fix mullvad bypass, override prowlarr dynamic user (hate it)

kiriwalawren · kiriwalawren · commit 3b0160907213 · 2025-11-03T16:12:21.000-05:00
diff --git a/modules/arr-common/mkArrServiceModule.nix b/modules/arr-common/mkArrServiceModule.nix
@@ -14,12 +14,8 @@ with lib; let
   mkArrHostConfigService = import ./hostConfigService.nix {inherit lib pkgs;};
   mkArrRootFoldersService = import ./rootFoldersService.nix {inherit lib pkgs;};
   capitalizedName = toUpper (substring 0 1 serviceName) + substring 1 (-1) serviceName;
-  usesDynamicUser = elem serviceName ["prowlarr"];
   usesMediaDirs = !(elem serviceName ["prowlarr"]);
-  effectiveUser =
-    if usesDynamicUser
-    then serviceName
-    else cfg.user;
+  serviceSupportsUserGroup = !(elem serviceName ["prowlarr"]);
 in {
   options.nixflix.${serviceName} =
     {
@@ -37,6 +33,18 @@ in {
         };
       };
 
+      user = mkOption {
+        type = types.str;
+        default = serviceName;
+        description = "User under which the service runs";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = serviceName;
+        description = "Group under which the service runs";
+      };
+
       config = mkOption {
         type =
           arrConfigModule
@@ -58,19 +66,6 @@ in {
         description = "${capitalizedName} configuration options that will be set via the API.";
       };
     }
-    // optionalAttrs (!usesDynamicUser) {
-      group = mkOption {
-        type = types.str;
-        default = serviceName;
-        description = "Group under which the service runs";
-      };
-
-      user = mkOption {
-        type = types.str;
-        default = serviceName;
-        description = "User under which the service runs";
-      };
-    }
     // optionalAttrs usesMediaDirs {
       mediaDirs = mkOption {
         type = types.listOf (types.submodule {
@@ -92,15 +87,13 @@ in {
     };
 
   config = mkIf (nixflix.enable && cfg.enable) {
-    # Assertion: VPN routing requires Mullvad to be enabled
     assertions = [
       {
         assertion = cfg.vpn.enable -> config.nixflix.mullvad.enable;
         message = "Cannot enable VPN routing for ${capitalizedName} (nixflix.${serviceName}.vpn.enable = true) when Mullvad VPN is disabled. Please set nixflix.mullvad.enable = true.";
       }
     ];
 
-    # Set pattern-based defaults
     nixflix.${serviceName}.config = {
       apiKeyPath = mkDefault null;
       hostConfig = {
@@ -115,23 +108,13 @@ in {
       };
     };
 
-    # Register directories to be created
     nixflix.dirRegistrations =
       [
-        (
-          if usesDynamicUser
-          then {
-            dir = stateDir;
-            owner = "root";
-            group = "root";
-            mode = "0700";
-          }
-          else {
-            inherit (cfg) group;
-            dir = stateDir;
-            owner = cfg.user;
-          }
-        )
+        {
+          inherit (cfg) group;
+          dir = stateDir;
+          owner = cfg.user;
+        }
       ]
       ++ optionals usesMediaDirs (map (mediaDir: {
           inherit (cfg) group;
@@ -144,6 +127,11 @@ in {
         {
           inherit (cfg) enable;
           dataDir = stateDir;
+        }
+        // optionalAttrs serviceSupportsUserGroup {
+          inherit (cfg) user group;
+        }
+        // {
           settings =
             {
               auth = {
@@ -155,23 +143,20 @@ in {
             // optionalAttrs config.services.postgresql.enable {
               log.dbEnabled = true;
               postgres = {
-                user = effectiveUser;
+                user = cfg.user;
                 host = "/run/postgresql";
                 port = 5432;
-                mainDb = effectiveUser;
-                logDb = effectiveUser;
+                mainDb = cfg.user;
+                logDb = cfg.user;
               };
             };
-        }
-        // optionalAttrs (!usesDynamicUser) {
-          inherit (cfg) user group;
         };
 
       postgresql = mkIf config.services.postgresql.enable {
-        ensureDatabases = [effectiveUser];
+        ensureDatabases = [cfg.user];
         ensureUsers = [
           {
-            name = effectiveUser;
+            name = cfg.user;
             ensureDBOwnership = true;
           }
         ];
@@ -195,7 +180,7 @@ in {
       };
     };
 
