable === false) throw new Error("connect ECONNREFUSED"); + if (u.pathname === "/identity") return reply(200, { MediaContainer: { machineIdentifier: MACHINE } }); + const token = init?.headers?.["X-Plex-Token"]; + if (token !== TOKEN) return reply(opts.trusted ? 400 : 401); + return reply(200, { MediaContainer: { friendlyName: "ace", machineIdentifier: MACHINE } }); + } + if (init?.headers?.ApiKey !== "ombi-key") return reply(401); + if (u.pathname === "/api/v1/Settings/Plex" && method === "GET") return reply(200, store.plex); + if (u.pathname === "/api/v1/Settings/Plex" && method === "POST") { + store.plex = body as Record; + return reply(200, true); + } + if (u.pathname === "/api/v1/Tester/plex") { + const tried = body as { plexAuthToken?: string; ip?: string }; + return reply(200, tried.plexAuthToken === TOKEN && tried.ip === "ace.internal"); + } + return reply(404); + }, + }; + return { http, calls, store }; +} + +// What an operator's ombi holds: plex loaded through its public name, plus a friend's server. +const operatorPlex = () => ({ + enable: true, + enableWatchlistImport: true, + monitorAll: false, + installId: "b358a2a2-2ab0-4025-a3f3-450313c3c418", + servers: [ + { + name: "ace", plexAuthToken: TOKEN, machineIdentifier: MACHINE, episodeBatchSize: 150, + serverHostname: "https://app.plex.tv", plexSelectedLibraries: [{ key: "1", title: "Films", enabled: true }], + ssl: true, subDir: null, ip: "plex.zurag.be", port: 443, id: 1, + }, + { + name: "a friend", plexAuthToken: "their-token", machineIdentifier: "another-server", episodeBatchSize: 150, + plexSelectedLibraries: [], ssl: false, subDir: null, ip: "10.0.0.9", port: 32400, id: 2, + }, + ], + id: 4, +}); + +test("the server's own entry gets the bound connection; its libraries and every other setting stay", async () => { + const f = fakes(operatorPlex()); + const out = await reconcilePlex(f.http, OMBI, binding(), `${TOKEN}\n`); + assert.deepEqual(out, { app: "plex", result: "written", fields: ["ip", "port", "ssl"] }); + const want = operatorPlex(); + Object.assign(want.servers[0], { ip: "ace.internal", port: 32400, ssl: false }); + assert.deepEqual(f.store.plex, want); +}); + +test("another server's entry is never touched", async () => { + const f = fakes(operatorPlex()); + await reconcilePlex(f.http, OMBI, binding(), TOKEN); + const servers = f.store.plex.servers as Record[]; + assert.deepEqual(servers[1], operatorPlex().servers[1]); +}); + +test("nothing is written when ombi already says what the mesh says", async () => { + const doc = operatorPlex(); + Object.assign(doc.servers[0], { ip: "ace.internal", port: 32400, ssl: false }); + const f = fakes(doc); + const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN); + assert.deepEqual(out, { app: "plex", result: "unchanged" }); + assert.equal(f.calls.filter((c) => c.method === "POST" && c.url.includes("/Settings/")).length, 0); +}); + +test("an ombi with no entry for this server gets one, named as plex names itself", async () => { + const fresh = { enable: false, enableWatchlistImport: false, monitorAll: false, installId: "x", servers: null, id: 0 }; + const f = fakes(fresh); + const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN); + assert.deepEqual(out, { app: "plex", result: "written", fields: ["server"] }); + assert.deepEqual(f.store.plex, { + ...fresh, + servers: [{ + name: "ace", machineIdentifier: MACHINE, ip: "ace.internal", port: 32400, ssl: false, subDir: null, + plexAuthToken: TOKEN, episodeBatchSize: 150, plexSelectedLibraries: [], + }], + }); + assert.equal(f.store.plex.enable, false, "whether plex is enabled in ombi is the operator's choice"); +}); + +test("a token plex