Compare commits
1 commit
main
...
dependabot
| Author | SHA1 | Date | |
|---|---|---|---|
|
72a258de1d |
103 changed files with 703 additions and 12059 deletions
16
.env.example
16
.env.example
|
|
@ -1,16 +0,0 @@
|
|||
# Copy this file to .env and fill in your values.
|
||||
# Then run: docker compose up -d
|
||||
|
||||
# Your TorrentClaw API key (required).
|
||||
# Get it at: https://torrentclaw.com/settings/api-keys
|
||||
UNARR_API_KEY=tc_your_key_here
|
||||
|
||||
# Absolute path to your media / downloads folder.
|
||||
# This is where finished movies and shows will be saved.
|
||||
DOWNLOAD_DIR=/home/youruser/Media
|
||||
|
||||
# (Optional) Config directory — defaults to ./config next to this file.
|
||||
# CONFIG_DIR=/home/youruser/.config/unarr
|
||||
|
||||
# (Optional) Timezone for logs.
|
||||
# TZ=Europe/Madrid
|
||||
|
|
@ -1,61 +0,0 @@
|
|||
# Rebuilds and re-pushes the `latest` image without a version bump so newly
|
||||
# *fixed* Alpine / ffmpeg / Go patches land between tagged releases. Versioned
|
||||
# tags are immutable and never touched here. Runs weekly and on demand.
|
||||
name: Docker rebuild
|
||||
|
||||
on:
|
||||
schedule:
|
||||
# Mondays 04:17 UTC (off the hour to avoid the scheduler rush)
|
||||
- cron: "17 4 * * 1"
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
rebuild:
|
||||
runs-on: docker
|
||||
container:
|
||||
image: docker.io/library/docker:27-cli
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Install build deps
|
||||
run: apk add --no-cache curl git bash
|
||||
|
||||
- name: Install buildx
|
||||
run: |
|
||||
mkdir -p ~/.docker/cli-plugins
|
||||
curl -sSL https://github.com/docker/buildx/releases/latest/download/buildx-linux-amd64 \
|
||||
-o ~/.docker/cli-plugins/docker-buildx
|
||||
chmod +x ~/.docker/cli-plugins/docker-buildx
|
||||
|
||||
- name: Set up qemu
|
||||
run: docker run --rm --privileged tonistiigi/binfmt --install all
|
||||
|
||||
# Stamp the binary with the most recent release tag (not "dev").
|
||||
- name: Resolve version
|
||||
id: ver
|
||||
run: |
|
||||
v=$(git describe --tags --abbrev=0 2>/dev/null || echo dev)
|
||||
echo "version=$v" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Login to Docker Hub
|
||||
env:
|
||||
DH_USER: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
DH_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
run: echo "$DH_TOKEN" | docker login -u "$DH_USER" --password-stdin
|
||||
|
||||
- name: Build + push (refresh latest)
|
||||
env:
|
||||
VERSION: ${{ steps.ver.outputs.version }}
|
||||
run: |
|
||||
docker buildx create --name builder --use --driver docker-container
|
||||
# Refresh the floating tag only — never overwrite a versioned release.
|
||||
# Force a fresh base pull so apk upgrade picks up new patches.
|
||||
docker buildx build \
|
||||
--platform linux/amd64,linux/arm64 \
|
||||
--build-arg "VERSION=$VERSION" \
|
||||
--tag "torrentclaw/unarr:latest" \
|
||||
--no-cache \
|
||||
--push \
|
||||
.
|
||||
|
|
@ -1,118 +0,0 @@
|
|||
name: Release
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- "v*"
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
jobs:
|
||||
release:
|
||||
runs-on: docker
|
||||
container:
|
||||
image: docker.io/library/golang:1.25
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Install build deps (bash, curl, jq, ffmpeg fetch deps)
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y --no-install-recommends bash curl ca-certificates jq xz-utils unzip
|
||||
|
||||
- name: Install goreleaser
|
||||
run: |
|
||||
curl -sSfL https://github.com/goreleaser/goreleaser/releases/latest/download/goreleaser_Linux_x86_64.tar.gz \
|
||||
| tar -xz -C /usr/local/bin goreleaser
|
||||
|
||||
- name: Run goreleaser
|
||||
env:
|
||||
# Forgejo runner auto-injects GITHUB_TOKEN (a per-job, instance-scoped
|
||||
# token usable against the Forgejo REST API). goreleaser only accepts
|
||||
# one token; with both GITHUB_TOKEN + GITEA_TOKEN set it errors out
|
||||
# ("multiple tokens"). Unset GITHUB_TOKEN before invoking goreleaser so
|
||||
# it picks the Gitea code path + the gitea_urls block in .goreleaser.yml.
|
||||
GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
|
||||
# Empty when RELEASE_SIGNING_PUBKEY variable is unset — goreleaser
|
||||
# accepts it and the resulting binary disables signature checks
|
||||
# (back-compat: pre-signing releases continue to update). Set
|
||||
# RELEASE_SIGNING_PUBKEY (variable) + RELEASE_SIGNING_KEY (secret)
|
||||
# to turn verification on.
|
||||
RELEASE_SIGNING_PUBKEY: ${{ vars.RELEASE_SIGNING_PUBKEY }}
|
||||
run: |
|
||||
unset GITHUB_TOKEN
|
||||
goreleaser release --clean
|
||||
|
||||
- name: Sign checksums.txt with ed25519
|
||||
if: ${{ vars.RELEASE_SIGNING_PUBKEY != '' && secrets.RELEASE_SIGNING_KEY != '' }}
|
||||
env:
|
||||
RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
|
||||
RELEASE_TAG: ${{ github.ref_name }}
|
||||
FORGEJO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
# Tailscale IP — domain-agnostic; the runner shares the dokploy-network with
|
||||
# forgejo (hostname `forgejo`), so the in-cluster hostname is fastest, but the
|
||||
# Tailscale IP is the documented fallback.
|
||||
FORGEJO_API: http://forgejo:3000/api/v1
|
||||
REPO: torrentclaw/unarr
|
||||
run: |
|
||||
set -euo pipefail
|
||||
go run ./scripts/sign-checksums \
|
||||
-key "$RELEASE_SIGNING_KEY" \
|
||||
-in dist/checksums.txt \
|
||||
-out dist/checksums.txt.sig
|
||||
|
||||
# Find the release ID for this tag, then upload the sig as an asset.
|
||||
rel_id=$(curl -sSf "$FORGEJO_API/repos/$REPO/releases/tags/$RELEASE_TAG" \
|
||||
-H "Authorization: token $FORGEJO_TOKEN" | jq -r '.id')
|
||||
curl -sSf -X POST \
|
||||
"$FORGEJO_API/repos/$REPO/releases/$rel_id/assets?name=checksums.txt.sig" \
|
||||
-H "Authorization: token $FORGEJO_TOKEN" \
|
||||
-F "attachment=@dist/checksums.txt.sig"
|
||||
|
||||
docker:
|
||||
needs: release
|
||||
runs-on: docker
|
||||
container:
|
||||
# Docker-in-Docker capable image — buildx + qemu pre-installed.
|
||||
image: docker.io/library/docker:27-cli
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install buildx
|
||||
run: |
|
||||
apk add --no-cache curl
|
||||
mkdir -p ~/.docker/cli-plugins
|
||||
curl -sSL https://github.com/docker/buildx/releases/latest/download/buildx-linux-amd64 \
|
||||
-o ~/.docker/cli-plugins/docker-buildx
|
||||
chmod +x ~/.docker/cli-plugins/docker-buildx
|
||||
|
||||
- name: Login to Docker Hub
|
||||
env:
|
||||
DH_USER: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
DH_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
run: echo "$DH_TOKEN" | docker login -u "$DH_USER" --password-stdin
|
||||
|
||||
- name: Set up qemu
|
||||
run: docker run --rm --privileged tonistiigi/binfmt --install all
|
||||
|
||||
- name: Build + push multi-arch image
|
||||
env:
|
||||
VERSION: ${{ github.ref_name }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
VERSION_SEMVER="${VERSION#v}"
|
||||
MAJOR_MINOR="${VERSION_SEMVER%.*}"
|
||||
docker buildx create --name builder --use --driver docker-container
|
||||
docker buildx build \
|
||||
--platform linux/amd64,linux/arm64 \
|
||||
--build-arg "VERSION=$VERSION" \
|
||||
--tag "torrentclaw/unarr:$VERSION_SEMVER" \
|
||||
--tag "torrentclaw/unarr:$MAJOR_MINOR" \
|
||||
--tag "torrentclaw/unarr:latest" \
|
||||
--push \
|
||||
.
|
||||
|
|
@ -12,26 +12,35 @@ permissions:
|
|||
jobs:
|
||||
test:
|
||||
name: Test
|
||||
runs-on: docker
|
||||
container:
|
||||
image: docker.io/library/golang:1.25
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
go-version: ["1.25"]
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: ${{ matrix.go-version }}
|
||||
|
||||
- name: Run tests
|
||||
run: go test -v -race -count=1 ./...
|
||||
|
||||
build:
|
||||
name: Build
|
||||
runs-on: docker
|
||||
container:
|
||||
image: docker.io/library/golang:1.25
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
goos: [linux, darwin, windows]
|
||||
goarch: [amd64, arm64]
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: "1.25"
|
||||
|
||||
- name: Build
|
||||
env:
|
||||
|
|
@ -41,30 +50,30 @@ jobs:
|
|||
|
||||
lint:
|
||||
name: Lint
|
||||
runs-on: docker
|
||||
container:
|
||||
image: docker.io/library/golang:1.25
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Install golangci-lint
|
||||
run: |
|
||||
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.11.4/install.sh \
|
||||
| sh -s -- -b /usr/local/bin v2.11.4
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: "1.25"
|
||||
|
||||
- name: Run golangci-lint
|
||||
run: golangci-lint run ./...
|
||||
uses: golangci/golangci-lint-action@v9
|
||||
with:
|
||||
version: v2.11.4
|
||||
|
||||
coverage:
|
||||
name: Coverage
|
||||
runs-on: docker
|
||||
container:
|
||||
image: docker.io/library/golang:1.25
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Install python3
|
||||
run: apt-get update && apt-get install -y --no-install-recommends python3
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: "1.25"
|
||||
|
||||
- name: Run tests with coverage (all packages)
|
||||
run: |
|
||||
|
|
@ -93,13 +102,24 @@ jobs:
|
|||
print('OK: Coverage meets minimum threshold')
|
||||
"
|
||||
|
||||
- name: Upload coverage to Codecov
|
||||
uses: codecov/codecov-action@v6
|
||||
with:
|
||||
files: ./coverage.out
|
||||
fail_ci_if_error: false
|
||||
env:
|
||||
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
||||
|
||||
vet:
|
||||
name: Vet
|
||||
runs-on: docker
|
||||
container:
|
||||
image: docker.io/library/golang:1.25
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version: "1.25"
|
||||
|
||||
- name: Run go vet
|
||||
run: go vet ./...
|
||||
163
.github/workflows/release.yml
vendored
Normal file
163
.github/workflows/release.yml
vendored
Normal file
|
|
@ -0,0 +1,163 @@
|
|||
name: Release
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- "v*"
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
jobs:
|
||||
release:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version-file: go.mod
|
||||
|
||||
- uses: goreleaser/goreleaser-action@v6
|
||||
with:
|
||||
version: "~> v2"
|
||||
args: release --clean
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
|
||||
|
||||
docker:
|
||||
needs: release
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Docker meta
|
||||
id: meta
|
||||
uses: docker/metadata-action@v6
|
||||
with:
|
||||
images: torrentclaw/unarr
|
||||
tags: |
|
||||
type=semver,pattern={{version}}
|
||||
type=semver,pattern={{major}}.{{minor}}
|
||||
type=raw,value=latest
|
||||
|
||||
- uses: docker/setup-qemu-action@v4
|
||||
- uses: docker/setup-buildx-action@v4
|
||||
|
||||
- uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
- uses: docker/build-push-action@v7
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
platforms: linux/amd64,linux/arm64
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
build-args: |
|
||||
VERSION=${{ github.ref_name }}
|
||||
|
||||
|
||||
virustotal:
|
||||
needs: release
|
||||
runs-on: ubuntu-latest
|
||||
if: vars.VT_ENABLED == 'true'
|
||||
steps:
|
||||
- name: Get release tag
|
||||
id: tag
|
||||
run: echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Download release assets
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
mkdir -p assets
|
||||
gh release download "${{ steps.tag.outputs.tag }}" \
|
||||
--repo "${{ github.repository }}" \
|
||||
--dir assets \
|
||||
--pattern '*.tar.gz' \
|
||||
--pattern '*.zip' \
|
||||
--pattern 'checksums.txt'
|
||||
|
||||
- name: Scan assets with VirusTotal
|
||||
env:
|
||||
VT_API_KEY: ${{ secrets.VT_API_KEY }}
|
||||
run: |
|
||||
mkdir -p results
|
||||
for file in assets/*; do
|
||||
filename=$(basename "$file")
|
||||
echo "Uploading $filename to VirusTotal..."
|
||||
|
||||
response=$(curl -s --request POST \
|
||||
--url https://www.virustotal.com/api/v3/files \
|
||||
--header "x-apikey: $VT_API_KEY" \
|
||||
--form "file=@$file")
|
||||
|
||||
analysis_id=$(echo "$response" | jq -r '.data.id // empty')
|
||||
if [ -z "$analysis_id" ]; then
|
||||
echo "::warning::Failed to upload $filename: $response"
|
||||
continue
|
||||
fi
|
||||
|
||||
echo "$filename=$analysis_id" >> results/scans.txt
|
||||
echo " Analysis ID: $analysis_id"
|
||||
|
||||
# Rate limit: VT free tier allows 4 req/min
|
||||
sleep 16
|
||||
done
|
||||
|
||||
- name: Wait for analysis completion
|
||||
env:
|
||||
VT_API_KEY: ${{ secrets.VT_API_KEY }}
|
||||
run: |
|
||||
echo "Waiting 60s for VirusTotal analysis to complete..."
|
||||
sleep 60
|
||||
|
||||
vt_report="## 🛡️ VirusTotal Scan Results\n\n"
|
||||
vt_report+="| File | Result | Link |\n"
|
||||
vt_report+="|------|--------|------|\n"
|
||||
|
||||
while IFS='=' read -r filename analysis_id; do
|
||||
result=$(curl -s --request GET \
|
||||
--url "https://www.virustotal.com/api/v3/analyses/$analysis_id" \
|
||||
--header "x-apikey: $VT_API_KEY")
|
||||
|
||||
malicious=$(echo "$result" | jq -r '.data.attributes.stats.malicious // 0')
|
||||
undetected=$(echo "$result" | jq -r '.data.attributes.stats.undetected // 0')
|
||||
sha256=$(echo "$result" | jq -r '.meta.file_info.sha256 // empty')
|
||||
|
||||
if [ "$malicious" = "0" ]; then
|
||||
status="✅ Clean ($undetected engines)"
|
||||
else
|
||||
status="⚠️ $malicious detections"
|
||||
fi
|
||||
|
||||
link="https://www.virustotal.com/gui/file/$sha256"
|
||||
vt_report+="| \`$filename\` | $status | [View]($link) |\n"
|
||||
|
||||
sleep 16
|
||||
done < results/scans.txt
|
||||
|
||||
echo -e "$vt_report" > results/report.md
|
||||
cat results/report.md
|
||||
|
||||
- name: Append scan results to release notes
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
current_body=$(gh release view "${{ steps.tag.outputs.tag }}" \
|
||||
--repo "${{ github.repository }}" \
|
||||
--json body --jq '.body')
|
||||
|
||||
new_body="${current_body}
|
||||
|
||||
$(cat results/report.md)"
|
||||
|
||||
gh release edit "${{ steps.tag.outputs.tag }}" \
|
||||
--repo "${{ github.repository }}" \
|
||||
--notes "$new_body"
|
||||
5
.gitignore
vendored
5
.gitignore
vendored
|
|
@ -36,12 +36,7 @@ Thumbs.db
|
|||
|
||||
# GoReleaser
|
||||
dist/
|
||||
dist-ffbinaries/
|
||||
|
||||
# Docker
|
||||
tmp/
|
||||
config/
|
||||
dist-ffbinaries/
|
||||
|
||||
# Claude Code: keep entirely local, do not track
|
||||
.claude/
|
||||
|
|
@ -2,14 +2,6 @@ version: 2
|
|||
|
||||
project_name: unarr
|
||||
|
||||
# Pre-build hook: fetch static ffmpeg + ffprobe per platform so each
|
||||
# release tarball ships them adjacent to the unarr binary. ResolveFFmpeg /
|
||||
# ResolveFFprobe pick them up via the "adjacent to executable" branch — no
|
||||
# system install or runtime download needed.
|
||||
before:
|
||||
hooks:
|
||||
- bash scripts/download-ffmpeg-static.sh
|
||||
|
||||
builds:
|
||||
- main: ./cmd/unarr/
|
||||
binary: unarr
|
||||
|
|
@ -26,27 +18,13 @@ builds:
|
|||
- -s -w
|
||||
- -X github.com/torrentclaw/unarr/internal/cmd.Version={{.Version}}
|
||||
- -X github.com/torrentclaw/unarr/internal/sentry.dsn={{ .Env.SENTRY_DSN }}
|
||||
# Release-signing public key — verified by the self-updater against
|
||||
# checksums.txt.sig. Empty when not configured; in that case
|
||||
# signature verification is skipped and a warning is logged.
|
||||
- -X github.com/torrentclaw/unarr/internal/upgrade.releasePubKeyBase64={{ .Env.RELEASE_SIGNING_PUBKEY }}
|
||||
|
||||
archives:
|
||||
- formats: [tar.gz]
|
||||
- format: tar.gz
|
||||
name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
|
||||
format_overrides:
|
||||
- goos: windows
|
||||
formats: [zip]
|
||||
files:
|
||||
- LICENSE*
|
||||
- README*
|
||||
# Bundle the matching ffmpeg + ffprobe (filename includes .exe on Windows
|
||||
# because download-ffmpeg-static.sh writes ffmpeg.exe / ffprobe.exe there).
|
||||
- src: "dist-ffbinaries/{{ .Os }}-{{ .Arch }}/*"
|
||||
dst: .
|
||||
strip_parent: true
|
||||
info:
|
||||
mode: 0o755
|
||||
format: zip
|
||||
|
||||
checksum:
|
||||
name_template: "checksums.txt"
|
||||
|
|
@ -59,22 +37,6 @@ changelog:
|
|||
- "^test:"
|
||||
- "^chore:"
|
||||
|
||||
# Self-hosted Forgejo at git.torrentclaw.com. goreleaser detects GITEA_TOKEN +
|
||||
# these URLs and publishes the release there instead of GitHub. Reachable via
|
||||
# `forgejo` hostname inside the dokploy-network (the runner shares it); for
|
||||
# local goreleaser runs outside the network, override via env GITEA_API_URL.
|
||||
#
|
||||
# In goreleaser v2 `gitea_urls` is a top-level key (was nested under `release`
|
||||
# in v1).
|
||||
gitea_urls:
|
||||
api: http://forgejo:3000/api/v1
|
||||
download: https://git.torrentclaw.com
|
||||
skip_tls_verify: false
|
||||
|
||||
release:
|
||||
draft: false
|
||||
prerelease: auto
|
||||
|
||||
# Homebrew tap — requires PAT with repo scope (not GITHUB_TOKEN)
|
||||
# Enable when torrentclaw/homebrew-tap PAT is configured as HOMEBREW_TAP_TOKEN
|
||||
# brews:
|
||||
|
|
|
|||
425
CHANGELOG.md
425
CHANGELOG.md
|
|
@ -5,265 +5,12 @@ All notable changes to this project will be documented in this file.
|
|||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
||||
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||||
|
||||
## [0.9.19] - 2026-05-30
|
||||
|
||||
|
||||
### Fixed
|
||||
|
||||
- **docker**: three streaming/reliability bugs found in live docker test
|
||||
## [0.9.18] - 2026-05-29
|
||||
|
||||
|
||||
### Fixed
|
||||
|
||||
- **stream**: make completed torrent files readable (mmap creates 0000)
|
||||
|
||||
### Other
|
||||
|
||||
- **release**: 0.9.18
|
||||
## [0.9.17] - 2026-05-27
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **scripts**: prune Forgejo releases >90 days in ship.sh
|
||||
|
||||
### Fixed
|
||||
|
||||
- **hls**: drop nvenc -tune ll — kills hls segmentation, bump 0.9.17
|
||||
|
||||
### Other
|
||||
|
||||
- **release**: 0.9.17
|
||||
## [0.9.15] - 2026-05-27
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **sentry**: enhance error handling by skipping user input errors in CaptureError
|
||||
|
||||
### Changed
|
||||
|
||||
- **ci**: point Forgejo URLs at torrentclaw org (post-transfer)
|
||||
- **sentry**: decouple agent import via string-match, rename predicate
|
||||
|
||||
### Documentation
|
||||
|
||||
- **positioning**: reframe unarr around download/stream/transcode, drop misleading search-first wording
|
||||
|
||||
### Fixed
|
||||
|
||||
- **ci**: unset GITHUB_TOKEN so goreleaser uses GITEA_TOKEN
|
||||
- **sentry**: skip "daemon not running" stop/reload errors
|
||||
|
||||
### Other
|
||||
|
||||
- **release**: 0.9.15
|
||||
- **scripts**: harden release.sh against double-release and inline version bumps
|
||||
- untrack .claude/ (private local config)
|
||||
## [0.9.14] - 2026-05-27
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **vaapi**: hybrid CPU-scale + hwupload encode path (QW2, 0.9.14)
|
||||
|
||||
### CI/CD
|
||||
|
||||
- port workflows from .github/ to .forgejo/ (Forgejo Actions)
|
||||
|
||||
### Fixed
|
||||
|
||||
- **daemon**: defensive IsClosed check in watchSessionReady poll loop
|
||||
- **daemon**: use parent ctx for MarkSessionReady so cancel propagates
|
||||
- **release**: move gitea_urls to top-level (goreleaser v2 schema)
|
||||
## [0.9.13] - 2026-05-27
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **agent**: session-ready webhook for SSE-driven player handshake (0.9.13)
|
||||
- **agent**: send full transcoder diagnostic in register payload (0.9.12)
|
||||
|
||||
### Fixed
|
||||
|
||||
- **daemon**: defer probeCancel so a panic mid-diagnostic still releases ctx
|
||||
|
||||
### Other
|
||||
|
||||
- **release**: add ship.sh end-to-end pipeline as GH Actions backup
|
||||
- **skills**: add /publish slash command + allow .claude/ in git
|
||||
## [0.9.11] - 2026-05-27
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **hls**: pre-segmentación delantada — 2 s segments + async session start (0.9.10)
|
||||
- **hls**: faster first-start — probe cache + tighter encoder presets (0.9.9)
|
||||
|
||||
### Changed
|
||||
|
||||
- **hls**: critico-driven hardening of fase 3.2
|
||||
|
||||
### Fixed
|
||||
|
||||
- **cors**: allow play from .to / staging / onion mirrors
|
||||
- **library**: classify resolution by width + height, not height alone
|
||||
- **transcode**: make preset libx264-only + restore quality opt-in
|
||||
|
||||
### Other
|
||||
|
||||
- **release**: 0.9.11
|
||||
## [0.9.8] - 2026-05-27
|
||||
|
||||
|
||||
### Fixed
|
||||
|
||||
- **upgrade**: break auto-apply restart loop (0.9.8)
|
||||
## [0.9.7] - 2026-05-26
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **hls**: persistent fMP4 segment cache + integrity + stats (0.9.7)
|
||||
## [0.9.6] - 2026-05-26
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **daemon**: auto-apply upgrades when server signals (0.9.6)
|
||||
## [0.9.5] - 2026-05-26
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **funnel**: cloudflare quick tunnel embedded subprocess (0.9.5)
|
||||
## [0.9.4] - 2026-05-26
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **stream**: retire WebRTC, HLS-only, bump 0.9.4 (**BREAKING**)
|
||||
## [0.9.3] - 2026-05-26
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **usenet**: warn at startup when par2 or extractor is missing
|
||||
|
||||
### Fixed
|
||||
|
||||
- **engine**: truncate errorMessage before reporting status
|
||||
- **hls**: clamp ffmpeg bitrate to the level we derive from outputHeight
|
||||
## [0.9.2] - 2026-05-22
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **vpn**: unarr vpn command + report/arbitrate the WireGuard slot
|
||||
## [0.9.1] - 2026-05-21
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **mirror**: update fallback URLs to use IPFS and remove GitHub Pages
|
||||
|
||||
### Fixed
|
||||
|
||||
- **security**: bump golang.org/x deps and add container CVE scan gate
|
||||
|
||||
### Other
|
||||
|
||||
- **release**: 0.9.1
|
||||
## [0.9.0] - 2026-05-21
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **agent**: add mirror failover, agent client refactor, status 401 detection
|
||||
- **vpn**: local config_file for self-hosted/personal VPN testing
|
||||
- **vpn**: split-tunnel torrent traffic through managed WireGuard
|
||||
|
||||
### CI/CD
|
||||
|
||||
- deploy install scripts to GitHub Pages
|
||||
|
||||
### Documentation
|
||||
|
||||
- **docker**: refresh Docker Hub README + sync description in CI
|
||||
|
||||
### Fixed
|
||||
|
||||
- **security**: CORS allowlist, URL scheme guard, state perms, ZIP slip, mirror docs
|
||||
- **security**: UPnP opt-in, bounded SSE reader, signed self-update
|
||||
- **security**: harden HLS session IDs, /health disclosure, archive password handling
|
||||
- **upgrade**: fetch releases from TorrentClaw app, not GitHub
|
||||
|
||||
### Other
|
||||
|
||||
- **pages**: add .nojekyll to disable Jekyll processing
|
||||
- **pages**: set custom domain unarr.torrentclaw.com
|
||||
- **release**: 0.9.0
|
||||
## [0.8.1] - 2026-05-08
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **config**: set default values for WebRTC and transcoding in minimal TOML config
|
||||
- **transcode**: dynamic H.264 level + HW probe + capability reporting
|
||||
|
||||
### Changed
|
||||
|
||||
- **streaming**: improve signal handling and remove unused components
|
||||
|
||||
### Fixed
|
||||
|
||||
- **self-update**: auto-restart live daemon after upgrade
|
||||
- **streaming**: allow HLS sessions when webrtc disabled
|
||||
|
||||
### Other
|
||||
|
||||
- **gitignore**: add dist-ffbinaries to ignored files
|
||||
- **release**: 0.8.1
|
||||
## [0.8.0] - 2026-05-08
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **mediainfo**: ResolveFFmpeg + DownloadFFmpeg mirroring ffprobe pattern
|
||||
- **release**: bundle ffmpeg + ffprobe in tarballs and Docker image
|
||||
- **seed-file**: unarr-side handler for browser-on-demand seeding (Fase 4.7.c)
|
||||
- **stream**: per-session quality cap from web
|
||||
- **stream**: real-time transcoding for non-browser-decodable codecs
|
||||
- **stream**: pion-based WebRTC byte streamer for browser playback
|
||||
- **streaming**: seek-restart, single-session, idle sweeper, probe.json
|
||||
- **streaming**: add HLS transport pipeline (daemon side)
|
||||
- **streaming**: ffmpeg transcoding pipeline (direct play / fMP4 / HW accel)
|
||||
- **torrent**: act as WebTorrent peer for browser ↔ unarr P2P streaming
|
||||
- **wstracker-probe**: -seed FILE mode for browser ↔ unarr e2e validation
|
||||
|
||||
### Fixed
|
||||
|
||||
- **streaming**: bounded ffmpeg auto-restart + tmpdir gc + probe/stderr safety
|
||||
- **transcoder**: force aac stereo 48khz + frag_duration for mse compat
|
||||
- **transcoder**: force main profile + setparams Rec.709 + serveRange wait
|
||||
- **transcoder**: correct scale filter + always force yuv420p
|
||||
|
||||
### Other
|
||||
|
||||
- **release**: 0.8.0
|
||||
- **streaming**: post-review fixes — race lock, dead branch, stderr cap
|
||||
- **torrent**: bump anacrolix log level Critical → Warning for visibility
|
||||
## [0.7.0] - 2026-04-10
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **daemon**: enhance service management with start, stop, restart, and status commands for Windows
|
||||
|
||||
### Other
|
||||
|
||||
- **release**: 0.7.0
|
||||
## [0.6.8] - 2026-04-10
|
||||
|
||||
|
||||
|
|
@ -438,117 +185,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|||
## [0.4.1] - 2026-04-01
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **cli**: add login command and refactor shared helpers
|
||||
- **stream**: report watch progress to API via HTTP Range tracking
|
||||
|
||||
### Fixed
|
||||
|
||||
- **ci**: fix lint errors and pin CI to Go 1.25
|
||||
- **lint**: remove unused newStubCmd function
|
||||
|
||||
### Other
|
||||
|
||||
- **cli**: remove moreseed stub command
|
||||
- **cli**: remove redundant stub commands (monitor, open, add, compare)
|
||||
## [0.4.0] - 2026-03-31
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **cli**: upgrade command, rich status, and version cache
|
||||
|
||||
### Fixed
|
||||
|
||||
- **progress**: always report status transitions and poll for control signals
|
||||
## [0.3.7] - 2026-03-31
|
||||
|
||||
|
||||
### CI/CD
|
||||
|
||||
- **docker**: remove dockerhub-description sync step
|
||||
## [0.3.6] - 2026-03-31
|
||||
|
||||
|
||||
### CI/CD
|
||||
|
||||
- **deps**: bump docker/metadata-action from 5 to 6
|
||||
- **deps**: bump docker/setup-qemu-action from 3 to 4
|
||||
- **deps**: bump docker/login-action from 3 to 4
|
||||
- **deps**: bump docker/build-push-action from 6 to 7
|
||||
- **deps**: bump codecov/codecov-action from 5 to 6
|
||||
- **docker**: add Docker Hub description sync and DOCKERHUB.md
|
||||
|
||||
### Fixed
|
||||
|
||||
- **ci**: upgrade golangci-lint to v2.11.3 for Go 1.25 support
|
||||
- **docker**: upgrade alpine packages to patch CVE-2025-60876 and CVE-2026-27171
|
||||
- **lint**: use default:none to disable errcheck, fix all gofmt and exhaustive
|
||||
- **lint**: disable errcheck, tune gosec/exclusions for codebase state
|
||||
- **lint**: configure linters for codebase maturity, fix gofmt and ineffassign
|
||||
- **lint**: exclude common fire-and-forget patterns from errcheck
|
||||
- **lint**: resolve errcheck and bodyclose warnings for golangci-lint v2
|
||||
## [0.3.5] - 2026-03-30
|
||||
|
||||
|
||||
### Changed
|
||||
|
||||
- migrate lint config to v2, remove daemon auto-upgrade, add trust badges
|
||||
## [0.3.3] - 2026-03-30
|
||||
|
||||
|
||||
### Fixed
|
||||
|
||||
- **ci**: remove go-client checkout steps
|
||||
## [0.3.2] - 2026-03-30
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **init**: add 60s countdown, skip key, and cancel detection to browser auth
|
||||
|
||||
### CI/CD
|
||||
|
||||
- **release**: add Docker Hub publish and VirusTotal scan jobs
|
||||
|
||||
### Documentation
|
||||
|
||||
- add beta notice, fix install URLs to get.torrentclaw.com
|
||||
|
||||
### Fixed
|
||||
|
||||
- **ci**: fix virustotal job condition syntax
|
||||
- **docker**: simplify Dockerfile for CI builds (no local go-client)
|
||||
- **release**: disable homebrew tap (needs PAT, not GITHUB_TOKEN)
|
||||
|
||||
### Other
|
||||
|
||||
- re-enable homebrew tap in goreleaser
|
||||
## [0.3.1] - 2026-03-30
|
||||
|
||||
|
||||
### Fixed
|
||||
|
||||
- **build**: unused variable in Windows process check
|
||||
- **release**: disable homebrew tap until repo is created
|
||||
|
||||
### Other
|
||||
|
||||
- rename module from torrentclaw-cli to unarr
|
||||
|
||||
### Build
|
||||
|
||||
- remove UPX compression (antivirus false positives, startup penalty)
|
||||
## [0.3.0] - 2026-03-29
|
||||
|
||||
|
||||
### Added
|
||||
|
||||
- **agent**: add WebSocket transport with HTTP fallback
|
||||
- **auth**: browser-based CLI authentication (like Claude Code)
|
||||
- **cli**: add login command and refactor shared helpers
|
||||
- **cli**: upgrade command, rich status, and version cache
|
||||
- **daemon**: add auto-scan, force start, and stall timeout default
|
||||
- **debrid**: add HTTPS downloader for debrid direct URLs
|
||||
- **init**: add 60s countdown, skip key, and cancel detection to browser auth
|
||||
- **stream**: report watch progress to API via HTTP Range tracking
|
||||
- **stream**: UPnP port forwarding for remote video playback
|
||||
- **usenet**: implement full NNTP download pipeline
|
||||
- add migrate command, media server detection, and debrid auto-config
|
||||
|
|
@ -558,42 +204,61 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|||
- improve daemon resilience, streaming, and usenet downloads
|
||||
- initial commit — unarr CLI
|
||||
|
||||
### CI/CD
|
||||
|
||||
- **deps**: bump docker/metadata-action from 5 to 6
|
||||
- **deps**: bump docker/setup-qemu-action from 3 to 4
|
||||
- **deps**: bump docker/login-action from 3 to 4
|
||||
- **deps**: bump docker/build-push-action from 6 to 7
|
||||
- **deps**: bump codecov/codecov-action from 5 to 6
|
||||
- **docker**: remove dockerhub-description sync step
|
||||
- **docker**: add Docker Hub description sync and DOCKERHUB.md
|
||||
- **release**: add Docker Hub publish and VirusTotal scan jobs
|
||||
|
||||
### Changed
|
||||
|
||||
- migrate lint config to v2, remove daemon auto-upgrade, add trust badges
|
||||
- extract BuildSyncItems to library package, remove duplication
|
||||
|
||||
### Documentation
|
||||
|
||||
- add beta notice, fix install URLs to get.torrentclaw.com
|
||||
- improve CLI help, shell completion, and README
|
||||
|
||||
### Fixed
|
||||
|
||||
- **build**: unused variable in Windows process check
|
||||
- **ci**: fix lint errors and pin CI to Go 1.25
|
||||
- **ci**: upgrade golangci-lint to v2.11.3 for Go 1.25 support
|
||||
- **ci**: remove go-client checkout steps
|
||||
- **ci**: fix virustotal job condition syntax
|
||||
- **docker**: upgrade alpine packages to patch CVE-2025-60876 and CVE-2026-27171
|
||||
- **docker**: simplify Dockerfile for CI builds (no local go-client)
|
||||
- **lint**: remove unused newStubCmd function
|
||||
- **lint**: use default:none to disable errcheck, fix all gofmt and exhaustive
|
||||
- **lint**: disable errcheck, tune gosec/exclusions for codebase state
|
||||
- **lint**: configure linters for codebase maturity, fix gofmt and ineffassign
|
||||
- **lint**: exclude common fire-and-forget patterns from errcheck
|
||||
- **lint**: resolve errcheck and bodyclose warnings for golangci-lint v2
|
||||
- **progress**: always report status transitions and poll for control signals
|
||||
- **release**: disable homebrew tap (needs PAT, not GITHUB_TOKEN)
|
||||
- **release**: disable homebrew tap until repo is created
|
||||
- **torrent**: expand tracker list, add DHT persistence and configurable timeouts
|
||||
- force-start tasks bypass HasCapacity check in dispatch loop
|
||||
- add panic recovery to auto-scan, cap DHT nodes at 200
|
||||
- harden usenet/debrid downloaders from critico review
|
||||
|
||||
### Other
|
||||
|
||||
- **cli**: remove moreseed stub command
|
||||
- **cli**: remove redundant stub commands (monitor, open, add, compare)
|
||||
- re-enable homebrew tap in goreleaser
|
||||
- rename module from torrentclaw-cli to unarr
|
||||
|
||||
### Build
|
||||
|
||||
- remove UPX compression (antivirus false positives, startup penalty)
|
||||
- add -s -w -trimpath to Makefile, add build-small target with UPX
|
||||
[0.9.19]: https://github.com/torrentclaw/unarr/compare/v0.9.18...v0.9.19
|
||||
[0.9.18]: https://github.com/torrentclaw/unarr/compare/v0.9.17...v0.9.18
|
||||
[0.9.17]: https://github.com/torrentclaw/unarr/compare/v0.9.15...v0.9.17
|
||||
[0.9.15]: https://github.com/torrentclaw/unarr/compare/v0.9.14...v0.9.15
|
||||
[0.9.14]: https://github.com/torrentclaw/unarr/compare/v0.9.13...v0.9.14
|
||||
[0.9.13]: https://github.com/torrentclaw/unarr/compare/v0.9.11...v0.9.13
|
||||
[0.9.11]: https://github.com/torrentclaw/unarr/compare/v0.9.8...v0.9.11
|
||||
[0.9.8]: https://github.com/torrentclaw/unarr/compare/v0.9.7...v0.9.8
|
||||
[0.9.7]: https://github.com/torrentclaw/unarr/compare/v0.9.6...v0.9.7
|
||||
[0.9.6]: https://github.com/torrentclaw/unarr/compare/v0.9.5...v0.9.6
|
||||
[0.9.5]: https://github.com/torrentclaw/unarr/compare/v0.9.4...v0.9.5
|
||||
[0.9.4]: https://github.com/torrentclaw/unarr/compare/v0.9.3...v0.9.4
|
||||
[0.9.3]: https://github.com/torrentclaw/unarr/compare/v0.9.2...v0.9.3
|
||||
[0.9.2]: https://github.com/torrentclaw/unarr/compare/v0.9.1...v0.9.2
|
||||
[0.9.1]: https://github.com/torrentclaw/unarr/compare/v0.9.0...v0.9.1
|
||||
[0.9.0]: https://github.com/torrentclaw/unarr/compare/v0.8.1...v0.9.0
|
||||
[0.8.1]: https://github.com/torrentclaw/unarr/compare/v0.8.0...v0.8.1
|
||||
[0.8.0]: https://github.com/torrentclaw/unarr/compare/v0.7.0...v0.8.0
|
||||
[0.7.0]: https://github.com/torrentclaw/unarr/compare/v0.6.8...v0.7.0
|
||||
[0.6.8]: https://github.com/torrentclaw/unarr/compare/v0.6.7...v0.6.8
|
||||
[0.6.7]: https://github.com/torrentclaw/unarr/compare/v0.6.6...v0.6.7
|
||||
|
|
@ -611,12 +276,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|||
[0.5.1]: https://github.com/torrentclaw/unarr/compare/v0.5.0...v0.5.1
|
||||
[0.5.0]: https://github.com/torrentclaw/unarr/compare/v0.4.1...v0.5.0
|
||||
[0.4.1]: https://github.com/torrentclaw/unarr/compare/v0.4.0...v0.4.1
|
||||
[0.4.0]: https://github.com/torrentclaw/unarr/compare/v0.3.7...v0.4.0
|
||||
[0.3.7]: https://github.com/torrentclaw/unarr/compare/v0.3.6...v0.3.7
|
||||
[0.3.6]: https://github.com/torrentclaw/unarr/compare/v0.3.5...v0.3.6
|
||||
[0.3.5]: https://github.com/torrentclaw/unarr/compare/v0.3.3...v0.3.5
|
||||
[0.3.3]: https://github.com/torrentclaw/unarr/compare/v0.3.2...v0.3.3
|
||||
[0.3.2]: https://github.com/torrentclaw/unarr/compare/v0.3.1...v0.3.2
|
||||
[0.3.1]: https://github.com/torrentclaw/unarr/compare/v0.3.0...v0.3.1
|
||||
[0.3.0]: https://github.com/torrentclaw/unarr/releases/tag/v0.3.0
|
||||
|
||||
|
|
|
|||
1
CNAME
1
CNAME
|
|
@ -1 +0,0 @@
|
|||
unarr.torrentclaw.com
|
||||
150
DOCKERHUB.md
150
DOCKERHUB.md
|
|
@ -1,21 +1,12 @@
|
|||
# unarr
|
||||
|
||||
**The single binary that replaces your whole *arr stack.** Built-in torrent,
|
||||
debrid, and usenet engines. Stream, transcode, and organize your library from
|
||||
one terminal — or run it as a headless daemon with a web dashboard, WireGuard
|
||||
split-tunnel, and Cloudflare Funnel remote access.
