nimmo/nixos-config

Watch

Fork 0

Deploy synthseek on chaos wired to slskd and the NAS library #193

New issue

Closed

opened 2026-08-26 04:38:01 +01:00 by nimmo · 3 comments

nimmo commented

2026-08-26 04:38:01 +01:00

Owner

Goal

Deploy Synthseek (ghcr.io/arukaraz/synthseek) on chaos, wired to slskd and the NAS music library, with its web UI exposed behind Pangolin.

Depends on the slskd-on-chaos issue.

Decisions made

Official image, pinned to a specific version/digest — young single-maintainer project (45 stars), do not blindly track latest.
Volume mapping: /data -> /srv/stacks/synthseek (inside chaos backup paths), /music -> NAS media/Music (rw), /downloads -> slskd completed-staging dir.
AUTH_SECRET generated once (openssl rand -base64 48) and stored via SOPS.
UI published through Pangolin on chaos's newt site as seek.nimmog.uk; slskd stays internal.
Synthseek ships a built-in MCP server — future follow-up could register it in the AI client MCP catalog like Forgejo/Trilium/Karakeep.

Known gotchas from the music.nimmog.uk setup (2026-08-25)

Pangolin targets must have the legacy method=http field set explicitly; null gives a permanent instant 503 "no available server" even when resource, target, and newt all report healthy, and it survives stack restarts.
Newly created Pangolin resources default sso=true; flip to false for apps that authenticate their own users (synthseek has local accounts + Plex OAuth). Subsonic/OIDC-incapable clients are why Jellyfin runs the same way.
Target health checks require full settings including hcHostname; update-target calls reset hcEnabled unless re-passed and reassign internalPort.

Tasks

modules/containers/synthseek.nix following the killarr/paseo-relay pattern with nixosConfig.synthseek.* options
Shared docker network so synthseek reaches slskd at http://slskd:5030 (alias on a user-defined network)
AUTH_SECRET in SOPS; wire into container environment
Chaos imports both container modules; add docker-synthseek to failure monitor
Create Pangolin resource seek.nimmog.uk (mode http, target method=http, sso=false, GET / health check against the container alias)
First-boot configuration: create the admin account, connect the slskd integration (API URL + key), confirm Deezer catalogue works keyless
End-to-end validation: search -> queue -> slskd download completes -> Beets organises into media/Music -> new material appears in Navidrome on vega without a manual rescan

Completion criteria

Acquisition proven end-to-end from the public URL
Navidrome's library updates automatically from synthseek downloads
Both units monitored; docs updated (README structure entry)

## Goal Deploy Synthseek (`ghcr.io/arukaraz/synthseek`) on **chaos**, wired to slskd and the NAS music library, with its web UI exposed behind Pangolin. Depends on the slskd-on-chaos issue. ## Decisions made - Official image, pinned to a specific version/digest — young single-maintainer project (45 stars), do not blindly track `latest`. - Volume mapping: `/data` -> `/srv/stacks/synthseek` (inside chaos backup paths), `/music` -> NAS `media/Music` (rw), `/downloads` -> slskd completed-staging dir. - `AUTH_SECRET` generated once (`openssl rand -base64 48`) and stored via SOPS. - UI published through Pangolin on chaos's newt site as `seek.nimmog.uk`; slskd stays internal. - Synthseek ships a built-in MCP server — future follow-up could register it in the AI client MCP catalog like Forgejo/Trilium/Karakeep. ## Known gotchas from the music.nimmog.uk setup (2026-08-25) - Pangolin targets must have the legacy `method=http` field set explicitly; `null` gives a permanent instant `503 "no available server"` even when resource, target, and newt all report healthy, and it survives stack restarts. - Newly created Pangolin resources default `sso=true`; flip to `false` for apps that authenticate their own users (synthseek has local accounts + Plex OAuth). Subsonic/OIDC-incapable clients are why Jellyfin runs the same way. - Target health checks require full settings including `hcHostname`; update-target calls reset `hcEnabled` unless re-passed and reassign `internalPort`. ## Tasks - [ ] `modules/containers/synthseek.nix` following the killarr/paseo-relay pattern with `nixosConfig.synthseek.*` options - [ ] Shared docker network so synthseek reaches slskd at `http://slskd:5030` (alias on a user-defined network) - [ ] `AUTH_SECRET` in SOPS; wire into container environment - [ ] Chaos imports both container modules; add `docker-synthseek` to failure monitor - [ ] Create Pangolin resource `seek.nimmog.uk` (mode http, target method=http, sso=false, GET / health check against the container alias) - [ ] First-boot configuration: create the admin account, connect the slskd integration (API URL + key), confirm Deezer catalogue works keyless - [ ] End-to-end validation: search -> queue -> slskd download completes -> Beets organises into `media/Music` -> new material appears in Navidrome on vega without a manual rescan ## Completion criteria - Acquisition proven end-to-end from the public URL - Navidrome's library updates automatically from synthseek downloads - Both units monitored; docs updated (README structure entry)

