From 40ef4444fab338cb89d7af213cb1399aab392ae8 Mon Sep 17 00:00:00 2001
From: rope <fredrik@nordhammer.it>
Date: Tue, 21 Jul 2026 09:41:16 +0100
Subject: [PATCH] sabnzbd: point complete_dir at group-writable pool path +
 permissions=0775
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes Sonarr/Radarr import fail-loop (can't delete sources → mergerfs thrash).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 services/sabnzbd.nix | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/services/sabnzbd.nix b/services/sabnzbd.nix
index ef9ab89..9a28491 100644
--- a/services/sabnzbd.nix
+++ b/services/sabnzbd.nix
@@ -7,17 +7,35 @@ let
   patchConfig = pkgs.writeShellScript "sabnzbd-patch-config" ''
     CONFIG=/var/lib/sabnzbd/sabnzbd.ini
     WHITELIST="sabnzbd.nordhammer.it,127.0.0.1,localhost"
+    # Completed downloads must land on the setgid, group-writable pool dir
+    # (see tmpfiles below), NOT sabnzbd's default /var/lib/sabnzbd/Downloads/
+    # complete which is 0755 — there Sonarr/Radarr (group media) can copy the
+    # file out but can't delete the source, so imports fail-loop forever with
+    # "Permission denied" and thrash the mergerfs pool. permissions=0775 makes
+    # sabnzbd force group-write on completed files/dirs so the *arrs can remove
+    # them after import.
+    COMPLETE_DIR="/mnt/storage/usenet/downloads"
+    PERMISSIONS="0775"
 
     if [ ! -f "$CONFIG" ]; then
-      printf '[misc]\nhost_whitelist = %s\nport = 8085\n' "$WHITELIST" > "$CONFIG"
+      printf '[misc]\nhost_whitelist = %s\nport = 8085\ncomplete_dir = %s\npermissions = %s\n' \
+        "$WHITELIST" "$COMPLETE_DIR" "$PERMISSIONS" > "$CONFIG"
       exit 0
     fi
 
-    if ${pkgs.gnugrep}/bin/grep -q "^host_whitelist" "$CONFIG"; then
-      ${pkgs.gnused}/bin/sed -i "s/^host_whitelist =.*/host_whitelist = $WHITELIST/" "$CONFIG"
-    else
-      ${pkgs.gnused}/bin/sed -i "/^\[misc\]/a host_whitelist = $WHITELIST" "$CONFIG"
-    fi
+    # Idempotently set a key in the [misc] section (create or replace).
+    set_misc() {
+      key="$1"; val="$2"
+      if ${pkgs.gnugrep}/bin/grep -q "^$key" "$CONFIG"; then
+        ${pkgs.gnused}/bin/sed -i "s|^$key =.*|$key = $val|" "$CONFIG"
+      else
+        ${pkgs.gnused}/bin/sed -i "/^\[misc\]/a $key = $val" "$CONFIG"
+      fi
+    }
+
+    set_misc host_whitelist "$WHITELIST"
+    set_misc complete_dir   "$COMPLETE_DIR"
+    set_misc permissions    "$PERMISSIONS"
   '';
 in
 {