|
||||
Powerful terminal tool for torrent search and management. Search 30+ sources, inspect quality, discover popular content, find streaming providers, and manage downloads — all from your terminal.
|
||||
|
||||
**[Website & docs](https://torrentclaw.com/unarr)** · **[Install guide](https://torrentclaw.com/cli)** · **[Get an API key](https://torrentclaw.com)**
|
||||
**[GitHub](https://github.com/torrentclaw/unarr)** | **[Documentation](https://github.com/torrentclaw/unarr#readme)** | **[Releases](https://github.com/torrentclaw/unarr/releases)**
|
||||
|
||||
> Powered by [TorrentClaw](https://torrentclaw.com) — an aggregator that unifies
|
||||
> YTS, EZTV, Knaben, Torrentio, Bitmagnet and more, enriched with TMDB metadata
|
||||
> and a 0–100 quality score per release.
|
||||
## Quick Start
|
||||
|
||||
---
|
||||
|
||||
## Quick start
|
||||
|
||||
### 1. First-time setup (interactive wizard)
|
||||
### 1. Setup (interactive wizard)
|
||||
|
||||
```bash
|
||||
docker run -it --rm \
|
||||
|
|
@ -23,9 +14,6 @@ docker run -it --rm \
|
|||
torrentclaw/unarr setup
|
||||
```
|
||||
|
||||
The wizard asks for your TorrentClaw API key (free at
|
||||
[torrentclaw.com](https://torrentclaw.com)) and your download directory.
|
||||
|
||||
### 2. Run the daemon
|
||||
|
||||
```bash
|
||||
|
|
@ -38,10 +26,6 @@ docker run -d --name unarr \
|
|||
torrentclaw/unarr
|
||||
```
|
||||
|
||||
That's it — `unarr` now runs headless, watching for jobs and managing downloads.
|
||||
|
||||
---
|
||||
|
||||
## Docker Compose
|
||||
|
||||
```yaml
|
||||
|
|
@ -61,54 +45,45 @@ services:
|
|||
environment:
|
||||
- TZ=UTC
|
||||
# - UNARR_API_KEY=tc_your_key_here
|
||||
network_mode: host # recommended for full P2P performance
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 512M
|
||||
cpus: "2.0"
|
||||
network_mode: host
|
||||
|
||||
volumes:
|
||||
unarr-data:
|
||||
```
|
||||
|
||||
```bash
|
||||
docker compose run --rm unarr setup # one-time wizard
|
||||
docker compose up -d # start the daemon
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Volumes
|
||||
|
||||
| Path | Purpose |
|
||||
|--------------|--------------------------------------------------|
|
||||
| `/config` | Configuration file (`config.toml`) |
|
||||
| `/downloads` | Finished media downloads |
|
||||
| `/data` | Internal state: torrent metadata, cache |
|
||||
| Path | Purpose |
|
||||
|------|---------|
|
||||
| `/config` | Configuration file (`config.toml`) |
|
||||
| `/downloads` | Finished media downloads |
|
||||
| `/data` | Internal state: torrent metadata, cache |
|
||||
|
||||
## Environment variables
|
||||
## Environment Variables
|
||||
|
||||
| Variable | Description | Default |
|
||||
|------------------------|--------------------------------------|---------------------------|
|
||||
| `UNARR_API_KEY` | TorrentClaw API key | from config |
|
||||
| `UNARR_API_URL` | API endpoint | `https://torrentclaw.com` |
|
||||
| `UNARR_DOWNLOAD_DIR` | Download directory | `/downloads` |
|
||||
| `UNARR_CONFIG_DIR` | Config directory | `/config` |
|
||||
| `UNARR_COUNTRY` | Country code (ISO 3166) | `US` |
|
||||
| `TZ` | Timezone | `UTC` |
|
||||
|
||||
Any config value can be overridden by its matching `UNARR_*` environment variable.
|
||||
| Variable | Description | Default |
|
||||
|----------|-------------|---------|
|
||||
| `TZ` | Timezone | `UTC` |
|
||||
| `UNARR_API_KEY` | TorrentClaw API key | from config |
|
||||
| `UNARR_API_URL` | API endpoint | `https://torrentclaw.com` |
|
||||
| `UNARR_DOWNLOAD_DIR` | Download directory | `/downloads` |
|
||||
| `UNARR_CONFIG_DIR` | Config directory | `/config` |
|
||||
| `UNARR_COUNTRY` | Country code (ISO 3166) | `US` |
|
||||
|
||||
## Networking
|
||||
|
||||
**Host mode (recommended)** — full P2P performance, no port mapping:
|
||||
**Host mode** (recommended) gives full P2P performance with no port management:
|
||||
|
||||
```yaml
|
||||
network_mode: host
|
||||
```
|
||||
|
||||
**Bridge mode** — more isolated, but you must expose the BitTorrent ports:
|
||||
**Bridge mode** — more isolated, but requires explicit ports:
|
||||
|
||||
```yaml
|
||||
ports:
|
||||
|
|
@ -116,7 +91,7 @@ ports:
|
|||
- "6881-6889:6881-6889/udp"
|
||||
```
|
||||
|
||||
## Running commands
|
||||
## Running Commands
|
||||
|
||||
Use `docker exec` for one-off commands while the daemon is running:
|
||||
|
||||
|
|
@ -124,77 +99,32 @@ Use `docker exec` for one-off commands while the daemon is running:
|
|||
docker exec unarr unarr search "inception" --quality 1080p
|
||||
docker exec unarr unarr popular --limit 10
|
||||
docker exec unarr unarr status
|
||||
docker exec unarr unarr doctor # diagnose config / connectivity
|
||||
docker exec unarr unarr doctor
|
||||
```
|
||||
|
||||
---
|
||||
## Supported Architectures
|
||||
|
||||
| Architecture | Tag |
|
||||
|-------------|-----|
|
||||
| `linux/amd64` | `latest`, `0.3`, `0.3.5` |
|
||||
| `linux/arm64` | `latest`, `0.3`, `0.3.5` |
|
||||
|
||||
## Tags
|
||||
|
||||
| Tag | Description |
|
||||
|----------|--------------------------------------------------|
|
||||
| `latest` | Latest stable release |
|
||||
| `X.Y.Z` | Exact version (e.g. `0.9.0`) |
|
||||
| `X.Y` | Latest patch within a minor (e.g. `0.9`) |
|
||||
| Tag | Description |
|
||||
|-----|-------------|
|
||||
| `latest` | Latest stable release |
|
||||
| `X.Y.Z` | Specific version (e.g. `0.3.5`) |
|
||||
| `X.Y` | Latest patch for minor version (e.g. `0.3`) |
|
||||
|
||||
Pin a tag in production (`torrentclaw/unarr:0.9.0`) for reproducible deploys.
|
||||
## Image Details
|
||||
|
||||
## Supported architectures
|
||||
|
||||
Multi-arch image — Docker pulls the right one automatically:
|
||||
|
||||
- `linux/amd64`
|
||||
- `linux/arm64` (Apple Silicon, Raspberry Pi 4/5, ARM servers)
|
||||
|
||||
## Image details
|
||||
|
||||
- **Base:** Alpine 3.22 (minimal, regularly patched)
|
||||
- **User:** `unarr` (UID 1000, GID 1000) — runs as **non-root**
|
||||
- **Base image:** Alpine 3.22
|
||||
- **User:** `unarr` (UID 1000, GID 1000)
|
||||
- **Entrypoint:** `unarr start` (daemon mode)
|
||||
- **Read-only rootfs** — only mounted volumes are writable
|
||||
- **Bundled `ffmpeg` / `ffprobe`** for media inspection — nothing else to install
|
||||
- **Self-contained updates** — binaries are served from TorrentClaw's own
|
||||
infrastructure, no third-party registry dependency
|
||||
|
||||
---
|
||||
|
||||
## Other install methods
|
||||
|
||||
Not using Docker? Install the native binary instead:
|
||||
|
||||
```bash
|
||||
# Linux / macOS
|
||||
curl -fsSL https://torrentclaw.com/install.sh | sh
|
||||
|
||||
# Windows (PowerShell)
|
||||
irm https://torrentclaw.com/install.ps1 | iex
|
||||
|
||||
# Go toolchain
|
||||
go install github.com/torrentclaw/unarr/cmd/unarr@latest
|
||||
```
|
||||
|
||||
## Mirrors
|
||||
|
||||
The installer and release binaries are served from every TorrentClaw mirror, so
|
||||
you can install even if one domain is blocked in your region. Each mirror is
|
||||
self-contained (it serves its own binaries — no cross-domain dependency):
|
||||
|
||||
| Mirror | Install command |
|
||||
|--------|-----------------|
|
||||
| `torrentclaw.com` (primary) | `curl -fsSL https://torrentclaw.com/install.sh \| sh` |
|
||||
| `torrentclaw.to` | `curl -fsSL https://torrentclaw.to/install.sh \| sh` |
|
||||
| Tor (`.onion`) | `torsocks sh -c "$(curl http://torrentf3aifidcsaaanmnmuhv2s53r6hqsl3zkmfidiaxainkeqk5id.onion/install.sh)"` |
|
||||
|
||||
The Tor address routes everything (install script + binaries) through the hidden
|
||||
service, so no clearnet exit is needed.
|
||||
|
||||
## Links
|
||||
|
||||
- **Website & docs:** https://torrentclaw.com/unarr
|
||||
- **CLI install guide:** https://torrentclaw.com/cli
|
||||
- **API & account:** https://torrentclaw.com
|
||||
- **Mirror status:** https://torrentclaw.com/mirrors
|
||||
- **Read-only filesystem** — only mounted volumes are writable
|
||||
- **No root required** — runs as non-root by default
|
||||
|
||||
## License
|
||||
|
||||
MIT.
|
||||
MIT License — see [LICENSE](https://github.com/torrentclaw/unarr/blob/main/LICENSE) for details.
|
||||
|
|
|
|||
43
Dockerfile
43
Dockerfile
|
|
@ -1,3 +1,25 @@
|
|||
# ---- ffprobe static binary stage ----
|
||||
# Download a static ffprobe build from BtbN/FFmpeg-Builds (GitHub CDN, reliable).
|
||||
FROM alpine:3.22 AS ffprobe-dl
|
||||
|
||||
RUN apk add --no-cache curl xz
|
||||
|
||||
RUN ARCH=$(uname -m) && \
|
||||
case "$ARCH" in \
|
||||
x86_64) SLUG="linux64" ;; \
|
||||
aarch64) SLUG="linuxarm64" ;; \
|
||||
*) echo "Unsupported arch: $ARCH" && exit 1 ;; \
|
||||
esac && \
|
||||
curl -fsSL --retry 3 --retry-delay 5 \
|
||||
"https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-${SLUG}-gpl.tar.xz" \
|
||||
-o /tmp/ff.tar.xz && \
|
||||
mkdir /tmp/ffbuild && \
|
||||
tar xJ -f /tmp/ff.tar.xz --strip-components=1 -C /tmp/ffbuild/ && \
|
||||
mv /tmp/ffbuild/bin/ffprobe /usr/local/bin/ffprobe && \
|
||||
chmod +x /usr/local/bin/ffprobe && \
|
||||
rm -rf /tmp/ff.tar.xz /tmp/ffbuild && \
|
||||
ffprobe -version | head -1
|
||||
|
||||
# ---- Build stage ----
|
||||
FROM golang:1.25-alpine AS builder
|
||||
|
||||
|
|
@ -18,26 +40,8 @@ RUN CGO_ENABLED=0 go build -ldflags="-s -w -X github.com/torrentclaw/unarr/inter
|
|||
# ---- Runtime stage ----
|
||||
FROM alpine:3.22
|
||||
|
||||
# Use Alpine's native musl ffmpeg + ffprobe instead of the johnvansickle /
|
||||
# BtbN static glibc builds — those need a glibc shim on Alpine and the
|
||||
# vector-math symbols the GPL builds reference are not satisfiable by
|
||||
# gcompat. Alpine ships ffmpeg ~7.x which is fine for the HLS transcoding
|
||||
# pipeline (libx264 + libfdk-aac alternatives included).
|
||||
RUN apk upgrade --no-cache && \
|
||||
apk add --no-cache ca-certificates tzdata ffmpeg wget
|
||||
|
||||
# Bundle cloudflared so `unarr funnel on` (default: on, see config defaults)
|
||||
# Just Works on a headless container with no first-run network round-trip.
|
||||
# TARGETARCH is set automatically by Docker buildx during cross-builds.
|
||||
ARG TARGETARCH=amd64
|
||||
RUN case "$TARGETARCH" in \
|
||||
amd64) CF_ARCH=amd64 ;; \
|
||||
arm64) CF_ARCH=arm64 ;; \
|
||||
arm) CF_ARCH=armhf ;; \
|
||||
*) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 1 ;; \
|
||||
esac && \
|
||||
wget -qO /usr/local/bin/cloudflared "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-$CF_ARCH" && \
|
||||
chmod +x /usr/local/bin/cloudflared
|
||||
apk add --no-cache ca-certificates tzdata
|
||||
|
||||
# Non-root user (UID 1000 matches typical host user for volume permissions)
|
||||
RUN addgroup -g 1000 unarr && adduser -u 1000 -G unarr -D -h /home/unarr unarr
|
||||
|
|
@ -49,6 +53,7 @@ RUN mkdir -p /config /downloads /data && \
|
|||
USER unarr
|
||||
|
||||
COPY --from=builder /unarr /usr/local/bin/unarr
|
||||
COPY --from=ffprobe-dl /usr/local/bin/ffprobe /usr/local/bin/ffprobe
|
||||
|
||||
# Environment: point config/data to container paths
|
||||
ENV UNARR_CONFIG_DIR=/config
|
||||
|
|
|
|||
|
|
@ -1,170 +0,0 @@
|
|||
# Plan: Sincronización bidireccional de biblioteca (CLI ↔ Web)
|
||||
|
||||
## Context
|
||||
La biblioteca web solo muestra descargas completadas (download_task + debrid). El `unarr scan` escanea ficheros con ffprobe y los sube al servidor, pero solo soporta un path, no detecta borrados del disco, y no permite borrar ficheros desde la web. El usuario quiere una biblioteca unificada que refleje el estado real de su colección y se sincronice en ambas direcciones.
|
||||
|
||||
## Protocolo de sincronización
|
||||
|
||||
### Forward Sync (Disco → Web)
|
||||
1. CLI escanea todos los `ScanPaths` configurados
|
||||
2. Para cada path: descubre ficheros, compara con cache (skip ffprobe si no cambió), sube a `/library-sync`
|
||||
3. En `isLastBatch=true`: el servidor elimina items con ese `scanPath` que no estén en el batch (ficheros borrados del disco desaparecen de la web)
|
||||
|
||||
### Reverse Sync (Web → Disco)
|
||||
1. CLI llama a `GET /agent/library-deletions` — items que el usuario soft-deleted desde la web
|
||||
2. Si `AutoDelete=true` o `--yes`: borra ficheros del disco
|
||||
3. Si no: muestra lista y pide confirmación interactiva
|
||||
4. Llama a `POST /agent/library-deletions/confirm` con los IDs confirmados → hard-delete en DB
|
||||
|
||||
### Resolución de conflictos
|
||||
- Fichero en disco pero no en web → forward sync lo añade
|
||||
- Fichero en web pero no en disco → forward sync lo elimina (isLastBatch)
|
||||
- Soft-deleted en web, aún en disco → reverse sync lo borra del disco y confirma
|
||||
- Soft-deleted en web, ya borrado del disco → reverse sync confirma directamente
|
||||
- Race condition (user borra en web mientras CLI escanea) → forward sync skippea rows con `deleted_at IS NOT NULL`
|
||||
|
||||
---
|
||||
|
||||
## Fase 1: Multi-path + Forward Sync mejorado
|
||||
|
||||
### 1.1 CLI — Config multi-path
|
||||
**Archivo:** `torrentclaw-cli/internal/config/config.go`
|
||||
- Añadir `ScanPaths []string` a `LibraryConfig`
|
||||
- Migrar `ScanPath` → `ScanPaths[0]` en `Load()` si `ScanPaths` está vacío
|
||||
- Añadir `AutoDelete bool` (default false)
|
||||
|
||||
### 1.2 CLI — Cache v2
|
||||
**Archivo:** `torrentclaw-cli/internal/library/types.go`
|
||||
- Cambiar `LibraryCache` a version 2: `Paths map[string][]LibraryItem`
|
||||
- Migración v1→v2: `Path`+items → `Paths[Path]`
|
||||
|
||||
**Archivo:** `torrentclaw-cli/internal/library/cache.go`
|
||||
- `LoadCache` detecta versión y migra
|
||||
- `SaveCache` siempre guarda v2
|
||||
|
||||
### 1.3 CLI — Scan multi-path
|
||||
**Archivo:** `torrentclaw-cli/internal/cmd/scan.go`
|
||||
- `unarr scan` sin args → escanea todos los `ScanPaths`
|
||||
- `unarr scan /path/a /path/b` → escanea paths específicos y los recuerda en config
|
||||
- Loop: para cada path, scan + sync con su `scanPath`
|
||||
|
||||
### 1.4 CLI — Nuevo comando `unarr sync`
|
||||
**Archivo nuevo:** `torrentclaw-cli/internal/cmd/sync.go`
|
||||
- Forward sync: scan ligero (sin ffprobe para ficheros sin cambios) + upload
|
||||
- Sin reverse sync todavía (Fase 3)
|
||||
- Flags: `--dry-run`, `--paths`
|
||||
|
||||
### 1.5 Web — Columna `scan_path` en `library_item`
|
||||
**Archivo:** `torrentclaw-web/src/lib/db/schema.ts`
|
||||
- Añadir `scanPath: varchar(2048)` a tabla `libraryItem`
|
||||
- Generar migración con `pnpm db:generate`
|
||||
|
||||
**Archivo:** `torrentclaw-web/src/lib/services/library-upgrade.ts`
|
||||
- `syncLibraryItems()`: persistir `scanPath` en cada row al hacer upsert
|
||||
|
||||
### 1.6 CLI — Daemon multi-path
|
||||
**Archivo:** `torrentclaw-cli/internal/cmd/daemon.go`
|
||||
- `runAutoScan()` itera sobre todos los `ScanPaths`
|
||||
|
||||
---
|
||||
|
||||
## Fase 2: Reverse Sync (Web → Disco)
|
||||
|
||||
### 2.1 Web — Soft-delete
|
||||
**Archivo:** `torrentclaw-web/src/lib/db/schema.ts`
|
||||
- Añadir `deletedAt: timestamp` a tabla `libraryItem`
|
||||
- Generar migración
|
||||
|
||||
### 2.2 Web — Endpoints de borrado
|
||||
**Archivo nuevo:** `torrentclaw-web/src/app/api/internal/library/items/route.ts`
|
||||
- `DELETE` — session auth, recibe `{itemIds: number[]}`, hace soft-delete (`deletedAt = NOW()`)
|
||||
|
||||
**Archivo nuevo:** `torrentclaw-web/src/app/api/internal/agent/library-deletions/route.ts`
|
||||
- `GET` — agent auth, devuelve items con `deletedAt IS NOT NULL` para ese usuario
|
||||
- `POST` — agent auth, recibe `{confirmedIds: number[]}`, hard-delete los rows
|
||||
|
||||
### 2.3 Web — Heartbeat con pendingDeletions
|
||||
**Archivo:** endpoint de heartbeat del agente
|
||||
- Añadir `pendingDeletions: number` al response (count de items con `deletedAt IS NOT NULL`)
|
||||
|
||||
### 2.4 Web — Forward sync respeta soft-deletes
|
||||
**Archivo:** `torrentclaw-web/src/lib/services/library-upgrade.ts`
|
||||
- `syncLibraryItems()` en `isLastBatch`: la query de DELETE excluye rows con `deletedAt IS NOT NULL`
|
||||
|
||||
### 2.5 CLI — Agent client nuevos métodos
|
||||
**Archivo:** `torrentclaw-cli/internal/agent/client.go`
|
||||
- `GetLibraryDeletions(ctx) → []DeletionItem`
|
||||
- `ConfirmLibraryDeletions(ctx, ids []int) → error`
|
||||
|
||||
**Archivo:** `torrentclaw-cli/internal/agent/types.go`
|
||||
- `DeletionItem {ID int, FilePath string, DeletedAt string}`
|
||||
|
||||
### 2.6 CLI — Sync reverse
|
||||
**Archivo:** `torrentclaw-cli/internal/cmd/sync.go`
|
||||
- Después del forward sync: llama a `GetLibraryDeletions()`
|
||||
- Valida que cada fichero está dentro de un `ScanPaths` conocido (seguridad)
|
||||
- Si `AutoDelete` o `--yes`: borra y confirma
|
||||
- Si no: muestra lista interactiva, pide confirmación
|
||||
- Flag `--no-delete` para skip reverse sync
|
||||
- Si `BackupDir` configurado: mover a backup en vez de borrar
|
||||
|
||||
### 2.7 CLI — Daemon auto-delete
|
||||
**Archivo:** `torrentclaw-cli/internal/cmd/daemon.go`
|
||||
- Al final de `runAutoSync()`: si `AutoDelete=true`, procesa deletions automáticamente
|
||||
- Si no: log warning "N files pending deletion, run `unarr sync`"
|
||||
|
||||
---
|
||||
|
||||
## Fase 3: Web UI (brief)
|
||||
|
||||
- Botón "Eliminar" en items de biblioteca → llama `DELETE /library/items`
|
||||
- Badge "Pendiente de borrar" en items soft-deleted
|
||||
- Posibilidad de cancelar el borrado (clear `deletedAt`)
|
||||
- Vista unificada: scanned items + downloaded items en la misma vista
|
||||
|
||||
---
|
||||
|
||||
## Archivos clave
|
||||
|
||||
### CLI (Go)
|
||||
| Archivo | Cambio |
|
||||
|---------|--------|
|
||||
| `internal/config/config.go` | ScanPaths, AutoDelete, migración |
|
||||
| `internal/library/types.go` | Cache v2 con Paths map |
|
||||
| `internal/library/cache.go` | Load/Save v2, migración v1 |
|
||||
| `internal/library/sync.go` | BuildSyncItems (sin cambios) |
|
||||
| `internal/cmd/scan.go` | Multi-path loop |
|
||||
| `internal/cmd/sync.go` | **Nuevo** — comando sync bidireccional |
|
||||
| `internal/cmd/daemon.go` | runAutoSync multi-path + reverse |
|
||||
| `internal/agent/client.go` | GetLibraryDeletions, ConfirmLibraryDeletions |
|
||||
| `internal/agent/types.go` | DeletionItem type |
|
||||
|
||||
### Web (TypeScript)
|
||||
| Archivo | Cambio |
|
||||
|---------|--------|
|
||||
| `src/lib/db/schema.ts` | scanPath + deletedAt en library_item |
|
||||
| `src/lib/services/library-upgrade.ts` | persistir scanPath, respetar soft-deletes |
|
||||
| `src/app/api/internal/agent/library-deletions/route.ts` | **Nuevo** — GET + POST |
|
||||
| `src/app/api/internal/library/items/route.ts` | **Nuevo** — DELETE soft-delete |
|
||||
| Endpoint heartbeat del agente | pendingDeletions en response |
|
||||
|
||||
---
|
||||
|
||||
## Verificación
|
||||
|
||||
### Fase 1
|
||||
1. `go build ./cmd/unarr/ && go test ./...`
|
||||
2. Configurar 2 scan paths en config.toml, ejecutar `unarr scan` → ambos se escanean
|
||||
3. Borrar un fichero del disco, ejecutar `unarr scan` → desaparece de la web
|
||||
4. `pnpm build` en torrentclaw-web para verificar tipos
|
||||
|
||||
### Fase 2
|
||||
1. Desde la web: borrar un item de la biblioteca
|
||||
2. Ejecutar `unarr sync` → muestra el fichero pendiente de borrar, pedir confirmación
|
||||
3. Confirmar → fichero se borra del disco y desaparece de la web
|
||||
4. `unarr sync --dry-run` → muestra lo que haría sin hacer nada
|
||||
5. Con `auto_delete = true` en config: el daemon borra automáticamente
|
||||
|
||||
### Fase 3
|
||||
1. Verificar visualmente en Chrome DevTools la UI de borrado
|
||||
2. Verificar que el badge "pendiente" aparece y desaparece correctamente
|
||||
|
|
@ -1,131 +0,0 @@
|
|||
# Phase 2.2 — Per-task stream token (deferred)
|
||||
|
||||
Status: deferred. Requires coordinated change in the web app
|
||||
(`torrentclaw-web`) and the CLI daemon. Pulled out of the Phase 2
|
||||
security pass because the CLI-only fixes (UPnP opt-in, SSE caps,
|
||||
signed self-update) ship without web-side work; the stream-token
|
||||
work cannot.
|
||||
|
||||
## Problem
|
||||
|
||||
`/stream`, `/playlist.m3u` and `/hls/<sessionID>/...` on the daemon
|
||||
HTTP server have no authentication. Today, anyone who can reach the
|
||||
listener and guesses (or learns) the `taskID` (for `/stream`) or
|
||||
`sessionID` (for `/hls`) can fetch the active file.
|
||||
|
||||
Mitigations already in place after Phase 1+2:
|
||||
|
||||
- `sessionID` is restricted to a safe regex and is a server-issued
|
||||
UUID v4 (122-bit entropy, not enumerable in practice).
|
||||
- `/health` no longer leaks the active filename, taskID prefix or
|
||||
client IP to remote callers (loopback diagnostics preserved).
|
||||
- UPnP is opt-in, so by default the daemon is not exposed to the
|
||||
public internet.
|
||||
- The web client probes `/health` to pick LAN vs Tailscale.
|
||||
|
||||
Residual risk:
|
||||
|
||||
- On a shared LAN (open Wi-Fi, office network, dorm) any device can
|
||||
reach the listener and brute-force `?id=<taskID>` against
|
||||
`/stream`. taskIDs are also UUIDs, so this is high entropy, but
|
||||
the URL may leak through browser history, sharing, screen capture
|
||||
or a passive logger and there is no second factor.
|
||||
- A user who explicitly opts into UPnP exposes the same surface to
|
||||
the entire internet.
|
||||
|
||||
A per-task secret carried in the URL closes this without breaking
|
||||
the `<video src>` flow (the browser cannot attach `Authorization`
|
||||
headers to media elements, but it can append a query parameter).
|
||||
|
||||
## Design
|
||||
|
||||
Both ends agree on a per-task secret token. The web generates it
|
||||
when the user requests streaming; the daemon receives the
|
||||
`(taskID, token)` pair and validates the token on every `/stream`
|
||||
and `/hls/...` request.
|
||||
|
||||
### Web side (`torrentclaw-web`)
|
||||
|
||||
When the user clicks "Stream":
|
||||
|
||||
1. Generate `streamToken = crypto.randomBytes(32).toString("hex")`
|
||||
server-side (NOT browser, so it never lives in client storage
|
||||
longer than the page lifetime).
|
||||
2. Persist `(taskID, streamToken, expiresAt)` in `download_task`
|
||||
(new columns or a sibling table). Token expires e.g. 6 h after
|
||||
issue or on explicit revoke.
|
||||
3. Push the token to the daemon over the existing heartbeat / sync
|
||||
channel that already carries `streamRequested`. Add a
|
||||
`streamToken` field next to it. The daemon trusts that channel
|
||||
(it is authenticated agent ↔ origin).
|
||||
4. Include the token in the stream URLs the API returns to the
|
||||
browser:
|
||||
`http://<host>:<port>/stream?id=<taskID>&t=<streamToken>` and
|
||||
the `/hls/<sessionID>` URLs gain `?t=<streamToken>` too.
|
||||
|
||||
Files that will need to change:
|
||||
|
||||
- `src/lib/services/agent.ts` — extend the stream-request payload
|
||||
with `streamToken`.
|
||||
- `src/lib/db/schema.ts` — column / table for the token.
|
||||
- `src/lib/services/stream-resolve.ts` — append `&t=` to the URLs
|
||||
it builds.
|
||||
- `src/lib/stream-probe.ts` — keep probing `/health` (no token),
|
||||
then append `&t=` to the winning stream URL before returning.
|
||||
- `src/middleware.ts` — no CORS change required (browser still hits
|
||||
daemon directly).
|
||||
|
||||
### CLI side
|
||||
|
||||
- `internal/agent/types.go` / `internal/agent/sync.go` — accept and
|
||||
store `streamToken` next to `streamRequested`.
|
||||
- `internal/agent/daemon.go` — when the heartbeat reports a new
|
||||
active stream task, push the token into the stream server via a
|
||||
setter: `streamSrv.SetTaskToken(taskID, token)`.
|
||||
- `internal/engine/stream_server.go`:
|
||||
- New field `tokens map[string]string` guarded by mutex.
|
||||
- `SetTaskToken(taskID, token)` and `ClearTaskToken(taskID)`.
|
||||
- `handler` (`/stream`) extracts `?id=` and `?t=`, checks the
|
||||
token with `subtle.ConstantTimeCompare`; 404 on mismatch.
|
||||
- `hlsHandler` (`/hls/<sessionID>/...`) needs an HLS-session
|
||||
→ token mapping, since the path carries `sessionID` not
|
||||
`taskID`. Store the token on the `HLSSession` at start and
|
||||
validate per request.
