From 0d2a7c315f405c8524f0c72dcc191a711f1af707 Mon Sep 17 00:00:00 2001
From: ibizaman <ibizaman@tiserbox.com>
Date: Mon, 23 Feb 2026 21:38:09 +0100
Subject: [PATCH] arr: add declarative api key

---
 modules/services/arr.nix | 36 ++++++++++++++++++++++++++----------
 test/services/arr.nix    |  4 ++--
 2 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/modules/services/arr.nix b/modules/services/arr.nix
index 573fe1c..66f9ce4 100644
--- a/modules/services/arr.nix
+++ b/modules/services/arr.nix
@@ -144,6 +144,10 @@ let
                 description = "Log level.";
                 default = "info";
               };
+              ApiKey = lib.mkOption {
+                type = shb.secretFileType;
+                description = "Path to api key secret file.";
+              };
               Port = lib.mkOption {
                 type = lib.types.port;
                 description = "Port on which bazarr listens to incoming requests.";
@@ -172,6 +176,10 @@ let
                 description = "Log level.";
                 default = "info";
               };
+              ApiKey = lib.mkOption {
+                type = shb.secretFileType;
+                description = "Path to api key secret file.";
+              };
               Port = lib.mkOption {
                 type = lib.types.port;
                 description = "Port on which readarr listens to incoming requests.";
@@ -199,6 +207,10 @@ let
                 description = "Log level.";
                 default = "info";
               };
+              ApiKey = lib.mkOption {
+                type = shb.secretFileType;
+                description = "Path to api key secret file.";
+              };
               Port = lib.mkOption {
                 type = lib.types.port;
                 description = "Port on which lidarr listens to incoming requests.";
@@ -458,16 +470,20 @@ in
         users.users.bazarr = {
           extraGroups = [ "media" ];
         };
-        systemd.services.bazarr.preStart = shb.replaceSecrets {
-          userConfig =
-            cfg'.settings
-            // (lib.optionalAttrs isSSOEnabled {
-              AuthenticationRequired = "DisabledForLocalAddresses";
-              AuthenticationMethod = "External";
-            });
-          resultPath = "${cfg'.dataDir}/config.xml";
-          generator = apps.bazarr.settingsFormat.generate;
-        };
+        # This is actually not working. Bazarr uses a config file in dataDir/config/config.yaml
+        # which includes all configuration so we must somehow merge our declarative config with it.
+        # It's doable but will take some time. Help is welcomed.
+        #
+        # systemd.services.bazarr.preStart = shb.replaceSecrets {
+        #   userConfig =
+        #     cfg'.settings
+        #     // (lib.optionalAttrs isSSOEnabled {
+        #       AuthenticationRequired = "DisabledForLocalAddresses";
+        #       AuthenticationMethod = "External";
+        #     });
+        #   resultPath = "${cfg'.dataDir}/config.xml";
+        #   generator = apps.bazarr.settingsFormat.generate;
+        # };
 
         shb.nginx.vhosts = [ (vhosts { } cfg') ];
       }
diff --git a/test/services/arr.nix b/test/services/arr.nix
index b4268cb..c585c01 100644
--- a/test/services/arr.nix
+++ b/test/services/arr.nix
@@ -51,7 +51,7 @@ let
               if response['code'] != 200:
                   raise Exception(f"Code is {response['code']}")
         ''
-        + lib.optionalString (apiKey != null) ''
+        + lib.optionalString (apiKey != null && cfgPath != null) ''
 
           with subtest("apikey"):
               config = server.succeed("cat ${cfgPath}")
@@ -212,7 +212,7 @@ let
 
   radarrCfgFn = cfg: "${cfg.dataDir}/config.xml";
   sonarrCfgFn = cfg: "${cfg.dataDir}/config.xml";
-  bazarrCfgFn = cfg: "${cfg.dataDir}/config.xml";
+  bazarrCfgFn = cfg: null;
   readarrCfgFn = cfg: "${cfg.dataDir}/config.xml";
   lidarrCfgFn = cfg: "${cfg.dataDir}/config.xml";
   jackettCfgFn = cfg: "${cfg.dataDir}/ServerConfig.json";