nimmo added this to the Music Library Automation milestone

2026-08-26 04:38:01 +01:00

nimmo added the

phase:module

service:synthseek

host:chaos

labels

2026-08-26 04:38:01 +01:00

nimmo referenced this issue from a commit

2026-08-26 08:04:34 +01:00

feat(chaos): add dormant synthseek module wired to slskd

nimmo commented

2026-08-26 08:06:09 +01:00

Author

Owner

Implementation pushed on branch feat/synthseek-chaos (f05477d):

modules/containers/synthseek.nix — dormant until secrets/synthseek.yaml exists; joins slskd's new shared docker network (slskd-net) so the API is reachable at http://slskd:5030
Reads downloads from the slskd staging dir and writes organised files straight into /srv/media/Music, which vega's Navidrome watches
slskd module gains nixosConfig.slskd.networkName; network created idempotently at preStart
Pangolin resource live: https://seek.nimmog.uk (resourceId 67, chaos newt site, target method=http set explicitly, sso=false, GET / health check) — will flip healthy once deployed
nix flake check green; closure builds; dormancy verified

Next step (human): check out this branch and run sops secrets/synthseek.yaml with:

synthseek:
    auth-secret: <openssl rand -base64 48>

Then activate. First boot: create the admin account in the web UI, then Settings -> connect slskd (URL http://slskd:5030, API key from secrets/slskd.yaml).

Implementation pushed on branch `feat/synthseek-chaos` (f05477d): - `modules/containers/synthseek.nix` — dormant until `secrets/synthseek.yaml` exists; joins slskd's new shared docker network (`slskd-net`) so the API is reachable at `http://slskd:5030` - Reads downloads from the slskd staging dir and writes organised files straight into `/srv/media/Music`, which vega's Navidrome watches - slskd module gains `nixosConfig.slskd.networkName`; network created idempotently at preStart - Pangolin resource live: **https://seek.nimmog.uk** (resourceId 67, chaos newt site, target method=http set explicitly, sso=false, GET / health check) — will flip healthy once deployed - `nix flake check` green; closure builds; dormancy verified **Next step (human):** check out this branch and run `sops secrets/synthseek.yaml` with: ```yaml synthseek: auth-secret: <openssl rand -base64 48> ``` Then activate. First boot: create the admin account in the web UI, then Settings -> connect slskd (URL `http://slskd:5030`, API key from secrets/slskd.yaml).

nimmo commented

2026-08-26 08:37:57 +01:00

Author

Owner

Deployment evidence (test activation on chaos, 2026-08-26):

docker-synthseek active; Synthseek v2.5.0 ready in 5.5s, database connected, container reports healthy
Web UI answers 200 on 127.0.0.1:4400 and publicly at https://seek.nimmog.uk
docker-slskd recreated onto the shared slskd-net network alongside it — both containers healthy
Pangolin target flipped healthy immediately (method=http was set at creation this time)

Remaining before merge: admin account creation + slskd integration (http://slskd:5030 + API key from secrets/slskd.yaml) in the Settings UI, then one end-to-end acquisition (search -> download -> Beets organise -> appears in Navidrome).

