D1 Service auto-wiring
- Area
- D — Content & household
- Audience
- operator
- Kind
- feature
- Status
- accepted
- Maturity
- shipped
- Shipped in
- 0.17.0
- Labels
- seed, wiring
The feature in the specification · Read at
Requirements
Service API keys MUST be read from service configuration, never requested from the operator.
- locked by
- 0.4.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/credentials.rscrates/lemonfiber-core/src/servarr.rscrates/lemonfiber-ports/src/http.rscrates/lemonfiber-adapters/src/http.rscrates/lemonfiber-core/src/validate.rscrates/lemonfiber-ports/src/nntp.rs
- cited by
- lemonfiber@574a0e4b83lemonfiber@d5f656960flemonfiber@771efea3c7lemonfiber@b22d4464e8
Seed MUST be idempotent; a second run with no changes MUST make no writes.
Seed MUST NOT overwrite values that have drifted from lemonfiber's baseline.
Each connection MUST be read back and verified after writing.
- locked by
- 0.4.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/seed.rscrates/lemonfiber-core/src/servarr.rs
- cited by
- lemonfiber@f9c906af22lemonfiber@990e67673flemonfiber@58693828a9lemonfiber@af669626b4lemonfiber@574a0e4b83lemonfiber@d7bfc86ea8lemonfiber@07cc2deebblemonfiber@7ba5295cb9lemonfiber@e5c0459138
Unavailable prerequisites MUST produce skipped, not failed.
Partial completion MUST report exactly which connections were not made and why, and MUST be resumable by re-running.
- locked by
- 0.4.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/seed.rscrates/lemonfiber-core/src/servarr.rs
- cited by
- lemonfiber@62245dff8f
Seerr MUST be configured to authenticate against Jellyfin.
- locked by
- 0.4.0 met
- recorded done
- lemonfiberspec:20-architecture/contracts/prowlarr-application.mdspec:20-architecture/contracts/jellyfin-seerr-identity.mdcrates/lemonfiber-core/src/prowlarr.rscrates/lemonfiber-ports/src/service.rscrates/lemonfiber-core/src/app/targets/media.rscrates/lemonfiber-core/src/seerr.rs
- cited by
- lemonfiber@58693828a9
Existing connections MUST be detected by connection details rather than label, to avoid duplicates.
Root folders MUST be created when within the data root, and refused with an explanation when outside it.
Two \arrs sharing a root folder MUST be refused with an explanation.
- locked by
- 0.4.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/seed.rscrates/lemonfiber-core/src/servarr.rs
- cited by
- lemonfiber@e028565bab
Service-reported errors MUST be surfaced verbatim rather than paraphrased.
An unsupported service API version MUST be reported rather than written to.
- locked by
- 0.4.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/seed.rscrates/lemonfiber-core/src/servarr.rs
- recorded partial
- lemonfiber-request-gatesrc/version.rssrc/version/tests.rs
- cited by
- lemonfiber@b2c0090efd
Interruption MUST leave every completed connection intact and valid.
- locked by
- 0.4.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/seed.rscrates/lemonfiber-core/src/servarr.rs
- cited by
- lemonfiber@5c3ee9b48a
A full seed against a healthy stack SHOULD complete within 60 seconds.
- locked by
- 0.4.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/seed.rscrates/lemonfiber-core/src/servarr.rs
- cited by
- lemonfiber@5c3ee9b48a
Bindery MUST be wired via Torznab endpoints, and the absence of Prowlarr app sync MUST be documented in-product.
Seeding MUST replace qBittorrent's temporary WebUI password with a generated one and record it where the forwarded-port push reads it.
- locked by
- 0.4.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/secret.rscrates/lemonfiber-ports/src/random.rscrates/lemonfiber-core/src/qbittorrent.rscrates/lemonfiber-core/src/seed.rsspec:20-architecture/contracts/prowlarr-application.md
- cited by
- lemonfiber@58693828a9lemonfiber@c68167ab73lemonfiber@a0e5dfb6cdlemonfiber@513fa97a9flemonfiber@80cf5a2c49
Each \arr that fulfils requests MUST be registered with the request service as a fulfilment target, and one absent from the stack MUST NOT be.
Every connection named in the wiring graph MUST be made where the services at both ends are in the stack, and each MUST be proven against the service that received it rather than against a stand-in for it.
- locked by
- 0.12.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/wiring.rscrates/lemonfiber-core/src/wiring/tests.rscrates/lemonfiber-core/tests/integration/wiring.rs
- cited by
- lemonfiber@52a7cb5ff4lemonfiber@040827b4eblemonfiber@3ef3514300lemonfiber@747082a565lemonfiber@c654861542lemonfiber@3750477d1clemonfiber@7527cb3bc7lemonfiber@729601f679
The request service MUST reach each fulfilling \arr and Jellyfin only through the request gate: each \arr MUST be registered with it at the gate's route for that \arr and with the token lemonfiber minted for that route, never with the \arr's own key, and it MUST be left holding no Jellyfin API key and no Jellyfin administrator's session (ADR-0032).
- locked by
- 0.17.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/seed/run/decline.rscrates/lemonfiber-core/src/seed/run/taken_back.rscrates/lemonfiber-core/src/seed/run/fulfilment.rscrates/lemonfiber-core/src/seed/run/linking.rs
- recorded partial
- lemonfiber-request-gatesrc/serving.rssrc/jellyfin/tests.rs::the_servers_name_and_an_avatar_go_upstream_with_no_credential
- cited by
- lemonfiber@71fee85c42lemonfiber@74d638a91elemonfiber-request-gate@5be17e061c
Once the request service is initialised, lemonfiber MUST authenticate to it with the request service's own API key and MUST NOT send it the media server administrator's password; the password the initialising sign-in carried MUST be rotated once that sign-in completes.
Where the request service is found holding a credential of an \arr or of Jellyfin, lemonfiber MUST move it to the request gate and prove the move through the request service before revoking anything, MUST then revoke or rotate every credential the request service held, and MUST report any consumer the rotation could not update.
Seeding MUST turn on NZBHydra2's authentication, with an administrator lemonfiber names and a password it generates and records under that service's own administrator-password setting, and MUST then prove that a read of its configuration or of the indexers it holds, presenting nothing, is refused.
Where NZBHydra2 is found running without authentication that lemonfiber has no record of having set, seeding MUST turn it on without removing or changing any indexer, setting or history the service holds, and MUST prove after the change that every indexer it held before is still held.
Where authentication lemonfiber turned on in NZBHydra2 has since been turned off or changed, seeding MUST keep it and report it as drift, and a reset MUST turn it back on.
Where the password lemonfiber recorded for NZBHydra2 is missing or refused, seeding MUST report the connection as refused, naming the setting, and MUST NOT turn the service's authentication off or replace its administrator.
The doctor MUST report an NZBHydra2 that answers a read of its configuration to a caller presenting nothing, naming the service, what the read exposes, and that a seed or a reset turns its authentication on.