|
||||
|
||||
### Backwards compatibility
|
||||
|
||||
- The daemon must accept token-less requests for one minor version
|
||||
so a newer daemon can still serve an older web (and vice-versa).
|
||||
Gate the check on a config flag (`require_stream_token`,
|
||||
default false in the first release, default true in the next).
|
||||
- The `<video src>` form supports query parameters, so the only
|
||||
user-visible change is the URL string.
|
||||
|
||||
## Open questions to resolve before implementing
|
||||
|
||||
1. Token TTL. 6 h gives plenty of room for a movie + pause +
|
||||
resume; longer means the post-leak window is wider.
|
||||
2. Where to store the token in `download_task` — same row, or a
|
||||
sibling `download_stream_token` table that we can rotate
|
||||
without writing to the task row.
|
||||
3. Should `/playlist.m3u` (VLC) embed the token directly, or use
|
||||
a one-shot redeem URL? VLC URL ends up in history.
|
||||
4. Token reuse across HLS reconnects — yes, scoped to the
|
||||
`HLSSession`, invalidated on `Close()`.
|
||||
5. Do we want a daemon flag `--require-stream-token` independent
|
||||
of config, for users to flip on quickly without editing TOML?
|
||||
|
||||
## Effort estimate
|
||||
|
||||
- CLI: ~3 h
|
||||
- Web: ~3 h
|
||||
- Migration + rollout (config flag flip): 1 release cycle of soak.
|
||||
|
||||
## Why not now
|
||||
|
||||
- Cross-repo coordination raises commit blast radius beyond what
|
||||
the Phase 2 security pass should carry.
|
||||
- Web work needs DB migration + UI surfaces (the "stream link
|
||||
expired" path).
|
||||
- Phase 2 hardenings ship value today without it; this is the
|
||||
defense-in-depth layer on top.
|
||||
15
Makefile
15
Makefile
|
|
@ -1,4 +1,4 @@
|
|||
.PHONY: all build test lint coverage clean fmt vet check install-hooks changelog release release-patch release-minor release-major release-dry ship ship-dry ship-push
|
||||
.PHONY: all build test lint coverage clean fmt vet check install-hooks changelog release release-patch release-minor release-major release-dry
|
||||
|
||||
BINARY = unarr
|
||||
SENTRY_DSN ?=
|
||||
|
|
@ -71,19 +71,6 @@ release-dry:
|
|||
@test -n "$(V)" || { echo "Usage: make release-dry V=patch|minor|major|0.5.0"; exit 1; }
|
||||
@./scripts/release.sh --dry-run $(V)
|
||||
|
||||
## Ship a release end-to-end (goreleaser + Hetzner + Docker Hub). Standalone backup for GH Actions.
|
||||
## Reads version from internal/cmd/version.go unless V= is provided.
|
||||
ship:
|
||||
@./scripts/ship.sh $(V)
|
||||
|
||||
## Ship + git push tag to GH afterwards
|
||||
ship-push:
|
||||
@./scripts/ship.sh --push $(V)
|
||||
|
||||
## Preview ship steps without executing
|
||||
ship-dry:
|
||||
@./scripts/ship.sh --dry-run $(V)
|
||||
|
||||
## Remove generated files
|
||||
clean:
|
||||
rm -f $(BINARY) coverage.out coverage.html
|
||||
|
|
|
|||
243
README.md
243
README.md
|
|
@ -11,9 +11,9 @@
|
|||
[](LICENSE)
|
||||
[](go.mod)
|
||||
|
||||
The single-binary terminal client for torrent, debrid, and usenet downloads. **Free and open source.**
|
||||
Powerful terminal tool for torrent search and management. **Free and open source.**
|
||||
|
||||
Built-in torrent engine, debrid (Real-Debrid / AllDebrid), and NZB support. Stream to mpv/vlc, transcode on the fly with hardware acceleration, and manage your library — one binary or a headless daemon with WireGuard split-tunnel and Cloudflare Funnel remote access.
|
||||
Search 30+ torrent sources, inspect torrent quality, discover popular content, find streaming providers, and manage your media collection — all from your terminal.
|
||||
|
||||
<!-- GIF demo placeholder -->
|
||||
<!--  -->
|
||||
|
|
@ -171,9 +171,6 @@ unarr start
|
|||
| `unarr status` | Show daemon status and active downloads |
|
||||
| `unarr daemon install` | Install as system service (systemd/launchd) |
|
||||
| `unarr daemon uninstall` | Remove the system service |
|
||||
| `unarr vpn status` | Show managed-VPN config and live tunnel state |
|
||||
| `unarr vpn enable` | Turn the managed VPN on |
|
||||
| `unarr vpn disable` | Turn the managed VPN off |
|
||||
|
||||
### System & Diagnostics
|
||||
|
||||
|
|
@ -283,53 +280,6 @@ The daemon connects via WebSocket for instant task delivery, with automatic HTTP
|
|||
- Linux: `~/.config/systemd/user/unarr.service` (systemd)
|
||||
- macOS: `~/Library/LaunchAgents/com.torrentclaw.unarr.plist` (launchd)
|
||||
|
||||
## VPN
|
||||
|
||||
unarr can route your **downloads** through a managed WireGuard VPN, so peers and
|
||||
trackers see the VPN server's IP instead of yours. It runs entirely in userspace
|
||||
(wireguard-go + a gVisor netstack) — **no root, no `wg-quick`, no changes to your
|
||||
OS routing table**.
|
||||
|
||||
Requires a **PRO+ plan with the VPN add-on**. Set it up at
|
||||
[torrentclaw.com/vpn](https://torrentclaw.com/vpn).
|
||||
|
||||
```bash
|
||||
# Turn it on (writes [downloads.vpn] enabled = true to your config)
|
||||
unarr vpn enable
|
||||
|
||||
# Restart the daemon so it brings the tunnel up at startup
|
||||
unarr daemon restart # or: unarr start (if not installed as a service)
|
||||
|
||||
# Check it's working — shows the exit server when the tunnel is up
|
||||
unarr vpn status
|
||||
|
||||
# Verify your account is provisioned (queries the API)
|
||||
unarr vpn status --check
|
||||
|
||||
# Turn it off again
|
||||
unarr vpn disable
|
||||
```
|
||||
|
||||
**Split-tunnel — read this:** only the torrent client's traffic goes through the
|
||||
VPN. Your browser, `curl`, and every other app keep using your **real IP** — that
|
||||
is by design. To check the VPN is working, look at `unarr vpn status` (or the
|
||||
peer/announce IP), **not** your browser's "what's my IP". To protect your other
|
||||
devices (phone, laptop), use the **OpenVPN credentials** from your profile — those
|
||||
support ~10 concurrent devices and do **not** share the agent's WireGuard slot.
|
||||
|
||||
**When does it fetch the config?** Once, at daemon startup. There's no periodic
|
||||
refresh — after changing your exit server in the web panel or re-provisioning,
|
||||
restart the daemon to pick it up. If the fetch fails the daemon logs a `[vpn]`
|
||||
line and downloads in the clear (never refuses to run).
|
||||
|
||||
**Self-hosted / personal VPN:** instead of the managed config, point unarr at a
|
||||
local WireGuard `.conf`:
|
||||
|
||||
```toml
|
||||
[downloads.vpn]
|
||||
config_file = "/path/to/wg.conf" # takes precedence over `enabled`
|
||||
```
|
||||
|
||||
## Diagnostics
|
||||
|
||||
```bash
|
||||
|
|
@ -343,58 +293,6 @@ unarr self-update --force # reinstall even if up to date
|
|||
|
||||
`unarr doctor` checks: config file, API key, server connectivity (with latency), agent registration, download directory, disk space, and version.
|
||||
|
||||
### Updating unarr
|
||||
|
||||
unarr supports three update paths. Pick whichever fits your workflow.
|
||||
|
||||
**1. Manual self-update (always available).**
|
||||
|
||||
```bash
|
||||
unarr self-update # interactive update to latest
|
||||
unarr self-update --force # reinstall same version
|
||||
unarr self-update --allow-unsigned # accept releases without checksum signature
|
||||
```
|
||||
|
||||
The CLI downloads the new release archive over HTTPS (from
|
||||
`torrentclaw.com/releases/download/v<ver>/`), verifies SHA-256, swaps the
|
||||
binary in place (`.backup` kept next to it), and restarts the systemd
|
||||
user unit if the daemon is running.
|
||||
|
||||
**2. Auto-apply on server signal (default, since 0.9.6).**
|
||||
|
||||
When you press **"Force update now"** on the web (Settings → Agent → Force
|
||||
update), the server sets a flag your daemon polls every sync (~3 s). On
|
||||
the next sync the daemon downloads the new binary, replaces itself, and
|
||||
exits — `systemd Restart=always` respawns on the new version. No SSH, no
|
||||
terminal access required. Works headless on NAS / Docker.
|
||||
|
||||
The button shows an amber warning if your agent is below 0.9.6 (older
|
||||
daemons see the signal but only log "run unarr update" — the operator
|
||||
must run the command manually that one time).
|
||||
|
||||
**Opt out of auto-apply.** Some users prefer reviewing CHANGELOG before
|
||||
applying. Disable in `config.toml`:
|
||||
|
||||
```toml
|
||||
[daemon]
|
||||
auto_upgrade = false
|
||||
```
|
||||
|
||||
With `auto_upgrade = false`, pressing the web button still flags your
|
||||
agent (so the daemon logs the new version on next sync), but the daemon
|
||||
will not download / replace anything — you run `unarr self-update` when
|
||||
you're ready.
|
||||
|
||||
**3. Docker auto-restart with a new tag.**
|
||||
|
||||
```bash
|
||||
docker pull torrentclaw/unarr:latest
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
Tags published: `latest`, `0.9`, `0.9.7`, ... — pin to a minor (`0.9`)
|
||||
for opt-in patch updates without surprises.
|
||||
|
||||
## Clean
|
||||
|
||||
Remove temporary files, logs, resume data, and other artifacts generated by unarr. Shows what will be removed and asks for confirmation before deleting.
|
||||
|
|
@ -476,7 +374,6 @@ tv_shows_dir = "~/Media/TV Shows"
|
|||
[daemon]
|
||||
poll_interval = "30s"
|
||||
heartbeat_interval = "30s"
|
||||
auto_upgrade = true # apply server-flagged upgrades in-place (since 0.9.6)
|
||||
|
||||
[notifications]
|
||||
enabled = true
|
||||
|
|
@ -485,142 +382,6 @@ enabled = true
|
|||
country = "US"
|
||||
```
|
||||
|
||||
### Streaming reference
|
||||
|
||||
The in-browser player on torrentclaw.com streams from the daemon over HLS
|
||||
(HTTP fragments + ffmpeg transcode for codecs the browser can't decode
|
||||
natively). Enabled by default — a fresh install "just works" without editing
|
||||
the TOML.
|
||||
|
||||
```toml
|
||||
[downloads.transcode]
|
||||
enabled = true # master switch
|
||||
hw_accel = "auto" # auto | none | nvenc | qsv | vaapi | videotoolbox
|
||||
preset = "veryfast" # libx264 preset
|
||||
video_bitrate = "" # e.g. "5M" caps -b:v; empty = engine fallback (5M)
|
||||
audio_bitrate = "192k" # e.g. "128k", "192k", "256k"
|
||||
max_height = 0 # 0 = no cap; e.g. 720 forces 720p max
|
||||
max_concurrent = 2 # max simultaneous ffmpeg processes
|
||||
```
|
||||
|
||||
#### `[downloads.transcode]`
|
||||
|
||||
| Key | Type | Default | Notes |
|
||||
|-----|------|---------|-------|
|
||||
| `enabled` | bool | `true` | Real-time HLS transcoding when source codec is browser-incompatible (HEVC, AV1, AC3, DTS). Requires `ffmpeg` + `ffprobe` on PATH. |
|
||||
| `hw_accel` | string | `"auto"` | Hardware accel: `"auto"`, `"none"`, `"nvenc"` (NVIDIA), `"qsv"` (Intel), `"vaapi"` (Linux), `"videotoolbox"` (macOS). |
|
||||
| `preset` | string | `"veryfast"` | libx264 preset. Slower preset = smaller files but higher CPU. Options: `ultrafast`, `superfast`, `veryfast`, `faster`, `fast`, `medium`, `slow`, `slower`, `veryslow`. |
|
||||
| `video_bitrate` | string | `""` | E.g. `"5M"` caps `-b:v`. Empty falls back to the engine default (`5M`). |
|
||||
| `audio_bitrate` | string | `"192k"` | E.g. `"128k"`, `"256k"`. |
|
||||
| `max_height` | int | `0` | `0` = no cap. E.g. `720` forces 720p max — useful on weak GPUs. |
|
||||
| `max_concurrent` | int | `2` | Max simultaneous ffmpeg processes. Increase if hosting multiple users on a beefy box. |
|
||||
|
||||
If `transcode.enabled = true` but `ffmpeg` / `ffprobe` aren't on PATH, the
|
||||
daemon logs a warning at startup and HLS sessions are rejected at runtime
|
||||
with a clear error — install ffmpeg or set `enabled = false`.
|
||||
|
||||
#### `[downloads.hls_cache]` — persistent HLS segment cache
|
||||
|
||||
```toml
|
||||
[downloads.hls_cache]
|
||||
enabled = true # on by default
|
||||
size_gb = 5 # disk budget; LRU eviction once exceeded
|
||||
dir = "" # custom path; empty = ~/.cache/unarr/hls-cache
|
||||
```
|
||||
|
||||
| Key | Type | Default | Notes |
|
||||
|-----|------|---------|-------|
|
||||
| `enabled` | bool | `true` | Persists finished HLS encodes per `(source, quality, audio_index)`. A second play of the same file at the same quality reuses the segments — no ffmpeg, near-zero CPU, instant playback. Set to `false` to delete segments on session close (original behavior). |
|
||||
| `size_gb` | int | `5` | Cache budget in gigabytes. When exceeded the LRU sweeper evicts the least-recently-used cached encodes hourly. Minimum 1 GB (smaller values are clamped up). |
|
||||
| `dir` | string | `""` | Custom storage path. Empty defaults to `~/.cache/unarr/hls-cache` (Linux/macOS) or the user cache dir (Windows). |
|
||||
|
||||
**What it does.** First play encodes normally (ffmpeg writes segments).
|
||||
On session close, if every segment is on disk and ffmpeg exited cleanly,
|
||||
the directory is sealed with a `.complete` marker and kept. Next time the
|
||||
same source + quality combo is requested, the daemon serves segments
|
||||
straight from disk — no transcode, no warm-up, no CPU cost.
|
||||
|
||||
**Why per (source, quality, audio).** Renaming the file or switching
|
||||
quality invalidates the entry: the segments are tied to the exact source
|
||||
bytes and the exact ffmpeg parameters. Re-encoding generates a new key.
|
||||
|
||||
**Eviction.** A background goroutine wakes every hour. If total cache size
|
||||
exceeds `size_gb`, it deletes the oldest entries (by mtime) until under
|
||||
budget. Active sessions are pinned — they never get evicted mid-play.
|
||||
|
||||
**Disable.** Either edit the TOML to set `enabled = false`, or remove the
|
||||
cache directory manually (it'll be recreated as needed). Disabling does
|
||||
not delete existing cached segments — drop `dir` (or `~/.cache/unarr/hls-cache`)
|
||||
to reclaim the space.
|
||||
|
||||
#### `[downloads.vpn]`
|
||||
|
||||
| Key | Type | Default | Notes |
|
||||
|-----|------|---------|-------|
|
||||
| `enabled` | bool | `false` | Managed VPN: at startup the daemon fetches a WireGuard config from your account and split-tunnels torrent traffic through it. Needs a PRO+ plan with the VPN add-on. Toggle with `unarr vpn enable` / `disable`. |
|
||||
| `config_file` | string | `""` | Self-hosted / personal VPN: path to a local WireGuard `.conf`. **Takes precedence over `enabled`** — when set, the daemon uses this file and never calls the API. |
|
||||
|
||||
See the [VPN](#vpn) section above for how it works (split-tunnel, no root) and
|
||||
how to protect your other devices.
|
||||
|
||||
#### `[downloads.funnel]` — public HTTPS hostname for the daemon (CloudFlare Quick Tunnel)
|
||||
|
||||
```toml
|
||||
[downloads.funnel]
|
||||
enabled = false # off by default
|
||||
```
|
||||
|
||||
| Key | Type | Default | Notes |
|
||||
|-----|------|---------|-------|
|
||||
| `enabled` | bool | `false` | Spawns `cloudflared tunnel --url http://localhost:<stream_port>` as a child process at daemon startup. Toggle with `unarr funnel on` / `off`. Requires `cloudflared` on PATH. |
|
||||
|
||||
**What it does.** Without a tunnel, the daemon is reachable on `localhost`,
|
||||
your LAN, and (if installed) Tailscale. That covers the same-machine and
|
||||
Tailscale-connected cases, but the **browser-based player on torrentclaw.com
|
||||
fails on any other network** because HTTPS pages can't fetch HTTP resources
|
||||
("mixed content"). Enabling the funnel gives the daemon a public
|
||||
`https://<random>.trycloudflare.com` hostname so the web player picks it up
|
||||
and playback works from anywhere — phone on cellular, friend's laptop on a
|
||||
foreign Wi-Fi, anywhere. The Stremio addon already works cross-network
|
||||
(native mpv/VLC players ignore CORS), so this is strictly a web-player fix.
|
||||
|
||||
**Privacy posture.** Bytes pass through CloudFlare's edge — TorrentClaw never
|
||||
relays content (we don't see your traffic), CloudFlare does. Quick Tunnels
|
||||
are **anonymous** (no CF account required); the registration is unauthenticated
|
||||
and the hostname is a random label, but CF logs request metadata like any CDN
|
||||
would. If you want zero third-party byte access, use Tailscale instead.
|
||||
|
||||
**Limitations (free Quick Tunnels).**
|
||||
| Aspect | Limit |
|
||||
|--------|-------|
|
||||
| Session lifetime | ~6 hours, then the hostname rotates. cloudflared re-registers automatically; the web picks up the new URL on the next sync. In-flight HLS sessions break across the rotation (browser retries). |
|
||||
| Bandwidth | No documented hard cap, but CF reserves the right to throttle. 1080p HLS (~6 Mbps) is fine; 4K HEVC at 25 Mbps may hit throttling. |
|
||||
| Latency | +20–80 ms vs direct LAN/Tailscale (extra hop browser → CF edge → tunnel). HLS player buffer absorbs it. |
|
||||
| Concurrency | One tunnel serves N viewers. CF rate-limits ~200 req/s, plenty for HLS segments. |
|
||||
| TOS | CloudFlare flags Quick Tunnels as "not for production traffic". They can decommission an abusive tunnel without notice. |
|
||||
|
||||
For heavy / high-throughput / persistent-URL use cases, switch to a CloudFlare
|
||||
Named Tunnel (free, needs a CF account) or run your own reverse proxy — both
|
||||
out of scope for the bundled command.
|
||||
|
||||
**Disable.** `unarr funnel off` flips `enabled` to `false` in the TOML and
|
||||
prompts you to restart the daemon. You can also edit `config.toml` directly:
|
||||
|
||||
```toml
|
||||
[downloads.funnel]
|
||||
enabled = false
|
||||
```
|
||||
|
||||
**Install cloudflared.**
|
||||
- Linux: `apt install cloudflared` (after adding CF's apt repo) — see
|
||||
<https://pkg.cloudflare.com>. Or pull the static binary from
|
||||
<https://github.com/cloudflare/cloudflared/releases>.
|
||||
- macOS: `brew install cloudflared`.
|
||||
- Windows: `winget install --id Cloudflare.cloudflared`.
|
||||
|
||||
If `cloudflared` is not on PATH the daemon logs a warning at startup and
|
||||
falls back to LAN/Tailscale-only reachability.
|
||||
|
||||
### Environment variables
|
||||
|
||||
Environment variables override config file values:
|
||||
|
|
|
|||
44
SECURITY.md
44
SECURITY.md
|
|
@ -59,50 +59,6 @@ This project follows these security practices:
|
|||
- **Non-root Docker** — Container runs as unprivileged user (UID 1000)
|
||||
- **Dependency scanning** — Automated via Dependabot
|
||||
|
||||
## Container Image Vulnerability Scanning
|
||||
|
||||
The Docker image (`torrentclaw/unarr`) is scanned by Docker Scout on Docker Hub and
|
||||
by a CVE gate in CI (see `.github/workflows/`). Two things matter when reading the
|
||||
Docker Hub vulnerability count:
|
||||
|
||||
- **Scanner database differs.** Docker Hub (Scout) matches `package@version` against
|
||||
NVD/GHSA. Trivy/Alpine `secdb` only lists CVEs Alpine has acknowledged and patched.
|
||||
A high Scout count with a clean Trivy report is expected, not a contradiction.
|
||||
- **The bulk comes from the bundled `ffmpeg` codec stack.** Alpine's `ffmpeg`
|
||||
package pulls ~40 codec/parser libraries (`x264`, `x265`, `libvpx`, `aom`,
|
||||
`dav1d`, `libtheora`, `libvorbis`, `libwebp`, `libbluray`, `libopenmpt`, …).
|
||||
Each carries a long NVD history that Alpine does not backport. ffmpeg is a
|
||||
**functional dependency** — the HLS transcode pipeline shells out to
|
||||
`ffmpeg`/`ffprobe` to decode untrusted media and re-encode to H.264 + AAC.
|
||||
|
||||
### Accepted risk and policy
|
||||
|
||||
- **Fixable** CRITICAL/HIGH findings **block** a release (CI CVE gate, `only-fixed`).
|
||||
- **Unfixed-upstream** codec CVEs are tracked but **accepted**: there is no patched
|
||||
Alpine package to move to, and dropping codecs would break playback of common
|
||||
formats. They are mitigated by the hardening below rather than eliminated.
|
||||
- Images are **rebuilt and re-pushed weekly** (scheduled workflow) so any newly
|
||||
*fixed* base/ffmpeg/Go patch lands between tagged releases.
|
||||
|
||||
### Mitigations (run the container hardened)
|
||||
|
||||
Crafted media (torrents are untrusted input) is the realistic attack vector against
|
||||
ffmpeg's parsers. The shipped `docker-compose.yml` already applies:
|
||||
|
||||
- **Non-root** user (UID 1000), **read-only** root filesystem, writable `tmpfs` only.
|
||||
- **Resource limits** (memory/CPU) to bound a runaway decode.
|
||||
|
||||
Recommended additions for exposed deployments:
|
||||
|
||||
```yaml
|
||||
cap_drop: ["ALL"]
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
```
|
||||
|
||||
If you do not need HLS transcoding, you can run with transcoding disabled to
|
||||
avoid feeding untrusted media to ffmpeg at all.
|
||||
|
||||
## Disclosure Policy
|
||||
|
||||
We follow coordinated disclosure. We will credit reporters in the release notes unless they prefer to remain anonymous.
|
||||
|
|
|
|||
|
|
@ -1,65 +1,48 @@
|
|||
# unarr — TorrentClaw agent
|
||||
#
|
||||
# Quick start:
|
||||
# 1. Copy this file to any directory.
|
||||
# 2. Set UNARR_API_KEY to your key (Settings → API Keys on torrentclaw.com).
|
||||
# 3. Set DOWNLOAD_DIR to your media folder (absolute path).
|
||||
# 4. Run: docker compose up -d
|
||||
#
|
||||
# Get your API key: https://torrentclaw.com/settings/api-keys
|
||||
# Full docs: https://torrentclaw.com/unarr
|
||||
|
||||
services:
|
||||
unarr:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: unarr/Dockerfile
|
||||
image: torrentclaw/unarr:latest
|
||||
pull_policy: always # always pull on `up` so you stay on the latest release
|
||||
container_name: unarr
|
||||
restart: unless-stopped
|
||||
user: "1000:1000"
|
||||
|
||||
# host network is required for:
|
||||
# - streaming to reach your TV / mobile / other LAN devices (port 11818)
|
||||
# - HLS transcode server (port 11819)
|
||||
# - Tailscale connectivity (if you use it)
|
||||
# On macOS / Windows Docker Desktop, replace with `ports` mapping (see below).
|
||||
network_mode: host
|
||||
|
||||
environment:
|
||||
# --- Required ---
|
||||
- UNARR_API_KEY=${UNARR_API_KEY:?Set UNARR_API_KEY in .env or export it}
|
||||
|
||||
# --- Optional ---
|
||||
# Server URL — change only if you run a self-hosted TorrentClaw instance
|
||||
- UNARR_API_URL=${UNARR_API_URL:-https://torrentclaw.com}
|
||||
- TZ=${TZ:-UTC}
|
||||
# Read-only root filesystem — only volumes are writable
|
||||
read_only: true
|
||||
tmpfs:
|
||||
- /tmp:size=64m,mode=1777
|
||||
|
||||
volumes:
|
||||
# Config: config.toml is auto-created here on first run.
|
||||
# After first start, edit this file to set organize paths, quality, etc.
|
||||
- ${CONFIG_DIR:-./config}:/config
|
||||
|
||||
# Downloads: where finished media is saved.
|
||||
# Set DOWNLOAD_DIR in .env or export it before running.
|
||||
- ${DOWNLOAD_DIR:?Set DOWNLOAD_DIR to your media folder}:/downloads
|
||||
|
||||
# Data: piece-completion DB, HLS cache, DHT nodes.
|
||||
# Named volume keeps this off your media drive (avoids NFS locking issues).
|
||||
# Config: your config.toml lives here
|
||||
- ./config:/config
|
||||
# Downloads: finished media goes here
|
||||
- ~/Media:/downloads
|
||||
# Data: torrent metadata, piece DB, cache
|
||||
- unarr-data:/data
|
||||
|
||||
# Optional: limit CPU/RAM for transcoding on shared hosts
|
||||
# deploy:
|
||||
# resources:
|
||||
# limits:
|
||||
# memory: 2G
|
||||
# cpus: "4.0"
|
||||
environment:
|
||||
- TZ=${TZ:-UTC}
|
||||
# Optional overrides (uncomment to use):
|
||||
# - UNARR_API_KEY=tc_your_key_here
|
||||
# - UNARR_API_URL=https://torrentclaw.com
|
||||
|
||||
# --- macOS / Windows alternative (replace network_mode: host above) ---
|
||||
# network_mode: bridge
|
||||
# Resource limits — adjust to your needs
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 512M
|
||||
cpus: "2.0"
|
||||
|
||||
# Torrent P2P needs host network or explicit port range
|
||||
# Option A: host network (simplest, full P2P performance)
|
||||
network_mode: host
|
||||
|
||||
# Option B: bridge network with port mapping (more isolated)
|
||||
# Uncomment below and comment out network_mode above:
|
||||
# ports:
|
||||
# - "11818:11818" # direct stream (VLC, download)
|
||||
# - "11819:11819" # HLS transcode (web player)
|
||||
# - "42069:42069" # BitTorrent incoming peers
|
||||
# Note: streaming will only reach devices on the same machine.
|
||||
# For LAN / Tailscale playback use a Linux host with network_mode: host.
|
||||
# - "6881-6889:6881-6889/tcp"
|
||||
# - "6881-6889:6881-6889/udp"
|
||||
|
||||
volumes:
|
||||
unarr-data:
|
||||
|
|
|
|||
15
go.mod
15
go.mod
|
|
@ -9,15 +9,14 @@ require (
|
|||
github.com/anacrolix/torrent v1.61.0
|
||||
github.com/charmbracelet/huh v1.0.0
|
||||
github.com/fatih/color v1.19.0
|
||||
github.com/getsentry/sentry-go v0.44.1
|
||||
github.com/getsentry/sentry-go v0.46.2
|
||||
github.com/google/uuid v1.6.0
|
||||
github.com/huin/goupnp v1.3.0
|
||||
github.com/olekukonko/tablewriter v1.1.4
|
||||
github.com/spf13/cobra v1.10.2
|
||||
github.com/torrentclaw/go-client v0.2.0
|
||||
golang.org/x/term v0.43.0
|
||||
golang.org/x/term v0.41.0
|
||||
golang.org/x/time v0.15.0
|
||||
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
|
||||
)
|
||||
|
||||
require (
|
||||
|
|
@ -122,14 +121,12 @@ require (
|
|||
go.opentelemetry.io/otel v1.42.0 // indirect
|
||||
go.opentelemetry.io/otel/metric v1.42.0 // indirect
|
||||
go.opentelemetry.io/otel/trace v1.42.0 // indirect
|
||||
golang.org/x/crypto v0.51.0 // indirect
|
||||
golang.org/x/crypto v0.49.0 // indirect
|
||||
golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
|
||||
golang.org/x/net v0.54.0 // indirect
|
||||
golang.org/x/net v0.52.0 // indirect
|
||||
golang.org/x/sync v0.20.0 // indirect
|
||||
golang.org/x/sys v0.44.0 // indirect
|
||||
golang.org/x/text v0.37.0 // indirect
|
||||
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
|
||||
gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c // indirect
|
||||
golang.org/x/sys v0.42.0 // indirect
|
||||
golang.org/x/text v0.35.0 // indirect
|
||||
lukechampine.com/blake3 v1.4.1 // indirect
|
||||
modernc.org/libc v1.70.0 // indirect
|
||||
modernc.org/mathutil v1.7.1 // indirect
|
||||
|
|
|
|||
38
go.sum
38
go.sum
|
|
@ -176,8 +176,8 @@ github.com/frankban/quicktest v1.14.4/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
|
|||
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
|
||||
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
|
||||
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
|
||||
github.com/getsentry/sentry-go v0.44.1 h1:/cPtrA5qB7uMRrhgSn9TYtcEF36auGP3Y6+ThvD/yaI=
|
||||
github.com/getsentry/sentry-go v0.44.1/go.mod h1:XDotiNZbgf5U8bPDUAfvcFmOnMQQceESxyKaObSssW0=
|
||||
github.com/getsentry/sentry-go v0.46.2 h1:1jhYwrKGa3sIpo/y5iDNXS5wDoT7I1KNzMHrnK6ojns=
|
||||
github.com/getsentry/sentry-go v0.46.2/go.mod h1:evVbw2qotNUdYG8KxXbAdjOQWWvWIwKxpjdZZIvcIPw=
|
||||
github.com/glycerine/go-unsnap-stream v0.0.0-20180323001048-9f0cb55181dd/go.mod h1:/20jfyN9Y5QPEAprSgKAUr+glWDY39ZiUEAYOEv5dsE=
|
||||
github.com/glycerine/go-unsnap-stream v0.0.0-20181221182339-f9677308dec2/go.mod h1:/20jfyN9Y5QPEAprSgKAUr+glWDY39ZiUEAYOEv5dsE=
|
||||
github.com/glycerine/go-unsnap-stream v0.0.0-20190901134440-81cf024a9e0a/go.mod h1:/20jfyN9Y5QPEAprSgKAUr+glWDY39ZiUEAYOEv5dsE=
|
||||
|
|
@ -473,8 +473,8 @@ golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnf
|
|||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
||||
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||
golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
|
||||
golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
|
||||
golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
|
||||
golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
|
||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20220428152302-39d4317da171/go.mod h1:lgLbSvA5ygNOMpwM/9anMpWVlVJ7Z+cHWq/eFuinpGE=
|
||||
golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
|
||||
|
|
@ -485,8 +485,8 @@ golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTk
|
|||
golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
|
||||
golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
|
||||
golang.org/x/mod v0.6.0-dev.0.20211013180041-c96bc1413d57/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
|
||||
golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
|
||||
golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
|
||||
golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
|
||||
golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
|
||||
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
|
|
@ -500,8 +500,8 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
|
|||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||
golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
|
||||
golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
|
||||
golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
|
||||
golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
|
|
@ -532,18 +532,18 @@ golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBc
|
|||
golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
|
||||
golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
|
||||
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
|
||||
golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
|
||||
golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
|
||||
golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
|
||||
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
|
||||
golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
|
||||
golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
|
||||
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
|
||||
golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
|
||||
golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
|
|
@ -554,16 +554,12 @@ golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3
|
|||
golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.1.8-0.20211029000441-d6a9af8af023/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
|
||||
golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
|
||||
golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
|
||||
golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
|
||||
golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
|
||||
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
|
||||
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=
|
||||
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
|
||||
google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
|
||||
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
|
||||
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
|
||||
|
|
@ -591,8 +587,6 @@ gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
|||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c h1:m/r7OM+Y2Ty1sgBQ7Qb27VgIMBW8ZZhT4gLnUyDIhzI=
|
||||
gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c/go.mod h1:3r5CMtNQMKIvBlrmM9xWUNamjKBYPOWyXOjmg5Kts3g=
|
||||
honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
lukechampine.com/blake3 v1.4.1 h1:I3Smz7gso8w4/TunLKec6K2fn+kyKtDxr/xcQEN84Wg=
|
||||
|
|
|
|||
|
|
@ -12,13 +12,8 @@ import (
|
|||
)
|
||||
|
||||
// Client communicates with the /api/internal/agent/* endpoints.
|
||||
//
|
||||
// The client owns a MirrorPool: when a request fails with a transient
|
||||
// network error (DNS, refused, timeout, 5xx) it rotates to the next mirror
|
||||
// and retries up to `len(mirrors)-1` times so a single agent run survives
|
||||
// a primary-domain takedown without user intervention.
|
||||
type Client struct {
|
||||
pool *MirrorPool
|
||||
baseURL string
|
||||
apiKey string
|
||||
httpClient *http.Client
|
||||
// wakeClient has no built-in timeout — used exclusively for the long-poll
|
||||
|
|
@ -30,20 +25,11 @@ type Client struct {
|
|||
userAgent string
|
||||
}
|
||||
|
||||
// NewClient creates an agent API client targeting a single base URL.
|
||||
// Equivalent to NewClientWithMirrors(baseURL, nil, ...) — kept for callers
|
||||
// that don't yet care about mirror failover.
|
||||
// NewClient creates an agent API client.
|
||||
func NewClient(baseURL, apiKey, userAgent string) *Client {
|
||||
return NewClientWithMirrors(baseURL, nil, apiKey, userAgent)
|
||||
}
|
||||
|
||||
// NewClientWithMirrors creates an agent API client that can fail over from
|
||||
// the primary base URL to any of the extras when the primary is unreachable.
|
||||
// The order of `extras` matters: they're tried left-to-right after a failure.
|
||||
func NewClientWithMirrors(baseURL string, extras []string, apiKey, userAgent string) *Client {
|
||||
return &Client{
|
||||
pool: NewMirrorPool(baseURL, extras),
|
||||
apiKey: apiKey,
|
||||
baseURL: baseURL,
|
||||
apiKey: apiKey,
|
||||
httpClient: &http.Client{
|
||||
Timeout: 30 * time.Second,
|
||||
},
|
||||
|
|
@ -58,18 +44,6 @@ func NewClientWithMirrors(baseURL string, extras []string, apiKey, userAgent str
|
|||
}
|
||||
}
|
||||
|
||||
// MirrorPool exposes the underlying pool so callers (e.g. the `unarr mirrors`
|
||||
// subcommand) can swap the list at runtime after fetching /api/v1/mirrors.
