test: add permanent failure test

Verifies the service enters failed state after exhausting all
StartLimitBurst retries when the API never becomes available.
Checks StartLimitIntervalSec/Burst configuration and confirms
repeated timeout messages appear in the journal.

flake.lock

@@ -1,23 +1,5 @@
 {
   "nodes": {
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1771848320,
@@ -36,24 +18,8 @@
     },
     "root": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",

modules/servarr.nix

@@ -216,7 +216,7 @@ let
 
       healthChecks = lib.mkOption {
         type = lib.types.bool;
-        default = true;
+        default = false;
         description = ''
           When enabled, the init service will verify connectivity after provisioning:
           - Tests all download clients are reachable via the application's testall API

scripts/servarr_init.py

@@ -42,9 +42,17 @@ def _dict_to_fields(d):
 
 
 def _needs_field_update(desired, current_fields):
-    """Return True if any desired field value differs from the current state."""
+    """Return True if any desired field value differs from the current state.
+
+    Skips fields that the API returns masked (e.g. '********' for API keys
+    and passwords) since comparison against the real value always shows drift.
+    """
     current = _fields_to_dict(current_fields)
-    return any(desired.get(k) != current.get(k) for k in desired)
+    return any(
+        desired.get(k) != current.get(k)
+        for k in desired
+        if current.get(k) != "********"
+    )
 
 
 # -- Download clients --------------------------------------------------------

tests/delayed-start.nix

@@ -97,7 +97,6 @@ pkgs.testers.runNixOSTest {
       ];
 
       services.arrInit.sonarr = {
-        healthChecks = false;
         enable = true;
         serviceName = "mock-sonarr";
         dataDir = "/var/lib/mock-sonarr";

tests/edge-cases.nix

@@ -45,7 +45,6 @@ pkgs.testers.runNixOSTest {
       # Test 3: Path with spaces
       services.arrInit.sonarr = {
         enable = true;
-        healthChecks = false;
         serviceName = "sonarr";
         dataDir = "/var/lib/sonarr/.config/NzbDrone";
         port = 8989;

tests/error-handling.nix

@@ -26,7 +26,6 @@ pkgs.testers.runNixOSTest {
       # The dataDir points to a non-existent config.xml
       services.arrInit.sonarr = {
         enable = true;
-        healthChecks = false;
         serviceName = "sonarr";
         dataDir = "/var/lib/nonexistent";
         port = 8989;

tests/integration.nix

@@ -61,7 +61,6 @@ pkgs.testers.runNixOSTest {
 
       services.arrInit.sonarr = {
         enable = true;
-        healthChecks = false;
         serviceName = "sonarr";
         dataDir = "/var/lib/sonarr/.config/NzbDrone";
         port = 8989;
@@ -84,7 +83,6 @@ pkgs.testers.runNixOSTest {
 
       services.arrInit.radarr = {
         enable = true;
-        healthChecks = false;
         serviceName = "radarr";
         dataDir = "/var/lib/radarr/.config/Radarr";
         port = 7878;
@@ -107,7 +105,6 @@ pkgs.testers.runNixOSTest {
 
       services.arrInit.prowlarr = {
         enable = true;
-        healthChecks = false;
         serviceName = "prowlarr";
         dataDir = "/var/lib/prowlarr";
         port = 9696;

tests/multiple-clients.nix

@@ -48,7 +48,6 @@ pkgs.testers.runNixOSTest {
       # Sonarr with TWO download clients: qBittorrent + SABnzbd
       services.arrInit.sonarr = {
         enable = true;
-        healthChecks = false;
         serviceName = "sonarr";
         dataDir = "/var/lib/sonarr/.config/NzbDrone";
         port = 8989;

tests/naming.nix

@@ -18,7 +18,6 @@ pkgs.testers.runNixOSTest {
       serviceName = "sonarr";
       dataDir = "/var/lib/sonarr/.config/NzbDrone";
       port = 8989;
-      healthChecks = false;
       naming = {
         renameEpisodes = true;
         standardEpisodeFormat = "{Series Title} - S{season:00}E{episode:00} - {Episode Title} {Quality Full}";

tests/network-namespace.nix

@@ -90,7 +90,6 @@ pkgs.testers.runNixOSTest {
       serviceName = "mock-sonarr";
       dataDir = "/var/lib/mock-sonarr";
       port = 8989;
-      healthChecks = false;
       networkNamespacePath = "/run/netns/test-ns";
       networkNamespaceService = "create-netns";
       rootFolders = [ "/media/tv" ];

tests/partial-config.nix

@@ -50,7 +50,6 @@ pkgs.testers.runNixOSTest {
       # Test 1: Only rootFolders (no downloadClients)
       services.arrInit.sonarr = {
         enable = true;
-        healthChecks = false;
         serviceName = "sonarr";
         dataDir = "/var/lib/sonarr/.config/NzbDrone";
         port = 8989;
@@ -62,7 +61,6 @@ pkgs.testers.runNixOSTest {
       # Test 2: Only downloadClients (no rootFolders)
       services.arrInit.radarr = {
         enable = true;
-        healthChecks = false;
         serviceName = "radarr";
         dataDir = "/var/lib/radarr/.config/Radarr";
         port = 7878;
@@ -87,7 +85,6 @@ pkgs.testers.runNixOSTest {
       # Test 3: Only syncedApps (Prowlarr)
       services.arrInit.prowlarr = {
         enable = true;
-        healthChecks = false;
         serviceName = "prowlarr";
         dataDir = "/var/lib/prowlarr";
         port = 9696;

tests/permanent-failure.nix

@@ -47,7 +47,6 @@ pkgs.testers.runNixOSTest {
       serviceName = "mock-sonarr";
       dataDir = "/var/lib/mock-sonarr";
       port = 8989;
-      healthChecks = false;
       # Very short timeout so retries happen fast
       apiTimeout = 3;
     };