The manifest named /services/sonarr/config and /var/lib/mesh/sonarr/route.json, host
paths ADR 0112 takes out of definitions. The config dir is now a pathless ${dir:config}
(0700, 1000:1000) mounted into the server and, read-only, into the runtime that reads the
API key from config.xml; the route binding lives in a placed state dir, as jackett and
searxng do. /var/lib/mesh/sonarr stays for the broker secret.
The image is pinned to 4.0.20.3014-ls325, the digest ace runs today. The old pin
(4.0.19.2979-ls322) was older than the running version, and Sonarr migrates its database
forward on start, so pointing the older build at ace's data is not safe.
The container mount points stay /series, /anime and /downloads: Sonarr's database stores
its root folders and the download clients' reported paths under exactly those names, and
there are no remote path mappings to absorb a change. The generic access paths stay;
ace's (/storage/media/*, /storage/downloads) and its media owner 1001:2000 wait on hq 153.
Based on feat/servarr-api-provision (#156), which makes sonarr provide sonarr-api.
Verified: catalogue key tests with MESH_CATALOGUE set (73 manifests parsed, not skipped);
a throwaway container of the pinned image on a fresh 0700 1000:1000 config dir answers
/ping, serves the v3 API with the key it generated and refuses a wrong one (401), accepts
/series as a writable root folder; the runtime's client discovers the key from that
config.xml and reads the queue.
jschoubben
d543defae6