arr-interconnect: wire Shelfarr to Prowlarr + SABnzbd via rails runner

services/arr-interconnect.nix

@@ -2,7 +2,7 @@
 let
   interconnectScript = pkgs.writeShellScript "arr-interconnect" ''
     set -euo pipefail
-    PATH="${lib.makeBinPath [ pkgs.curl pkgs.jq pkgs.gnused pkgs.gnugrep pkgs.coreutils pkgs.systemd pkgs.sqlite ]}:$PATH"
+    PATH="${lib.makeBinPath [ pkgs.curl pkgs.jq pkgs.gnused pkgs.gnugrep pkgs.coreutils pkgs.systemd pkgs.sqlite pkgs.docker ]}:$PATH"
 
     BASE="http://127.0.0.1"
 
@@ -283,6 +283,57 @@ let
       fi
     fi
 
+    ##########################################################################
+    # Shelfarr → Prowlarr + SABnzbd (audiobook indexer + download client)
+    #
+    # Shelfarr's own settings/download-client config lives behind session
+    # auth in its admin UI, not a public REST API, so this shells into the
+    # container and drives ActiveRecord directly via `rails runner`. That
+    # needs two secrets Shelfarr generates on first boot and writes into its
+    # storage volume — .encryption_keys (Setting values aren't encrypted,
+    # but DownloadClient#api_key/#password are) and .secret_key_base
+    # (Rails always requires this to boot at all). Both only exist after the
+    # container has started once.
+    ##########################################################################
+    if [ -f /var/lib/shelfarr/.encryption_keys ] && [ -f /var/lib/shelfarr/.secret_key_base ]; then
+      wait_for "Shelfarr" "$BASE:5056/up" "" || true
+
+      SHELFARR_SKB=$(cat /var/lib/shelfarr/.secret_key_base)
+      docker exec -i \
+        -e SECRET_KEY_BASE="$SHELFARR_SKB" \
+        -e ARR_PROWLARR_URL="$BASE:9696" \
+        -e ARR_PROWLARR_KEY="$PROWLARR_KEY" \
+        -e ARR_SABNZBD_URL="$BASE:8085" \
+        -e ARR_SABNZBD_KEY="$SABNZBD_KEY" \
+        shelfarr sh -c '. /rails/storage/.encryption_keys && bin/rails runner -' <<'RUBY' && echo "  done" || echo "  failed"
+      if ENV["ARR_PROWLARR_URL"].to_s != "" && ENV["ARR_PROWLARR_KEY"].to_s != "" && !SettingsService.prowlarr_configured?
+        SettingsService.set(:prowlarr_url, ENV["ARR_PROWLARR_URL"])
+        SettingsService.set(:prowlarr_api_key, ENV["ARR_PROWLARR_KEY"])
+        SettingsService.set(:indexer_provider, "prowlarr")
+        puts "Prowlarr configured in Shelfarr"
+      else
+        puts "Shelfarr → Prowlarr already configured, or key missing"
+      end
+
+      if ENV["ARR_SABNZBD_URL"].to_s != "" && ENV["ARR_SABNZBD_KEY"].to_s != "" && !DownloadClient.exists?(name: "SABnzbd")
+        DownloadClient.create!(
+          name: "SABnzbd",
+          client_type: "sabnzbd",
+          url: ENV["ARR_SABNZBD_URL"],
+          api_key: ENV["ARR_SABNZBD_KEY"],
+          category: "shelfarr",
+          enabled: true,
+          priority: 0
+        )
+        puts "SABnzbd added to Shelfarr"
+      else
+        puts "Shelfarr → SABnzbd already configured, or key missing"
+      end
+RUBY
+    else
+      echo "Shelfarr hasn't completed its first boot yet (no encryption keys), skipping"
+    fi
+
     ##########################################################################
     # Bazarr → Sonarr (subtitle management for TV)
     ##########################################################################
@@ -452,6 +503,7 @@ in
         "bazarr.service"
         "qbittorrent-nox.service"
         "sabnzbd.service"
+        "docker-shelfarr.service"
       ];
       wants = [
         "sonarr.service"
@@ -460,6 +512,7 @@ in
         "bazarr.service"
         "qbittorrent-nox.service"
         "sabnzbd.service"
+        "docker-shelfarr.service"
       ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {