test: add permanent failure test

Verifies the service enters failed state after exhausting all StartLimitBurst retries when the API never becomes available. Checks StartLimitIntervalSec/Burst configuration and confirms repeated timeout messages appear in the journal.
test: add network namespace test
2026-04-16 16:35:28 -04:00 · 2026-04-16 16:34:53 -04:00 · 2026-04-16 16:34:28 -04:00 · 2026-04-16 16:34:04 -04:00 · 2026-04-16 16:33:18 -04:00 · 2026-04-16 13:50:51 -04:00
12 changed files with 50 additions and 11 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,23 @@
 {
  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "nixpkgs": {
      "locked": {
        "lastModified": 1771848320,
@@ -18,8 +36,24 @@
    },
    "root": {
      "inputs": {
+        "flake-utils": "flake-utils",
        "nixpkgs": "nixpkgs"
      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/modules/servarr.nix
+++ b/modules/servarr.nix
@@ -216,7 +216,7 @@ let

      healthChecks = lib.mkOption {
        type = lib.types.bool;
-        default = false;
+        default = true;
        description = ''
          When enabled, the init service will verify connectivity after provisioning:
          - Tests all download clients are reachable via the application's testall API
--- a/scripts/servarr_init.py
+++ b/scripts/servarr_init.py
@@ -42,17 +42,9 @@ def _dict_to_fields(d):


 def _needs_field_update(desired, current_fields):
-    """Return True if any desired field value differs from the current state.
-
-    Skips fields that the API returns masked (e.g. '********' for API keys
-    and passwords) since comparison against the real value always shows drift.
-    """
+    """Return True if any desired field value differs from the current state."""
    current = _fields_to_dict(current_fields)
-    return any(
-        desired.get(k) != current.get(k)
-        for k in desired
-        if current.get(k) != "********"
-    )
+    return any(desired.get(k) != current.get(k) for k in desired)


 # -- Download clients --------------------------------------------------------
--- a/tests/delayed-start.nix
+++ b/tests/delayed-start.nix
@@ -97,6 +97,7 @@ pkgs.testers.runNixOSTest {
      ];

      services.arrInit.sonarr = {
+        healthChecks = false;
        enable = true;
        serviceName = "mock-sonarr";
        dataDir = "/var/lib/mock-sonarr";
--- a/tests/edge-cases.nix
+++ b/tests/edge-cases.nix
@@ -45,6 +45,7 @@ pkgs.testers.runNixOSTest {
      # Test 3: Path with spaces
      services.arrInit.sonarr = {
        enable = true;
+        healthChecks = false;
        serviceName = "sonarr";
        dataDir = "/var/lib/sonarr/.config/NzbDrone";
        port = 8989;
--- a/tests/error-handling.nix
+++ b/tests/error-handling.nix
@@ -26,6 +26,7 @@ pkgs.testers.runNixOSTest {
      # The dataDir points to a non-existent config.xml
      services.arrInit.sonarr = {
        enable = true;
+        healthChecks = false;
        serviceName = "sonarr";
        dataDir = "/var/lib/nonexistent";
        port = 8989;
--- a/tests/integration.nix
+++ b/tests/integration.nix
@@ -61,6 +61,7 @@ pkgs.testers.runNixOSTest {

      services.arrInit.sonarr = {
        enable = true;
+        healthChecks = false;
        serviceName = "sonarr";
        dataDir = "/var/lib/sonarr/.config/NzbDrone";
        port = 8989;
@@ -83,6 +84,7 @@ pkgs.testers.runNixOSTest {

      services.arrInit.radarr = {
        enable = true;
+        healthChecks = false;
        serviceName = "radarr";
        dataDir = "/var/lib/radarr/.config/Radarr";
        port = 7878;
@@ -105,6 +107,7 @@ pkgs.testers.runNixOSTest {

