add healthChecks option

module.nix

@@ -172,6 +172,17 @@ let
         default = [ ];
         description = "Applications to register for indexer sync (Prowlarr only).";
       };
+
+      healthChecks = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          When enabled, the init service will verify connectivity after provisioning:
+          - Tests all download clients are reachable via the application's testall API
+          - For Prowlarr instances: tests all synced applications are reachable
+          The init service will fail if any health check fails.
+        '';
+      };
     };
   };
 
@@ -325,6 +336,53 @@ let
     fi
   '';
 
+  mkHealthCheckSection =
+    name: inst:
+    lib.optionalString inst.healthChecks ''
+      # Health checks
+      echo "Running ${name} health checks..."
+
+      ${lib.optionalString (inst.downloadClients != [ ]) ''
+        # Test download client connectivity
+        echo "Testing download client connectivity..."
+        DC_TEST=$(${curl} -s --connect-timeout 10 --max-time 30 -X POST "$BASE_URL/downloadclient/testall" \
+          -H "X-Api-Key: $API_KEY" \
+          -H "Content-Type: application/json") || {
+          echo "Health check FAILED: could not reach ${name} API for download client test" >&2
+          exit 1
+        }
+        DC_FAILURES=$(echo "$DC_TEST" | ${jq} '[.[] | select(.isValid == false)]')
+        DC_FAIL_COUNT=$(echo "$DC_FAILURES" | ${jq} 'length')
+        if [ "$DC_FAIL_COUNT" -gt 0 ]; then
+          echo "Health check FAILED: $DC_FAIL_COUNT download client(s) unreachable:" >&2
+          echo "$DC_FAILURES" | ${jq} -r '.[] | "  - ID \(.id): \(.validationFailures | map(.errorMessage) | join(", "))"' >&2
+          exit 1
+        fi
+        echo "All download clients healthy"
+      ''}
+
+      ${lib.optionalString (inst.syncedApps != [ ]) ''
+        # Test synced application connectivity
+        echo "Testing synced application connectivity..."
+        APP_TEST=$(${curl} -s --connect-timeout 10 --max-time 30 -X POST "$BASE_URL/applications/testall" \
+          -H "X-Api-Key: $API_KEY" \
+          -H "Content-Type: application/json") || {
+          echo "Health check FAILED: could not reach ${name} API for synced app test" >&2
+          exit 1
+        }
+        APP_FAILURES=$(echo "$APP_TEST" | ${jq} '[.[] | select(.isValid == false)]')
+        APP_FAIL_COUNT=$(echo "$APP_FAILURES" | ${jq} 'length')
+        if [ "$APP_FAIL_COUNT" -gt 0 ]; then
+          echo "Health check FAILED: $APP_FAIL_COUNT synced application(s) unreachable:" >&2
+          echo "$APP_FAILURES" | ${jq} -r '.[] | "  - ID \(.id): \(.validationFailures | map(.errorMessage) | join(", "))"' >&2
+          exit 1
+        fi
+        echo "All synced applications healthy"
+      ''}
+
+      echo "${name} health checks passed"
+    '';
+
   mkInitScript =
     name: inst:
     pkgs.writeShellScript "${name}-init" ''
@@ -358,6 +416,8 @@ let
       ${lib.concatMapStringsSep "\n" mkRootFolderSection inst.rootFolders}
       ${lib.concatMapStringsSep "\n" mkSyncedAppSection inst.syncedApps}
 
+      ${mkHealthCheckSection name inst}
+
       echo "${name} init complete"
     '';