|
||||
func (c *Client) MirrorPool() *MirrorPool {
|
||||
return c.pool
|
||||
}
|
||||
|
||||
// baseURL returns the currently-active mirror. Routed through this helper so
|
||||
// future changes (e.g. per-endpoint mirror affinity) only need one edit.
|
||||
func (c *Client) baseURL() string {
|
||||
return c.pool.Current()
|
||||
}
|
||||
|
||||
// Register registers the CLI agent with the server and returns user info + features.
|
||||
func (c *Client) Register(ctx context.Context, req RegisterRequest) (*RegisterResponse, error) {
|
||||
var resp RegisterResponse
|
||||
|
|
@ -91,45 +65,6 @@ func (c *Client) Deregister(ctx context.Context, agentID string) error {
|
|||
return nil
|
||||
}
|
||||
|
||||
// ReportUpgradeResult tells the server the outcome of a previously requested
|
||||
// upgrade so the server can clear `upgrade_requested`. Without this call the
|
||||
// flag stays sticky and the daemon would re-trigger applyAutoUpgrade on every
|
||||
// sync after upgrade — even for "already on target version" no-ops.
|
||||
func (c *Client) ReportUpgradeResult(ctx context.Context, agentID string, success bool, version, errMsg string) error {
|
||||
req := struct {
|
||||
AgentID string `json:"agentId"`
|
||||
Success bool `json:"success"`
|
||||
Version string `json:"version,omitempty"`
|
||||
Error string `json:"error,omitempty"`
|
||||
}{AgentID: agentID, Success: success, Version: version, Error: errMsg}
|
||||
var resp StatusResponse
|
||||
if err := c.doPost(ctx, "/api/internal/agent/upgrade-result", req, &resp); err != nil {
|
||||
return fmt.Errorf("report upgrade result: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarkSessionReady signals the server that the first HLS segment + init.mp4
|
||||
// landed on disk for the given session. The web side flips
|
||||
// streaming_session.ready_at = NOW(), which its SSE endpoint emits to
|
||||
// subscribed players so the "Preparando…" UI ends without polling HEAD
|
||||
// on /hls/<id>/master.m3u8.
|
||||
//
|
||||
// Best-effort: the server is the source of truth for session state and
|
||||
// will reach the same conclusion via HEAD probes anyway if this call
|
||||
// fails. We log the error in the caller but don't retry — by the time
|
||||
// a retry would land the user is likely already playing.
|
||||
func (c *Client) MarkSessionReady(ctx context.Context, sessionID string) error {
|
||||
req := struct {
|
||||
SessionID string `json:"sessionId"`
|
||||
}{SessionID: sessionID}
|
||||
var resp StatusResponse
|
||||
if err := c.doPost(ctx, "/api/internal/agent/session-ready", req, &resp); err != nil {
|
||||
return fmt.Errorf("mark session ready: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ReportStatus reports download progress. Returns server-side flags the CLI must act on.
|
||||
func (c *Client) ReportStatus(ctx context.Context, update StatusUpdate) (*StatusResponse, error) {
|
||||
var resp StatusResponse
|
||||
|
|
@ -174,35 +109,30 @@ func (c *Client) SearchNzbs(ctx context.Context, params NzbSearchParams) (*NzbSe
|
|||
// DownloadNzb downloads the NZB file for the given nzbId.
|
||||
// Returns the raw NZB XML bytes.
|
||||
func (c *Client) DownloadNzb(ctx context.Context, nzbID string) ([]byte, error) {
|
||||
path := fmt.Sprintf("/api/internal/agent/nzb-download?nzbId=%s", nzbID)
|
||||
url := fmt.Sprintf("/api/internal/agent/nzb-download?nzbId=%s", nzbID)
|
||||
|
||||
var out []byte
|
||||
err := c.withMirrorFailover(func(base string) error {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+path, nil)
|
||||
if err != nil {
|
||||
return fmt.Errorf("create request: %w", err)
|
||||
}
|
||||
c.setHeaders(req)
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+url, nil)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("create request: %w", err)
|
||||
}
|
||||
c.setHeaders(req)
|
||||
|
||||
resp, err := c.httpClient.Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("request failed: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
resp, err := c.httpClient.Do(req)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("request failed: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode >= 400 {
|
||||
body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<16))
|
||||
return &HTTPError{StatusCode: resp.StatusCode, Message: string(body)}
|
||||
}
|
||||
if resp.StatusCode >= 400 {
|
||||
body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<16))
|
||||
return nil, fmt.Errorf("nzb download error %d: %s", resp.StatusCode, string(body))
|
||||
}
|
||||
|
||||
data, err := io.ReadAll(io.LimitReader(resp.Body, 100<<20)) // 100MB limit
|
||||
if err != nil {
|
||||
return fmt.Errorf("read nzb: %w", err)
|
||||
}
|
||||
out = data
|
||||
return nil
|
||||
})
|
||||
return out, err
|
||||
data, err := io.ReadAll(io.LimitReader(resp.Body, 100<<20)) // 100MB limit
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read nzb: %w", err)
|
||||
}
|
||||
return data, nil
|
||||
}
|
||||
|
||||
// GetUsenetCredentials fetches NNTP connection credentials.
|
||||
|
|
@ -263,41 +193,31 @@ func (c *Client) ReportWatchProgress(ctx context.Context, update WatchProgressUp
|
|||
// WaitForWake blocks until the server sends a wake signal, the long-poll
|
||||
// timeout elapses, or ctx is cancelled. Returns true when a wake signal
|
||||
// was received (caller should sync immediately), false on timeout/cancel.
|
||||
//
|
||||
// Wake is a long-poll on a single mirror — failover here would just drop
|
||||
// the connection and try again immediately, which the server already
|
||||
// handles with a fresh wait loop. We only retry against the next mirror
|
||||
// when the current one is definitively unreachable (DNS / refused / TLS).
|
||||
func (c *Client) WaitForWake(ctx context.Context) (bool, error) {
|
||||
var wake bool
|
||||
err := c.withMirrorFailover(func(base string) error {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+"/api/internal/agent/wake", nil)
|
||||
if err != nil {
|
||||
return fmt.Errorf("create wake request: %w", err)
|
||||
}
|
||||
c.setHeaders(req)
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+"/api/internal/agent/wake", nil)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("create wake request: %w", err)
|
||||
}
|
||||
c.setHeaders(req)
|
||||
|
||||
resp, err := c.wakeClient.Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("wake request failed: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
resp, err := c.wakeClient.Do(req)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("wake request failed: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode >= 400 {
|
||||
body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<10))
|
||||
return &HTTPError{StatusCode: resp.StatusCode, Message: string(body)}
|
||||
}
|
||||
if resp.StatusCode >= 400 {
|
||||
body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<10))
|
||||
return false, &HTTPError{StatusCode: resp.StatusCode, Message: string(body)}
|
||||
}
|
||||
|
||||
var result struct {
|
||||
Wake bool `json:"wake"`
|
||||
}
|
||||
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
|
||||
return fmt.Errorf("decode wake response: %w", err)
|
||||
}
|
||||
wake = result.Wake
|
||||
return nil
|
||||
})
|
||||
return wake, err
|
||||
var result struct {
|
||||
Wake bool `json:"wake"`
|
||||
}
|
||||
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
|
||||
return false, fmt.Errorf("decode wake response: %w", err)
|
||||
}
|
||||
return result.Wake, nil
|
||||
}
|
||||
|
||||
// doPost sends a JSON POST request using the default httpClient and decodes the response.
|
||||
|
|
@ -307,89 +227,45 @@ func (c *Client) doPost(ctx context.Context, path string, body any, dst any) err
|
|||
|
||||
// doPostWith sends a JSON POST request using the provided HTTP client and decodes the response.
|
||||
// Use this to override the default timeout for specific operations (e.g. librarySyncClient).
|
||||
// Wrapped in withMirrorFailover so a transient connection failure on the
|
||||
// active mirror retries against the next one.
|
||||
func (c *Client) doPostWith(ctx context.Context, hc *http.Client, path string, body any, dst any) error {
|
||||
jsonBody, err := json.Marshal(body)
|
||||
if err != nil {
|
||||
return fmt.Errorf("marshal body: %w", err)
|
||||
}
|
||||
|
||||
return c.withMirrorFailover(func(base string) error {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, base+path, bytes.NewReader(jsonBody))
|
||||
if err != nil {
|
||||
return fmt.Errorf("create request: %w", err)
|
||||
}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+path, bytes.NewReader(jsonBody))
|
||||
if err != nil {
|
||||
return fmt.Errorf("create request: %w", err)
|
||||
}
|
||||
|
||||
c.setHeaders(req)
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
c.setHeaders(req)
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
|
||||
resp, err := hc.Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("request failed: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
resp, err := hc.Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("request failed: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
return c.handleResponse(resp, dst)
|
||||
})
|
||||
return c.handleResponse(resp, dst)
|
||||
}
|
||||
|
||||
// doGet sends a GET request and decodes the response.
|
||||
func (c *Client) doGet(ctx context.Context, path string, dst any) error {
|
||||
return c.withMirrorFailover(func(base string) error {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+path, nil)
|
||||
if err != nil {
|
||||
return fmt.Errorf("create request: %w", err)
|
||||
}
|
||||
|
||||
c.setHeaders(req)
|
||||
|
||||
resp, err := c.httpClient.Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("request failed: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
return c.handleResponse(resp, dst)
|
||||
})
|
||||
}
|
||||
|
||||
// withMirrorFailover runs `fn` against the current mirror; on a transient
|
||||
// error it rotates the pool and retries up to `len(mirrors)-1` times.
|
||||
//
|
||||
// The active mirror is updated on rotation so subsequent unrelated calls
|
||||
// stick to the working host until that host fails too — this avoids
|
||||
// hammering a known-bad primary on every request, while still trying it
|
||||
// again next time the agent reloads (no permanent demotion).
|
||||
func (c *Client) withMirrorFailover(fn func(base string) error) error {
|
||||
attempts := c.pool.Len()
|
||||
if attempts < 1 {
|
||||
attempts = 1
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+path, nil)
|
||||
if err != nil {
|
||||
return fmt.Errorf("create request: %w", err)
|
||||
}
|
||||
|
||||
var lastErr error
|
||||
for i := 0; i < attempts; i++ {
|
||||
base := c.baseURL()
|
||||
err := fn(base)
|
||||
if err == nil {
|
||||
return nil
|
||||
}
|
||||
lastErr = err
|
||||
if !IsTransient(err) {
|
||||
return err
|
||||
}
|
||||
// Last attempt: don't bother rotating, just surface the error.
|
||||
if i == attempts-1 {
|
||||
break
|
||||
}
|
||||
next, rotated := c.pool.Rotate()
|
||||
if !rotated {
|
||||
break
|
||||
}
|
||||
_ = next // mirror rotation logging is left to higher layers (cmd/) so the
|
||||
// pool stays log-free for tests.
|
||||
c.setHeaders(req)
|
||||
|
||||
resp, err := c.httpClient.Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("request failed: %w", err)
|
||||
}
|
||||
return lastErr
|
||||
defer resp.Body.Close()
|
||||
|
||||
return c.handleResponse(resp, dst)
|
||||
}
|
||||
|
||||
func (c *Client) setHeaders(req *http.Request) {
|
||||
|
|
|
|||
|
|
@ -498,8 +498,8 @@ func TestClient_SlowServer_Timeout(t *testing.T) {
|
|||
|
||||
// Crear cliente con timeout muy corto
|
||||
c := &Client{
|
||||
pool: NewMirrorPool(srv.URL, nil),
|
||||
apiKey: "test-key",
|
||||
baseURL: srv.URL,
|
||||
apiKey: "test-key",
|
||||
httpClient: &http.Client{
|
||||
Timeout: 50 * time.Millisecond,
|
||||
},
|
||||
|
|
|
|||
|
|
@ -6,37 +6,23 @@ import (
|
|||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
"os/exec"
|
||||
"runtime"
|
||||
"strings"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
"github.com/torrentclaw/unarr/internal/upgrade"
|
||||
)
|
||||
|
||||
// DaemonConfig holds daemon runtime settings.
|
||||
type DaemonConfig struct {
|
||||
AgentID string
|
||||
AgentName string
|
||||
Version string
|
||||
DownloadDir string
|
||||
StreamPort int // port for the HTTP stream server
|
||||
LanIP string // LAN IP (reported in sync for stream URL resolution)
|
||||
TailscaleIP string // Tailscale IP (reported in sync for stream URL resolution)
|
||||
CanDelete bool // library.allow_delete is enabled
|
||||
ScanPaths []string // configured scan paths for file deletion validation
|
||||
HWAccel string // detected encoder backend ("nvenc"/"qsv"/"vaapi"/"videotoolbox"/"none")
|
||||
MaxTranscodeHeight int // resolution cap the agent can transcode comfortably (px)
|
||||
// Diagnostic data populated by engine.DetectHWAccelDiagnostic at daemon
|
||||
// start. Surfaced in the web "Diagnose transcoder" modal — lets a user
|
||||
// see which encoders the ffmpeg binary supports and which devices the
|
||||
// host exposes without running `unarr probe-hwaccel`.
|
||||
FFmpegVersion string // first line of `ffmpeg -version`
|
||||
FFmpegPath string // resolved binary path
|
||||
HWEncoders []string // HW-class encoder names found in `ffmpeg -encoders`
|
||||
HWDevices []string // device files + driver bins detected at probe time
|
||||
AutoUpgrade bool // honor server-flagged upgrades by downloading + restarting (default: true)
|
||||
AgentID string
|
||||
AgentName string
|
||||
Version string
|
||||
DownloadDir string
|
||||
StreamPort int // port for the HTTP stream server
|
||||
LanIP string // LAN IP (reported in sync for stream URL resolution)
|
||||
TailscaleIP string // Tailscale IP (reported in sync for stream URL resolution)
|
||||
CanDelete bool // library.allow_delete is enabled
|
||||
ScanPaths []string // configured scan paths for file deletion validation
|
||||
}
|
||||
|
||||
// Daemon manages agent registration and the sync loop.
|
||||
|
|
@ -49,7 +35,6 @@ type Daemon struct {
|
|||
// Callbacks — set by cmd/daemon.go before calling Run.
|
||||
OnTasksClaimed func(tasks []Task)
|
||||
OnStreamRequested func(req StreamRequest)
|
||||
OnStreamSession func(sess StreamSession)
|
||||
OnControlAction func(action, taskID string, deleteFiles bool)
|
||||
GetActiveCount func() int // returns number of active downloads (wired from manager)
|
||||
|
||||
|
|
@ -60,16 +45,6 @@ type Daemon struct {
|
|||
State DaemonState
|
||||
lastNotifiedVersion string
|
||||
|
||||
// Managed-VPN split-tunnel state, set by cmd/daemon.go before Run and folded
|
||||
// into DaemonState on every write so external tools (`unarr vpn status`) see it.
|
||||
vpnActive bool
|
||||
vpnMode string
|
||||
vpnServer string
|
||||
|
||||
// CloudFlare Quick Tunnel public URL; folded into DaemonState + heartbeat
|
||||
// so the web can prefer it over Tailscale/LAN for in-browser playback.
|
||||
funnelURL string
|
||||
|
||||
// Watching tracks whether a user is viewing download progress in the web UI.
|
||||
Watching atomic.Bool
|
||||
|
||||
|
|
@ -92,23 +67,6 @@ func NewDaemon(cfg DaemonConfig, client *Client) *Daemon {
|
|||
// SyncClient returns the sync client for external wiring.
|
||||
func (d *Daemon) SyncClient() *SyncClient { return d.sync }
|
||||
|
||||
// SetVPNState records the managed-VPN split-tunnel state so it's reflected in the
|
||||
// daemon state file (read by `unarr vpn status`). Call before Run.
|
||||
func (d *Daemon) SetVPNState(active bool, mode, server string) {
|
||||
d.vpnActive = active
|
||||
d.vpnMode = mode
|
||||
d.vpnServer = server
|
||||
}
|
||||
|
||||
// SetFunnelURL records the CloudFlare Quick Tunnel hostname so it's reflected
|
||||
// in the daemon state file (read by `unarr funnel status`) and in heartbeat
|
||||
// requests (so the web prefers it over Tailscale/LAN). Pass "" to clear.
|
||||
func (d *Daemon) SetFunnelURL(url string) {
|
||||
d.funnelURL = url
|
||||
d.State.FunnelURL = url
|
||||
WriteState(&d.State)
|
||||
}
|
||||
|
||||
// UpdateStreamPort updates the stream port reported in sync requests.
|
||||
func (d *Daemon) UpdateStreamPort(port int) {
|
||||
d.cfg.StreamPort = port
|
||||
|
|
@ -119,25 +77,15 @@ func (d *Daemon) UpdateStreamPort(port int) {
|
|||
// Retries with exponential backoff on transient errors (429, 5xx, network).
|
||||
func (d *Daemon) Register(ctx context.Context) error {
|
||||
req := RegisterRequest{
|
||||
AgentID: d.cfg.AgentID,
|
||||
Name: d.cfg.AgentName,
|
||||
OS: runtime.GOOS,
|
||||
Arch: runtime.GOARCH,
|
||||
Version: d.cfg.Version,
|
||||
DownloadDir: d.cfg.DownloadDir,
|
||||
StreamPort: d.cfg.StreamPort,
|
||||
LanIP: d.cfg.LanIP,
|
||||
TailscaleIP: d.cfg.TailscaleIP,
|
||||
HWAccel: d.cfg.HWAccel,
|
||||
MaxTranscodeHeight: d.cfg.MaxTranscodeHeight,
|
||||
FFmpegVersion: d.cfg.FFmpegVersion,
|
||||
FFmpegPath: d.cfg.FFmpegPath,
|
||||
HWEncoders: d.cfg.HWEncoders,
|
||||
HWDevices: d.cfg.HWDevices,
|
||||
VPNActive: d.vpnActive,
|
||||
VPNMode: d.vpnMode,
|
||||
VPNServer: d.vpnServer,
|
||||
FunnelURL: d.funnelURL,
|
||||
AgentID: d.cfg.AgentID,
|
||||
Name: d.cfg.AgentName,
|
||||
OS: runtime.GOOS,
|
||||
Arch: runtime.GOARCH,
|
||||
Version: d.cfg.Version,
|
||||
DownloadDir: d.cfg.DownloadDir,
|
||||
StreamPort: d.cfg.StreamPort,
|
||||
LanIP: d.cfg.LanIP,
|
||||
TailscaleIP: d.cfg.TailscaleIP,
|
||||
}
|
||||
if free, total, err := DiskInfo(d.cfg.DownloadDir); err == nil {
|
||||
req.DiskFreeBytes = free
|
||||
|
|
@ -188,10 +136,6 @@ func (d *Daemon) Register(ctx context.Context) error {
|
|||
PID: os.Getpid(),
|
||||
StartedAt: now,
|
||||
MethodStats: make(map[string]int),
|
||||
VPNActive: d.vpnActive,
|
||||
VPNMode: d.vpnMode,
|
||||
VPNServer: d.vpnServer,
|
||||
FunnelURL: d.funnelURL,
|
||||
}
|
||||
WriteState(&d.State)
|
||||
|
||||
|
|
@ -209,21 +153,6 @@ func (d *Daemon) Run(ctx context.Context) error {
|
|||
log.Printf("Agent registered: %s (%s) [%s]", d.User.Name, d.User.Email, d.User.Plan)
|
||||
log.Printf("Features: torrent=%v debrid=%v usenet=%v", d.Features.Torrent, d.Features.Debrid, d.Features.Usenet)
|
||||
|
||||
// Usenet needs par2 (segment repair) + an extractor (RAR/7z) on the host.
|
||||
// Without par2, a single bad segment corrupts the file silently; without
|
||||
// an extractor, RAR-packed downloads can't be unpacked. Warn loudly at
|
||||
// startup so the operator installs them before the first download fails.
|
||||
if d.Features.Usenet {
|
||||
if _, err := exec.LookPath("par2"); err != nil {
|
||||
log.Printf("[usenet] WARNING: par2 not found in PATH — corrupted segments cannot be repaired and extraction may fail. Install par2 (apt install par2 / brew install par2).")
|
||||
}
|
||||
_, unrarErr := exec.LookPath("unrar")
|
||||
_, sevenZErr := exec.LookPath("7z")
|
||||
if unrarErr != nil && sevenZErr != nil {
|
||||
log.Printf("[usenet] WARNING: no archive extractor (unrar or 7z) found — RAR-packed downloads cannot be unpacked. Install unrar or 7z.")
|
||||
}
|
||||
}
|
||||
|
||||
// Wire sync callbacks
|
||||
d.sync.OnNewTasks = func(tasks []Task) {
|
||||
if d.OnTasksClaimed != nil {
|
||||
|
|
@ -240,22 +169,11 @@ func (d *Daemon) Run(ctx context.Context) error {
|
|||
d.OnStreamRequested(req)
|
||||
}
|
||||
}
|
||||
d.sync.OnStreamSession = func(sess StreamSession) {
|
||||
if d.OnStreamSession != nil {
|
||||
d.OnStreamSession(sess)
|
||||
}
|
||||
}
|
||||
d.sync.OnUpgrade = func(version string) {
|
||||
if version == d.lastNotifiedVersion {
|
||||
return
|
||||
if version != d.lastNotifiedVersion {
|
||||
d.lastNotifiedVersion = version
|
||||
log.Printf("New version available: %s (run `unarr self-update` to upgrade)", version)
|
||||
}
|
||||
d.lastNotifiedVersion = version
|
||||
if !d.cfg.AutoUpgrade {
|
||||
log.Printf("[upgrade] new version available: %s — auto_upgrade=false, run `unarr update` to apply", version)
|
||||
return
|
||||
}
|
||||
log.Printf("[upgrade] new version available: %s — applying auto-upgrade", version)
|
||||
go d.applyAutoUpgrade(version)
|
||||
}
|
||||
d.sync.OnScan = func() {
|
||||
log.Printf("Library scan requested by server")
|
||||
|
|
@ -267,12 +185,6 @@ func (d *Daemon) Run(ctx context.Context) error {
|
|||
d.sync.OnWatchingChange = func(watching bool) {
|
||||
d.Watching.Store(watching)
|
||||
}
|
||||
d.sync.GetVPNState = func() (bool, string, string) {
|
||||
return d.vpnActive, d.vpnMode, d.vpnServer
|
||||
}
|
||||
d.sync.GetFunnelURL = func() string {
|
||||
return d.funnelURL
|
||||
}
|
||||
d.sync.OnSyncSuccess = func() {
|
||||
d.State.LastHeartbeat = time.Now()
|
||||
if d.GetActiveCount != nil {
|
||||
|
|
@ -302,67 +214,6 @@ func (d *Daemon) Deregister() {
|
|||
RemoveState()
|
||||
}
|
||||
|
||||
// applyAutoUpgrade downloads the target version and exits so the service
|
||||
// supervisor (systemd Restart=always on Linux) respawns on the new binary.
|
||||
// Triggered by the server's upgrade signal — opt-in flag set by the user from
|
||||
// the web UI; the daemon never auto-upgrades on a passive version bump.
|
||||
//
|
||||
// Reports the outcome to /api/internal/agent/upgrade-result so the server
|
||||
// clears `upgrade_requested`. Without this report the flag stays sticky and
|
||||
// the daemon would loop on every sync — including the no-op case where it's
|
||||
// already on the target version.
|
||||
func (d *Daemon) applyAutoUpgrade(targetVersion string) {
|
||||
currentClean := strings.TrimPrefix(d.cfg.Version, "v")
|
||||
targetClean := strings.TrimPrefix(targetVersion, "v")
|
||||
|
||||
// No-op: server signal arrived but we're already running the target. This
|
||||
// happens when the daemon restarts after a previous auto-upgrade before
|
||||
// reportUpgradeResult cleared the flag, or when the operator manually
|
||||
// installed the same version off-band. Skip Execute (which would also
|
||||
// no-op) AND skip os.Exit, but DO clear the flag — otherwise we loop.
|
||||
if currentClean == targetClean {
|
||||
log.Printf("[upgrade] already on v%s — clearing server flag", currentClean)
|
||||
ctxR, cancelR := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer cancelR()
|
||||
if err := d.client.ReportUpgradeResult(ctxR, d.cfg.AgentID, true, currentClean, ""); err != nil {
|
||||
log.Printf("[upgrade] report-result failed (will retry on next signal): %v", err)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
upgrader := &upgrade.Upgrader{
|
||||
CurrentVersion: currentClean,
|
||||
OnProgress: func(msg string) {
|
||||
log.Printf("[upgrade] %s", msg)
|
||||
},
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
|
||||
defer cancel()
|
||||
result := upgrader.Execute(ctx, targetVersion)
|
||||
if !result.Success {
|
||||
log.Printf("[upgrade] auto-upgrade failed: %v", result.Error)
|
||||
errMsg := ""
|
||||
if result.Error != nil {
|
||||
errMsg = result.Error.Error()
|
||||
}
|
||||
ctxR, cancelR := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer cancelR()
|
||||
if err := d.client.ReportUpgradeResult(ctxR, d.cfg.AgentID, false, targetClean, errMsg); err != nil {
|
||||
log.Printf("[upgrade] report-result failed: %v", err)
|
||||
}
|
||||
return
|
||||
}
|
||||
log.Printf("[upgrade] upgraded v%s → v%s; reporting result + exiting so service supervisor restarts on new binary",
|
||||
result.OldVersion, result.NewVersion)
|
||||
ctxR, cancelR := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
if err := d.client.ReportUpgradeResult(ctxR, d.cfg.AgentID, true, result.NewVersion, ""); err != nil {
|
||||
log.Printf("[upgrade] report-result failed: %v", err)
|
||||
}
|
||||
cancelR()
|
||||
time.Sleep(500 * time.Millisecond)
|
||||
os.Exit(0)
|
||||
}
|
||||
|
||||
// isTransientError returns true for errors worth retrying (429, 5xx, network).
|
||||
func isTransientError(err error) bool {
|
||||
if err == nil {
|
||||
|
|
|
|||
|
|
@ -1,62 +0,0 @@
|
|||
package agent
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestDirSize(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
if err := os.WriteFile(filepath.Join(root, "a.bin"), make([]byte, 100), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.MkdirAll(filepath.Join(root, "sub"), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(root, "sub", "b.bin"), make([]byte, 250), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
got, err := DirSize(root)
|
||||
if err != nil {
|
||||
t.Fatalf("DirSize error: %v", err)
|
||||
}
|
||||
if got != 350 {
|
||||
t.Errorf("DirSize = %d, want 350", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDirSizeEmpty(t *testing.T) {
|
||||
got, err := DirSize(t.TempDir())
|
||||
if err != nil {
|
||||
t.Fatalf("DirSize empty dir error: %v", err)
|
||||
}
|
||||
if got != 0 {
|
||||
t.Errorf("DirSize empty = %d, want 0", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDirSizeMissing(t *testing.T) {
|
||||
// Walk skips unreadable entries — missing path returns 0 with no error.
|
||||
got, err := DirSize("/nonexistent/path/zzz")
|
||||
if err != nil {
|
||||
t.Errorf("DirSize on missing path = err %v, want nil", err)
|
||||
}
|
||||
if got != 0 {
|
||||
t.Errorf("DirSize on missing path = %d, want 0", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDiskInfoCurrentDir(t *testing.T) {
|
||||
free, total, err := DiskInfo(".")
|
||||
if err != nil {
|
||||
t.Fatalf("DiskInfo: %v", err)
|
||||
}
|
||||
if total <= 0 {
|
||||
t.Errorf("total bytes should be > 0, got %d", total)
|
||||
}
|
||||
if free > total {
|
||||
t.Errorf("free (%d) should not exceed total (%d)", free, total)
|
||||
}
|
||||
}
|
||||
|
|
@ -1,232 +0,0 @@
|
|||
package agent
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"time"
|
||||
)
|
||||
|
||||
// MirrorEntry mirrors the shape of /api/v1/mirrors items on the server.
|
||||
type MirrorEntry struct {
|
||||
URL string `json:"url"`
|
||||
Label string `json:"label"`
|
||||
Kind string `json:"kind"` // "clearnet" | "tor"
|
||||
Primary bool `json:"primary"`
|
||||
}
|
||||
|
||||
// MirrorChannel is an out-of-band status channel (Telegram, status page, etc.)
|
||||
type MirrorChannel struct {
|
||||
URL string `json:"url"`
|
||||
Label string `json:"label"`
|
||||
}
|
||||
|
||||
// MirrorsResponse is the JSON document served by /api/v1/mirrors and
|
||||
// /api/mirrors.
|
||||
type MirrorsResponse struct {
|
||||
Revision int `json:"revision"`
|
||||
Mirrors []MirrorEntry `json:"mirrors"`
|
||||
Tor *MirrorEntry `json:"tor"`
|
||||
Channels []MirrorChannel `json:"channels"`
|
||||
UpdatedAt string `json:"updatedAt"`
|
||||
}
|
||||
|
||||
// DefaultStaticFallbackURLs lists off-domain JSON copies of the mirror list.
|
||||
// Hard-coded here (not loaded from config) because the whole point is to
|
||||
// have something to consult when config-driven URLs all fail.
|
||||
//
|
||||
// Hosted on IPFS (content-addressed, re-pinnable, no host can take it down
|
||||
// permanently — same bytes re-pinned anywhere keep the same CID). Multiple
|
||||
// public gateways are listed so a single gateway being blocked doesn't kill
|
||||
// the fallback; the /ipfs/<CID>/ path is identical across all gateways.
|
||||
//
|
||||
// GitHub Pages was removed 2026-05-17: the whole torrentclaw org is
|
||||
// shadow-banned (public repos 404 to anonymous users). Do NOT re-add any
|
||||
// github.io URL. Keep this slice in sync with `STATIC_FALLBACKS` in
|
||||
// `torrentclaw-web/src/lib/mirrors-config.ts` — when the IPFS CID changes
|
||||
// (scripts/publish-mirrors-ipfs.sh), update both.
|
||||
//
|
||||
// Future hardening: sign mirrors.json with the same ed25519 release key
|
||||
// (or a sibling) so a hijack of any single static host cannot serve a
|
||||
// malicious mirror list. Today the only signal is "agreement between
|
||||
// independent providers" via cross-checking, which we leave to the
|
||||
// operator.
|
||||
const mirrorsIPFSCID = "bafybeigwux74fek7uky7nct47z5eqwwnpylakfxppqqnzbuxdw7p3ikfdy"
|
||||
|
||||
var DefaultStaticFallbackURLs = []string{
|
||||
"https://ipfs.io/ipfs/" + mirrorsIPFSCID + "/mirrors.json",
|
||||
"https://dweb.link/ipfs/" + mirrorsIPFSCID + "/mirrors.json",
|
||||
"https://gateway.pinata.cloud/ipfs/" + mirrorsIPFSCID + "/mirrors.json",
|
||||
}
|
||||
|
||||
// FetchMirrorsWithFallback pulls the mirror list using FetchMirrors against
|
||||
// `candidates` first; if every candidate fails, it falls back to the static
|
||||
// JSON copies on off-domain hosts (GitHub Pages, Cloudflare Pages, …).
|
||||
//
|
||||
// This is the function `unarr mirrors update` should call when it wants the
|
||||
// strongest "give me a working mirror list no matter what" guarantee.
|
||||
func FetchMirrorsWithFallback(ctx context.Context, candidates []string, userAgent string) (*MirrorsResponse, error) {
|
||||
resp, err := FetchMirrors(ctx, candidates, userAgent)
|
||||
if err == nil {
|
||||
return resp, nil
|
||||
}
|
||||
if len(DefaultStaticFallbackURLs) == 0 {
|
||||
return nil, err
|
||||
}
|
||||
// Try the static JSON files directly. They follow the same wire shape so
|
||||
// we can reuse the same parser — but the URLs already include the JSON
|
||||
// suffix so we hit them with `fetchMirrorsJSON` instead of FetchMirrors
|
||||
// (which appends /api/v1/mirrors).
|
||||
staticResp, staticErr := fetchMirrorsJSON(ctx, DefaultStaticFallbackURLs, userAgent)
|
||||
if staticErr == nil {
|
||||
return staticResp, nil
|
||||
}
|
||||
return nil, fmt.Errorf("primary failed (%v) and static fallback failed (%v)", err, staticErr)
|
||||
}
|
||||
|
||||
// fetchMirrorsJSON pulls a MirrorsResponse from already-fully-qualified URLs
|
||||
// (e.g. https://ipfs.io/ipfs/<CID>/mirrors.json). Each candidate is tried
|
||||
// in order; the first success wins.
|
||||
func fetchMirrorsJSON(ctx context.Context, urls []string, userAgent string) (*MirrorsResponse, error) {
|
||||
if len(urls) == 0 {
|
||||
return nil, fmt.Errorf("no static fallback URLs configured")
|
||||
}
|
||||
hc := &http.Client{Timeout: 15 * time.Second}
|
||||
var lastErr error
|
||||
for _, url := range urls {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
||||
if err != nil {
|
||||
lastErr = err
|
||||
continue
|
||||
}
|
||||
if userAgent != "" {
|
||||
req.Header.Set("User-Agent", userAgent)
|
||||
}
|
||||
req.Header.Set("Accept", "application/json")
|
||||
resp, err := hc.Do(req)
|
||||
if err != nil {
|
||||
lastErr = err
|
||||
continue
|
||||
}
|
||||
body, readErr := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
|
||||
resp.Body.Close()
|
||||
if readErr != nil {
|
||||
lastErr = readErr
|
||||
continue
|
||||
}
|
||||
if resp.StatusCode >= 400 {
|
||||
lastErr = fmt.Errorf("%s returned HTTP %d", url, resp.StatusCode)
|
||||
continue
|
||||
}
|
||||
var out MirrorsResponse
|
||||
if err := json.Unmarshal(body, &out); err != nil {
|
||||
lastErr = fmt.Errorf("%s: invalid JSON: %w", url, err)
|
||||
continue
|
||||
}
|
||||
if len(out.Mirrors) == 0 {
|
||||
lastErr = fmt.Errorf("%s returned empty mirror list", url)
|
||||
continue
|
||||
}
|
||||
return &out, nil
|
||||
}
|
||||
if lastErr == nil {
|
||||
lastErr = fmt.Errorf("no reachable static fallback")
|
||||
}
|
||||
return nil, lastErr
|
||||
}
|
||||
|
||||
// FetchMirrors pulls the latest mirror list from the server.