refuses is never written, and the accept that fixes it is named", async () => { + for (const trusted of [false, true]) { + const f = fakes(operatorPlex(), { trusted }); + const out = await reconcilePlex(f.http, OMBI, binding(), "a-value-the-mesh-minted"); + assert.equal(out.result, "refused"); + const problem = (out as { problem: string }).problem; + assert.match(problem, /secret accept ombi plex-api --provider ace/); + assert.doesNotMatch(problem, /a-value-the-mesh-minted/); + assert.deepEqual(f.store.plex, operatorPlex(), "ombi's working settings were left alone"); + assert.equal(f.calls.some((c) => c.url.includes("/api/v1/")), false, "ombi was not even asked"); + } +}); + +test("a plex it cannot reach is reported, and ombi is left alone", async () => { + const f = fakes(operatorPlex(), { reachable: false }); + const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN); + assert.equal(out.result, "refused"); + assert.match((out as { problem: string }).problem, /could not be asked.*ECONNREFUSED/); + assert.deepEqual(f.store.plex, operatorPlex()); +}); + +test("a loopback binding is refused: from ombi's container it is ombi itself", () => { + const w = wantedPlex(binding(32400, "127.0.0.1"), TOKEN); + assert.equal(w.ok, false); + assert.match((w as { problem: string }).problem, /private network/); +}); + +test("an https binding sets ombi's ssl flag; an empty subDir is none", () => { + const w = wantedPlex(binding(32400, "ace.internal", "https"), TOKEN); + assert.equal(w.ok && w.connection.ssl, true); + assert.deepEqual( + differingPlex({ ip: "h", port: 1, ssl: false, subDir: "", plexAuthToken: "k" }, { ip: "h", port: 1, ssl: false, subDir: null, plexAuthToken: "k" }), + [], + ); +}); + +test("every entry naming the server is laid over, not only the first", () => { + const doc = { servers: [{ machineIdentifier: MACHINE, ip: "a" }, { machineIdentifier: MACHINE, ip: "b" }] }; + const want = { ip: "ace.internal", port: 32400, ssl: false, subDir: null, plexAuthToken: TOKEN }; + const laid = withPlexServer(doc, MACHINE, want, "ace"); + assert.equal(laid.added, false); + assert.deepEqual((laid.next.servers as { ip: string }[]).map((s) => s.ip), ["ace.internal", "ace.internal"]); +}); + +// ace's own ombi: its one entry was loaded from an older server (a stale identifier) and retyped to +// plex's public name, so it IS this server, reached another way (read from ace, 2026-09-30). +const acesOmbi = () => ({ + enable: true, + enableWatchlistImport: true, + servers: [{ + name: "Nami", plexAuthToken: TOKEN, machineIdentifier: "76562198623e708eef85b46aedb72c8f2fe671aa", episodeBatchSize: 0, + plexSelectedLibraries: [1, 2, 3, 4, 5, 6].map((k) => ({ key: String(k), enabled: true })), ssl: true, subDir: null, + ip: "plex.zurag.be", port: 443, id: 1, + }], + id: 4, +}); + +test("an entry whose own address answers as this server is adopted: connection and identifier, nothing else", async () => { + const f = fakes(acesOmbi()); + const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN); + assert.deepEqual(out, { app: "plex", result: "written", fields: ["ip", "port", "ssl", "machineIdentifier"] }); + const want = acesOmbi(); + Object.assign(want.servers[0], { ip: "ace.internal", port: 32400, ssl: false, machineIdentifier: MACHINE }); + assert.deepEqual(f.store.plex, want, "one entry, still named Nami, its six libraries kept; none added"); +}); + +test("an entry answering as another server, or not at all, is not adopted; this server gets its own", async () => { + const doc = { + servers: [ + { name: "a friend", machineIdentifier: "stale-1", ip: "10.0.0.9", port: 32400, ssl: false, plexAuthToken: "theirs" }, + { name: "gone", machineIdentifier: "stale-2", ip: "gone.example", port: 32400, ssl: false, plexAuthToken: "old" }, + ], + }; + const f = fakes(structuredClone(doc)); + const out = await reconcilePlex(f.http, OMBI, binding(), TOKEN); + assert.deepEqual(out, { app: "plex", result: "written", fields: ["server"] }); + const servers = f.store.plex.servers as Record[]; + assert.deepEqual(servers.slice(0, 2), doc.servers, "both left exactly as they were"); + assert.equal(servers[2].machineIdentifier, MACHINE); +}); + +test("no entry is probed once one carries the server's identifier", async () => { + const f = fakes(operatorPlex()); + await reconcilePlex(f.http, OMBI, binding(), TOKEN); + assert.equal(f.calls.some((c) => c.url.startsWith("http://10.0.0.9")), false, "the friend's server was not asked"); +}); diff --git a/modules/ombi/test/servarr.test.ts b/modules/ombi/test/servarr.test.ts new file mode 100644 index 0000000..45ec405 --- /dev/null +++ b/modules/ombi/test/servarr.test.ts @@ -0,0 +1,147 @@ +// What holds ombi's Servarr step (servarr/settings.ts): the connection ombi keeps for each app is +// made to say what the mesh bound — host, port, TLS, base path, key — and nothing else it keeps is +// touched; nothing is written when nothing differs; Radarr's 4K instance is left alone; and a key the +// app refuses (the mesh's own minted value, before the operator accepts the app's key) is never +// written, with the `secret accept` that fixes it named. +// +// ombi and the apps are fakes: the routes the step touches, answering as the real ones do (checked +// against lscr.io/linuxserver/ombi 4.53.10 and the catalogue's pinned sonarr/radarr/lidarr). + +import { test } from "node:test"; +import assert from "node:assert/strict"; + +import { APPS, differing, reconcileApp, subDirOf, wanted, type Binding, type Http, type ServarrApp } from "../servarr/settings.ts"; + +const SONARR = APPS.find((a) => a.app === "sonarr") as ServarrApp; +const RADARR = APPS.find((a) => a.app === "radarr") as ServarrApp; +const LIDARR = APPS.find((a) => a.app === "lidarr") as ServarrApp; +const THE_KEY = "the-apps-own-key"; + +function binding(provision: string, port: number, at = "ace.internal"): Binding { + return { binding: 1, provision, from: "ace", at, as: "mesh_ace_ombi", serves: { scheme: "http", port, "url-base": "" } } as Binding; +} + +interface Call { + method: string; + url: string; + body?: unknown; +} + +/** ombi's settings store and the apps' key check, behind one fetch. */ +function fakes(settings: Record, opts: { appKey?: string; reachable?: boolean } = {}) { + const calls: Call[] = []; + const appKey = opts.appKey ?? THE_KEY; + const http: Http = { + async fetch(url, init) { + const method = init?.method ?? "GET"; + const body = init?.body ? (JSON.parse(init.body) as unknown) : undefined; + calls.push({ method, url, body }); + const reply = (status: number, value?: unknown) => ({ + status, + text: async () => (value === undefined ? "" : JSON.stringify(value)), + }); + const u = new URL(url); + if (u.pathname.endsWith("/system/status")) { + if (opts.reachable === false) throw new Error("connect ECONNREFUSED"); + return init?.headers?.["X-Api-Key"] === appKey ? reply(200, { version: "4" }) : reply(401); + } + if (init?.headers?.ApiKey !