fix accidental overrides (#289)

* fix accidental overrides

* add test coverage, update changelog

Author: kiriwalawren

CHANGELOG.md

@@ -10,6 +10,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 - fix seerr sonarr activeDirectory default resolving host config ([#283](https://github.com/kiriwalawren/nixflix/pull/283))
 - fix \*arr rootfolders oneshot racing app startup ([#286](https://github.com/kiriwalawren/nixflix/pull/286))
+- fix \*arr `config.hostConfig` auth/port/urlBase values being ignored in favor of hardcoded `settings` env vars ([#289](https://github.com/kiriwalawren/nixflix/issues/289))
 
 ## [3.0.0] - 2026-07-12
 

modules/arr-common/mkArrServiceModule.nix

@@ -14,6 +14,7 @@ let
   inherit (import ./utils.nix { inherit lib pkgs serviceName; })
     usesMediaDirs
     capitalizedName
+    capitalize
     serviceBase
     mkWaitForApiScript
     ;
@@ -170,8 +171,8 @@ in
       defaultText = literalExpression ''
         {
           auth = {
-            required = "Enabled";
-            method = "Forms";
+            required = capitalize config.nixflix.${serviceName}.config.hostConfig.authenticationRequired;
+            method = capitalize config.nixflix.${serviceName}.config.hostConfig.authenticationMethod;
           };
           server = {
             inherit (config.nixflix.${serviceName}.config.hostConfig) port urlBase;
@@ -202,6 +203,14 @@ in
         Attribute set of arbitrary config options.
         Please consult the documentation at the [wiki](https://wiki.servarr.com/useful-tools#using-environment-variables-for-config).
 
+        These values are translated into environment variables (e.g. `settings.auth.method`
+        becomes `${toUpper serviceBase}__AUTH__METHOD`), which ${capitalizedName} reads on
+        startup and are applied *in addition to and with higher precedence than* anything
+        configured through `config.hostConfig` via the API. `auth.required`/`auth.method`
+        and `server.port`/`server.urlBase` default to mirroring the corresponding
+        `config.hostConfig` values, so setting those is normally enough; only set these
+        directly to override that derived default.
+
         !!! warning
 
             This configuration is stored in the world-readable Nix store!
@@ -266,10 +275,13 @@ in
       nixflix.${serviceName} = {
         settings = {
           auth = {
-            required = "Enabled";
-            method = "Forms";
+            required = mkDefault (capitalize cfg.config.hostConfig.authenticationRequired);
+            method = mkDefault (capitalize cfg.config.hostConfig.authenticationMethod);
+          };
+          server = {
+            port = mkDefault cfg.config.hostConfig.port;
+            urlBase = mkDefault cfg.config.hostConfig.urlBase;
           };
-          server = { inherit (cfg.config.hostConfig) port urlBase; };
         };
       };
 

modules/arr-common/utils.nix

@@ -5,12 +5,12 @@
 }:
 let
   serviceBase = builtins.elemAt (lib.splitString "-" serviceName) 0;
+  capitalize = s: lib.toUpper (builtins.substring 0 1 s) + builtins.substring 1 (-1) s;
 in
 {
-  inherit serviceBase;
+  inherit serviceBase capitalize;
   usesMediaDirs = !(lib.elem serviceName [ "prowlarr" ]);
-  capitalizedName =
-    lib.toUpper (builtins.substring 0 1 serviceName) + builtins.substring 1 (-1) serviceName;
+  capitalizedName = capitalize serviceName;
   isSonarr = serviceBase == "sonarr";
   isRadarr = serviceBase == "radarr";
   isLidarr = serviceBase == "lidarr";

tests/unit-tests/default.nix

@@ -825,4 +825,82 @@ in
     in
     assertTest "hostconfig-password-requires-username" (!result.success);
 
+  # https://github.com/kiriwalawren/nixflix/issues/270
+  # settings.auth/settings.server must mirror config.hostConfig so that the
+  # environment variables actually reflect what the user configured there.
+  hostconfig-drives-settings-auth =
+    let
+      config = evalConfig [
+        {
+          nixflix = {
+            enable = true;
+            radarr = {
+              enable = true;
+              config = {
+                hostConfig = {
+                  port = 7878;
+                  urlBase = "/radarr";
+                  authenticationMethod = "external";
+                  authenticationRequired = "disabledForLocalAddresses";
+                  username = "admin";
+                  password._secret = "/run/secrets/radarr-pass";
+                };
+                apiKey._secret = "/run/secrets/radarr-api";
+                rootFolders = [ { path = "/media/movies"; } ];
+              };
+            };
+          };
+        }
+      ];
+      radarrCfg = config.config.nixflix.radarr;
+      environment = config.config.systemd.services.radarr.environment;
+    in
+    pkgs.runCommand "unit-test-hostconfig-drives-settings-auth" { } ''
+      ${check "settings.auth.method mirrors hostConfig.authenticationMethod" (
+        radarrCfg.settings.auth.method == "External"
+      )}
+      ${check "settings.auth.required mirrors hostConfig.authenticationRequired" (
+        radarrCfg.settings.auth.required == "DisabledForLocalAddresses"
+      )}
+      ${check "settings.server.port mirrors hostConfig.port" (radarrCfg.settings.server.port == 7878)}
+      ${check "settings.server.urlBase mirrors hostConfig.urlBase" (
+        radarrCfg.settings.server.urlBase == "/radarr"
+      )}
+      ${check "RADARR__AUTH__METHOD env var reflects hostConfig" (
+        environment.RADARR__AUTH__METHOD == "External"
+      )}
+      ${check "RADARR__AUTH__REQUIRED env var reflects hostConfig" (
+        environment.RADARR__AUTH__REQUIRED == "DisabledForLocalAddresses"
+      )}
+      echo 'PASS: hostconfig-drives-settings-auth' > $out
+    '';
+
+  # A user should be able to override settings.auth directly (normal priority,
+  # no lib.mkForce needed) since the hostConfig-derived value is only mkDefault.
+  settings-auth-overrides-hostconfig =
+    let
+      config = evalConfig [
+        {
+          nixflix = {
+            enable = true;
+            radarr = {
+              enable = true;
+              config = {
+                hostConfig = {
+                  port = 7878;
+                  authenticationMethod = "forms";
+                  username = "admin";
+                  password._secret = "/run/secrets/radarr-pass";
+                };
+                apiKey._secret = "/run/secrets/radarr-api";
+                rootFolders = [ { path = "/media/movies"; } ];
+              };
+              settings.auth.method = "External";
+            };
+          };
+        }
+      ];
+      radarrCfg = config.config.nixflix.radarr;
+    in
+    assertTest "settings-auth-overrides-hostconfig" (radarrCfg.settings.auth.method == "External");
 }