|
||||
//
|
||||
// The endpoint is intentionally public and unauthenticated: the whole point
|
||||
// of mirror discovery is that it must work even when the user's API key
|
||||
// is invalid, expired, or the auth path is unreachable. The function tries
|
||||
// each candidate base URL in order so a takedown of the primary doesn't
|
||||
// also kill mirror discovery.
|
||||
func FetchMirrors(ctx context.Context, candidates []string, userAgent string) (*MirrorsResponse, error) {
|
||||
if len(candidates) == 0 {
|
||||
return nil, fmt.Errorf("no mirror discovery URLs configured")
|
||||
}
|
||||
|
||||
hc := &http.Client{Timeout: 15 * time.Second}
|
||||
|
||||
var lastErr error
|
||||
for _, base := range candidates {
|
||||
if base == "" {
|
||||
continue
|
||||
}
|
||||
url := base + "/api/v1/mirrors"
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
||||
if err != nil {
|
||||
lastErr = err
|
||||
continue
|
||||
}
|
||||
if userAgent != "" {
|
||||
req.Header.Set("User-Agent", userAgent)
|
||||
}
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
resp, err := hc.Do(req)
|
||||
if err != nil {
|
||||
lastErr = err
|
||||
continue
|
||||
}
|
||||
body, readErr := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
|
||||
resp.Body.Close()
|
||||
if readErr != nil {
|
||||
lastErr = readErr
|
||||
continue
|
||||
}
|
||||
if resp.StatusCode >= 400 {
|
||||
lastErr = fmt.Errorf("%s returned HTTP %d", base, resp.StatusCode)
|
||||
continue
|
||||
}
|
||||
var out MirrorsResponse
|
||||
if err := json.Unmarshal(body, &out); err != nil {
|
||||
lastErr = fmt.Errorf("%s: invalid JSON: %w", base, err)
|
||||
continue
|
||||
}
|
||||
if len(out.Mirrors) == 0 {
|
||||
lastErr = fmt.Errorf("%s returned empty mirror list", base)
|
||||
continue
|
||||
}
|
||||
return &out, nil
|
||||
}
|
||||
|
||||
if lastErr == nil {
|
||||
lastErr = fmt.Errorf("no reachable mirror discovery endpoint")
|
||||
}
|
||||
return nil, fmt.Errorf("fetch mirrors: %w", lastErr)
|
||||
}
|
||||
|
||||
// ToConfig splits a MirrorsResponse into (primary, extras) suitable for
|
||||
// rebuilding a MirrorPool or persisting back into config.toml.
|
||||
//
|
||||
// The "primary" returned here is whichever entry has primary=true. If none
|
||||
// are flagged, the first one wins.
|
||||
func (m *MirrorsResponse) ToConfig() (primary string, extras []string) {
|
||||
if m == nil {
|
||||
return "", nil
|
||||
}
|
||||
var picked *MirrorEntry
|
||||
for i := range m.Mirrors {
|
||||
if m.Mirrors[i].Primary {
|
||||
picked = &m.Mirrors[i]
|
||||
break
|
||||
}
|
||||
}
|
||||
if picked == nil && len(m.Mirrors) > 0 {
|
||||
picked = &m.Mirrors[0]
|
||||
}
|
||||
if picked != nil {
|
||||
primary = picked.URL
|
||||
}
|
||||
for _, e := range m.Mirrors {
|
||||
if e.URL == primary {
|
||||
continue
|
||||
}
|
||||
extras = append(extras, e.URL)
|
||||
}
|
||||
return primary, extras
|
||||
}
|
||||
|
|
@ -1,172 +0,0 @@
|
|||
package agent
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"sync"
|
||||
)
|
||||
|
||||
// MirrorPool holds the ordered list of API base URLs the client is willing to
|
||||
// fall back to when the current mirror is unreachable. The first entry is
|
||||
// always the "preferred" mirror configured by the user. Subsequent entries
|
||||
// are alternate domains we can rotate to without changing any user-visible
|
||||
// configuration — they exist so a long-lived agent survives a takedown of
|
||||
// the primary host without needing a new release.
|
||||
//
|
||||
// The pool is concurrency-safe; rotation is a fast O(1) index bump under a
|
||||
// mutex. The previously-active mirror is NEVER removed — it might just be
|
||||
// temporarily unreachable from one network path.
|
||||
type MirrorPool struct {
|
||||
mu sync.RWMutex
|
||||
mirrors []string
|
||||
current int
|
||||
}
|
||||
|
||||
// NewMirrorPool builds a pool from the provided base URLs. The primary URL
|
||||
// is always first; "extras" are appended in order and de-duplicated. Empty
|
||||
// strings are skipped. Trailing slashes are normalised so callers can concat
|
||||
// `pool.Current() + "/api/..."` reliably.
|
||||
func NewMirrorPool(primary string, extras []string) *MirrorPool {
|
||||
seen := make(map[string]struct{})
|
||||
var out []string
|
||||
|
||||
add := func(raw string) {
|
||||
raw = strings.TrimRight(strings.TrimSpace(raw), "/")
|
||||
if raw == "" {
|
||||
return
|
||||
}
|
||||
if _, dup := seen[raw]; dup {
|
||||
return
|
||||
}
|
||||
seen[raw] = struct{}{}
|
||||
out = append(out, raw)
|
||||
}
|
||||
|
||||
add(primary)
|
||||
for _, e := range extras {
|
||||
add(e)
|
||||
}
|
||||
|
||||
if len(out) == 0 {
|
||||
// Defensive: always return a pool with at least one entry so callers
|
||||
// can call Current() without nil checks. The empty string would
|
||||
// produce obvious errors immediately, which is preferable to a panic
|
||||
// somewhere deep in net/http.
|
||||
out = []string{""}
|
||||
}
|
||||
|
||||
return &MirrorPool{mirrors: out}
|
||||
}
|
||||
|
||||
// Current returns the active base URL.
|
||||
func (p *MirrorPool) Current() string {
|
||||
p.mu.RLock()
|
||||
defer p.mu.RUnlock()
|
||||
return p.mirrors[p.current]
|
||||
}
|
||||
|
||||
// Mirrors returns a copy of the configured base URLs in priority order.
|
||||
func (p *MirrorPool) Mirrors() []string {
|
||||
p.mu.RLock()
|
||||
defer p.mu.RUnlock()
|
||||
out := make([]string, len(p.mirrors))
|
||||
copy(out, p.mirrors)
|
||||
return out
|
||||
}
|
||||
|
||||
// Len reports how many mirrors are configured.
|
||||
func (p *MirrorPool) Len() int {
|
||||
p.mu.RLock()
|
||||
defer p.mu.RUnlock()
|
||||
return len(p.mirrors)
|
||||
}
|
||||
|
||||
// Rotate moves the cursor to the next mirror in the pool, wrapping around.
|
||||
// Returns the new current mirror and whether a rotation actually happened
|
||||
// (a single-mirror pool returns false).
|
||||
func (p *MirrorPool) Rotate() (string, bool) {
|
||||
p.mu.Lock()
|
||||
defer p.mu.Unlock()
|
||||
if len(p.mirrors) <= 1 {
|
||||
return p.mirrors[p.current], false
|
||||
}
|
||||
p.current = (p.current + 1) % len(p.mirrors)
|
||||
return p.mirrors[p.current], true
|
||||
}
|
||||
|
||||
// Replace swaps the entire mirror set, e.g. after `unarr mirrors update`
|
||||
// downloaded a fresh list from /api/v1/mirrors. Resets the cursor to 0 so
|
||||
// the newly-discovered primary is tried first.
|
||||
func (p *MirrorPool) Replace(primary string, extras []string) {
|
||||
fresh := NewMirrorPool(primary, extras)
|
||||
p.mu.Lock()
|
||||
defer p.mu.Unlock()
|
||||
p.mirrors = fresh.mirrors
|
||||
p.current = 0
|
||||
}
|
||||
|
||||
// IsTransient reports whether an error is the kind we should retry against
|
||||
// another mirror. The intent is conservative: rotate on connection-level
|
||||
// failures (DNS, refused, TLS, timeouts, 5xx) but NOT on auth or validation
|
||||
// errors that would just fail again somewhere else.
|
||||
func IsTransient(err error) bool {
|
||||
if err == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
var httpErr *HTTPError
|
||||
if errors.As(err, &httpErr) {
|
||||
switch httpErr.StatusCode {
|
||||
case http.StatusBadGateway,
|
||||
http.StatusServiceUnavailable,
|
||||
http.StatusGatewayTimeout,
|
||||
http.StatusRequestTimeout:
|
||||
return true
|
||||
}
|
||||
// 4xx (auth, rate limit, validation) won't get healthier on another mirror.
|
||||
return false
|
||||
}
|
||||
|
||||
if errors.Is(err, context.DeadlineExceeded) {
|
||||
return true
|
||||
}
|
||||
|
||||
var netErr net.Error
|
||||
if errors.As(err, &netErr) && netErr.Timeout() {
|
||||
return true
|
||||
}
|
||||
|
||||
var dnsErr *net.DNSError
|
||||
if errors.As(err, &dnsErr) {
|
||||
return true
|
||||
}
|
||||
|
||||
var urlErr *url.Error
|
||||
if errors.As(err, &urlErr) {
|
||||
// `connection refused`, `EOF`, `tls: ...` end up as wrapped url.Errors.
|
||||
msg := urlErr.Error()
|
||||
if strings.Contains(msg, "connection refused") ||
|
||||
strings.Contains(msg, "no such host") ||
|
||||
strings.Contains(msg, "EOF") ||
|
||||
strings.Contains(msg, "tls:") ||
|
||||
strings.Contains(msg, "i/o timeout") ||
|
||||
strings.Contains(msg, "network is unreachable") {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
// Bare strings as last resort — net.OpError messages are unstable across Go versions.
|
||||
msg := err.Error()
|
||||
if strings.Contains(msg, "connection refused") ||
|
||||
strings.Contains(msg, "no such host") ||
|
||||
strings.Contains(msg, "i/o timeout") ||
|
||||
strings.Contains(msg, "network is unreachable") {
|
||||
return true
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
//go:build !windows
|
||||
|
||||
package agent
|
||||
|
||||
import (
|
||||
"os"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestIsProcessAliveSelf(t *testing.T) {
|
||||
if !IsProcessAlive(os.Getpid()) {
|
||||
t.Errorf("self PID should be alive")
|
||||
}
|
||||
}
|
||||
|
||||
func TestIsProcessAliveBogus(t *testing.T) {
|
||||
// PID 0 is reserved (signal 0 to PID 0 broadcasts to the whole pgrp).
|
||||
// Pick a very high PID unlikely to exist.
|
||||
if IsProcessAlive(0x7FFFFFFE) {
|
||||
t.Errorf("very high PID should not be alive")
|
||||
}
|
||||
}
|
||||
|
|
@ -2,8 +2,6 @@ package agent
|
|||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"time"
|
||||
|
|
@ -11,13 +9,6 @@ import (
|
|||
"github.com/torrentclaw/unarr/internal/config"
|
||||
)
|
||||
|
||||
// ErrDaemonNotRunning is returned when no daemon state file exists on disk.
|
||||
// Callers may wrap it with %w; downstream code uses errors.Is to detect it.
|
||||
// NOTE: the message text is matched by the sentry package (string-match, to
|
||||
// avoid an import cycle). Keep the prefix "daemon does not appear to be
|
||||
// running" stable, or update sentry.daemonNotRunningMarker accordingly.
|
||||
var ErrDaemonNotRunning = errors.New("daemon does not appear to be running (state file not found)")
|
||||
|
||||
// DaemonState is written to disk every heartbeat for external tools to read.
|
||||
type DaemonState struct {
|
||||
AgentID string `json:"agentId"`
|
||||
|
|
@ -31,18 +22,6 @@ type DaemonState struct {
|
|||
FailedCount int `json:"failedCount"`
|
||||
TotalDownloaded int64 `json:"totalDownloaded"`
|
||||
MethodStats map[string]int `json:"methodStats,omitempty"`
|
||||
|
||||
// Managed-VPN split-tunnel state, so `unarr vpn status` can report whether
|
||||
// torrent traffic is actually being routed through the tunnel (vs. the daemon
|
||||
// running but the tunnel having failed to come up → downloading in the clear).
|
||||
VPNActive bool `json:"vpnActive,omitempty"`
|
||||
VPNMode string `json:"vpnMode,omitempty"` // managed | self-hosted
|
||||
VPNServer string `json:"vpnServer,omitempty"` // WireGuard endpoint (ip:port)
|
||||
|
||||
// CloudFlare Quick Tunnel state, so `unarr funnel status` can report the
|
||||
// HTTPS hostname the daemon is reachable at from anywhere on the internet.
|
||||
// Empty when the funnel is off or hasn't registered yet.
|
||||
FunnelURL string `json:"funnelUrl,omitempty"`
|
||||
}
|
||||
|
||||
// stateFilePathFn is overridable for testing.
|
||||
|
|
@ -66,43 +45,25 @@ func WriteState(state *DaemonState) {
|
|||
return
|
||||
}
|
||||
|
||||
// Write to temp file then rename for atomicity. 0o600 keeps the file
|
||||
// readable only by the owning user — the state contains agentID, PID
|
||||
// and counters which are useful to a co-tenant on a shared host for
|
||||
// fingerprinting the daemon, and we already use 0o600 for the config
|
||||
// file. No need for cross-user readability here.
|
||||
// Write to temp file then rename for atomicity
|
||||
tmp := path + ".tmp"
|
||||
if err := os.WriteFile(tmp, data, 0o600); err != nil {
|
||||
if err := os.WriteFile(tmp, data, 0o644); err != nil {
|
||||
return
|
||||
}
|
||||
os.Rename(tmp, path)
|
||||
}
|
||||
|
||||
// ReadState reads the daemon state from disk. Returns nil if not found or
|
||||
// unreadable. Use LoadState when callers need to distinguish "not running"
|
||||
// from "state file corrupted".
|
||||
// ReadState reads the daemon state from disk. Returns nil if not found.
|
||||
func ReadState() *DaemonState {
|
||||
state, _ := LoadState()
|
||||
return state
|
||||
}
|
||||
|
||||
// LoadState reads the daemon state and returns explicit errors:
|
||||
// - ErrDaemonNotRunning when the state file does not exist
|
||||
// - a wrapped json error when the file exists but cannot be decoded
|
||||
// (a real bug worth reporting to Sentry)
|
||||
func LoadState() (*DaemonState, error) {
|
||||
data, err := os.ReadFile(StateFilePath())
|
||||
if err != nil {
|
||||
if errors.Is(err, os.ErrNotExist) {
|
||||
return nil, ErrDaemonNotRunning
|
||||
}
|
||||
return nil, err
|
||||
return nil
|
||||
}
|
||||
var state DaemonState
|
||||
if err := json.Unmarshal(data, &state); err != nil {
|
||||
return nil, fmt.Errorf("decode daemon state %s: %w", StateFilePath(), err)
|
||||
if json.Unmarshal(data, &state) != nil {
|
||||
return nil
|
||||
}
|
||||
return &state, nil
|
||||
return &state
|
||||
}
|
||||
|
||||
// RemoveState deletes the state file (called on clean shutdown).
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
package agent
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
|
@ -105,39 +104,3 @@ func TestReadStateCorruptedJSON(t *testing.T) {
|
|||
t.Errorf("ReadState() should return nil for corrupted JSON, got %+v", state)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadStateNotFound(t *testing.T) {
|
||||
tmpDir := t.TempDir()
|
||||
origFn := stateFilePathFn
|
||||
stateFilePathFn = func() string { return filepath.Join(tmpDir, "nonexistent.json") }
|
||||
defer func() { stateFilePathFn = origFn }()
|
||||
|
||||
state, err := LoadState()
|
||||
if state != nil {
|
||||
t.Errorf("LoadState() state = %+v, want nil", state)
|
||||
}
|
||||
if !errors.Is(err, ErrDaemonNotRunning) {
|
||||
t.Errorf("LoadState() err = %v, want ErrDaemonNotRunning", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadStateCorruptedJSON(t *testing.T) {
|
||||
tmpDir := t.TempDir()
|
||||
origFn := stateFilePathFn
|
||||
path := filepath.Join(tmpDir, "daemon.state.json")
|
||||
stateFilePathFn = func() string { return path }
|
||||
defer func() { stateFilePathFn = origFn }()
|
||||
|
||||
os.WriteFile(path, []byte("not valid json{{{"), 0o644)
|
||||
|
||||
state, err := LoadState()
|
||||
if state != nil {
|
||||
t.Errorf("LoadState() state = %+v, want nil", state)
|
||||
}
|
||||
if err == nil {
|
||||
t.Fatal("LoadState() err = nil, want decode error")
|
||||
}
|
||||
if errors.Is(err, ErrDaemonNotRunning) {
|
||||
t.Error("corrupt state must not be reported as ErrDaemonNotRunning — it would be filtered from Sentry")
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -29,20 +29,12 @@ type SyncClient struct {
|
|||
OnNewTasks func(tasks []Task)
|
||||
OnControl func(action, taskID string, deleteFiles bool)
|
||||
OnStreamRequest func(req StreamRequest)
|
||||
OnStreamSession func(sess StreamSession)
|
||||
OnUpgrade func(version string)
|
||||
OnScan func()
|
||||
OnWatchingChange func(watching bool)
|
||||
OnSyncSuccess func() // called after each successful sync (e.g. to update state file)
|
||||
GetFreeSlots func() int
|
||||
GetTaskStates func() []TaskState // returns current state of all active + recently finished tasks
|
||||
// GetVPNState returns the live managed-VPN split-tunnel state (whether the
|
||||
// WireGuard tunnel is up, the mode, and the exit server) so the web can track
|
||||
// which agent holds the single WG slot.
|
||||
GetVPNState func() (active bool, mode, server string)
|
||||
// GetFunnelURL returns the CloudFlare Quick Tunnel public hostname if one
|
||||
// is active, else "". Sent on every sync so the web picks it up live.
|
||||
GetFunnelURL func() string
|
||||
// OnDeleteFiles is called when the server requests file deletion from disk.
|
||||
// It should delete the files and return the IDs of successfully deleted items.
|
||||
OnDeleteFiles func(items []LibraryDeleteRequest) []int
|
||||
|
|
@ -162,12 +154,6 @@ func (sc *SyncClient) buildRequest() SyncRequest {
|
|||
if sc.GetFreeSlots != nil {
|
||||
req.FreeSlots = sc.GetFreeSlots()
|
||||
}
|
||||
if sc.GetVPNState != nil {
|
||||
req.VPNActive, req.VPNMode, req.VPNServer = sc.GetVPNState()
|
||||
}
|
||||
if sc.GetFunnelURL != nil {
|
||||
req.FunnelURL = sc.GetFunnelURL()
|
||||
}
|
||||
// Flush confirmed deletions from previous cycle.
|
||||
// Once flushed, remove IDs from deleteInFlight — the server will stop sending
|
||||
// them after this sync, so deduplication protection is no longer needed.
|
||||
|
|
@ -205,13 +191,6 @@ func (sc *SyncClient) processResponse(resp *SyncResponse) {
|
|||
}
|
||||
}
|
||||
|
||||
// HLS streaming sessions.
|
||||
for _, ws := range resp.StreamSessions {
|
||||
if sc.OnStreamSession != nil {
|
||||
sc.OnStreamSession(ws)
|
||||
}
|
||||
}
|
||||
|
||||
// Upgrade
|
||||
if resp.Upgrade != nil && resp.Upgrade.Version != "" && sc.OnUpgrade != nil {
|
||||
sc.OnUpgrade(resp.Upgrade.Version)
|
||||
|
|
|
|||
|
|
@ -215,56 +215,3 @@ func TestLocalState_EmptySnapshot(t *testing.T) {
|
|||
t.Errorf("expected 0 tasks, got %d", len(snap))
|
||||
}
|
||||
}
|
||||
|
||||
func TestTaskStateFromUpdate(t *testing.T) {
|
||||
u := StatusUpdate{
|
||||
TaskID: "task-1",
|
||||
Status: "downloading",
|
||||
Progress: 42,
|
||||
DownloadedBytes: 1024,
|
||||
TotalBytes: 4096,
|
||||
SpeedBps: 100,
|
||||
ETA: 30,
|
||||
ResolvedMethod: "torrent",
|
||||
FileName: "movie.mkv",
|
||||
FilePath: "/tmp/movie.mkv",
|
||||
StreamURL: "http://localhost/stream",
|
||||
ErrorMessage: "",
|
||||
}
|
||||
got := TaskStateFromUpdate(u)
|
||||
if got.TaskID != "task-1" || got.Status != "downloading" || got.Progress != 42 {
|
||||
t.Errorf("basic fields wrong: %+v", got)
|
||||
}
|
||||
if got.DownloadedBytes != 1024 || got.TotalBytes != 4096 || got.SpeedBps != 100 {
|
||||
t.Errorf("byte fields wrong: %+v", got)
|
||||
}
|
||||
if got.ResolvedMethod != "torrent" || got.FileName != "movie.mkv" {
|
||||
t.Errorf("method/name fields wrong: %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestShortID(t *testing.T) {
|
||||
if got := ShortID("abcdef1234567890"); got != "abcdef12" {
|
||||
t.Errorf("ShortID = %q", got)
|
||||
}
|
||||
if got := ShortID("short"); got != "short" {
|
||||
t.Errorf("ShortID short = %q", got)
|
||||
}
|
||||
if got := ShortID(""); got != "" {
|
||||
t.Errorf("ShortID empty = %q", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStateFilePath(t *testing.T) {
|
||||
if got := StateFilePath(); got == "" {
|
||||
t.Errorf("StateFilePath should not be empty")
|
||||
}
|
||||
}
|
||||
|
||||
func TestHTTPError(t *testing.T) {
|
||||
e := &HTTPError{StatusCode: 404, Message: "not found"}
|
||||
got := e.Error()
|
||||
if got == "" || got == "API error 0: " {
|
||||
t.Errorf("HTTPError.Error() unexpected: %q", got)
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -18,34 +18,6 @@ type RegisterRequest struct {
|
|||
StreamPort int `json:"streamPort,omitempty"`
|
||||
LanIP string `json:"lanIp,omitempty"`
|
||||
TailscaleIP string `json:"tailscaleIp,omitempty"`
|
||||
// Transcode capabilities — let the web side suggest a smarter quality
|
||||
// before the player even starts. HWAccel is the picked backend
|
||||
// ("nvenc"/"qsv"/"vaapi"/"videotoolbox"/"none"). MaxTranscodeHeight is
|
||||
// the largest output resolution the agent can encode comfortably; for
|
||||
// software-only ffmpeg this is 1080p, with a real GPU encoder it goes
|
||||
// up to 2160p.
|
||||
HWAccel string `json:"hwAccel,omitempty"`
|
||||
MaxTranscodeHeight int `json:"maxTranscodeHeight,omitempty"`
|
||||
// Diagnostic surface filled by engine.DetectHWAccelDiagnostic at daemon
|
||||
// start. Surfaced in the web "Diagnose transcoder" modal so users can
|
||||
// see *why* their HWAccel landed on "none" without running
|
||||
// `unarr probe-hwaccel` locally — most commonly the ffmpeg binary
|
||||
// shipped without HW encoders (linuxbrew, brew's default formula).
|
||||
FFmpegVersion string `json:"ffmpegVersion,omitempty"`
|
||||
FFmpegPath string `json:"ffmpegPath,omitempty"`
|
||||
HWEncoders []string `json:"hwEncoders,omitempty"`
|
||||
HWDevices []string `json:"hwDevices,omitempty"`
|
||||
// Managed-VPN split-tunnel state. The web tracks which agent holds the single
|
||||
// WireGuard slot (1 VPNResellers account = 1 WG keypair = 1 concurrent
|
||||
// connection); other agents are told to use OpenVPN on their host instead.
|
||||
// VPNActive has no omitempty: false is a meaningful state (tunnel down), not
|
||||
// "unset" — the server must see it to release the slot.
|
||||
VPNActive bool `json:"vpnActive"`
|
||||
VPNMode string `json:"vpnMode,omitempty"` // managed | self-hosted
|
||||
VPNServer string `json:"vpnServer,omitempty"`
|
||||
// CloudFlare Quick Tunnel hostname when enabled; the web prefers it over
|
||||
// Tailscale/LAN for in-browser playback because it works on any network.
|
||||
FunnelURL string `json:"funnelUrl,omitempty"`
|
||||
}
|
||||
|
||||
// RegisterResponse is returned by the server after registration.
|
||||
|
|
@ -100,12 +72,6 @@ type Task struct {
|
|||
Episode *int `json:"episode,omitempty"` // Episode number
|
||||
ContentYear *int `json:"contentYear,omitempty"` // Year from TMDB (avoids regex on torrent title)
|
||||
CollectionName string `json:"collectionName,omitempty"` // Collection name (e.g., "Harry Potter Collection")
|
||||
|
||||
// FilePath is the on-disk path of the file the agent is being asked
|
||||
// to operate on. Currently used by mode=seed_file to know which
|
||||
// arbitrary file to wrap as a single-file torrent for browser
|
||||
// streaming; populated by the server from libraryItem.filePath.
|
||||
FilePath string `json:"filePath,omitempty"`
|
||||
}
|
||||
|
||||
// StreamRequest is a request to stream a completed download from disk.
|
||||
|
|
@ -129,9 +95,6 @@ type StatusUpdate struct {
|
|||
StreamURL string `json:"streamUrl,omitempty"`
|
||||
StreamReady bool `json:"streamReady,omitempty"`
|
||||
ErrorMessage string `json:"errorMessage,omitempty"`
|
||||
// mode=seed_file: agent computes the info_hash from the local file
|
||||
// and reports it back so the web player can target /stream/<hash>.
|
||||
InfoHash string `json:"infoHash,omitempty"`
|
||||
}
|
||||
|
||||
// StatusResponse is returned by the status endpoint.
|
||||
|
|
@ -364,15 +327,6 @@ type SyncRequest struct {
|
|||
Tasks []TaskState `json:"tasks"`
|
||||
CanDelete bool `json:"canDelete"` // library.allow_delete is enabled
|
||||
DeleteConfirmed []int `json:"deleteConfirmed,omitempty"` // library item IDs successfully deleted from disk
|
||||
// Live managed-VPN split-tunnel state, sent every sync so the web sees the
|
||||
// WireGuard slot owner update in near-realtime (vs. register, once at startup).
|
||||
// VPNActive has no omitempty: false (tunnel down) must reach the server so it
|
||||
// releases the slot, not be elided as "unset".
|
||||
VPNActive bool `json:"vpnActive"`
|
||||
VPNMode string `json:"vpnMode,omitempty"`
|
||||
VPNServer string `json:"vpnServer,omitempty"`
|
||||
// CloudFlare Quick Tunnel hostname when enabled, else empty.
|
||||
FunnelURL string `json:"funnelUrl,omitempty"`
|
||||
}
|
||||
|
||||
// ControlAction represents a server-side control signal for a task.
|
||||
|
|
@ -388,31 +342,11 @@ type LibraryDeleteRequest struct {
|
|||
FilePath string `json:"filePath"`
|
||||
}
|
||||
|
||||
// StreamSession is a request to open an HLS streaming session for an
|
||||
// in-browser player. The CLI registers the HLS session in the StreamServer's
|
||||
// HLS registry; source bytes come from FilePath (or, when only InfoHash is
|
||||
// set, from a download_task on disk).
|
||||
type StreamSession struct {
|
||||
SessionID string `json:"sessionId"`
|
||||
FilePath string `json:"filePath,omitempty"`
|
||||
InfoHash string `json:"infoHash,omitempty"`
|
||||
TaskID string `json:"taskId,omitempty"`
|
||||
FileName string `json:"fileName,omitempty"`
|
||||
FileSize int64 `json:"fileSize,omitempty"`
|
||||
// Quality target the daemon should aim for when transcoding. One of
|
||||
// "2160p" | "1080p" | "720p" | "480p" | "original" | "" (defer to config).
|
||||
Quality string `json:"quality,omitempty"`
|
||||
// AudioIndex selects the source audio track (-map 0:a:N). -1 means
|
||||
// "use the default/first track".
|
||||
AudioIndex int `json:"audioIndex,omitempty"`
|
||||
}
|
||||
|
||||
// SyncResponse is returned by the server with all pending actions for the CLI.
|
||||
type SyncResponse struct {
|
||||
NewTasks []Task `json:"newTasks,omitempty"`
|
||||
Controls []ControlAction `json:"controls,omitempty"`
|
||||
StreamRequests []StreamRequest `json:"streamRequests,omitempty"`
|
||||
StreamSessions []StreamSession `json:"streamSessions,omitempty"`
|
||||
Watching bool `json:"watching"`
|
||||
Upgrade *UpgradeSignal `json:"upgrade,omitempty"`
|
||||
Scan bool `json:"scan,omitempty"`
|
||||
|
|
|
|||
|
|
@ -1,23 +0,0 @@
|
|||
package cmd
|
||||
|
||||
import (
|
||||
"github.com/torrentclaw/unarr/internal/agent"
|
||||
"github.com/torrentclaw/unarr/internal/config"
|
||||
)
|
||||
|
||||
// newAgentClientFromConfig builds an agent.Client wired with the mirror pool
|
||||
// from the user's TOML config. Use this instead of agent.NewClient in any
|
||||
// long-running command (daemon, status loop, etc.) so a `.com` outage rolls
|
||||
// over to `.to` / .onion without restarting the agent.
|
||||
//
|
||||
// The function lives in cmd/ rather than agent/ because it has to know
|
||||
// about the config struct, and cmd/ is the only place that owns the
|
||||
// "wire defaults + user overrides" rule.
|
||||
func newAgentClientFromConfig(cfg config.Config, userAgent string) *agent.Client {
|
||||
return agent.NewClientWithMirrors(
|
||||
cfg.Auth.APIURL,
|
||||
cfg.Auth.Mirrors,
|
||||
cfg.Auth.APIKey,
|
||||
userAgent,
|
||||
)
|
||||
}
|
||||
|
|
@ -2,7 +2,6 @@ package cmd
|
|||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
|
|
@ -17,11 +16,8 @@ import (
|
|||
"github.com/torrentclaw/unarr/internal/agent"
|
||||
"github.com/torrentclaw/unarr/internal/config"
|
||||
"github.com/torrentclaw/unarr/internal/engine"
|
||||
"github.com/torrentclaw/unarr/internal/funnel"
|
||||
"github.com/torrentclaw/unarr/internal/library"
|
||||
"github.com/torrentclaw/unarr/internal/library/mediainfo"
|
||||
"github.com/torrentclaw/unarr/internal/usenet/download"
|
||||
"github.com/torrentclaw/unarr/internal/vpn"
|
||||
)
|
||||
|
||||
// newStartCmd creates the top-level `unarr start` command.
|
||||
|
|
@ -139,52 +135,22 @@ func runDaemonStart() error {
|
|||
|
||||
userAgent := "unarr/" + Version
|
||||
|
||||
// Probe HW accel + derive a sensible transcode resolution cap. The cap
|
||||
// is what the web side uses to decide whether the user should pre-empt
|
||||
// transcoding by downloading a smaller version (4K source on a software
|
||||
// libx264-only host is the canonical case where pre-download wins).
|
||||
//
|
||||
// Use the full diagnostic (encoders + devices + ffmpeg version) instead
|
||||
// of just the picked backend — the extra fields ride along in the
|
||||
// register payload so the web "Diagnose transcoder" modal can show *why*
|
||||
// libx264 was selected on a host with a GPU (e.g. brew's ffmpeg without
|
||||
// --enable-nvenc). 10 s ceiling so a hung ffmpeg binary can't stall
|
||||
// startup forever.
|
||||
ffmpegResolved, _ := mediainfo.ResolveFFmpeg(cfg.Library.FFmpegPath)
|
||||
probeCtx, probeCancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer probeCancel() // guard against a panic inside DetectHWAccelDiagnostic
|
||||
hwDiag := engine.DetectHWAccelDiagnostic(probeCtx, ffmpegResolved)
|
||||
log.Println(hwDiag.LogLine())
|
||||
hwAccelPick := hwDiag.Pick
|
||||
maxTranscodeHeight := 1080
|
||||
if hwAccelPick != engine.HWAccelNone {
|
||||
maxTranscodeHeight = 2160
|
||||
}
|
||||
|
||||
// Create daemon config
|
||||
daemonCfg := agent.DaemonConfig{
|
||||
AgentID: cfg.Agent.ID,
|
||||
AgentName: cfg.Agent.Name,
|
||||
Version: Version,
|
||||
DownloadDir: cfg.Download.Dir,
|
||||
StreamPort: cfg.Download.StreamPort,
|
||||
LanIP: engine.LanIP(),
|
||||
TailscaleIP: engine.TailscaleIP(),
|
||||
CanDelete: cfg.Library.AllowDelete,
|
||||
ScanPaths: library.ResolveScanPaths(cfg.Download.Dir, cfg.Organize.MoviesDir, cfg.Organize.TVShowsDir, cfg.Library.ScanPath),
|
||||
HWAccel: string(hwAccelPick),
|
||||
MaxTranscodeHeight: maxTranscodeHeight,
|
||||
FFmpegVersion: hwDiag.FFmpegVersion,
|
||||
FFmpegPath: hwDiag.FFmpegPath,
|
||||
HWEncoders: hwDiag.Encoders,
|
||||
HWDevices: hwDiag.Devices,
|
||||
AutoUpgrade: cfg.Daemon.AutoUpgradeEnabled(),
|
||||
AgentID: cfg.Agent.ID,
|
||||
AgentName: cfg.Agent.Name,
|
||||
Version: Version,
|
||||
DownloadDir: cfg.Download.Dir,
|
||||
StreamPort: cfg.Download.StreamPort,
|
||||
LanIP: engine.LanIP(),
|
||||
TailscaleIP: engine.TailscaleIP(),
|
||||
CanDelete: cfg.Library.AllowDelete,
|
||||
ScanPaths: library.ResolveScanPaths(cfg.Download.Dir, cfg.Organize.MoviesDir, cfg.Organize.TVShowsDir, cfg.Library.ScanPath),
|
||||
}
|
||||
|
||||
// Create HTTP client with mirror failover so a `.com` block-out rolls
|
||||
// over to `.to` / .onion without restarting the daemon.
|
||||
agentClient := newAgentClientFromConfig(cfg, userAgent)
|
||||
log.Printf("Transport: HTTP sync → %s (mirrors: %d)", cfg.Auth.APIURL, len(cfg.Auth.Mirrors))
|
||||
// Create HTTP client — single communication channel
|
||||
agentClient := agent.NewClient(cfg.Auth.APIURL, cfg.Auth.APIKey, userAgent)
|
||||
log.Printf("Transport: HTTP sync → %s", cfg.Auth.APIURL)
|
||||
|
||||
// Create daemon
|
||||
d := agent.NewDaemon(daemonCfg, agentClient)
|
||||
|
|
@ -213,68 +179,16 @@ func runDaemonStart() error {
|
|||
reporter := engine.NewProgressReporter(agentClient, statusInterval)
|
||||
reporter.SetWatchingFunc(func() bool { return d.Watching.Load() })
|
||||
|
||||
// Managed-VPN add-on: bring up the in-process WireGuard split-tunnel before
|
||||
// the torrent client so peer + tracker traffic routes through it. Failure is
|
||||
// non-fatal — log and download in the clear (better than refusing to run).