== "ombi-key") return reply(401); + const m = u.pathname.match(/^\/api\/v1\/(Settings|Tester)\/(\w+)$/); + if (!m) return reply(404); + const [, kind, app] = m; + if (kind === "Settings" && method === "GET") return reply(200, settings[app]); + if (kind === "Settings" && method === "POST") { + settings[app] = body; + return reply(200, true); + } + const tried = body as { apiKey?: string }; + return reply(200, { isValid: tried.apiKey === appKey, expectedSubDir: null }); + }, + }; + return { http, calls, settings }; +} + +const OMBI = { url: "http://127.0.0.1:3579", apiKey: "ombi-key" }; + +const operatorSonarr = () => ({ + enabled: true, apiKey: "old-key", qualityProfile: "3", seasonFolders: true, rootPath: "10", + qualityProfileAnime: "7", rootPathAnime: "9", languageProfile: 1, ssl: false, subDir: null, + ip: "sonarr", port: 8989, id: 5, +}); + +test("it writes the connection the mesh bound, and keeps every other setting ombi had", async () => { + const f = fakes({ sonarr: operatorSonarr() }); + const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), `${THE_KEY}\n`); + assert.deepEqual(out, { app: "sonarr", result: "written", fields: ["ip", "port", "apiKey"] }); + assert.deepEqual(f.settings.sonarr, { + ...operatorSonarr(), ip: "ace.internal", port: 20101, apiKey: THE_KEY, ssl: false, subDir: null, + }); + // Checked against the app itself, at the bound address, before anything was written. + assert.equal(f.calls[0].url, "http://ace.internal:20101/api/v3/system/status"); +}); + +test("nothing is written when ombi already says what the mesh says", async () => { + const f = fakes({ sonarr: { ...operatorSonarr(), ip: "ace.internal", port: 20101, apiKey: THE_KEY } }); + const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), THE_KEY); + assert.deepEqual(out, { app: "sonarr", result: "unchanged" }); + assert.equal(f.calls.filter((c) => c.method === "POST" && c.url.includes("/Settings/")).length, 0); +}); + +test("a key the app refuses is never written, and the accept that fixes it is named", async () => { + const f = fakes({ sonarr: operatorSonarr() }); + const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), "a-value-the-mesh-minted"); + assert.equal(out.result, "refused"); + assert.match((out as { problem: string }).problem, /secret accept ombi sonarr-api --provider ace/); + assert.doesNotMatch((out as { problem: string }).problem, /a-value-the-mesh-minted/); + assert.deepEqual(f.settings.sonarr, operatorSonarr(), "ombi's working settings were left alone"); + assert.equal(f.calls.some((c) => c.url.includes("/api/v1/")), false, "ombi was not even asked"); +}); + +test("an app it cannot reach is reported, and ombi is left alone", async () => { + const f = fakes({ sonarr: operatorSonarr() }, { reachable: false }); + const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), THE_KEY); + assert.equal(out.result, "refused"); + assert.match((out as { problem: string }).problem, /could not be asked.*ECONNREFUSED/); + assert.deepEqual(f.settings.sonarr, operatorSonarr()); +}); + +test("radarr's connection is written inside its combined document, and the 4K instance is untouched", async () => { + const fourK = { enabled: true, apiKey: "4k-key", ip: "radarr4k", port: 7879, defaultQualityProfile: "9", id: 7 }; + const f = fakes({ radarr: { radarr: { enabled: true, apiKey: "old", ip: "radarr", port: 7878, defaultRootPath: "/movies", id: 6 }, radarr4K: fourK } }); + const out = await reconcileApp(f.http, OMBI, RADARR, binding("radarr-api", 20102), THE_KEY); + assert.equal(out.result, "written"); + const doc = f.settings.radarr as { radarr: Record; radarr4K: unknown }; + assert.deepEqual(doc.radarr4K, fourK); + assert.equal(doc.radarr.ip, "ace.internal"); + assert.equal(doc.radarr.port, 20102); + assert.equal(doc.radarr.defaultRootPath, "/movies"); +}); + +test("lidarr is checked on its own API version", async () => { + const f = fakes({ lidarr: { enabled: true, apiKey: null, ip: null, port: 0, id: 0 } }); + const out = await reconcileApp(f.http, OMBI, LIDARR, binding("lidarr-api", 