-    users = mkIf (!usesDynamicUser) {
+    users = {
       groups.${cfg.group} = optionalAttrs (globals.gids ? ${cfg.group}) {
         gid = globals.gids.${cfg.group};
       };
@@ -218,30 +203,17 @@ in {
           before = ["postgresql-ready.target"];
           requiredBy = ["postgresql-ready.target"];
 
-          serviceConfig =
-            {
-              Type = "oneshot";
-              RemainAfterExit = true;
-              TimeoutStartSec = "5min";
-            }
-            // optionalAttrs (!usesDynamicUser) {
-              User = cfg.user;
-              Group = cfg.group;
-            };
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            TimeoutStartSec = "5min";
+            User = cfg.user;
+            Group = cfg.group;
+          };
 
-          script = let
-            dbUser = effectiveUser;
-            psqlCmd =
-              if usesDynamicUser
-              then "${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/psql"
-              else "${pkgs.postgresql}/bin/psql -h /run/postgresql";
-            checkCmd =
-              if usesDynamicUser
-              then "SELECT 1 FROM pg_database WHERE datname='${dbUser}'"
-              else "SELECT 1";
-          in ''
+          script = ''
             while true; do
-              if ${psqlCmd} -d ${dbUser} -c "${checkCmd}" > /dev/null 2>&1; then
+              if ${pkgs.postgresql}/bin/psql -h /run/postgresql -d ${cfg.user} -c "SELECT 1" > /dev/null 2>&1; then
                 echo "${capitalizedName} PostgreSQL database is ready"
                 exit 0
               fi
@@ -265,16 +237,29 @@ in {
               ++ (optional (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) "${serviceName}-env.service")
               ++ (optional config.services.postgresql.enable "postgresql-ready.target");
             wants = optional config.nixflix.mullvad.enable "mullvad-config.service";
-          }
-          // optionalAttrs (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) {
-            serviceConfig.EnvironmentFile = "/run/${serviceName}/env";
-          }
-          // optionalAttrs (config.nixflix.mullvad.enable && !cfg.vpn.enable) {
-            # Bypass VPN by wrapping with mullvad-exclude
-            serviceConfig.ExecStart = mkForce (pkgs.writeShellScript "${serviceName}-vpn-bypass" ''
-              exec /run/wrappers/bin/mullvad-exclude ${getExe config.services.${serviceName}.package} \
-                -nobrowser -data='${stateDir}'
-            '');
+
+            # Always use static users and configure VPN bypass
+            serviceConfig =
+              {
+                # DynamicUser causes issues with VPN bypass and permissions
+                DynamicUser = mkForce false;
+                User = cfg.user;
+                Group = cfg.group;
+              }
+              // optionalAttrs (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) {
+                EnvironmentFile = "/run/${serviceName}/env";
+              }
+              // optionalAttrs (config.nixflix.mullvad.enable && !cfg.vpn.enable) {
+                # Bypass VPN by wrapping with mullvad-exclude
+                ExecStart = mkForce (pkgs.writeShellScript "${serviceName}-vpn-bypass" ''
+                  exec /run/wrappers/bin/mullvad-exclude ${getExe config.services.${serviceName}.package} \
+                    -nobrowser -data='${stateDir}'
+                '');
+                # mullvad-exclude needs CAP_SYS_ADMIN to manipulate cgroups
+                AmbientCapabilities = "CAP_SYS_ADMIN";
+                # Delegate allows the service to manage its cgroup subtree
+                Delegate = mkForce true;
+              };
           };
       }
       # Only create config and rootfolders services if apiKeyPath is configured
@@ -295,12 +280,8 @@ in {
           in ''
             mkdir -p /run/${serviceName}
             echo "${envVar}=$(cat ${cfg.config.apiKeyPath})" > /run/${serviceName}/env
-            ${optionalString (!usesDynamicUser) "chown ${cfg.user}:${cfg.group} /run/${serviceName}/env"}
-            chmod 0${
-              if usesDynamicUser
-              then "444"
-              else "400"
-            } /run/${serviceName}/env
+            chown ${cfg.user}:${cfg.group} /run/${serviceName}/env
+            chmod 0400 /run/${serviceName}/env
           '';
         };
 
