From dba54f116071dab9e07d3dcd64b726f85adc4880 Mon Sep 17 00:00:00 2001
From: ibizaman <ibizaman@tiserbox.com>
Date: Mon, 23 Feb 2026 21:44:57 +0100
Subject: [PATCH] arr: make arr stack declare ldap groups

---
 docs/redirects.json      | 18 ++++++++++++++++++
 modules/services/arr.nix | 37 ++++++++++++++++++++++++++++++++++++-
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/docs/redirects.json b/docs/redirects.json
index 7e5b0e0..0e6e87f 100644
--- a/docs/redirects.json
+++ b/docs/redirects.json
@@ -2267,6 +2267,9 @@
   "services-arr-options-shb.arr.bazarr.enable": [
     "services-arr.html#services-arr-options-shb.arr.bazarr.enable"
   ],
+  "services-arr-options-shb.arr.bazarr.ldapUserGroup": [
+    "services-arr.html#services-arr-options-shb.arr.bazarr.ldapUserGroup"
+  ],
   "services-arr-options-shb.arr.bazarr.settings": [
     "services-arr.html#services-arr-options-shb.arr.bazarr.settings"
   ],
@@ -2342,6 +2345,9 @@
   "services-arr-options-shb.arr.jackett.enable": [
     "services-arr.html#services-arr-options-shb.arr.jackett.enable"
   ],
+  "services-arr-options-shb.arr.jackett.ldapUserGroup": [
+    "services-arr.html#services-arr-options-shb.arr.jackett.ldapUserGroup"
+  ],
   "services-arr-options-shb.arr.jackett.settings": [
     "services-arr.html#services-arr-options-shb.arr.jackett.settings"
   ],
@@ -2444,6 +2450,9 @@
   "services-arr-options-shb.arr.lidarr.enable": [
     "services-arr.html#services-arr-options-shb.arr.lidarr.enable"
   ],
+  "services-arr-options-shb.arr.lidarr.ldapUserGroup": [
+    "services-arr.html#services-arr-options-shb.arr.lidarr.ldapUserGroup"
+  ],
   "services-arr-options-shb.arr.lidarr.settings": [
     "services-arr.html#services-arr-options-shb.arr.lidarr.settings"
   ],
@@ -2519,6 +2528,9 @@
   "services-arr-options-shb.arr.radarr.enable": [
     "services-arr.html#services-arr-options-shb.arr.radarr.enable"
   ],
+  "services-arr-options-shb.arr.radarr.ldapUserGroup": [
+    "services-arr.html#services-arr-options-shb.arr.radarr.ldapUserGroup"
+  ],
   "services-arr-options-shb.arr.radarr.settings": [
     "services-arr.html#services-arr-options-shb.arr.radarr.settings"
   ],
@@ -2606,6 +2618,9 @@
   "services-arr-options-shb.arr.readarr.enable": [
     "services-arr.html#services-arr-options-shb.arr.readarr.enable"
   ],
+  "services-arr-options-shb.arr.readarr.ldapUserGroup": [
+    "services-arr.html#services-arr-options-shb.arr.readarr.ldapUserGroup"
+  ],
   "services-arr-options-shb.arr.readarr.settings": [
     "services-arr.html#services-arr-options-shb.arr.readarr.settings"
   ],
@@ -2681,6 +2696,9 @@
   "services-arr-options-shb.arr.sonarr.enable": [
     "services-arr.html#services-arr-options-shb.arr.sonarr.enable"
   ],
+  "services-arr-options-shb.arr.sonarr.ldapUserGroup": [
+    "services-arr.html#services-arr-options-shb.arr.sonarr.ldapUserGroup"
+  ],
   "services-arr-options-shb.arr.sonarr.settings": [
     "services-arr.html#services-arr-options-shb.arr.sonarr.settings"
   ],
diff --git a/modules/services/arr.nix b/modules/services/arr.nix
index 66f9ce4..a8ebe9c 100644
--- a/modules/services/arr.nix
+++ b/modules/services/arr.nix
@@ -317,7 +317,7 @@ let
         {
           domain = "${c.subdomain}.${c.domain}";
           policy = "two_factor";
-          subject = [ "group:arr_user" ];
+          subject = [ "group:${c.ldapUserGroup}" ];
         }
       ];
     };
@@ -356,6 +356,16 @@ let
               default = null;
             };
 
+            ldapUserGroup = lib.mkOption {
+              description = ''
+                LDAP group a user must belong to be able to login.
+
+                Note that all users are admins too.
+              '';
+              type = lib.types.str;
+              default = "arr_user";
+            };
+
             authEndpoint = lib.mkOption {
               type = lib.types.nullOr lib.types.str;
               default = null;
@@ -392,6 +402,7 @@ in
   imports = [
     ../../lib/module.nix
     ../blocks/nginx.nix
+    ../blocks/lldap.nix
   ];
 
   options.shb.arr = lib.listToAttrs (lib.mapAttrsToList appOption apps);
@@ -422,6 +433,10 @@ in
         };
 
         shb.nginx.vhosts = [ (vhosts { } cfg') ];
+
+        shb.lldap.ensureGroups = {
+          ${cfg'.ldapUserGroup} = { };
+        };
       }
     ))
 
@@ -453,6 +468,10 @@ in
         };
 
         shb.nginx.vhosts = [ (vhosts { } cfg') ];
+
+        shb.lldap.ensureGroups = {
+          ${cfg'.ldapUserGroup} = { };
+        };
       }
     ))
 
@@ -486,6 +505,10 @@ in
         # };
 
         shb.nginx.vhosts = [ (vhosts { } cfg') ];
+
+        shb.lldap.ensureGroups = {
+          ${cfg'.ldapUserGroup} = { };
+        };
       }
     ))
 
@@ -508,6 +531,10 @@ in
         };
 
         shb.nginx.vhosts = [ (vhosts { } cfg') ];
+
+        shb.lldap.ensureGroups = {
+          ${cfg'.ldapUserGroup} = { };
+        };
       }
     ))
 
@@ -536,6 +563,10 @@ in
         };
 
         shb.nginx.vhosts = [ (vhosts { } cfg') ];
+
+        shb.lldap.ensureGroups = {
+          ${cfg'.ldapUserGroup} = { };
+        };
       }
     ))
 
@@ -563,6 +594,10 @@ in
             extraBypassResources = [ "^/dl.*" ];
           } cfg')
         ];
+
+        shb.lldap.ensureGroups = {
+          ${cfg'.ldapUserGroup} = { };
+        };
       }
     ))
   ];