|
||||
var vpnTunnel *vpn.Tunnel
|
||||
if cfg.Download.VPN.ConfigFile != "" {
|
||||
// Self-hosted / personal-VPN mode: read a local .conf directly.
|
||||
raw, rerr := os.ReadFile(cfg.Download.VPN.ConfigFile)
|
||||
if rerr != nil {
|
||||
log.Printf("[vpn] could not read config_file %q (%v) — downloading in the clear", cfg.Download.VPN.ConfigFile, rerr)
|
||||
} else if t, uerr := vpn.Up(string(raw)); uerr != nil {
|
||||
log.Printf("[vpn] tunnel failed to start from config_file (%v) — downloading in the clear", uerr)
|
||||
} else {
|
||||
vpnTunnel = t
|
||||
defer vpnTunnel.Close()
|
||||
log.Printf("[vpn] managed VPN active (local config_file) — torrent traffic split-tunnelled through WireGuard")
|
||||
}
|
||||
} else if cfg.Download.VPN.Enabled {
|
||||
apiURL := cfg.Auth.APIURL
|
||||
if apiURL == "" {
|
||||
apiURL = "https://torrentclaw.com"
|
||||
}
|
||||
fetchCtx, cancel := context.WithTimeout(context.Background(), 25*time.Second)
|
||||
conf, ferr := vpn.FetchConfig(fetchCtx, apiURL, cfg.Auth.APIKey, "unarr/"+Version, cfg.Agent.ID, false)
|
||||
cancel()
|
||||
var fe *vpn.FetchError
|
||||
switch {
|
||||
case ferr != nil && errors.As(ferr, &fe) && fe.Code == vpn.ErrSlotOnDevice:
|
||||
log.Printf("[vpn] the single WireGuard slot is already held by another unarr agent — this one downloads in the clear. To protect this machine too, set up OpenVPN on it (1 agent uses WireGuard, the rest use OpenVPN — up to 10). See https://torrentclaw.com/vpn")
|
||||
case ferr != nil:
|
||||
log.Printf("[vpn] could not enable VPN (%v) — downloading in the clear", ferr)
|
||||
default:
|
||||
if t, uerr := vpn.Up(conf); uerr != nil {
|
||||
log.Printf("[vpn] tunnel failed to start (%v) — downloading in the clear", uerr)
|
||||
} else {
|
||||
vpnTunnel = t
|
||||
defer vpnTunnel.Close()
|
||||
log.Printf("[vpn] managed VPN active — torrent traffic split-tunnelled through WireGuard")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Record VPN split-tunnel state for `unarr vpn status`.
|
||||
if vpnTunnel != nil {
|
||||
mode := "managed"
|
||||
if cfg.Download.VPN.ConfigFile != "" {
|
||||
mode = "self-hosted"
|
||||
}
|
||||
d.SetVPNState(true, mode, vpnTunnel.Endpoint)
|
||||
}
|
||||
|
||||
// Create torrent downloader
|
||||
torrentDl, err := engine.NewTorrentDownloader(engine.TorrentConfig{
|
||||
DataDir: cfg.Download.Dir,
|
||||
PieceCompletionDir: config.DataDir(), // keep piece-completion DB off NFS/SMB mounts
|
||||
MetadataTimeout: metaTimeout,
|
||||
StallTimeout: stallTimeout,
|
||||
MaxTimeout: 0,
|
||||
MaxDownloadRate: maxDl,
|
||||
MaxUploadRate: maxUl,
|
||||
ListenPort: cfg.Download.ListenPort,
|
||||
SeedEnabled: false,
|
||||
VPNTunnel: vpnTunnel,
|
||||
DataDir: cfg.Download.Dir,
|
||||
MetadataTimeout: metaTimeout,
|
||||
StallTimeout: stallTimeout,
|
||||
MaxTimeout: 0,
|
||||
MaxDownloadRate: maxDl,
|
||||
MaxUploadRate: maxUl,
|
||||
ListenPort: cfg.Download.ListenPort,
|
||||
SeedEnabled: false,
|
||||
})
|
||||
if err != nil {
|
||||
return fmt.Errorf("create torrent downloader: %w", err)
|
||||
|
|
@ -309,74 +223,11 @@ func runDaemonStart() error {
|
|||
|
||||
// Create persistent stream server
|
||||
streamSrv := engine.NewStreamServer(cfg.Download.StreamPort)
|
||||
streamSrv.SetUPnPEnabled(cfg.Download.EnableUPnP)
|
||||
// CORS extras = operator config + dynamic mirror list from /api/mirrors.
|
||||
// Without the mirror merge, a user playing from `torrentclaw.to` (or any
|
||||
// future mirror) hits the daemon, gets 200 + body, but no
|
||||
// `Access-Control-Allow-Origin` → browser drops the response → player
|
||||
// reports "404 todos los canales". Fetching /api/mirrors at startup
|
||||
// future-proofs against mirror additions without a CLI rebuild.
|
||||
corsExtras := append([]string(nil), cfg.Download.CORSExtraOrigins...)
|
||||
corsExtras = append(corsExtras, mirrorCORSOrigins(ctx, cfg, userAgent)...)
|
||||
streamSrv.SetCORSAllowedOrigins(corsExtras)
|
||||
// Reap HLS tmpdirs left over from a previous daemon run before we start
|
||||
// accepting new sessions. The in-memory registry doesn't survive a
|
||||
// restart, so without this disk usage grows unbounded across restarts.
|
||||
if err := engine.CleanupHLSOrphanDirs(); err != nil {
|
||||
log.Printf("[hls] orphan tmpdir cleanup: %v", err)
|
||||
}
|
||||
|
||||
// Persistent HLS segment cache — survives across sessions so re-plays
|
||||
// of the same file at the same quality skip ffmpeg entirely. Off when
|
||||
// hls_cache.enabled = false; size cap from hls_cache.size_gb; path from
|
||||
// hls_cache.dir (defaults to ~/.cache/unarr/hls-cache).
|
||||
var hlsCache *engine.HLSCache
|
||||
if cfg.Download.HLSCache.Enabled {
|
||||
cacheDir := cfg.Download.HLSCache.Dir
|
||||
if cacheDir == "" {
|
||||
if base, err := os.UserCacheDir(); err == nil {
|
||||
cacheDir = filepath.Join(base, "unarr", "hls-cache")
|
||||
} else {
|
||||
cacheDir = filepath.Join(os.TempDir(), "unarr-hls-cache")
|
||||
}
|
||||
}
|
||||
c, err := engine.NewHLSCache(cacheDir, cfg.Download.HLSCache.SizeGB)
|
||||
if err != nil {
|
||||
log.Printf("[hls_cache] init failed (%v) — falling back to per-session tmpdirs", err)
|
||||
} else {
|
||||
hlsCache = c
|
||||
hlsCache.StartSweeper(ctx, time.Hour)
|
||||
log.Printf("[hls_cache] enabled: dir=%s budget=%dGB", cacheDir, cfg.Download.HLSCache.SizeGB)
|
||||
}
|
||||
} else {
|
||||
log.Printf("[hls_cache] disabled by config — every play re-encodes from scratch")
|
||||
}
|
||||
if err := streamSrv.Listen(ctx); err != nil {
|
||||
return fmt.Errorf("start stream server: %w", err)
|
||||
}
|
||||
d.UpdateStreamPort(streamSrv.Port())
|
||||
|
||||
// CloudFlare Quick Tunnel — needs the ACTUAL listening port (the
|
||||
// configured port may have been busy and bumped). Spawning here ensures
|
||||
// cloudflared --url points at the right socket. Failures degrade to
|
||||
// Tailscale/LAN only; the supervisor keeps the tunnel up across CF's
|
||||
// periodic rotation + transient cloudflared crashes.
|
||||
if cfg.Download.Funnel.Enabled {
|
||||
go superviseFunnel(ctx, d, streamSrv.Port())
|
||||
}
|
||||
|
||||
// Warn at startup if transcode is enabled but ffmpeg/ffprobe are missing.
|
||||
// HLS sessions get rejected at runtime (see daemon.go ~line 455), but
|
||||
// surfacing it here gives the operator a chance to install ffmpeg before
|
||||
// a user hits a confusing "rejected" line in the logs.
|
||||
if cfg.Download.Transcode.Enabled {
|
||||
if _, err := mediainfo.ResolveFFmpeg(cfg.Library.FFmpegPath); err != nil {
|
||||
log.Printf("[hls] transcode enabled but ffmpeg/ffprobe not found — install ffmpeg to use HLS")
|
||||
} else if _, err := mediainfo.ResolveFFprobe(cfg.Library.FFprobePath); err != nil {
|
||||
log.Printf("[hls] transcode enabled but ffmpeg/ffprobe not found — install ffmpeg to use HLS")
|
||||
}
|
||||
}
|
||||
|
||||
// Wire sync client callbacks
|
||||
sc := d.SyncClient()
|
||||
sc.GetFreeSlots = manager.FreeSlots
|
||||
|
|
@ -550,77 +401,6 @@ func runDaemonStart() error {
|
|||
}()
|
||||
}
|
||||
|
||||
// Wire: sync receives HLS streaming session requests. Each session spawns
|
||||
// one ffmpeg process and registers its HLS playlist with the StreamServer.
|
||||
// Validate FilePath against allowed dirs to prevent path traversal abuse
|
||||
// from a compromised server.
|
||||
d.OnStreamSession = func(sess agent.StreamSession) {
|
||||
if playerSessionRegistry.has(sess.SessionID) {
|
||||
return // already running
|
||||
}
|
||||
filePath := sess.FilePath
|
||||
if filePath == "" {
|
||||
log.Printf("[hls %s] rejected: empty file path", agent.ShortID(sess.SessionID))
|
||||
return
|
||||
}
|
||||
filePath = filepath.Clean(filePath)
|
||||
if !isAllowedStreamPath(filePath, cfg.Download.Dir, cfg.Library.ScanPath,
|
||||
cfg.Organize.MoviesDir, cfg.Organize.TVShowsDir) {
|
||||
log.Printf("[hls %s] rejected: path outside allowed dirs: %s",
|
||||
agent.ShortID(sess.SessionID), filePath)
|
||||
return
|
||||
}
|
||||
// Resolve directory → first video file (matches StreamRequest behavior).
|
||||
if info, err := os.Stat(filePath); err == nil && info.IsDir() {
|
||||
found := engine.FindVideoFile(filePath)
|
||||
if found == "" {
|
||||
log.Printf("[hls %s] rejected: no video file in dir %s",
|
||||
agent.ShortID(sess.SessionID), filePath)
|
||||
return
|
||||
}
|
||||
filePath = found
|
||||
}
|
||||
|
||||
tcRuntime := buildTranscodeRuntime(ctx, cfg)
|
||||
if tcRuntime.FFmpegPath == "" || tcRuntime.FFprobePath == "" {
|
||||
log.Printf("[hls %s] rejected: ffmpeg/ffprobe unavailable", agent.ShortID(sess.SessionID))
|
||||
return
|
||||
}
|
||||
hlsCtx, hlsCancel := context.WithCancel(ctx)
|
||||
playerSessionRegistry.add(sess.SessionID, hlsCancel)
|
||||
hlsCfg := engine.HLSSessionConfig{
|
||||
SessionID: sess.SessionID,
|
||||
SourcePath: filePath,
|
||||
FileName: sess.FileName,
|
||||
Quality: sess.Quality,
|
||||
AudioIndex: sess.AudioIndex,
|
||||
Transcode: tcRuntime,
|
||||
Cache: hlsCache,
|
||||
}
|
||||
// StartHLSSession runs ffprobe (15 s cap, typical 0.3–1 s) before
|
||||
// returning. Doing this synchronously inside the sync handler holds
|
||||
// the next sync HTTP cycle until ffprobe is done, so any other
|
||||
// pending actions (new tasks, deletes) wait too. Hand it off so
|
||||
// the sync loop returns immediately — browser HEAD probes already
|
||||
// have a 30 s retry budget that absorbs the gap until
|
||||
// `streamSrv.HLS().Register` lands.
|
||||
go func() {
|
||||
hsess, err := engine.StartHLSSession(hlsCtx, hlsCfg)
|
||||
if err != nil {
|
||||
playerSessionRegistry.remove(sess.SessionID)
|
||||
hlsCancel()
|
||||
log.Printf("[hls %s] start failed: %v", agent.ShortID(sess.SessionID), err)
|
||||
return
|
||||
}
|
||||
streamSrv.HLS().Register(hsess)
|
||||
// Tell the server seg-0 is on disk as soon as it lands so the
|
||||
// player's SSE subscription flips its "Preparando…" UI without
|
||||
// waiting for the browser HEAD-probe loop to discover it
|
||||
// independently. Cache-HIT sessions are ready immediately.
|
||||
go watchSessionReady(hlsCtx, agentClient, hsess, sess.SessionID)
|
||||
}()
|
||||
}
|
||||
|
||||
// Periodic DHT node persistence (every 5 min)
|
||||
go func() {
|
||||
ticker := time.NewTicker(5 * time.Minute)
|
||||
|
|
@ -635,25 +415,6 @@ func runDaemonStart() error {
|
|||
}
|
||||
}()
|
||||
|
||||
// Periodic HLS session sweeper (every 5 min). Closes sessions whose last
|
||||
// segment fetch was over 30 min ago — kills the orphan ffmpeg + removes
|
||||
// the per-session tmpdir, so a tab that died mid-stream doesn't leak
|
||||
// disk space until daemon shutdown.
|
||||
go func() {
|
||||
ticker := time.NewTicker(5 * time.Minute)
|
||||
defer ticker.Stop()
|
||||
for {
|
||||
select {
|
||||
case <-ticker.C:
|
||||
if n := streamSrv.HLS().SweepIdle(); n > 0 {
|
||||
log.Printf("[hls] swept %d idle session(s)", n)
|
||||
}
|
||||
case <-ctx.Done():
|
||||
return
|
||||
}
|
||||
}
|
||||
}()
|
||||
|
||||
// Start auto-scan goroutine
|
||||
scanPaths := daemonCfg.ScanPaths
|
||||
if len(scanPaths) > 0 && cfg.Library.AutoScan {
|
||||
|
|
@ -687,7 +448,6 @@ func runDaemonStart() error {
|
|||
case sig := <-sigCh:
|
||||
fmt.Printf("\n Received %s, shutting down...\n", sig)
|
||||
cancelStreamContexts()
|
||||
cancelAllPlayerSessions()
|
||||
streamSrv.Shutdown(context.Background())
|
||||
cancel()
|
||||
|
||||
|
|
@ -702,7 +462,6 @@ func runDaemonStart() error {
|
|||
|
||||
case err := <-errCh:
|
||||
cancelStreamContexts()
|
||||
cancelAllPlayerSessions()
|
||||
streamSrv.Shutdown(context.Background())
|
||||
cancel()
|
||||
return err
|
||||
|
|
@ -850,144 +609,3 @@ func runAutoScan(ctx context.Context, cfg config.Config, interval time.Duration,
|
|||
}
|
||||
}
|
||||
}
|
||||
|
||||
// superviseFunnel keeps a CloudFlare Quick Tunnel up across cloudflared
|
||||
// crashes and CF's ~6h tunnel rotation. On a clean exit (cancellation) it
|
||||
// returns; on a crash it clears the reported URL and respawns with an
|
||||
// exponential backoff so we don't hammer cloudflared into a tight loop when
|
||||
// it can't reach the CF edge.
|
||||
func superviseFunnel(ctx context.Context, d *agent.Daemon, port int) {
|
||||
backoff := 2 * time.Second
|
||||
const maxBackoff = 5 * time.Minute
|
||||
for ctx.Err() == nil {
|
||||
t, err := funnel.Start(ctx, funnel.Config{Port: port})
|
||||
if err != nil {
|
||||
log.Printf("[funnel] could not start CloudFlare tunnel (%v) — retrying in %s", err, backoff)
|
||||
select {
|
||||
case <-time.After(backoff):
|
||||
case <-ctx.Done():
|
||||
return
|
||||
}
|
||||
backoff = min(backoff*2, maxBackoff)
|
||||
continue
|
||||
}
|
||||
log.Printf("[funnel] cloudflared started, waiting for public URL...")
|
||||
go func() {
|
||||
url, werr := t.WaitURL(45 * time.Second)
|
||||
if werr != nil {
|
||||
log.Printf("[funnel] cloudflared did not emit a URL (%v)", werr)
|
||||
return
|
||||
}
|
||||
log.Printf("[funnel] public URL: %s", url)
|
||||
d.SetFunnelURL(url)
|
||||
}()
|
||||
// Block until cloudflared exits (CF rotation, crash, or shutdown).
|
||||
exitErr := <-t.Done()
|
||||
_ = t.Close()
|
||||
d.SetFunnelURL("")
|
||||
if ctx.Err() != nil {
|
||||
return
|
||||
}
|
||||
if exitErr != nil {
|
||||
log.Printf("[funnel] cloudflared exited: %v — restarting in %s", exitErr, backoff)
|
||||
} else {
|
||||
log.Printf("[funnel] cloudflared exited cleanly — restarting in %s", backoff)
|
||||
}
|
||||
select {
|
||||
case <-time.After(backoff):
|
||||
case <-ctx.Done():
|
||||
return
|
||||
}
|
||||
backoff = min(backoff*2, maxBackoff)
|
||||
}
|
||||
}
|
||||
|
||||
// mirrorCORSOrigins fetches /api/mirrors from the configured primary (+ extra
|
||||
// mirror candidates + static IPFS fallback) and returns the discovered URLs as
|
||||
// Origin strings. Best-effort: any failure logs a warning and returns an empty
|
||||
// slice; the static defaultCORSAllowedOrigins in validate.go covers the known
|
||||
// mirrors (.com / .to / built-in onion) so the daemon still accepts the
|
||||
// official surfaces when this call fails.
|
||||
//
|
||||
// Bounded to a short timeout so a slow /api/mirrors response can't delay
|
||||
// daemon startup — every second here is a second the user can't play.
|
||||
func mirrorCORSOrigins(parent context.Context, cfg config.Config, userAgent string) []string {
|
||||
ctx, cancel := context.WithTimeout(parent, 10*time.Second)
|
||||
defer cancel()
|
||||
|
||||
candidates := append([]string{cfg.Auth.APIURL}, cfg.Auth.Mirrors...)
|
||||
resp, err := agent.FetchMirrorsWithFallback(ctx, candidates, userAgent)
|
||||
if err != nil {
|
||||
log.Printf("[cors] mirror discovery failed (%v) — using static allowlist only", err)
|
||||
return nil
|
||||
}
|
||||
|
||||
seen := make(map[string]struct{})
|
||||
out := make([]string, 0, len(resp.Mirrors))
|
||||
add := func(rawURL string) {
|
||||
if rawURL == "" {
|
||||
return
|
||||
}
|
||||
origin := strings.TrimRight(rawURL, "/")
|
||||
if _, dup := seen[origin]; dup {
|
||||
return
|
||||
}
|
||||
seen[origin] = struct{}{}
|
||||
out = append(out, origin)
|
||||
}
|
||||
for _, m := range resp.Mirrors {
|
||||
add(m.URL)
|
||||
}
|
||||
if resp.Tor != nil {
|
||||
add(resp.Tor.URL)
|
||||
}
|
||||
if len(out) > 0 {
|
||||
log.Printf("[cors] merged %d mirror origins from /api/mirrors", len(out))
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// watchSessionReady polls HLSSession.ReadyCount until the first segment +
|
||||
// init.mp4 are on disk, then POSTs /api/internal/agent/session-ready so
|
||||
// the web side flips streaming_session.ready_at — which its SSE endpoint
|
||||
// pushes to subscribed players. Cache-HIT sessions are ready the moment
|
||||
// StartHLSSession returns and POST immediately.
|
||||
//
|
||||
// Bounded by a 60 s deadline so a permanently stuck encoder doesn't keep
|
||||
// a goroutine alive forever; if seg-0 never lands the player falls back
|
||||
// to its existing HEAD-probe retry path anyway.
|
||||
func watchSessionReady(ctx context.Context, client *agent.Client, hsess *engine.HLSSession, sessionID string) {
|
||||
deadline := time.Now().Add(60 * time.Second)
|
||||
ticker := time.NewTicker(200 * time.Millisecond)
|
||||
defer ticker.Stop()
|
||||
for {
|
||||
// Session torn down through a path that didn't cancel ctx (registry
|
||||
// replace, idle sweep, internal kill). Bail before polling further —
|
||||
// without this check the watcher could keep alive for up to 60 s on
|
||||
// a dead HLSSession that's never going to become ready.
|
||||
if hsess.IsClosed() {
|
||||
return
|
||||
}
|
||||
// Cache HIT or seg-0 ready → notify + done.
|
||||
if hsess.FromCache() || hsess.ReadyCount() >= 1 {
|
||||
// Parent ctx so a session cancel mid-POST (user closed tab,
|
||||
// daemon shutdown) tears down the in-flight webhook instead of
|
||||
// blocking the goroutine for up to 10 s on a now-orphan call.
|
||||
rctx, cancel := context.WithTimeout(ctx, 10*time.Second)
|
||||
if err := client.MarkSessionReady(rctx, sessionID); err != nil {
|
||||
log.Printf("[hls %s] mark-ready failed: %v", agent.ShortID(sessionID), err)
|
||||
}
|
||||
cancel()
|
||||
return
|
||||
}
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return
|
||||
case <-ticker.C:
|
||||
}
|
||||
if time.Now().After(deadline) {
|
||||
log.Printf("[hls %s] mark-ready: timeout waiting for seg-0", agent.ShortID(sessionID))
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
package cmd
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
|
|
@ -263,12 +262,9 @@ func runDaemonReload() error {
|
|||
// stopDaemonByPID reads the state file and sends a graceful stop to the daemon PID.
|
||||
// Used as fallback on platforms without a service manager (and as Windows implementation).
|
||||
func stopDaemonByPID() error {
|
||||
state, err := agent.LoadState()
|
||||
if err != nil {
|
||||
if errors.Is(err, agent.ErrDaemonNotRunning) {
|
||||
return err
|
||||
}
|
||||
return fmt.Errorf("read daemon state: %w", err)
|
||||
state := agent.ReadState()
|
||||
if state == nil {
|
||||
return fmt.Errorf("daemon does not appear to be running (state file not found)")
|
||||
}
|
||||
return killPID(state.PID)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -119,10 +119,11 @@ func runDownloadWithDeps(input, method string, deps downloadDeps) error {
|
|||
return fmt.Errorf("create downloader: %w", err)
|
||||
}
|
||||
|
||||
// Local-only reporter: one-shot downloads have no server-side task, so a nil
|
||||
// client keeps terminal progress working without spamming the status API
|
||||
// (which 400s the synthetic "oneshot-" id).
|
||||
reporter := engine.NewProgressReporter(nil, 5*time.Second)
|
||||
// Create a dummy reporter (no API reporting for one-shot)
|
||||
reporter := engine.NewProgressReporter(
|
||||
deps.newAgentClient(cfg.Auth.APIURL, cfg.Auth.APIKey, "unarr/"+Version),
|
||||
5*time.Second,
|
||||
)
|
||||
|
||||
debridDl := deps.newDebridDl()
|
||||
|
||||
|
|
|
|||
|
|
@ -1,165 +0,0 @@
|
|||
package cmd
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/fatih/color"
|
||||
"github.com/spf13/cobra"
|
||||
"github.com/torrentclaw/unarr/internal/agent"
|
||||
"github.com/torrentclaw/unarr/internal/config"
|
||||
)
|
||||
|
||||
func newFunnelCmd() *cobra.Command {
|
||||
cmd := &cobra.Command{
|
||||
Use: "funnel",
|
||||
Short: "Expose the daemon over a public HTTPS hostname via CloudFlare Quick Tunnel",
|
||||
Long: `Turn the CloudFlare Quick Tunnel on/off and check its status.
|
||||
|
||||
When on, the daemon spawns cloudflared as a child process and registers a
|
||||
` + "`https://<random>.trycloudflare.com`" + ` hostname tunnelled to its local
|
||||
HLS server. The torrentclaw.com / torrentclaw.to web player picks the tunnel
|
||||
URL first so cross-network playback works from any browser without Tailscale
|
||||
or port forwarding.
|
||||
|
||||
Trade-offs:
|
||||
• Bytes proxy through CloudFlare. We don't relay; CF does. Preserves the
|
||||
TorrentClaw legal posture but means CF sees your traffic shape.
|
||||
• Quick Tunnels are anonymous — no CF account required.
|
||||
• Hostname is random per session and rotates roughly every 6 h.
|
||||
|
||||
Requires the cloudflared binary on PATH. Install:
|
||||
Linux : https://pkg.cloudflare.com (apt) or download from
|
||||
https://github.com/cloudflare/cloudflared/releases
|
||||
macOS : brew install cloudflared
|
||||
Windows: winget install --id Cloudflare.cloudflared`,
|
||||
Example: ` unarr funnel status # is the tunnel up? what's the URL?
|
||||
unarr funnel on # turn it on
|
||||
unarr funnel off # turn it off`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return cmd.Help()
|
||||
},
|
||||
}
|
||||
cmd.AddCommand(newFunnelStatusCmd(), newFunnelOnCmd(), newFunnelOffCmd())
|
||||
return cmd
|
||||
}
|
||||
|
||||
func newFunnelStatusCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "status",
|
||||
Short: "Show CloudFlare tunnel configuration + live URL",
|
||||
Example: " unarr funnel status",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return runFunnelStatus()
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func runFunnelStatus() error {
|
||||
bold := color.New(color.Bold)
|
||||
dim := color.New(color.FgHiBlack)
|
||||
green := color.New(color.FgGreen)
|
||||
yellow := color.New(color.FgYellow)
|
||||
cyan := color.New(color.FgCyan)
|
||||
|
||||
cfg := loadConfig()
|
||||
|
||||
fmt.Println()
|
||||
bold.Println(" CloudFlare Quick Tunnel")
|
||||
fmt.Println()
|
||||
|
||||
if !cfg.Download.Funnel.Enabled {
|
||||
dim.Println(" Mode: off")
|
||||
fmt.Println()
|
||||
dim.Println(" Enable with `unarr funnel on` to give the daemon a public HTTPS URL")
|
||||
dim.Println(" so cross-network browser playback works without Tailscale.")
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
cyan.Println(" Mode: on")
|
||||
|
||||
state := agent.ReadState()
|
||||
alive := state != nil && isDaemonAlive(state)
|
||||
fmt.Println()
|
||||
switch {
|
||||
case alive && state.FunnelURL != "":
|
||||
green.Println(" ✓ Tunnel ACTIVE")
|
||||
fmt.Printf(" URL: %s\n", state.FunnelURL)
|
||||
fmt.Println()
|
||||
dim.Println(" This URL rotates roughly every 6 h. The web player picks it up")
|
||||
dim.Println(" automatically — no action needed on your side.")
|
||||
case alive:
|
||||
yellow.Println(" ⚠ Daemon is running but the tunnel hasn't registered yet.")
|
||||
dim.Println(" Check `unarr daemon logs` for a [funnel] line. Common cause:")
|
||||
dim.Println(" cloudflared isn't installed on PATH.")
|
||||
default:
|
||||
dim.Println(" Daemon not running — start it (`unarr start`) to bring the tunnel up.")
|
||||
}
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
|
||||
func newFunnelOnCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "on",
|
||||
Short: "Turn the CloudFlare tunnel on",
|
||||
Example: " unarr funnel on",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return setFunnelEnabled(true)
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func newFunnelOffCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "off",
|
||||
Short: "Turn the CloudFlare tunnel off",
|
||||
Example: " unarr funnel off",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return setFunnelEnabled(false)
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func setFunnelEnabled(enabled bool) error {
|
||||
green := color.New(color.FgGreen)
|
||||
dim := color.New(color.FgHiBlack)
|
||||
|
||||
cfg := loadConfig()
|
||||
if cfg.Download.Funnel.Enabled == enabled {
|
||||
fmt.Println()
|
||||
dim.Printf(" Tunnel is already %s — nothing to do.\n", onOffWord(enabled))
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
|
||||
cfg.Download.Funnel.Enabled = enabled
|
||||
|
||||
configPath := config.FilePath()
|
||||
if cfgFile != "" {
|
||||
configPath = cfgFile
|
||||
}
|
||||
if err := config.Save(cfg, configPath); err != nil {
|
||||
return fmt.Errorf("save config: %w", err)
|
||||
}
|
||||
appCfg = cfg
|
||||
|
||||
fmt.Println()
|
||||
green.Printf(" ✓ CloudFlare tunnel %s.\n", onOffWord(enabled))
|
||||
|
||||
// Subprocess is launched/torn down by the daemon at startup; a plain config
|
||||
// reload does not bring it up. Prompt for a restart when the daemon is alive.
|
||||
if state := agent.ReadState(); state != nil && isDaemonAlive(state) {
|
||||
fmt.Println()
|
||||
dim.Println(" The daemon is running. Restart it for this to take effect:")
|
||||
dim.Println(" unarr daemon restart")
|
||||
}
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
|
||||
func onOffWord(enabled bool) string {
|
||||
if enabled {
|
||||
return "on"
|
||||
}
|
||||
return "off"
|
||||
}
|
||||
|
|
@ -9,21 +9,12 @@ import (
|
|||
)
|
||||
|
||||
// openBrowser opens a URL in the default browser.
|
||||
//
|
||||
// The URL is restricted to http(s) so that a hostile caller cannot trick
|
||||
// xdg-open/open into interpreting it as a flag (a leading "-" would otherwise
|
||||
// match a switch on every helper we shell out to). Where the helper supports
|
||||
// it we also append "--" to terminate switch parsing as belt-and-braces.
|
||||
func openBrowser(url string) {
|
||||
if !isSafeBrowserURL(url) {
|
||||
return
|
||||
}
|
||||
var c *exec.Cmd
|
||||
switch runtime.GOOS {
|
||||
case "darwin":
|
||||
c = exec.Command("open", "--", url)
|
||||
c = exec.Command("open", url)
|
||||
case "windows":
|
||||
// rundll32 does not parse switches from positional args.
|
||||
c = exec.Command("rundll32", "url.dll,FileProtocolHandler", url)
|
||||
default: // linux, freebsd
|
||||
c = exec.Command("xdg-open", url)
|
||||
|
|
@ -31,12 +22,6 @@ func openBrowser(url string) {
|
|||
_ = c.Start() // fire and forget; best-effort
|
||||
}
|
||||
|
||||
// isSafeBrowserURL accepts only http(s) URLs. Other schemes (file://, javascript:,
|
||||
// data:, ...) and flag-shaped strings ("--help") are rejected.
|
||||
func isSafeBrowserURL(url string) bool {
|
||||
return strings.HasPrefix(url, "http://") || strings.HasPrefix(url, "https://")
|
||||
}
|
||||
|
||||
// defaultDownloadDir returns a sensible default download directory.
|
||||
func defaultDownloadDir() string {
|
||||
home, _ := os.UserHomeDir()
|
||||
|
|
|
|||
|
|
@ -31,32 +31,6 @@ func TestExpandHome(t *testing.T) {
|
|||
}
|
||||
}
|
||||
|
||||
func TestIsSafeBrowserURL(t *testing.T) {
|
||||
good := []string{
|
||||
"http://localhost:3000",
|
||||
"https://torrentclaw.com/some/path?q=1",
|
||||
}
|
||||
bad := []string{
|
||||
"--help",
|
||||
"-version",
|
||||
"file:///etc/passwd",
|
||||
"javascript:alert(1)",
|
||||
"data:text/html,foo",
|
||||
"ftp://example.com",
|
||||
"",
|
||||
}
|
||||
for _, u := range good {
|
||||
if !isSafeBrowserURL(u) {
|
||||
t.Errorf("isSafeBrowserURL(%q) = false, want true", u)
|
||||
}
|
||||
}
|
||||
for _, u := range bad {
|
||||
if isSafeBrowserURL(u) {
|
||||
t.Errorf("isSafeBrowserURL(%q) = true, want false", u)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestDefaultDownloadDir(t *testing.T) {
|
||||
dir := defaultDownloadDir()
|
||||
if dir == "" {
|
||||
|
|
|
|||
|
|
@ -1,204 +0,0 @@
|
|||
package cmd
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/fatih/color"
|
||||
"github.com/spf13/cobra"
|
||||
"github.com/torrentclaw/unarr/internal/agent"
|
||||
"github.com/torrentclaw/unarr/internal/config"
|
||||
)
|
||||
|
||||
// newMirrorsCmd wires `unarr mirrors` and its subcommands.
|
||||
//
|
||||
// Mirrors are alternate base URLs the agent can fall back to when the
|
||||
// primary api_url is unreachable. The pool is consulted on every transient
|
||||
// network failure (DNS, refused, timeout, 5xx) — see internal/agent/
|
||||
// mirror_pool.go for the rotation rules.
|
||||
func newMirrorsCmd() *cobra.Command {
|
||||
cmd := &cobra.Command{
|
||||
Use: "mirrors",
|
||||
Short: "Manage TorrentClaw mirror failover list",
|
||||
Long: `Mirrors are alternate base URLs the agent falls back to when the primary
|
||||
domain is unreachable. The pool survives DNS blocks, ISP filters, and
|
||||
short-lived takedowns without restarting the agent.
|
||||
|
||||
Examples:
|
||||
unarr mirrors list Print currently configured mirrors
|
||||
unarr mirrors update Refresh from the server's canonical list
|
||||
unarr mirrors test Probe every configured mirror`,
|
||||
}
|
||||
|
||||
cmd.AddCommand(newMirrorsListCmd())
|
||||
cmd.AddCommand(newMirrorsUpdateCmd())
|
||||
cmd.AddCommand(newMirrorsTestCmd())
|
||||
return cmd
|
||||
}
|
||||
|
||||
func newMirrorsListCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "list",
|
||||
Short: "Print currently configured mirrors",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
cfg := loadConfig()
|
||||
pool := agent.NewMirrorPool(cfg.Auth.APIURL, cfg.Auth.Mirrors)
|
||||
|
||||
if jsonOut {
|
||||
out := map[string]any{
|
||||
"primary": cfg.Auth.APIURL,
|
||||
"mirrors": pool.Mirrors(),
|
||||
}
|
||||
return json.NewEncoder(os.Stdout).Encode(out)
|
||||
}
|
||||
|
||||
fmt.Printf("Primary: %s\n", color.GreenString(cfg.Auth.APIURL))
|
||||
if len(cfg.Auth.Mirrors) == 0 {
|
||||
fmt.Println("Fallbacks: (none configured — run `unarr mirrors update`)")
|
||||
return nil
|
||||
}
|
||||
fmt.Println("Fallbacks:")
|
||||
for i, m := range cfg.Auth.Mirrors {
|
||||
fmt.Printf(" %d. %s\n", i+1, m)
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func newMirrorsUpdateCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "update",
|
||||
Short: "Refresh the mirror list from the server",
|
||||
Long: `Fetch /api/v1/mirrors from the configured primary (with fallback to any
|
||||
currently-known mirrors) and write the resulting list back to config.toml.
|
||||
|
||||
This is how long-running agents survive a takedown of the primary domain:
|
||||
the user runs ` + "`unarr mirrors update`" + ` once a week (or via cron), and
|
||||
the agent transparently picks up new mirrors without a CLI release.`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
cfg := loadConfig()
|
||||
|
||||
// Candidate set: primary + any currently-known mirrors. Order matters —
|
||||
// we try primary first so the most-trusted endpoint wins.
|
||||
candidates := append([]string{cfg.Auth.APIURL}, cfg.Auth.Mirrors...)