20103), THE_KEY); + assert.equal(out.result, "written"); + assert.equal(f.calls[0].url, "http://ace.internal:20103/api/v1/system/status"); +}); + +test("a loopback binding is refused: from ombi's container it is ombi itself", () => { + const w = wanted(SONARR, binding("sonarr-api", 20101, "127.0.0.1"), THE_KEY); + assert.equal(w.ok, false); + assert.match((w as { problem: string }).problem, /private network/); +}); + +test("the base path is ombi's subDir, slashes trimmed; empty is none", () => { + assert.equal(subDirOf(""), null); + assert.equal(subDirOf("/sonarr/"), "sonarr"); + assert.deepEqual( + differing({ ip: "h", port: 1, ssl: false, subDir: "", apiKey: "k" }, { ip: "h", port: 1, ssl: false, subDir: null, apiKey: "k" }), + [], + ); +}); + +test("an https binding sets ombi's ssl flag", () => { + const b = binding("sonarr-api", 443); + (b.serves as Record).scheme = "https"; + const w = wanted(SONARR, b, THE_KEY); + assert.equal(w.ok && w.connection.ssl, true); +}); diff --git a/modules/ombi/tsconfig.json b/modules/ombi/tsconfig.json index 3677859..d0c9ec8 100644 --- a/modules/ombi/tsconfig.json +++ b/modules/ombi/tsconfig.json @@ -8,5 +8,5 @@ "skipLibCheck": true, "noEmit": true }, - "include": ["client.ts", "index.ts", "tools/index.ts"] + "include": ["client.ts", "index.ts", "tools/index.ts", "servarr/settings.ts", "plex/settings.ts", "connections/index.ts"] } diff --git a/modules/qbittorrent/module.json b/modules/qbittorrent/module.json index 1efef1a..cb67403 100644 --- a/modules/qbittorrent/module.json +++ b/modules/qbittorrent/module.json @@ -82,7 +82,7 @@ ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", - "MESH_QBITTORRENT_URL": "http://127.0.0.1:8080", + "MESH_QBITTORRENT_URL": "http://127.0.0.1:${port:8080}", "MESH_QBITTORRENT_PASSWORD_FILE": "/run/secrets/password", "MESH_QBITTORRENT_CONFIG_FILE": "/run/config/config.json", "MESH_QBITTORRENT_CONFIG_DIR": "/var/lib/qbittorrent/config" diff --git a/modules/radarr/module.json b/modules/radarr/module.json index 351fcb3..b3c31c6 100644 --- a/modules/radarr/module.json +++ b/modules/radarr/module.json @@ -1,6 +1,19 @@ { "module": "radarr", "version": "1", + "provides": [ + { + "name": "radarr-api", + "scope": "mesh" + } + ], + "serves": { + "radarr-api": { + "scheme": "http", + "port": 7878, + "url-base": "" + } + }, "capabilities": [ "container-runtime" ], @@ -75,7 +88,7 @@ ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", - "MESH_RADARR_URL": "http://127.0.0.1:7878", + "MESH_RADARR_URL": "http://127.0.0.1:${port:7878}", "MESH_RADARR_CONFIG_DIR": "/var/lib/radarr/config" }, "artifact": "runtime" diff --git a/modules/searxng/module.json b/modules/searxng/module.json index d2b0fa0..2aaa312 100644 --- a/modules/searxng/module.json +++ b/modules/searxng/module.json @@ -100,7 +100,7 @@ ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", - "MESH_SEARXNG_URL": "http://127.0.0.1:8080", + "MESH_SEARXNG_URL": "http://127.0.0.1:${port:8080}", "MESH_SEARXNG_CONFIG_FILE": "/run/config/config.json" }, "restart-on": [ diff --git a/modules/sonarr/module.json b/modules/sonarr/module.json index d91708b..b051720 100644 --- a/modules/sonarr/module.json +++ b/modules/sonarr/module.json @@ -1,6 +1,19 @@ { "module": "sonarr", "version": "1", + "provides": [ + { + "name": "sonarr-api", + "scope": "mesh" + } + ], + "serves": { + "sonarr-api": { + "scheme": "http", + "port": 8989, + "url-base": "" + } + }, "capabilities": [ "container-runtime" ], @@ -80,7 +93,7 @@ ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", - "MESH_SONARR_URL": "http://127.0.0.1:8989", + "MESH_SONARR_URL": "http://127.0.0.1:${port:8989}", "MESH_SONARR_CONFIG_DIR": "/var/lib/sonarr/config" }, "artifact": "runtime"