Deployment evidence (test activation on chaos, 2026-08-26): - `docker-synthseek` active; **Synthseek v2.5.0** ready in 5.5s, database connected, container reports healthy - Web UI answers 200 on 127.0.0.1:4400 and publicly at **https://seek.nimmog.uk** - `docker-slskd` recreated onto the shared `slskd-net` network alongside it — both containers healthy - Pangolin target flipped healthy immediately (method=http was set at creation this time) Remaining before merge: admin account creation + slskd integration (`http://slskd:5030` + API key from secrets/slskd.yaml) in the Settings UI, then one end-to-end acquisition (search -> download -> Beets organise -> appears in Navidrome).

nimmo referenced this issue from a commit

2026-08-26 09:07:34 +01:00

fix(navidrome): schedule periodic library scans

nimmo referenced this issue from a commit

2026-08-26 09:25:21 +01:00

fix(chaos): keep slskd staging dir writable across rebuilds

nimmo commented

2026-08-26 09:26:10 +01:00

Author

Owner

Closing out — full pipeline verified live and merged to main (1a8e013).

Live deployment evidence:

End-to-end acquisition proven on chaos test activation: request -> slskd search (14 responses) -> FLAC staged -> Beets tagged and filed to Music/The Aquabats!/Finally!/ -> visible in Navidrome
slskd logged into Soulseek (photophobic-nucleus) with shares actively browsed by real peers
seek.nimmog.uk serving 200 via Pangolin (target method=http set at creation; sso off)
Both containers healthy on shared slskd-net; slskd web UI loopback-only

Fixes landed during bring-up (all in the branch):

Pre-create NFS staging dir + keep it 0777 at preStart — docker's chown fails on root-squashed NFS, and synthseek runs unprivileged (PUID 1000)
slskd 0.26 config schema: shares moved to top-level shares: (upstream PR #1672)
Navidrome Scanner.Schedule = @every 15m on vega — the fs watcher cannot see cross-host NFS writes and upstream disables periodic scanning by default

Updaters will make everything permanent on chaos and deliver the scan schedule to vega. Known quirks noted: one transient dead-menu first load (self-healed, watch for recurrence); CGNAT keeps slskd passive (inbound blocked, downloads unaffected); Weezer "1900..." searches found zero sources — genuinely rare material.

Closing out — full pipeline verified live and merged to main (1a8e013). **Live deployment evidence:** - End-to-end acquisition proven on chaos test activation: request -> slskd search (14 responses) -> FLAC staged -> Beets tagged and filed to `Music/The Aquabats!/Finally!/` -> visible in Navidrome - slskd logged into Soulseek (`photophobic-nucleus`) with shares actively browsed by real peers - seek.nimmog.uk serving 200 via Pangolin (target method=http set at creation; sso off) - Both containers healthy on shared `slskd-net`; slskd web UI loopback-only **Fixes landed during bring-up (all in the branch):** 1. Pre-create NFS staging dir + keep it 0777 at preStart — docker's chown fails on root-squashed NFS, and synthseek runs unprivileged (PUID 1000) 2. slskd 0.26 config schema: shares moved to top-level `shares:` (upstream PR #1672) 3. Navidrome `Scanner.Schedule = @every 15m` on vega — the fs watcher cannot see cross-host NFS writes and upstream disables periodic scanning by default Updaters will make everything permanent on chaos and deliver the scan schedule to vega. Known quirks noted: one transient dead-menu first load (self-healed, watch for recurrence); CGNAT keeps slskd passive (inbound blocked, downloads unaffected); Weezer "1900..." searches found zero sources — genuinely rare material.

nimmo closed this issue

2026-08-26 09:26:23 +01:00