From 288a90f366de5276597c2c26d2b72886af48dad2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 18 Feb 2026 22:53:33 -0500
Subject: [PATCH] more recyclarr things

---
 services/recyclarr.nix | 28 +++++++++++++++++++++-------
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/services/recyclarr.nix b/services/recyclarr.nix
index 23412b3..c1d3641 100644
--- a/services/recyclarr.nix
+++ b/services/recyclarr.nix
@@ -8,7 +8,7 @@
 let
   configTemplate = (pkgs.formats.yaml {}).generate "recyclarr.yml" {
     radarr.movies = {
-      base_url = "http://localhost:${service_configs.ports.radarr}";
+      base_url = "http://localhost:${builtins.toString service_configs.ports.radarr}";
       api_key = "RADARR_API_KEY_PLACEHOLDER";
 
       include = [
@@ -59,7 +59,7 @@ let
     };
 
     sonarr.series = {
-      base_url = "http://localhost:${service_configs.ports.sonarr}";
+      base_url = "http://localhost:${builtins.toString service_configs.ports.sonarr}";
       api_key = "SONARR_API_KEY_PLACEHOLDER";
 
       include = [
@@ -113,7 +113,10 @@ let
   radarrConfig = "${service_configs.radarr.dataDir}/config.xml";
   sonarrConfig = "${service_configs.sonarr.dataDir}/config.xml";
 
-  # Script to inject API keys from sonarr/radarr config.xml at runtime
+  user = "recyclarr";
+  group = "recyclarr";
+
+  # Runs as root (via + prefix) to read API keys from config.xml, then chowns output
   generateConfig = pkgs.writeShellScript "recyclarr-generate-config" ''
     RADARR_KEY=$(${pkgs.gnugrep}/bin/grep -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
     SONARR_KEY=$(${pkgs.gnugrep}/bin/grep -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
@@ -121,6 +124,7 @@ let
       -e "s/RADARR_API_KEY_PLACEHOLDER/$RADARR_KEY/" \
       -e "s/SONARR_API_KEY_PLACEHOLDER/$SONARR_KEY/" \
       ${configTemplate} > ${dataDir}/recyclarr.yml
+    chown ${user}:${group} ${dataDir}/recyclarr.yml
   '';
 in
 {
@@ -131,8 +135,8 @@ in
   ];
 
   systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 root root -"
-    "d ${dataDir}/data 0755 root root -"
+    "d ${dataDir} 0755 ${user} ${group} -"
+    "d ${dataDir}/data 0755 ${user} ${group} -"
   ];
 
   systemd.services.recyclarr = {
@@ -141,11 +145,21 @@ in
     wants = [ "network-online.target" ];
     serviceConfig = {
       Type = "oneshot";
-      ExecStartPre = "${generateConfig}";
-      ExecStart = "${pkgs.recyclarr}/bin/recyclarr sync --config ${dataDir}/recyclarr.yml --app-data ${dataDir}/data";
+      User = user;
+      Group = group;
+      ExecStartPre = "+${generateConfig}";
+      ExecStart = "${lib.getExe pkgs.recyclarr} sync --config ${dataDir}/recyclarr.yml --app-data ${dataDir}/data";
     };
   };
 
+  users.users.${user} = {
+    isSystemUser = true;
+    group = group;
+    home = dataDir;
+  };
+
+  users.groups.${group} = {};
+
   systemd.timers.recyclarr = {
     description = "Run Recyclarr daily";
     wantedBy = [ "timers.target" ];