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
|
||||
defer cancel()
|
||||
|
||||
fmt.Println("Refreshing mirror list...")
|
||||
resp, err := agent.FetchMirrorsWithFallback(ctx, candidates, "unarr/"+Version)
|
||||
if err != nil {
|
||||
return fmt.Errorf("fetch mirrors: %w", err)
|
||||
}
|
||||
|
||||
primary, extras := resp.ToConfig()
|
||||
if primary == "" {
|
||||
return fmt.Errorf("server returned no mirrors")
|
||||
}
|
||||
|
||||
// Track what changed so we can give the user a clear diff.
|
||||
added, removed := diffMirrors(append([]string{cfg.Auth.APIURL}, cfg.Auth.Mirrors...), append([]string{primary}, extras...))
|
||||
|
||||
cfg.Auth.APIURL = primary
|
||||
cfg.Auth.Mirrors = extras
|
||||
if err := config.Save(cfg, cfgFile); err != nil {
|
||||
return fmt.Errorf("save config: %w", err)
|
||||
}
|
||||
|
||||
fmt.Printf("%s revision %d (%d mirror%s)\n",
|
||||
color.GreenString("✓"), resp.Revision, len(resp.Mirrors), pluralS(len(resp.Mirrors)))
|
||||
fmt.Printf(" Primary: %s\n", primary)
|
||||
if len(extras) > 0 {
|
||||
fmt.Printf(" Fallbacks: %s\n", strings.Join(extras, ", "))
|
||||
}
|
||||
if resp.Tor != nil {
|
||||
fmt.Printf(" Tor: %s\n", resp.Tor.URL)
|
||||
}
|
||||
for _, c := range resp.Channels {
|
||||
fmt.Printf(" Channel: %s — %s\n", c.Label, c.URL)
|
||||
}
|
||||
if len(added) > 0 {
|
||||
fmt.Printf(" %s %s\n", color.GreenString("added:"), strings.Join(added, ", "))
|
||||
}
|
||||
if len(removed) > 0 {
|
||||
fmt.Printf(" %s %s\n", color.YellowString("removed:"), strings.Join(removed, ", "))
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func newMirrorsTestCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "test",
|
||||
Short: "Probe every configured mirror",
|
||||
Long: `Performs a small unauthenticated HEAD/GET against /api/health on every
|
||||
configured mirror and reports latency + reachability.`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
cfg := loadConfig()
|
||||
all := append([]string{cfg.Auth.APIURL}, cfg.Auth.Mirrors...)
|
||||
if len(all) == 0 {
|
||||
return fmt.Errorf("no mirrors configured")
|
||||
}
|
||||
|
||||
for _, base := range all {
|
||||
if base == "" {
|
||||
continue
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 6*time.Second)
|
||||
start := time.Now()
|
||||
_, err := agent.FetchMirrors(ctx, []string{base}, "unarr/"+Version)
|
||||
cancel()
|
||||
elapsed := time.Since(start)
|
||||
if err != nil {
|
||||
fmt.Printf(" %s %s — %s (%s)\n", color.RedString("✗"), base, err, elapsed.Round(time.Millisecond))
|
||||
continue
|
||||
}
|
||||
fmt.Printf(" %s %s (%s)\n", color.GreenString("✓"), base, elapsed.Round(time.Millisecond))
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// diffMirrors returns the URLs added and removed between two ordered lists.
|
||||
// Used to print a friendly diff after `unarr mirrors update`.
|
||||
func diffMirrors(old, fresh []string) (added, removed []string) {
|
||||
oldSet := make(map[string]struct{}, len(old))
|
||||
for _, m := range old {
|
||||
if m != "" {
|
||||
oldSet[m] = struct{}{}
|
||||
}
|
||||
}
|
||||
freshSet := make(map[string]struct{}, len(fresh))
|
||||
for _, m := range fresh {
|
||||
if m == "" {
|
||||
continue
|
||||
}
|
||||
freshSet[m] = struct{}{}
|
||||
if _, ok := oldSet[m]; !ok {
|
||||
added = append(added, m)
|
||||
}
|
||||
}
|
||||
for _, m := range old {
|
||||
if m == "" {
|
||||
continue
|
||||
}
|
||||
if _, ok := freshSet[m]; !ok {
|
||||
removed = append(removed, m)
|
||||
}
|
||||
}
|
||||
return added, removed
|
||||
}
|
||||
|
||||
func pluralS(n int) string {
|
||||
if n == 1 {
|
||||
return ""
|
||||
}
|
||||
return "s"
|
||||
}
|
||||
|
|
@ -1,96 +0,0 @@
|
|||
package cmd
|
||||
|
||||
import (
|
||||
"context"
|
||||
"sync"
|
||||
|
||||
"github.com/torrentclaw/unarr/internal/config"
|
||||
"github.com/torrentclaw/unarr/internal/engine"
|
||||
"github.com/torrentclaw/unarr/internal/library/mediainfo"
|
||||
)
|
||||
|
||||
// playerSessionRegistry tracks per-session cancel funcs for active in-browser
|
||||
// HLS streaming sessions. Each session lives only as long as its ffmpeg
|
||||
// process; the registry exists so duplicate sync responses don't double-spawn
|
||||
// the same session and so daemon shutdown can drain.
|
||||
var playerSessionRegistry = &playerSessionRegistryT{
|
||||
cancels: make(map[string]context.CancelFunc),
|
||||
}
|
||||
|
||||
type playerSessionRegistryT struct {
|
||||
mu sync.Mutex
|
||||
cancels map[string]context.CancelFunc
|
||||
}
|
||||
|
||||
func (r *playerSessionRegistryT) has(sessionID string) bool {
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
_, ok := r.cancels[sessionID]
|
||||
return ok
|
||||
}
|
||||
|
||||
func (r *playerSessionRegistryT) add(sessionID string, cancel context.CancelFunc) {
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
r.cancels[sessionID] = cancel
|
||||
}
|
||||
|
||||
func (r *playerSessionRegistryT) remove(sessionID string) {
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
delete(r.cancels, sessionID)
|
||||
}
|
||||
|
||||
// cancelAllPlayerSessions cancels every running session. Called on daemon
|
||||
// shutdown so the ffmpeg children and SSE consumers exit cleanly.
|
||||
func cancelAllPlayerSessions() {
|
||||
playerSessionRegistry.mu.Lock()
|
||||
cancels := make([]context.CancelFunc, 0, len(playerSessionRegistry.cancels))
|
||||
for _, c := range playerSessionRegistry.cancels {
|
||||
cancels = append(cancels, c)
|
||||
}
|
||||
playerSessionRegistry.cancels = make(map[string]context.CancelFunc)
|
||||
playerSessionRegistry.mu.Unlock()
|
||||
for _, c := range cancels {
|
||||
c()
|
||||
}
|
||||
}
|
||||
|
||||
// buildTranscodeRuntime resolves the ffmpeg/ffprobe binaries + config knobs
|
||||
// for the HLS streaming pipeline. Failure to resolve a binary returns a
|
||||
// runtime with empty paths so the caller can short-circuit instead of
|
||||
// launching a transcoder that will immediately fail.
|
||||
func buildTranscodeRuntime(ctx context.Context, cfg config.Config) engine.TranscodeRuntime {
|
||||
if !cfg.Download.Transcode.Enabled {
|
||||
return engine.TranscodeRuntime{Disabled: true}
|
||||
}
|
||||
ffmpegPath, errF := mediainfo.ResolveFFmpeg(cfg.Library.FFmpegPath)
|
||||
ffprobePath, errP := mediainfo.ResolveFFprobe(cfg.Library.FFprobePath)
|
||||
if errF != nil || errP != nil {
|
||||
return engine.TranscodeRuntime{Disabled: true}
|
||||
}
|
||||
hw := engine.HWAccelNone
|
||||
switch cfg.Download.Transcode.HWAccel {
|
||||
case "auto":
|
||||
hw = engine.DetectHWAccel(ctx, ffmpegPath)
|
||||
case "nvenc":
|
||||
hw = engine.HWAccelNVENC
|
||||
case "qsv":
|
||||
hw = engine.HWAccelQSV
|
||||
case "vaapi":
|
||||
hw = engine.HWAccelVAAPI
|
||||
case "videotoolbox":
|
||||
hw = engine.HWAccelVideoToolbox
|
||||
case "none", "":
|
||||
hw = engine.HWAccelNone
|
||||
}
|
||||
return engine.TranscodeRuntime{
|
||||
FFmpegPath: ffmpegPath,
|
||||
FFprobePath: ffprobePath,
|
||||
HWAccel: hw,
|
||||
Preset: cfg.Download.Transcode.Preset,
|
||||
VideoBitrate: cfg.Download.Transcode.VideoBitrate,
|
||||
AudioBitrate: cfg.Download.Transcode.AudioBitrate,
|
||||
MaxHeight: cfg.Download.Transcode.MaxHeight,
|
||||
}
|
||||
}
|
||||
|
|
@ -1,176 +0,0 @@
|
|||
package cmd
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"runtime"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/fatih/color"
|
||||
"github.com/spf13/cobra"
|
||||
"github.com/torrentclaw/unarr/internal/engine"
|
||||
)
|
||||
|
||||
// newProbeHWAccelCmd reports the hardware-acceleration capabilities the daemon
|
||||
// would actually use for HLS transcoding. The motivation: a beefy host
|
||||
// (e.g. RTX 3090) can still fall back to software encoding when the installed
|
||||
// ffmpeg binary was built without nvenc/qsv/vaapi support — Homebrew ffmpeg
|
||||
// is a common offender. Without this command, users see slow / failing 4K
|
||||
// transcodes and no obvious way to diagnose where the regression sits.
|
||||
func newProbeHWAccelCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "probe-hwaccel",
|
||||
Short: "Diagnose hardware-acceleration availability",
|
||||
Long: `Report the hardware-acceleration backends the daemon would pick for
|
||||
transcoding, plus exactly why each one was kept or rejected.
|
||||
|
||||
Checks performed:
|
||||
- ffmpeg / ffprobe paths
|
||||
- which HW encoders the ffmpeg binary supports (h264_nvenc, h264_qsv, h264_vaapi…)
|
||||
- whether the matching device files / drivers are actually present
|
||||
- which backend the daemon would pick today (HWAccelNone means software)
|
||||
|
||||
Use this when transcoding feels slow or fails on 4K — the most common cause
|
||||
is a software-only ffmpeg build, not a missing GPU.`,
|
||||
Example: ` unarr probe-hwaccel`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return runProbeHWAccel()
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func runProbeHWAccel() error {
|
||||
bold := color.New(color.Bold)
|
||||
green := color.New(color.FgGreen)
|
||||
yellow := color.New(color.FgYellow)
|
||||
red := color.New(color.FgRed)
|
||||
|
||||
fmt.Println()
|
||||
bold.Println(" Hardware acceleration probe")
|
||||
fmt.Println()
|
||||
|
||||
// 1. Locate ffmpeg / ffprobe.
|
||||
ffmpegPath, ffmpegErr := exec.LookPath("ffmpeg")
|
||||
ffprobePath, ffprobeErr := exec.LookPath("ffprobe")
|
||||
|
||||
bold.Println(" Binaries")
|
||||
if ffmpegErr != nil {
|
||||
red.Printf(" x ffmpeg not on PATH\n")
|
||||
fmt.Println()
|
||||
yellow.Println(" HW probe needs ffmpeg. Install it:")
|
||||
fmt.Println(" Ubuntu/Debian: sudo apt install ffmpeg")
|
||||
fmt.Println(" macOS: brew install ffmpeg")
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
green.Printf(" OK ffmpeg %s\n", ffmpegPath)
|
||||
if ffprobeErr != nil {
|
||||
yellow.Printf(" ! ffprobe not on PATH (HLS still works, source probing falls back to ffmpeg)\n")
|
||||
} else {
|
||||
green.Printf(" OK ffprobe %s\n", ffprobePath)
|
||||
}
|
||||
fmt.Println()
|
||||
|
||||
// 2. List encoders the ffmpeg binary supports.
|
||||
bold.Println(" HW encoders compiled in")
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer cancel()
|
||||
|
||||
out, err := exec.CommandContext(ctx, ffmpegPath, "-hide_banner", "-encoders").CombinedOutput()
|
||||
if err != nil {
|
||||
red.Printf(" x ffmpeg -encoders failed: %v\n", err)
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
encoders := string(out)
|
||||
|
||||
hwEncoders := []struct {
|
||||
name string
|
||||
family string
|
||||
family2 string
|
||||
}{
|
||||
{"h264_nvenc", "NVIDIA NVENC", "hevc_nvenc"},
|
||||
{"h264_qsv", "Intel Quick Sync", "hevc_qsv"},
|
||||
{"h264_vaapi", "Linux VA-API (Intel/AMD)", "hevc_vaapi"},
|
||||
{"h264_videotoolbox", "macOS VideoToolbox", "hevc_videotoolbox"},
|
||||
}
|
||||
anyHWEncoder := false
|
||||
for _, e := range hwEncoders {
|
||||
hasH264 := strings.Contains(encoders, e.name)
|
||||
hasHEVC := strings.Contains(encoders, e.family2)
|
||||
if hasH264 || hasHEVC {
|
||||
anyHWEncoder = true
|
||||
green.Printf(" OK %s\n", e.family)
|
||||
if hasH264 {
|
||||
fmt.Printf(" %s\n", e.name)
|
||||
}
|
||||
if hasHEVC {
|
||||
fmt.Printf(" %s\n", e.family2)
|
||||
}
|
||||
}
|
||||
}
|
||||
if !anyHWEncoder {
|
||||
red.Printf(" x No HW encoders compiled in\n")
|
||||
fmt.Println()
|
||||
yellow.Println(" Most likely your ffmpeg was built without --enable-nvenc /")
|
||||
yellow.Println(" --enable-libmfx / --enable-vaapi. Brew's default formula is one")
|
||||
yellow.Println(" common offender. On Ubuntu, the system package ships with VAAPI")
|
||||
yellow.Println(" by default and NVENC if you have CUDA installed.")
|
||||
}
|
||||
fmt.Println()
|
||||
|
||||
// 3. Device-file checks.
|
||||
bold.Println(" Devices / drivers")
|
||||
checks := []struct {
|
||||
path string
|
||||
desc string
|
||||
}{
|
||||
{"/dev/nvidia0", "NVIDIA GPU"},
|
||||
{"/dev/dri/renderD128", "Linux DRM render node (used by VA-API + QSV)"},
|
||||
}
|
||||
for _, c := range checks {
|
||||
if fileExistsLocal(c.path) {
|
||||
green.Printf(" OK %s — %s\n", c.path, c.desc)
|
||||
} else {
|
||||
yellow.Printf(" - %s — %s (not present)\n", c.path, c.desc)
|
||||
}
|
||||
}
|
||||
if _, err := exec.LookPath("nvidia-smi"); err == nil {
|
||||
green.Printf(" OK nvidia-smi on PATH\n")
|
||||
} else {
|
||||
yellow.Printf(" - nvidia-smi not on PATH\n")
|
||||
}
|
||||
if runtime.GOOS == "darwin" {
|
||||
fmt.Printf(" . macOS host — VideoToolbox available if encoder was compiled in\n")
|
||||
}
|
||||
fmt.Println()
|
||||
|
||||
// 4. Daemon's actual decision.
|
||||
engine.ResetHWAccelCache()
|
||||
pick := engine.DetectHWAccel(ctx, ffmpegPath)
|
||||
bold.Println(" Daemon would pick")
|
||||
switch pick {
|
||||
case engine.HWAccelNone:
|
||||
red.Printf(" x %s — software libx264 only\n", pick)
|
||||
fmt.Println()
|
||||
yellow.Println(" On a slow CPU 1080p will lag and 4K is effectively unwatchable.")
|
||||
yellow.Println(" Fix: rebuild / reinstall ffmpeg with HW encoder support, then:")
|
||||
fmt.Println()
|
||||
fmt.Println(" unarr daemon restart")
|
||||
default:
|
||||
green.Printf(" OK %s\n", pick)
|
||||
fmt.Printf(" encoder: %s (h264) / %s (hevc)\n", pick.FFmpegVideoCodec("h264"), pick.FFmpegVideoCodec("hevc"))
|
||||
}
|
||||
fmt.Println()
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// fileExistsLocal stats a path. Mirrors engine.fileExists without exporting it.
|
||||
func fileExistsLocal(path string) bool {
|
||||
_, err := os.Stat(path)
|
||||
return err == nil
|
||||
}
|
||||
|
|
@ -3,7 +3,6 @@
|
|||
package cmd
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
|
|
@ -44,12 +43,9 @@ func startReloadWatcher(rc *ReloadableConfig) {
|
|||
|
||||
// sendReloadSignal sends SIGUSR1 to the running daemon process.
|
||||
func sendReloadSignal() error {
|
||||
state, err := agent.LoadState()
|
||||
if err != nil {
|
||||
if errors.Is(err, agent.ErrDaemonNotRunning) {
|
||||
return err
|
||||
}
|
||||
return fmt.Errorf("read daemon state: %w", err)
|
||||
state := agent.ReadState()
|
||||
if state == nil {
|
||||
return fmt.Errorf("daemon does not appear to be running (state file not found)")
|
||||
}
|
||||
p, err := os.FindProcess(state.PID)
|
||||
if err != nil {
|
||||
|
|
|
|||
|
|
@ -9,7 +9,6 @@ import (
|
|||
tc "github.com/torrentclaw/go-client"
|
||||
"github.com/torrentclaw/unarr/internal/config"
|
||||
"github.com/torrentclaw/unarr/internal/sentry"
|
||||
"github.com/torrentclaw/unarr/internal/upgrade"
|
||||
)
|
||||
|
||||
var (
|
||||
|
|
@ -25,20 +24,16 @@ var (
|
|||
|
||||
func init() {
|
||||
rootCmd = &cobra.Command{
|
||||
Use: "unarr",
|
||||
Version: Version,
|
||||
Short: "Terminal torrent + debrid + usenet client — download, stream, transcode",
|
||||
Long: `unarr is a terminal-native client that downloads torrents, debrid links,
|
||||
and usenet (NZB) — all from the same binary. It streams content straight
|
||||
to mpv/vlc with sequential piece prioritization, transcodes on the fly via
|
||||
ffmpeg with hardware acceleration (NVENC, QSV, VA-API, VideoToolbox), and
|
||||
organizes your library into Movies/TV folders. Run it one-shot or as a
|
||||
long-running daemon with a built-in WireGuard split-tunnel and remote
|
||||
playback over Cloudflare Funnel.
|
||||
Use: "unarr",
|
||||
Short: "unarr — torrent search and management",
|
||||
Long: `unarr is a powerful terminal tool for torrent search and management.
|
||||
|
||||
Search 30+ torrent sources, inspect torrent quality, discover popular content,
|
||||
find streaming providers, and manage your media collection — all from your terminal.
|
||||
|
||||
Get started:
|
||||
unarr init First-time configuration wizard
|
||||
unarr download <magnet|hash> Grab a torrent one-shot
|
||||
unarr search "breaking bad" Search for content
|
||||
unarr start Start the download daemon
|
||||
|
||||
Documentation: https://torrentclaw.com/cli
|
||||
|
|
@ -47,10 +42,6 @@ Source: https://github.com/torrentclaw/unarr`,
|
|||
if noColor || os.Getenv("NO_COLOR") != "" {
|
||||
color.NoColor = true
|
||||
}
|
||||
// Self-updater fetches releases from the configured host (default
|
||||
// torrentclaw.com), not GitHub — so mirrors / onion / staging /
|
||||
// UNARR_API_URL all route updates correctly.
|
||||
upgrade.SetBaseURL(loadConfig().Auth.APIURL)
|
||||
},
|
||||
SilenceUsage: true,
|
||||
SilenceErrors: true,
|
||||
|
|
@ -59,7 +50,7 @@ Source: https://github.com/torrentclaw/unarr`,
|
|||
// Command groups for organized help output
|
||||
rootCmd.AddGroup(
|
||||
&cobra.Group{ID: "start", Title: "Getting Started:"},
|
||||
&cobra.Group{ID: "search", Title: "Catalog & Discovery:"},
|
||||
&cobra.Group{ID: "search", Title: "Search & Discovery:"},
|
||||
&cobra.Group{ID: "download", Title: "Downloads & Streaming:"},
|
||||
&cobra.Group{ID: "daemon", Title: "Daemon Management:"},
|
||||
&cobra.Group{ID: "system", Title: "System & Diagnostics:"},
|
||||
|
|
@ -107,22 +98,14 @@ Source: https://github.com/torrentclaw/unarr`,
|
|||
statusCmd.GroupID = "daemon"
|
||||
daemonCmd := newDaemonCmd()
|
||||
daemonCmd.GroupID = "daemon"
|
||||
vpnCmd := newVPNCmd()
|
||||
vpnCmd.GroupID = "daemon"
|
||||
funnelCmd := newFunnelCmd()
|
||||
funnelCmd.GroupID = "daemon"
|
||||
|
||||
// System & Diagnostics
|
||||
statsCmd := newStatsCmd()
|
||||
statsCmd.GroupID = "system"
|
||||
doctorCmd := newDoctorCmd()
|
||||
doctorCmd.GroupID = "system"
|
||||
probeHWAccelCmd := newProbeHWAccelCmd()
|
||||
probeHWAccelCmd.GroupID = "system"
|
||||
cleanCmd := newCleanCmd()
|
||||
cleanCmd.GroupID = "system"
|
||||
mirrorsCmd := newMirrorsCmd()
|
||||
mirrorsCmd.GroupID = "system"
|
||||
selfUpdateCmd := newSelfUpdateCmd()
|
||||
selfUpdateCmd.GroupID = "system"
|
||||
versionCmd := newVersionCmd()
|
||||
|
|
@ -154,14 +137,10 @@ Source: https://github.com/torrentclaw/unarr`,
|
|||
stopCmd,
|
||||
statusCmd,
|
||||
daemonCmd,
|
||||
vpnCmd,
|
||||
funnelCmd,
|
||||
// System & Diagnostics
|
||||
statsCmd,
|
||||
doctorCmd,
|
||||
probeHWAccelCmd,
|
||||
cleanCmd,
|
||||
mirrorsCmd,
|
||||
selfUpdateCmd,
|
||||
versionCmd,
|
||||
completionCmd,
|
||||
|
|
|
|||
|
|
@ -241,7 +241,7 @@ func printScanSummary(cache *library.LibraryCache) {
|
|||
continue
|
||||
}
|
||||
|
||||
res := library.ResolveResolution(item.MediaInfo.Video.Width, item.MediaInfo.Video.Height)
|
||||
res := library.ResolveResolution(item.MediaInfo.Video.Height)
|
||||
if res == "" {
|
||||
res = "other"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,17 +3,19 @@ package cmd
|
|||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"runtime"
|
||||
"strings"
|
||||
"syscall"
|
||||
|
||||
"github.com/fatih/color"
|
||||
"github.com/spf13/cobra"
|
||||
"github.com/torrentclaw/unarr/internal/agent"
|
||||
"github.com/torrentclaw/unarr/internal/upgrade"
|
||||
)
|
||||
|
||||
func newSelfUpdateCmd() *cobra.Command {
|
||||
var force bool
|
||||
var allowUnsigned bool
|
||||
|
||||
cmd := &cobra.Command{
|
||||
Use: "self-update",
|
||||
|
|
@ -21,35 +23,29 @@ func newSelfUpdateCmd() *cobra.Command {
|
|||
Long: `Download and install the latest version of unarr.
|
||||
|
||||
Checks GitHub for the latest release, verifies the checksum, and
|
||||
replaces the current binary. A backup is kept at <binary>.backup.
|
||||
|
||||
If the daemon is running, it is automatically restarted so the new
|
||||
version is loaded into memory (otherwise heartbeat would keep
|
||||
reporting the old version until a manual restart).`,
|
||||
replaces the current binary. A backup is kept at <binary>.backup.`,
|
||||
Example: ` unarr self-update
|
||||
unarr self-update --force
|
||||
unarr self-update --allow-unsigned # accept releases missing checksums.txt.sig`,
|
||||
unarr self-update --force`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return runSelfUpdate(force, allowUnsigned)
|
||||
return runSelfUpdate(force)
|
||||
},
|
||||
}
|
||||
|
||||
cmd.Flags().BoolVarP(&force, "force", "f", false, "reinstall even if already up to date")
|
||||
cmd.Flags().BoolVar(&allowUnsigned, "allow-unsigned", false, "continue with SHA256-only verification when checksums.txt.sig is missing")
|
||||
|
||||
return cmd
|
||||
}
|
||||
|
||||
func runSelfUpdate(force, allowUnsigned bool) error {
|
||||
func runSelfUpdate(force bool) error {
|
||||
bold := color.New(color.Bold)
|
||||
green := color.New(color.FgGreen)
|
||||
yellow := color.New(color.FgYellow)
|
||||
red := color.New(color.FgRed)
|
||||
|
||||
fmt.Println()
|
||||
bold.Println(" unarr self-update")
|
||||
fmt.Println()
|
||||
|
||||
// Check latest version
|
||||
fmt.Print(" Checking latest version... ")
|
||||
ctx := context.Background()
|
||||
latest, err := upgrade.CheckLatest(ctx)
|
||||
|
|
@ -77,7 +73,6 @@ func runSelfUpdate(force, allowUnsigned bool) error {
|
|||
|
||||
upgrader := &upgrade.Upgrader{
|
||||
CurrentVersion: currentClean,
|
||||
AllowUnsigned: allowUnsigned,
|
||||
OnProgress: func(msg string) {
|
||||
fmt.Printf(" %s\n", msg)
|
||||
},
|
||||
|
|
@ -94,25 +89,37 @@ func runSelfUpdate(force, allowUnsigned bool) error {
|
|||
if result.BackupPath != "" {
|
||||
fmt.Printf(" Backup: %s\n", result.BackupPath)
|
||||
}
|
||||
fmt.Println()
|
||||
|
||||
// Auto-restart daemon if it is running, otherwise the live process keeps
|
||||
// serving the old version (heartbeat reports old version → web gates
|
||||
// features against the wrong version).
|
||||
if state := agent.ReadState(); state != nil && isDaemonAlive(state) {
|
||||
fmt.Println()
|
||||
fmt.Printf(" → Daemon running (PID %d), restarting to load new version...\n", state.PID)
|
||||
if err := runDaemonSvcRestart(); err != nil {
|
||||
fmt.Println()
|
||||
red.Printf(" ✗ Auto-restart failed: %v\n", err)
|
||||
fmt.Println(" The new binary is on disk but the daemon is still running the old version.")
|
||||
fmt.Println(" Run manually: unarr daemon restart")
|
||||
fmt.Println(" (If the daemon runs under a different user/session, restart it there.)")
|
||||
fmt.Println()
|
||||
return nil
|
||||
// If running as daemon, re-exec to restart with new binary
|
||||
// For interactive use, just suggest restarting
|
||||
if isRunningAsDaemon() {
|
||||
fmt.Println(" Restarting daemon with new version...")
|
||||
binPath, err := os.Executable()
|
||||
if err != nil {
|
||||
return fmt.Errorf("could not determine executable path: %w", err)
|
||||
}
|
||||
green.Println(" ✓ Daemon restarted")
|
||||
execErr := syscall.Exec(binPath, os.Args, os.Environ())
|
||||
if execErr != nil && runtime.GOOS == "windows" {
|
||||
// Windows doesn't support syscall.Exec — start new process
|
||||
proc := exec.Command(binPath, os.Args[1:]...)
|
||||
proc.Stdout = os.Stdout
|
||||
proc.Stderr = os.Stderr
|
||||
proc.Stdin = os.Stdin
|
||||
return proc.Start()
|
||||
}
|
||||
return execErr
|
||||
}
|
||||
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
|
||||
func isRunningAsDaemon() bool {
|
||||
// Simple heuristic: check if "start" was in the original args
|
||||
for _, arg := range os.Args {
|
||||
if arg == "start" {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@ package cmd
|
|||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"runtime"
|
||||
"strings"
|
||||
|
|
@ -59,7 +58,7 @@ func runStatus() error {
|
|||
go func() {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
|
||||
defer cancel()
|
||||
ac := newAgentClientFromConfig(cfg, "unarr/"+Version)
|
||||
ac := agent.NewClient(cfg.Auth.APIURL, cfg.Auth.APIKey, "unarr/"+Version)
|
||||
resp, err := ac.Register(ctx, agent.RegisterRequest{
|
||||
AgentID: cfg.Agent.ID,
|
||||
Name: cfg.Agent.Name,
|
||||
|
|
@ -75,17 +74,7 @@ func runStatus() error {
|
|||
cyan.Println(" Account")
|
||||
ar := <-accountCh
|
||||
if ar.err != nil {
|
||||
var httpErr *agent.HTTPError
|
||||
switch {
|
||||
case errors.As(ar.err, &httpErr) && httpErr.StatusCode == 401:
|
||||
yellow.Println(" API key invalid or revoked")
|
||||
fmt.Printf(" Run %s to re-authenticate\n", cyan.Sprint("unarr login"))
|
||||
case errors.As(ar.err, &httpErr) && httpErr.StatusCode == 403:
|
||||
yellow.Println(" API key lacks permission for this server")
|
||||
fmt.Printf(" Check plan or run %s\n", cyan.Sprint("unarr login"))
|
||||
default:
|
||||
dim.Printf(" Could not fetch account info (%v)\n", ar.err)
|
||||
}
|
||||
dim.Println(" Could not fetch account info")
|
||||
} else {
|
||||
fmt.Printf(" User: %s\n", ar.user.Name)
|
||||
fmt.Printf(" Email: %s\n", ar.user.Email)
|
||||
|
|
|
|||
|
|
@ -7,7 +7,6 @@ import (
|
|||
// newUpgradeCmd creates the `unarr upgrade` command as an alias for `self-update`.
|
||||
func newUpgradeCmd() *cobra.Command {
|
||||
var force bool
|
||||
var allowUnsigned bool
|
||||
|
||||
cmd := &cobra.Command{
|
||||
Use: "upgrade",
|
||||
|
|
@ -19,15 +18,13 @@ This is an alias for 'unarr self-update'. Checks GitHub for the latest
|
|||
release, verifies the checksum, and replaces the current binary.
|
||||
A backup is kept at <binary>.backup.`,
|
||||
Example: ` unarr upgrade
|
||||
unarr upgrade --force
|
||||
unarr upgrade --allow-unsigned`,
|
||||
unarr upgrade --force`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return runSelfUpdate(force, allowUnsigned)
|
||||
return runSelfUpdate(force)
|
||||
},
|
||||
}
|
||||
|
||||
cmd.Flags().BoolVarP(&force, "force", "f", false, "reinstall even if already up to date")
|
||||
cmd.Flags().BoolVar(&allowUnsigned, "allow-unsigned", false, "continue with SHA256-only verification when checksums.txt.sig is missing")
|
||||
|
||||
return cmd
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
package cmd
|
||||
|
||||
// Version is the CLI version. Overridden by goreleaser ldflags at release time.
|
||||
var Version = "0.9.19"
|
||||
var Version = "0.7.0"
|
||||
|
|
|
|||
|
|
@ -1,213 +0,0 @@
|
|||
package cmd
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"time"
|
||||
|
||||
"github.com/fatih/color"
|
||||
"github.com/spf13/cobra"
|
||||
"github.com/torrentclaw/unarr/internal/agent"
|
||||
"github.com/torrentclaw/unarr/internal/config"
|
||||
"github.com/torrentclaw/unarr/internal/vpn"
|
||||
)
|
||||
|
||||
func newVPNCmd() *cobra.Command {
|
||||
cmd := &cobra.Command{
|
||||
Use: "vpn",
|
||||
Short: "Manage the managed-VPN split-tunnel for downloads",
|
||||
Long: `Enable, disable, and inspect the managed VPN.
|
||||
|
||||
When enabled, the daemon fetches a WireGuard config from your TorrentClaw account
|
||||
at startup and routes ONLY the torrent client's traffic (peers + trackers) through
|
||||
an in-process WireGuard tunnel — no root, no OS routing changes.
|
||||
|
||||
This is split-tunnel: your browser and other apps keep using your real IP. Only
|
||||
your downloads are hidden behind the VPN server.
|
||||
|
||||
The VPN requires a PRO+ plan with the VPN add-on. Set it up at
|
||||
https://torrentclaw.com/vpn and configure your other devices (phone, laptop) with
|
||||
the OpenVPN credentials from your profile — those don't share the agent's tunnel.`,
|
||||
Example: ` unarr vpn status # is the tunnel up? which server?
|
||||
unarr vpn enable # turn the managed VPN on
|
||||
unarr vpn disable # turn it off`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return cmd.Help()
|
||||
},
|
||||
}
|
||||
cmd.AddCommand(newVPNStatusCmd(), newVPNEnableCmd(), newVPNDisableCmd())
|
||||
return cmd
|
||||
}
|
||||
|
||||
func newVPNStatusCmd() *cobra.Command {
|
||||
var check bool
|
||||
cmd := &cobra.Command{
|
||||
Use: "status",
|
||||
Short: "Show VPN configuration and live tunnel state",
|
||||
Example: " unarr vpn status\n unarr vpn status --check # also verify your account is provisioned",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return runVPNStatus(check)
|
||||
},
|
||||
}
|
||||
cmd.Flags().BoolVar(&check, "check", false, "query the API to verify the VPN is provisioned on your account")
|
||||
return cmd
|
||||
}
|
||||
|
||||
func runVPNStatus(check bool) error {
|
||||
bold := color.New(color.Bold)
|
||||
dim := color.New(color.FgHiBlack)
|
||||
green := color.New(color.FgGreen)
|
||||
yellow := color.New(color.FgYellow)
|
||||
cyan := color.New(color.FgCyan)
|
||||
|
||||
cfg := loadConfig()
|
||||
|
||||
fmt.Println()
|
||||
bold.Println(" Managed VPN")
|
||||
fmt.Println()
|
||||
|
||||
// ── Configured mode ──
|
||||
switch {
|
||||
case cfg.Download.VPN.ConfigFile != "":
|
||||
cyan.Println(" Mode: self-hosted (local config_file)")
|
||||
fmt.Printf(" Config: %s\n", cfg.Download.VPN.ConfigFile)
|
||||
case cfg.Download.VPN.Enabled:
|
||||
cyan.Println(" Mode: managed (config fetched from your account)")
|
||||
default:
|
||||
dim.Println(" Mode: off")
|
||||
fmt.Println()
|
||||
dim.Println(" Enable with `unarr vpn enable` (needs a PRO+ plan with the VPN add-on).")
