test: add permanent failure test

Verifies the service enters failed state after exhausting all
StartLimitBurst retries when the API never becomes available.
Checks StartLimitIntervalSec/Burst configuration and confirms
repeated timeout messages appear in the journal.

flake.lock

@@ -1,5 +1,23 @@
 {
   "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1771848320,
@@ -18,8 +36,24 @@
     },
     "root": {
       "inputs": {
+        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

modules/servarr.nix

@@ -216,7 +216,7 @@ let
 
       healthChecks = lib.mkOption {
         type = lib.types.bool;
-        default = false;
+        default = true;
         description = ''
           When enabled, the init service will verify connectivity after provisioning:
           - Tests all download clients are reachable via the application's testall API

scripts/servarr_init.py

@@ -42,17 +42,9 @@ def _dict_to_fields(d):
 
 
 def _needs_field_update(desired, current_fields):
-    """Return True if any desired field value differs from the current state.
+    """Return True if any desired field value differs from the current state."""
-
-    Skips fields that the API returns masked (e.g. '********' for API keys
-    and passwords) since comparison against the real value always shows drift.
-    """
     current = _fields_to_dict(current_fields)
-    return any(
+    return any(desired.get(k) != current.get(k) for k in desired)
-        desired.get(k) != current.get(k)
-        for k in desired
-        if current.get(k) != "********"
-    )
 
 
 # -- Download clients --------------------------------------------------------

tests/delayed-start.nix

@@ -97,6 +97,7 @@ pkgs.testers.runNixOSTest {
       ];
 
       services.arrInit.sonarr = {
+        healthChecks = false;
         enable = true;
         serviceName = "mock-sonarr";
         dataDir = "/var/lib/mock-sonarr";

tests/edge-cases.nix

@@ -45,6 +45,7 @@ pkgs.testers.runNixOSTest {
       # Test 3: Path with spaces
       services.arrInit.sonarr = {
         enable = true;
+        healthChecks = false;
         serviceName = "sonarr";
         dataDir = "/var/lib/sonarr/.config/NzbDrone";
         port = 8989;

tests/error-handling.nix

@@ -26,6 +26,7 @@ pkgs.testers.runNixOSTest {
       # The dataDir points to a non-existent config.xml
       services.arrInit.sonarr = {
         enable = true;
+        healthChecks = false;
         serviceName = "sonarr";
         dataDir = "/var/lib/nonexistent";
         port = 8989;

tests/integration.nix

@@ -61,6 +61,7 @@ pkgs.testers.runNixOSTest {
 
       services.arrInit.sonarr = {
         enable = true;
+        healthChecks = false;
         serviceName = "sonarr";
         dataDir = "/var/lib/sonarr/.config/NzbDrone";
         port = 8989;
@@ -83,6 +84,7 @@ pkgs.testers.runNixOSTest {
 
       services.arrInit.radarr = {
         enable = true;
+        healthChecks = false;
         serviceName = "radarr";
         dataDir = "/var/lib/radarr/.config/Radarr";
         port = 7878;
@@ -105,6 +107,7 @@ pkgs.testers.runNixOSTest {
 
       services.arrInit.prowlarr = {
         enable = true;
+        healthChecks = false;
         serviceName = "prowlarr";
         dataDir = "/var/lib/prowlarr";
         port = 9696;

tests/multiple-clients.nix

@@ -48,6 +48,7 @@ pkgs.testers.runNixOSTest {
       # Sonarr with TWO download clients: qBittorrent + SABnzbd
       services.arrInit.sonarr = {
         enable = true;
+        healthChecks = false;
         serviceName = "sonarr";
         dataDir = "/var/lib/sonarr/.config/NzbDrone";
         port = 8989;

tests/naming.nix

@@ -18,6 +18,7 @@ pkgs.testers.runNixOSTest {
       serviceName = "sonarr";
       dataDir = "/var/lib/sonarr/.config/NzbDrone";
       port = 8989;
+      healthChecks = false;
       naming = {
         renameEpisodes = true;
         standardEpisodeFormat = "{Series Title} - S{season:00}E{episode:00} - {Episode Title} {Quality Full}";

tests/network-namespace.nix

@@ -90,6 +90,7 @@ pkgs.testers.runNixOSTest {
       serviceName = "mock-sonarr";
       dataDir = "/var/lib/mock-sonarr";
       port = 8989;
+      healthChecks = false;
       networkNamespacePath = "/run/netns/test-ns";
       networkNamespaceService = "create-netns";
       rootFolders = [ "/media/tv" ];

tests/partial-config.nix

@@ -50,6 +50,7 @@ pkgs.testers.runNixOSTest {
       # Test 1: Only rootFolders (no downloadClients)
       services.arrInit.sonarr = {
         enable = true;
+        healthChecks = false;
         serviceName = "sonarr";
         dataDir = "/var/lib/sonarr/.config/NzbDrone";
         port = 8989;
@@ -61,6 +62,7 @@ pkgs.testers.runNixOSTest {
       # Test 2: Only downloadClients (no rootFolders)
       services.arrInit.radarr = {
         enable = true;
+        healthChecks = false;
         serviceName = "radarr";
         dataDir = "/var/lib/radarr/.config/Radarr";
         port = 7878;
@@ -85,6 +87,7 @@ pkgs.testers.runNixOSTest {
       # Test 3: Only syncedApps (Prowlarr)
       services.arrInit.prowlarr = {
         enable = true;
+        healthChecks = false;
         serviceName = "prowlarr";
         dataDir = "/var/lib/prowlarr";
         port = 9696;

tests/permanent-failure.nix

@@ -47,6 +47,7 @@ pkgs.testers.runNixOSTest {
       serviceName = "mock-sonarr";
       dataDir = "/var/lib/mock-sonarr";
       port = 8989;
+      healthChecks = false;
       # Very short timeout so retries happen fast
       apiTimeout = 3;
     };