diff --git a/tests/vm-tests/mullvad-integration.nix b/tests/vm-tests/mullvad-integration.nix
@@ -24,6 +24,60 @@ pkgs.testers.runNixOSTest {
         };
         dns = ["1.1.1.1" "1.0.0.1"];
       };
+
+      prowlarr = {
+        enable = true;
+        config = {
+          hostConfig = {
+            port = 9696;
+            username = "admin";
+            passwordPath = "${pkgs.writeText "prowlarr-password" "testpass"}";
+          };
+          apiKeyPath = "${pkgs.writeText "prowlarr-apikey" "prowlarr11111111111111111111111111"}";
+        };
+      };
+
+      sonarr = {
+        enable = true;
+        user = "mediauser";
+        mediaDirs = [{dir = "/media/tv";}];
+        config = {
+          hostConfig = {
+            port = 8989;
+            username = "admin";
+            passwordPath = "${pkgs.writeText "sonarr-password" "testpass"}";
+          };
+          apiKeyPath = "${pkgs.writeText "sonarr-apikey" "sonarr222222222222222222222222222"}";
+        };
+      };
+
+      radarr = {
+        enable = true;
+        user = "mediauser";
+        mediaDirs = [{dir = "/media/movies";}];
+        config = {
+          hostConfig = {
+            port = 7878;
+            username = "admin";
+            passwordPath = "${pkgs.writeText "radarr-password" "testpass"}";
+          };
+          apiKeyPath = "${pkgs.writeText "radarr-apikey" "radarr333333333333333333333333333"}";
+        };
+      };
+
+      lidarr = {
+        enable = true;
+        user = "mediauser";
+        mediaDirs = [{dir = "/media/music";}];
+        config = {
+          hostConfig = {
+            port = 8686;
+            username = "admin";
+            passwordPath = "${pkgs.writeText "lidarr-password" "testpass"}";
+          };
+          apiKeyPath = "${pkgs.writeText "lidarr-apikey" "lidarr444444444444444444444444444"}";
+        };
+      };
     };
   };
 
@@ -66,6 +120,42 @@ pkgs.testers.runNixOSTest {
     print("Testing disconnect command...")
     machine.succeed("mullvad disconnect || true")
 
+    # Wait for all services to start
+    machine.wait_for_unit("prowlarr.service", timeout=30)
+    machine.wait_for_unit("sonarr.service", timeout=30)
+    machine.wait_for_unit("radarr.service", timeout=30)
+    machine.wait_for_unit("lidarr.service", timeout=30)
+
+    # Verify services are actually running and stable (not crash-looping)
+    print("Verifying services are stable and responding...")
+    import time
+    time.sleep(5)  # Wait for any crashes to happen
+
+    # Check that services are still active (not failed)
+    machine.succeed("systemctl is-active prowlarr.service")
+    machine.succeed("systemctl is-active sonarr.service")
+    machine.succeed("systemctl is-active radarr.service")
+    machine.succeed("systemctl is-active lidarr.service")
+
+    # Check that services haven't restarted (restart counter should be 0)
+    prowlarr_restarts = machine.succeed("systemctl show prowlarr.service -p NRestarts --value")
+    assert prowlarr_restarts.strip() == "0", f"Prowlarr has restarted {prowlarr_restarts.strip()} times"
+
+    sonarr_restarts = machine.succeed("systemctl show sonarr.service -p NRestarts --value")
+    assert sonarr_restarts.strip() == "0", f"Sonarr has restarted {sonarr_restarts.strip()} times"
+
+    radarr_restarts = machine.succeed("systemctl show radarr.service -p NRestarts --value")
+    assert radarr_restarts.strip() == "0", f"Radarr has restarted {radarr_restarts.strip()} times"
+
+    lidarr_restarts = machine.succeed("systemctl show lidarr.service -p NRestarts --value")
+    assert lidarr_restarts.strip() == "0", f"Lidarr has restarted {lidarr_restarts.strip()} times"
+
+    # Verify HTTP endpoints are responding
+    machine.wait_for_open_port(9696, timeout=60)  # Prowlarr
+    machine.wait_for_open_port(8989, timeout=60)  # Sonarr
+    machine.wait_for_open_port(7878, timeout=60)  # Radarr
+    machine.wait_for_open_port(8686, timeout=60)  # Lidarr
+
     print("Mullvad integration test successful! Kill switch configured correctly.")
   '';
 }