      services.arrInit.prowlarr = {
        enable = true;
+        healthChecks = false;
        serviceName = "prowlarr";
        dataDir = "/var/lib/prowlarr";
        port = 9696;
--- a/tests/multiple-clients.nix
+++ b/tests/multiple-clients.nix
@@ -48,6 +48,7 @@ pkgs.testers.runNixOSTest {
      # Sonarr with TWO download clients: qBittorrent + SABnzbd
      services.arrInit.sonarr = {
        enable = true;
+        healthChecks = false;
        serviceName = "sonarr";
        dataDir = "/var/lib/sonarr/.config/NzbDrone";
        port = 8989;
--- a/tests/naming.nix
+++ b/tests/naming.nix
@@ -18,6 +18,7 @@ pkgs.testers.runNixOSTest {
      serviceName = "sonarr";
      dataDir = "/var/lib/sonarr/.config/NzbDrone";
      port = 8989;
+      healthChecks = false;
      naming = {
        renameEpisodes = true;
        standardEpisodeFormat = "{Series Title} - S{season:00}E{episode:00} - {Episode Title} {Quality Full}";
--- a/tests/network-namespace.nix
+++ b/tests/network-namespace.nix
@@ -90,6 +90,7 @@ pkgs.testers.runNixOSTest {
      serviceName = "mock-sonarr";
      dataDir = "/var/lib/mock-sonarr";
      port = 8989;
+      healthChecks = false;
      networkNamespacePath = "/run/netns/test-ns";
      networkNamespaceService = "create-netns";
      rootFolders = [ "/media/tv" ];
--- a/tests/partial-config.nix
+++ b/tests/partial-config.nix
@@ -50,6 +50,7 @@ pkgs.testers.runNixOSTest {
      # Test 1: Only rootFolders (no downloadClients)
      services.arrInit.sonarr = {
        enable = true;
+        healthChecks = false;
        serviceName = "sonarr";
        dataDir = "/var/lib/sonarr/.config/NzbDrone";
        port = 8989;
@@ -61,6 +62,7 @@ pkgs.testers.runNixOSTest {
      # Test 2: Only downloadClients (no rootFolders)
      services.arrInit.radarr = {
        enable = true;
+        healthChecks = false;
        serviceName = "radarr";
        dataDir = "/var/lib/radarr/.config/Radarr";
        port = 7878;
@@ -85,6 +87,7 @@ pkgs.testers.runNixOSTest {
      # Test 3: Only syncedApps (Prowlarr)
      services.arrInit.prowlarr = {
        enable = true;
+        healthChecks = false;
        serviceName = "prowlarr";
        dataDir = "/var/lib/prowlarr";
        port = 9696;
--- a/tests/permanent-failure.nix
+++ b/tests/permanent-failure.nix
@@ -47,6 +47,7 @@ pkgs.testers.runNixOSTest {
      serviceName = "mock-sonarr";
      dataDir = "/var/lib/mock-sonarr";
      port = 8989;
+      healthChecks = false;
      # Very short timeout so retries happen fast
      apiTimeout = 3;
    };
Author	SHA1	Message	Date
Simon Gardling	9635aecb81	test: add permanent failure test Verifies the service enters failed state after exhausting all StartLimitBurst retries when the API never becomes available. Checks StartLimitIntervalSec/Burst configuration and confirms repeated timeout messages appear in the journal.	2026-04-16 16:35:28 -04:00
Simon Gardling	a37b6f6112	test: add network namespace test Tests networkNamespacePath and networkNamespaceService options. Creates a network namespace, runs a mock Servarr inside it, verifies namespace isolation (mock unreachable from default ns), and confirms the init service provisions resources through the namespace.	2026-04-16 16:34:53 -04:00
Simon Gardling	f766e5f71e	test: add naming configuration test Exercises the naming option which was previously untested. Verifies fields are applied to Sonarr via config/naming API and validates idempotency (second run reports 'already correct').	2026-04-16 16:34:28 -04:00
Simon Gardling	f86a5f1b39	refactor: split module.nix into per-service modules Replace the 1301-line monolithic module.nix with focused modules: - modules/servarr.nix (Sonarr/Radarr/Prowlarr) - modules/bazarr.nix (Bazarr provider connections) - modules/jellyseerr.nix (Jellyseerr quality profiles) - modules/default.nix (import aggregator) Python scripts (from prior commit) are referenced as standalone files via PYTHONPATH, with config passed as a JSON file argument. New options and behavioral changes: - Add bindAddress option to all services (default 127.0.0.1) - Change healthChecks default from false to true - Replace hardcoded wg.service dependency with configurable networkNamespaceService option - Add systemd hardening: PrivateTmp, NoNewPrivileges, ProtectHome, ProtectKernelTunables/Modules, ProtectControlGroups, RestrictSUIDSGID, SystemCallArchitectures=native Test updates: - Extract mock qBittorrent/SABnzbd servers into tests/lib/mocks.nix - Add healthChecks=false to tests not exercising health checks - Fix duplicate wait_for_unit calls in integration test	2026-04-16 16:34:04 -04:00
Simon Gardling	b464a8cea2	refactor: extract Python scripts into standalone files Move embedded Python scripts out of Nix string interpolation into standalone files under scripts/. Each script reads its configuration from a JSON file passed as the first CLI argument. Shared utilities (API key reading, API polling, health check loop) are consolidated into common.py, eliminating three copies of read_api_key and wait_for_api. Implementation improvements included in the extraction: - Remove pyarr dependency; all HTTP calls use raw requests - Add update semantics: download clients and synced apps are now compared against desired state and updated on drift via PUT - Bazarr configure_provider compares API keys and updates stale ones - Narrow health_check_loop exception clause from bare Exception to (RequestException, ValueError, KeyError) - Fix double resp.json() call in resolve_profile_id (jellyseerr) - Replace os.system with subprocess.run for Jellyseerr restart - Handle missing 'value' key in Servarr field API responses	2026-04-16 16:33:18 -04:00
Simon Gardling	b97ed1e90c	flake.nix: use flake-utils for system gen	2026-04-16 13:50:51 -04:00