Media modules access the shared library, they do not own it (ADR 0051) #6

2026-09-05T20:48:04Z

jschoubben commented

2026-09-05 20:48:04 +00:00

Implements ADR 0051 in the catalogue. All eight media modules (plex, sonarr, radarr, nzbget, qbittorrent, bazarr, lidarr, bookshelf): every /services/media/* path moves from an owned directory resource to an accesses entry (operator-owned); each module's own config and /var/lib/mesh/* dirs stay owned; container volume mounts unchanged. Modes are least-privilege (plex read-only on libraries as a player; managers/clients read-write on what they import).

https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

Implements ADR 0051 in the catalogue. All eight media modules (plex, sonarr, radarr, nzbget, qbittorrent, bazarr, lidarr, bookshelf): every `/services/media/*` path moves from an owned `directory` resource to an `accesses` entry (operator-owned); each module's own `config` and `/var/lib/mesh/*` dirs stay owned; container volume mounts unchanged. Modes are least-privilege (plex read-only on libraries as a player; managers/clients read-write on what they import). https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

jschoubben added 1 commit 2026-09-05 20:48:04 +00:00

media stack: the shared library is accessed, not owned 69c8a5edf8

04-ISSUES/036: eight media modules each declared the shared library and
download directories under /services/media/* as their own `directory`
resources. Six of them owning one path is the collision the resolver
refuses — so the stack's only sensible assignment, all on one machine
sharing one filesystem, would be refused the first time two landed
together.

The media library is the operator's, owned by no module (novox/hq
ADR 0051). Move every /services/media/* path from an owned `directory`
resource to an `accesses` entry: the mesh mounts it and owns nothing —
does not create, chown, reconcile or remove it — and several modules may
access one path with no conflict. Each module's own config and mesh-state
directories stay owned resources.

Modes are least-privilege: plex reads the libraries it streams; the
managers and download clients get read-write on what they import and
write; bazarr writes subtitles into the libraries (read-write) and only
reads the download spool. The container volume mounts are unchanged.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

jschoubben merged commit 50eb1e6f02 into main

2026-09-05 20:48:16 +00:00

jschoubben deleted branch feat/media-access-not-ownership

2026-09-05 20:48:16 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#6