From 901be0cfe2879e887fdb89e56a72181363f34632 Mon Sep 17 00:00:00 2001 From: Gabriel Fontes Date: Thu, 20 Aug 2026 19:02:19 -0300 Subject: [PATCH] fix(hosts/merope/calibre-web): make library read-only calibre-web wrote metadata.db directly, which desynced calibre-server's in-memory library cache: books uploaded through books.m7.rs stayed invisible on the content server until it was restarted, and two writers on one library risk clobbering each other's metadata. Drop calibre-web from the readarr and calibre-server groups and force ReadWritePaths down to its state directory, so the pre-existing ProtectSystem=strict leaves the library read-only. The 0002 umask only existed to keep those shared-library writes group-writable, so it goes too. Readarr already writes through the content server API, so calibre-server is now the sole writer. Note that services.calibre-web.options.enableBookUploading does not cover this on its own: config_uploading only drives the templates, while POST /upload stays gated on the per-user ROLE_UPLOAD bit alone. Assisted-by: pi (claude-opus-5) --- hosts/nixos/merope/services/media/calibre-web.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hosts/nixos/merope/services/media/calibre-web.nix b/hosts/nixos/merope/services/media/calibre-web.nix index 9cdcb8d0..132de537 100644 --- a/hosts/nixos/merope/services/media/calibre-web.nix +++ b/hosts/nixos/merope/services/media/calibre-web.nix @@ -4,9 +4,8 @@ ... }: { users.users = { - # Allow calibre to write to readarr-managed library + # Allow calibre-server to write to readarr-managed library calibre-server.extraGroups = [config.services.readarr.group]; - calibre-web.extraGroups = [config.services.calibre-server.group config.services.readarr.group]; }; services = { @@ -43,7 +42,8 @@ calibre-web.serviceConfig = { CPUWeight = 50; IOWeight = 50; - UMask = "0002"; + ReadWritePaths = lib.mkForce ["/var/lib/calibre-web"]; + ReadOnlyPaths = config.services.calibre-server.libraries; }; };