The six media providers share their one credential with every consumer (ADR 0158) #4

2026-10-01T11:05:05Z

mesh-admin commented

2026-10-01 11:05:05 +00:00

The catalogue half of hq #243 / ADR 0158. Each of nzbget, qbittorrent, jackett, sonarr, radarr, lidarr: provides: [{name, credential: {own: <secret>}}], that own secret taken: at-start, and a custom-cont-init.d script that applies the file before the service starts (nzbget: NZBGET_USER from the assignment beside the password it already takes as a start option; qbittorrent: the WebUI login's PBKDF2-HMAC-SHA512 hash written into qBittorrent.conf by python3; jackett: APIKey in ServerConfig.json via jq; the arrs: <ApiKey> in config.xml via sed). plex stays accepted (its token is plex.tv's). Twelve manifests pass module check against a controller with #184.

The catalogue half of hq #243 / ADR 0158. Each of nzbget, qbittorrent, jackett, sonarr, radarr, lidarr: `provides: [{name, credential: {own: <secret>}}]`, that own secret `taken: at-start`, and a `custom-cont-init.d` script that applies the file before the service starts (nzbget: `NZBGET_USER` from the assignment beside the password it already takes as a start option; qbittorrent: the WebUI login's PBKDF2-HMAC-SHA512 hash written into qBittorrent.conf by python3; jackett: `APIKey` in ServerConfig.json via jq; the arrs: `<ApiKey>` in config.xml via sed). plex stays accepted (its token is plex.tv's). Twelve manifests pass `module check` against a controller with #184.

mesh-admin added 1 commit 2026-10-01 11:05:05 +00:00

The six media providers share their one credential with every consumer (ADR 0158) 11da93e966

nzbget, qbittorrent, jackett, sonarr, radarr and lidarr each hold one
credential; the offer now names the provider's own secret as the
provision's credential, that secret is taken at start, and a
custom-cont-init script applies the file to the software on every start
(nzbget: NZBGET_USER beside the password it already took as a start
option; qbittorrent: the WebUI login's PBKDF2 hash; jackett: APIKey in
ServerConfig.json; the arrs: <ApiKey> in config.xml). Nothing is accepted
per consumer any more; rotating the provider's secret reaches everyone.

mesh-admin merged commit 7c97cb7a02 into main

2026-10-01 11:05:15 +00:00

mesh-admin deleted branch feat/0158-one-credential-shared-with-every-consumer

2026-10-01 11:05:15 +00:00

mesh-admin referenced this pull request

2026-10-01 11:35:59 +00:00

Sidecars read the vault's key and restart when it is remade; a stale WebUI attempt bans for a minute #5

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-media-catalog#4