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
|
||||
// ── Live tunnel state (from the daemon state file) ──
|
||||
state := agent.ReadState()
|
||||
alive := state != nil && isDaemonAlive(state)
|
||||
fmt.Println()
|
||||
switch {
|
||||
case alive && state.VPNActive:
|
||||
server := state.VPNServer
|
||||
if host, _, err := net.SplitHostPort(server); err == nil && host != "" {
|
||||
server = host
|
||||
}
|
||||
green.Println(" ✓ Tunnel ACTIVE — torrent traffic is routed through the VPN")
|
||||
if server != "" {
|
||||
fmt.Printf(" Exit server: %s\n", server)
|
||||
}
|
||||
case alive:
|
||||
yellow.Println(" ⚠ Daemon is running but the tunnel is NOT up — downloads go in the clear.")
|
||||
dim.Println(" Check `unarr daemon logs` for a [vpn] line. Common cause: no active")
|
||||
dim.Println(" VPN on your account (set it up at https://torrentclaw.com/vpn).")
|
||||
default:
|
||||
dim.Println(" Daemon not running — start it (`unarr start`) to bring the tunnel up.")
|
||||
}
|
||||
|
||||
// ── Optional live provisioning check ──
|
||||
if check {
|
||||
fmt.Println()
|
||||
if cfg.Auth.APIKey == "" {
|
||||
yellow.Println(" ⚠ No API key — run `unarr init` first.")
|
||||
} else {
|
||||
apiURL := cfg.Auth.APIURL
|
||||
if apiURL == "" {
|
||||
apiURL = "https://torrentclaw.com"
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
_, err := vpn.FetchConfig(ctx, apiURL, cfg.Auth.APIKey, "unarr/"+Version, cfg.Agent.ID, true)
|
||||
cancel()
|
||||
switch {
|
||||
case err == nil:
|
||||
green.Println(" ✓ Account provisioned — a VPN config is available.")
|
||||
default:
|
||||
yellow.Printf(" ⚠ %s\n", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ── Split-tunnel reminder ──
|
||||
fmt.Println()
|
||||
dim.Println(" Split-tunnel: only your downloads use the VPN. Your browser and other")
|
||||
dim.Println(" apps keep your real IP — that's by design. Use the OpenVPN credentials in")
|
||||
dim.Println(" your profile to protect your other devices.")
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
|
||||
func newVPNEnableCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "enable",
|
||||
Short: "Turn the managed VPN on",
|
||||
Example: " unarr vpn enable",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return setVPNEnabled(true)
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func newVPNDisableCmd() *cobra.Command {
|
||||
return &cobra.Command{
|
||||
Use: "disable",
|
||||
Short: "Turn the managed VPN off",
|
||||
Example: " unarr vpn disable",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return setVPNEnabled(false)
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func setVPNEnabled(enabled bool) error {
|
||||
green := color.New(color.FgGreen)
|
||||
yellow := color.New(color.FgYellow)
|
||||
dim := color.New(color.FgHiBlack)
|
||||
|
||||
cfg := loadConfig()
|
||||
|
||||
if enabled && cfg.Auth.APIKey == "" {
|
||||
return fmt.Errorf("no API key configured — run `unarr init` first (the managed VPN fetches its config from your account)")
|
||||
}
|
||||
|
||||
if cfg.Download.VPN.Enabled == enabled {
|
||||
fmt.Println()
|
||||
dim.Printf(" VPN is already %s — nothing to do.\n", enabledWord(enabled))
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
|
||||
cfg.Download.VPN.Enabled = enabled
|
||||
|
||||
configPath := config.FilePath()
|
||||
if cfgFile != "" {
|
||||
configPath = cfgFile
|
||||
}
|
||||
if err := config.Save(cfg, configPath); err != nil {
|
||||
return fmt.Errorf("save config: %w", err)
|
||||
}
|
||||
appCfg = cfg
|
||||
|
||||
fmt.Println()
|
||||
green.Printf(" ✓ Managed VPN %s.\n", enabledWord(enabled))
|
||||
|
||||
if enabled && cfg.Download.VPN.ConfigFile != "" {
|
||||
yellow.Println(" ⚠ A config_file is set, so self-hosted mode takes precedence and the")
|
||||
yellow.Println(" managed config from your account is ignored. Clear config_file to use it.")
|
||||
}
|
||||
|
||||
// The tunnel is brought up once at daemon startup; a plain config reload does
|
||||
// NOT (re)create it. Tell the user to restart the daemon if it's running.
|
||||
if state := agent.ReadState(); state != nil && isDaemonAlive(state) {
|
||||
fmt.Println()
|
||||
dim.Println(" The daemon is running. Restart it for this to take effect:")
|
||||
dim.Println(" unarr daemon restart")
|
||||
}
|
||||
fmt.Println()
|
||||
return nil
|
||||
}
|
||||
|
||||
func enabledWord(enabled bool) string {
|
||||
if enabled {
|
||||
return "enabled"
|
||||
}
|
||||
return "disabled"
|
||||
}
|
||||
|
|
@ -26,11 +26,6 @@ type Config struct {
|
|||
type AuthConfig struct {
|
||||
APIKey string `toml:"api_key"`
|
||||
APIURL string `toml:"api_url"`
|
||||
// Mirrors lists alternate base URLs the agent will fall back to when the
|
||||
// primary api_url is unreachable. Ordered by preference. Refreshed at
|
||||
// runtime by `unarr mirrors update` against /api/v1/mirrors so a long-
|
||||
// running agent survives a primary takedown without a new release.
|
||||
Mirrors []string `toml:"mirrors"`
|
||||
}
|
||||
|
||||
type AgentConfig struct {
|
||||
|
|
@ -39,88 +34,16 @@ type AgentConfig struct {
|
|||
}
|
||||
|
||||
type DownloadConfig struct {
|
||||
Dir string `toml:"dir"`
|
||||
PreferredMethod string `toml:"preferred_method"`
|
||||
PreferredQuality string `toml:"preferred_quality"` // "2160p", "1080p", "720p" — hint for auto-selection
|
||||
MaxConcurrent int `toml:"max_concurrent"`
|
||||
MaxDownloadSpeed string `toml:"max_download_speed"` // e.g. "10MB", "500KB", "0" = unlimited
|
||||
MaxUploadSpeed string `toml:"max_upload_speed"` // e.g. "1MB", "0" = unlimited
|
||||
MetadataTimeout string `toml:"metadata_timeout"` // e.g. "1h", "30m", "0" = unlimited (default: "0")
|
||||
StallTimeout string `toml:"stall_timeout"` // e.g. "30m", "1h", "0" = unlimited (default: "30m")
|
||||
ListenPort int `toml:"listen_port"` // fixed port for incoming peer connections (default: 42069, 0 = random)
|
||||
StreamPort int `toml:"stream_port"` // fixed port for streaming HTTP server (default: 11818)
|
||||
EnableUPnP bool `toml:"enable_upnp"` // map StreamPort to the WAN via UPnP/NAT-PMP (default: false; opt-in because it exposes the unauthenticated /stream + /hls endpoints to the public internet)
|
||||
CORSExtraOrigins []string `toml:"cors_extra_origins"` // extra browser origins added on top of the baked-in allowlist (torrentclaw.com, app.torrentclaw.com, localhost:3030)
|
||||
Transcode TranscodeConfig `toml:"transcode"`
|
||||
HLSCache HLSCacheConfig `toml:"hls_cache"`
|
||||
VPN VPNConfig `toml:"vpn"`
|
||||
Funnel FunnelConfig `toml:"funnel"`
|
||||
}
|
||||
|
||||
// HLSCacheConfig controls the persistent HLS segment cache. A completed encode
|
||||
// is kept on disk so a second play of the same file at the same quality skips
|
||||
// ffmpeg entirely. Old entries are evicted (LRU) once the cache exceeds the
|
||||
// size budget. Enabled by default — disable to save disk space at the cost of
|
||||
// re-encoding every play.
|
||||
type HLSCacheConfig struct {
|
||||
Enabled bool `toml:"enabled"` // default: true
|
||||
SizeGB int `toml:"size_gb"` // size budget in gigabytes; default: 5; minimum: 1
|
||||
Dir string `toml:"dir"` // override storage path; default: ~/.cache/unarr/hls-cache
|
||||
}
|
||||
|
||||
// FunnelConfig gates the optional CloudFlare Quick Tunnel that exposes the
|
||||
// daemon's HLS server over a public HTTPS hostname (https://<random>.try
|
||||
// cloudflare.com). Enabling it lets the web player on torrentclaw.com play
|
||||
// from this daemon across any network without Tailscale or a public IP —
|
||||
// the cost is that bytes proxy through CloudFlare's network. Off by default.
|
||||
type FunnelConfig struct {
|
||||
Enabled bool `toml:"enabled"`
|
||||
}
|
||||
|
||||
// VPNConfig gates the managed-VPN add-on split-tunnel. When enabled, the daemon
|
||||
// fetches a WireGuard config from the web (/api/internal/agent/vpn-config) and
|
||||
// routes only the torrent client's peer/tracker traffic through an in-process
|
||||
// userspace tunnel (no root, no OS routing changes). Requires an active VPN
|
||||
// add-on on the account; otherwise the daemon logs and downloads in the clear.
|
||||
type VPNConfig struct {
|
||||
Enabled bool `toml:"enabled"`
|
||||
// ConfigFile, when set, makes the daemon read a local WireGuard .conf instead
|
||||
// of fetching one from the web API. For self-hosted / personal-VPN testing:
|
||||
// point it at a peer .conf from your own WireGuard server and the torrent
|
||||
// client split-tunnels through it with no web/provider plumbing.
|
||||
ConfigFile string `toml:"config_file"`
|
||||
}
|
||||
|
||||
// TranscodeConfig controls real-time transcoding for the in-browser player
|
||||
// when source codecs aren't browser-decodable (HEVC, AV1, AC3, DTS, etc.).
|
||||
// Disabled by default; enabling requires ffmpeg + ffprobe on PATH (or
|
||||
// explicit paths via the library config).
|
||||
type TranscodeConfig struct {
|
||||
Enabled bool `toml:"enabled"` // master switch
|
||||
HWAccel string `toml:"hw_accel"` // "auto" | "none" | "nvenc" | "qsv" | "vaapi" | "videotoolbox"
|
||||
// Preset is the encoder speed/quality dial. Only used on software encode
|
||||
// (libx264) — HW backends (NVENC/QSV/VAAPI/VideoToolbox) use vendor
|
||||
// presets that don't share libx264's vocabulary and would be rejected
|
||||
// by ffmpeg if passed here.
|
||||
//
|
||||
// Empty (default) → engine picks "superfast" — latency-biased, ~3 s
|
||||
// first-play on 1080p source on a modern x86 CPU. Marginal quality loss
|
||||
// at 5-25 Mbps target bitrates.
|
||||
//
|
||||
// For better quality at slower first-play (1-2 s slower per seg):
|
||||
// "veryfast" — previous default; balanced
|
||||
// "faster" — slight quality bump
|
||||
// "fast" — meaningful quality bump
|
||||
// "medium" — libx264 stock default; CPU-bound on 4K
|
||||
// "slow" / "slower" / "veryslow" — only for batch encodes, not real-time HLS
|
||||
//
|
||||
// Or faster:
|
||||
// "ultrafast" — lowest quality, fastest encode
|
||||
Preset string `toml:"preset"`
|
||||
VideoBitrate string `toml:"video_bitrate"` // e.g. "5M"
|
||||
AudioBitrate string `toml:"audio_bitrate"` // e.g. "192k"
|
||||
MaxHeight int `toml:"max_height"` // optional downscale cap (e.g. 720)
|
||||
MaxConcurrent int `toml:"max_concurrent"` // safety cap on simultaneous transcoder processes
|
||||
Dir string `toml:"dir"`
|
||||
PreferredMethod string `toml:"preferred_method"`
|
||||
PreferredQuality string `toml:"preferred_quality"` // "2160p", "1080p", "720p" — hint for auto-selection
|
||||
MaxConcurrent int `toml:"max_concurrent"`
|
||||
MaxDownloadSpeed string `toml:"max_download_speed"` // e.g. "10MB", "500KB", "0" = unlimited
|
||||
MaxUploadSpeed string `toml:"max_upload_speed"` // e.g. "1MB", "0" = unlimited
|
||||
MetadataTimeout string `toml:"metadata_timeout"` // e.g. "1h", "30m", "0" = unlimited (default: "0")
|
||||
StallTimeout string `toml:"stall_timeout"` // e.g. "30m", "1h", "0" = unlimited (default: "30m")
|
||||
ListenPort int `toml:"listen_port"` // fixed port for incoming peer connections (default: 42069, 0 = random)
|
||||
StreamPort int `toml:"stream_port"` // fixed port for streaming HTTP server (default: 11818)
|
||||
}
|
||||
|
||||
type OrganizeConfig struct {
|
||||
|
|
@ -131,27 +54,8 @@ type OrganizeConfig struct {
|
|||
|
||||
type DaemonConfig struct {
|
||||
StatusInterval string `toml:"status_interval"`
|
||||
// AutoUpgrade gates the daemon's response to a server-flagged upgrade
|
||||
// (set via the "Force update" button on the web). When true the daemon
|
||||
// downloads + replaces the binary in-place and exits so the service
|
||||
// supervisor respawns on the new version. When false the daemon only
|
||||
// logs "new version available" and the operator must run `unarr update`
|
||||
// manually. Default: true. Available since unarr 0.9.6.
|
||||
AutoUpgrade *bool `toml:"auto_upgrade"`
|
||||
}
|
||||
|
||||
// AutoUpgradeEnabled returns the resolved AutoUpgrade flag — defaults to true
|
||||
// when the user has not set it explicitly. Pointer-vs-bool because Go's
|
||||
// zero-value bool would collapse "unset" and "false" together.
|
||||
func (d DaemonConfig) AutoUpgradeEnabled() bool {
|
||||
if d.AutoUpgrade == nil {
|
||||
return true
|
||||
}
|
||||
return *d.AutoUpgrade
|
||||
}
|
||||
|
||||
func boolPtr(v bool) *bool { return &v }
|
||||
|
||||
type NotificationsConfig struct {
|
||||
Enabled bool `toml:"enabled"`
|
||||
}
|
||||
|
|
@ -166,66 +70,27 @@ type LibraryConfig struct {
|
|||
ScanPath string `toml:"scan_path"` // remembered from last scan
|
||||
Workers int `toml:"workers"` // concurrent ffprobe (default 8)
|
||||
FFprobePath string `toml:"ffprobe_path"` // optional explicit path
|
||||
FFmpegPath string `toml:"ffmpeg_path"` // optional explicit path (used by the HLS streaming transcoder)
|
||||
BackupDir string `toml:"backup_dir"` // for replaced files
|
||||
AutoScan bool `toml:"auto_scan"` // enable daily auto-scan in daemon (default true)
|
||||
ScanInterval string `toml:"scan_interval"` // e.g. "24h", "12h", "6h" (default "24h")
|
||||
AllowDelete bool `toml:"allow_delete"` // allow web UI to request file deletion from disk
|
||||
}
|
||||
|
||||
// Default returns a Config with sensible defaults. Used both for fresh
|
||||
// installs (no config file yet) and as the baseline for Load — fields not
|
||||
// present in the user's TOML keep their Default() value.
|
||||
// Default returns a Config with sensible defaults.
|
||||
func Default() Config {
|
||||
return Config{
|
||||
Auth: AuthConfig{
|
||||
APIURL: "https://torrentclaw.com",
|
||||
// Default mirror list. Kept in sync with src/lib/mirrors-config.ts
|
||||
// on the server. Users can override with `unarr mirrors update`,
|
||||
// which pulls the live list from /api/v1/mirrors.
|
||||
Mirrors: []string{
|
||||
"https://torrentclaw.to",
|
||||
},
|
||||
},
|
||||
Download: DownloadConfig{
|
||||
PreferredMethod: "auto",
|
||||
MaxConcurrent: 3,
|
||||
StreamPort: 11818,
|
||||
Transcode: TranscodeConfig{
|
||||
Enabled: true,
|
||||
HWAccel: "auto",
|
||||
// Empty preset → engine.ResolveEncoderProfile picks the
|
||||
// latency-biased default ("superfast" on libx264). Override
|
||||
// in config.toml when quality > first-start latency matters.
|
||||
Preset: "",
|
||||
AudioBitrate: "192k",
|
||||
MaxConcurrent: 2,
|
||||
},
|
||||
Funnel: FunnelConfig{
|
||||
// On by default so headless installs (NAS / Docker) get cross-network
|
||||
// HTTPS playback without anyone having to terminal in. Users who
|
||||
// don't want bytes proxied through CloudFlare can opt out with
|
||||
// `unarr funnel off` (sets enabled=false in the TOML).
|
||||
Enabled: true,
|
||||
},
|
||||
HLSCache: HLSCacheConfig{
|
||||
// On by default — second play of a recently watched file at the
|
||||
// same quality skips ffmpeg (instant start, near-zero CPU).
|
||||
// Users can opt out (hls_cache.enabled=false) or shrink the
|
||||
// budget (hls_cache.size_gb) when disk is tight.
|
||||
Enabled: true,
|
||||
SizeGB: 5,
|
||||
},
|
||||
},
|
||||
Daemon: DaemonConfig{
|
||||
// Pointer-to-true so Default() round-trips through TOML marshal
|
||||
// as `auto_upgrade = true` instead of an omitted key — keeps the
|
||||
// freshly-written config aligned with what README documents.
|
||||
AutoUpgrade: boolPtr(true),
|
||||
},
|
||||
Organize: OrganizeConfig{
|
||||
Enabled: true,
|
||||
},
|
||||
Daemon: DaemonConfig{},
|
||||
Notifications: NotificationsConfig{
|
||||
Enabled: true,
|
||||
},
|
||||
|
|
@ -259,67 +124,28 @@ func Load(path string) (Config, error) {
|
|||
return cfg, fmt.Errorf("read config: %w", err)
|
||||
}
|
||||
|
||||
meta, err := toml.Decode(string(data), &cfg)
|
||||
if err != nil {
|
||||
if err := toml.Unmarshal(data, &cfg); err != nil {
|
||||
return cfg, fmt.Errorf("parse config: %w", err)
|
||||
}
|
||||
|
||||
applyDefaults(&cfg, meta)
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
// applyDefaults fills in sensible defaults for keys that the user did not
|
||||
// define in the TOML file. We use MetaData (rather than zero-value checks) so
|
||||
// that explicitly setting a field to its zero value (e.g. `enabled = false`)
|
||||
// is respected — only truly missing keys get defaulted. This lets a fresh
|
||||
// install work out of the box for streaming without forcing every user to
|
||||
// edit the TOML, while still letting power users disable features.
|
||||
func applyDefaults(cfg *Config, meta toml.MetaData) {
|
||||
if !meta.IsDefined("auth", "api_url") {
|
||||
// Re-apply defaults for zero values that should have defaults
|
||||
if cfg.Auth.APIURL == "" {
|
||||
cfg.Auth.APIURL = "https://torrentclaw.com"
|
||||
}
|
||||
if !meta.IsDefined("auth", "mirrors") {
|
||||
cfg.Auth.Mirrors = []string{"https://torrentclaw.to"}
|
||||
}
|
||||
if !meta.IsDefined("downloads", "preferred_method") {
|
||||
if cfg.Download.PreferredMethod == "" {
|
||||
cfg.Download.PreferredMethod = "auto"
|
||||
}
|
||||
if !meta.IsDefined("downloads", "max_concurrent") {
|
||||
if cfg.Download.MaxConcurrent == 0 {
|
||||
cfg.Download.MaxConcurrent = 3
|
||||
}
|
||||
if !meta.IsDefined("downloads", "stream_port") {
|
||||
cfg.Download.StreamPort = 11818
|
||||
}
|
||||
if !meta.IsDefined("general", "country") {
|
||||
if cfg.General.Country == "" {
|
||||
cfg.General.Country = "US"
|
||||
}
|
||||
if cfg.Download.StreamPort == 0 {
|
||||
cfg.Download.StreamPort = 11818
|
||||
}
|
||||
|
||||
if !meta.IsDefined("downloads", "transcode", "enabled") {
|
||||
cfg.Download.Transcode.Enabled = true
|
||||
}
|
||||
if !meta.IsDefined("downloads", "transcode", "hw_accel") {
|
||||
cfg.Download.Transcode.HWAccel = "auto"
|
||||
}
|
||||
if !meta.IsDefined("downloads", "transcode", "preset") {
|
||||
// Empty = let engine.ResolveEncoderProfile pick the latency-biased
|
||||
// default ("superfast" on libx264). Users wanting better quality at
|
||||
// slower first-play can override to "veryfast" / "fast" / "medium" in
|
||||
// config.toml. Ignored when hw_accel picks NVENC/QSV/VAAPI/VideoToolbox
|
||||
// (those have built-in vendor presets).
|
||||
cfg.Download.Transcode.Preset = ""
|
||||
}
|
||||
if !meta.IsDefined("downloads", "transcode", "audio_bitrate") {
|
||||
cfg.Download.Transcode.AudioBitrate = "192k"
|
||||
}
|
||||
if !meta.IsDefined("downloads", "transcode", "max_concurrent") {
|
||||
cfg.Download.Transcode.MaxConcurrent = 2
|
||||
}
|
||||
// NOTE: Funnel default-ON only applies to fresh installs (no config file →
|
||||
// Default() returns Funnel.Enabled=true straight off). When an existing
|
||||
// config file lacks `[downloads.funnel]` entirely we intentionally do NOT
|
||||
// flip it on here — that would silently route an upgraded operator's
|
||||
// traffic through CloudFlare without their consent. They opt in with
|
||||
// `unarr funnel on` whenever they're ready.
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
// Save writes config to the default or specified path using atomic write.
|
||||
|
|
|
|||
|
|
@ -190,62 +190,6 @@ func TestParseSpeed(t *testing.T) {
|
|||
}
|
||||
}
|
||||
|
||||
func TestLoadMinimalTOMLAppliesStreamingDefaults(t *testing.T) {
|
||||
tmp := t.TempDir()
|
||||
path := filepath.Join(tmp, "config.toml")
|
||||
|
||||
// Minimal config — only auth + agent. Nothing about webrtc / transcode.
|
||||
os.WriteFile(path, []byte(`[auth]
|
||||
api_key = "tc_minimal"
|
||||
|
||||
[agent]
|
||||
id = "agent-uuid"
|
||||
name = "Test"
|
||||
`), 0o644)
|
||||
|
||||
cfg, err := Load(path)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
|
||||
// Transcode should be on by default.
|
||||
if !cfg.Download.Transcode.Enabled {
|
||||
t.Error("Transcode.Enabled should default to true when [downloads.transcode] is absent")
|
||||
}
|
||||
if cfg.Download.Transcode.HWAccel != "auto" {
|
||||
t.Errorf("Transcode.HWAccel = %q, want auto", cfg.Download.Transcode.HWAccel)
|
||||
}
|
||||
if cfg.Download.Transcode.Preset != "" {
|
||||
// Default is now empty — engine.ResolveEncoderProfile picks
|
||||
// "superfast" on libx264 for first-start latency. Users
|
||||
// wanting better quality override in config.toml.
|
||||
t.Errorf("Transcode.Preset = %q, want empty", cfg.Download.Transcode.Preset)
|
||||
}
|
||||
if cfg.Download.Transcode.MaxConcurrent != 2 {
|
||||
t.Errorf("Transcode.MaxConcurrent = %d, want 2", cfg.Download.Transcode.MaxConcurrent)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadRespectsExplicitlyDisabledStreaming(t *testing.T) {
|
||||
tmp := t.TempDir()
|
||||
path := filepath.Join(tmp, "config.toml")
|
||||
|
||||
// User explicitly opted out of transcode. Defaults must NOT override
|
||||
// it — that would silently re-enable a feature the user disabled.
|
||||
os.WriteFile(path, []byte(`[downloads.transcode]
|
||||
enabled = false
|
||||
`), 0o644)
|
||||
|
||||
cfg, err := Load(path)
|
||||
if err != nil {
|
||||
t.Fatalf("Load failed: %v", err)
|
||||
}
|
||||
|
||||
if cfg.Download.Transcode.Enabled {
|
||||
t.Error("Transcode.Enabled = true, want false (user explicitly disabled)")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadInvalidTOML(t *testing.T) {
|
||||
tmp := t.TempDir()
|
||||
path := filepath.Join(tmp, "config.toml")
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -1,410 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
)
|
||||
|
||||
// HLSCache persists transcoded HLS segments per (source, quality, audio) so a
|
||||
// second play of the same file at the same quality skips ffmpeg entirely.
|
||||
//
|
||||
// Layout on disk:
|
||||
//
|
||||
// {root}/{key}/init.mp4
|
||||
// {root}/{key}/seg-0.m4s
|
||||
// {root}/{key}/seg-N.m4s
|
||||
// {root}/{key}/.complete
|
||||
//
|
||||
// Atomicity: the .complete marker is written only when ffmpeg exits 0 AND all
|
||||
// segments are on disk. A dir without .complete is treated as a partial run —
|
||||
// next session can reuse the segments already present, ffmpeg fills the gaps.
|
||||
//
|
||||
// Concurrency: Pin/Unpin increments a ref counter per key so the LRU sweeper
|
||||
// never evicts a directory that an active session is reading from.
|
||||
type HLSCache struct {
|
||||
root string
|
||||
maxBytes int64
|
||||
|
||||
mu sync.Mutex
|
||||
refs map[string]int
|
||||
writers map[string]bool // exclusive ffmpeg writer per key; nil entries are absent
|
||||
|
||||
// Counters surfaced via Stats() — useful for /api/internal/agent/cache-stats
|
||||
// and for the sweeper's daily log line. atomic so RecordHit/RecordMiss are
|
||||
// safe to call from any goroutine without taking the cache mutex.
|
||||
hits atomic.Uint64
|
||||
misses atomic.Uint64
|
||||
}
|
||||
|
||||
const (
|
||||
hlsCacheCompleteMarker = ".complete"
|
||||
// hlsCacheMinBudgetGB clamps absurd / zero / negative SizeGB values to
|
||||
// a sane floor. NOT a guarantee that any single encode fits — a long
|
||||
// 4K HEVC re-encode can exceed it. Operators should set size_gb based
|
||||
// on their actual workload.
|
||||
hlsCacheMinBudgetGB = 1
|
||||
// hlsCacheStartupOrphanAge: directories without .complete older than
|
||||
// this are removed on cache startup. Long enough that a daemon crash
|
||||
// during an in-progress encode (which legitimately leaves a partial
|
||||
// dir) doesn't get nuked too aggressively if the daemon restarts fast.
|
||||
hlsCacheStartupOrphanAge = 10 * time.Minute
|
||||
)
|
||||
|
||||
// NewHLSCache creates the cache rooted at the given dir with a size budget in
|
||||
// gigabytes. A budget < hlsCacheMinBudgetGB is clamped up so a single play
|
||||
// doesn't get instantly evicted mid-stream.
|
||||
func NewHLSCache(root string, sizeGB int) (*HLSCache, error) {
|
||||
if root == "" {
|
||||
return nil, errors.New("hls_cache: empty root")
|
||||
}
|
||||
if sizeGB < hlsCacheMinBudgetGB {
|
||||
sizeGB = hlsCacheMinBudgetGB
|
||||
}
|
||||
if err := os.MkdirAll(root, 0o755); err != nil {
|
||||
return nil, fmt.Errorf("hls_cache: mkdir root: %w", err)
|
||||
}
|
||||
c := &HLSCache{
|
||||
root: root,
|
||||
maxBytes: int64(sizeGB) * 1024 * 1024 * 1024,
|
||||
refs: make(map[string]int),
|
||||
writers: make(map[string]bool),
|
||||
}
|
||||
// Reap dirs left over from a crashed encode. A dir without .complete that
|
||||
// hasn't been touched recently was almost certainly orphaned by an
|
||||
// ungraceful daemon exit — keeping it just feeds the unbounded growth
|
||||
// pattern the hourly LRU is too slow to contain.
|
||||
if removed, err := c.cleanStartupOrphans(); err != nil {
|
||||
log.Printf("[hls_cache] startup orphan cleanup: %v", err)
|
||||
} else if removed > 0 {
|
||||
log.Printf("[hls_cache] startup: removed %d orphan dir(s) without .complete", removed)
|
||||
}
|
||||
return c, nil
|
||||
}
|
||||
|
||||
// cleanStartupOrphans removes cache subdirectories that lack a .complete
|
||||
// marker AND haven't been modified within hlsCacheStartupOrphanAge. Called
|
||||
// once at construction. Safe at startup because no sessions are active yet,
|
||||
// so Pin can't race with us.
|
||||
func (c *HLSCache) cleanStartupOrphans() (int, error) {
|
||||
entries, err := os.ReadDir(c.root)
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return 0, nil
|
||||
}
|
||||
return 0, err
|
||||
}
|
||||
cutoff := time.Now().Add(-hlsCacheStartupOrphanAge)
|
||||
removed := 0
|
||||
for _, e := range entries {
|
||||
if !e.IsDir() {
|
||||
continue
|
||||
}
|
||||
dir := filepath.Join(c.root, e.Name())
|
||||
if _, err := os.Stat(filepath.Join(dir, hlsCacheCompleteMarker)); err == nil {
|
||||
continue // sealed, keep
|
||||
}
|
||||
info, err := e.Info()
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
if info.ModTime().After(cutoff) {
|
||||
continue // too recent — might be a daemon that just restarted mid-encode
|
||||
}
|
||||
if err := os.RemoveAll(dir); err == nil {
|
||||
removed++
|
||||
}
|
||||
}
|
||||
return removed, nil
|
||||
}
|
||||
|
||||
// TryAcquireWriter attempts to claim exclusive ffmpeg-write access to a key.
|
||||
// Returns true on success — the caller is then responsible for ReleaseWriter
|
||||
// when ffmpeg exits / fails. Returns false if another session is already
|
||||
// writing this key, in which case the caller must fall back to a private
|
||||
// per-session tmpdir (no caching for that session).
|
||||
func (c *HLSCache) TryAcquireWriter(key string) bool {
|
||||
c.mu.Lock()
|
||||
defer c.mu.Unlock()
|
||||
if c.writers[key] {
|
||||
return false
|
||||
}
|
||||
c.writers[key] = true
|
||||
return true
|
||||
}
|
||||
|
||||
// ReleaseWriter releases the writer claim acquired via TryAcquireWriter.
|
||||
// Idempotent on unknown keys.
|
||||
func (c *HLSCache) ReleaseWriter(key string) {
|
||||
c.mu.Lock()
|
||||
delete(c.writers, key)
|
||||
c.mu.Unlock()
|
||||
}
|
||||
|
||||
// KeyFor derives a stable cache key for (source, quality, audioIndex). Using
|
||||
// the absolute source path means renaming a file invalidates the cache, which
|
||||
// is correct — segment content is tied to the encoded source.
|
||||
func (c *HLSCache) KeyFor(sourcePath, quality string, audioIndex int) string {
|
||||
abs, err := filepath.Abs(sourcePath)
|
||||
if err != nil {
|
||||
abs = sourcePath
|
||||
}
|
||||
h := sha256.Sum256([]byte(fmt.Sprintf("%s|%s|%d", abs, quality, audioIndex)))
|
||||
return hex.EncodeToString(h[:8]) // 16 hex chars — collision-safe enough for per-host cache
|
||||
}
|
||||
|
||||
// DirFor returns the on-disk directory for a cache key. Caller is responsible
|
||||
// for creating it.
|
||||
func (c *HLSCache) DirFor(key string) string {
|
||||
return filepath.Join(c.root, key)
|
||||
}
|
||||
|
||||
// HasComplete returns true when the .complete marker is present, meaning the
|
||||
// directory holds a full set of segments from a successful encode.
|
||||
func (c *HLSCache) HasComplete(key string) bool {
|
||||
if _, err := os.Stat(filepath.Join(c.DirFor(key), hlsCacheCompleteMarker)); err == nil {
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// MarkComplete writes the .complete marker. Call only after verifying ffmpeg
|
||||
// exited cleanly AND every expected segment is on disk. The dir must already
|
||||
// exist — StartHLSSession created it on the writer path.
|
||||
func (c *HLSCache) MarkComplete(key string) error {
|
||||
return os.WriteFile(filepath.Join(c.DirFor(key), hlsCacheCompleteMarker), nil, 0o644)
|
||||
}
|
||||
|
||||
// RecordHit increments the hit counter; called by StartHLSSession on a
|
||||
// cache-HIT path.
|
||||
func (c *HLSCache) RecordHit() { c.hits.Add(1) }
|
||||
|
||||
// RecordMiss increments the miss counter; called when a session has to
|
||||
// encode from scratch (or fails an integrity check on a stale HIT).
|
||||
func (c *HLSCache) RecordMiss() { c.misses.Add(1) }
|
||||
|
||||
// CacheStats is a snapshot of the cache's runtime counters + on-disk size.
|
||||
// The size fields are best-effort (computed via dirSize) so callers paying
|
||||
// for them should cache the result, not poll in a hot loop.
|
||||
type CacheStats struct {
|
||||
Hits uint64
|
||||
Misses uint64
|
||||
EntryCount int
|
||||
TotalBytes int64
|
||||
}
|
||||
|
||||
// Stats returns a snapshot of the cache counters and size. Walks the root
|
||||
// to total disk usage — O(N segments). Call at most every few minutes.
|
||||
func (c *HLSCache) Stats() CacheStats {
|
||||
s := CacheStats{
|
||||
Hits: c.hits.Load(),
|
||||
Misses: c.misses.Load(),
|
||||
}
|
||||
entries, err := os.ReadDir(c.root)
|
||||
if err != nil {
|
||||
return s
|
||||
}
|
||||
for _, e := range entries {
|
||||
if !e.IsDir() {
|
||||
continue
|
||||
}
|
||||
size, err := dirSize(filepath.Join(c.root, e.Name()))
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
s.EntryCount++
|
||||
s.TotalBytes += size
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
// hitRatePercent returns the current hit/(hit+miss) percentage rounded to
|
||||
// the nearest int; 0 when no calls have been recorded.
|
||||
func (c *HLSCache) hitRatePercent() int {
|
||||
h := c.hits.Load()
|
||||
m := c.misses.Load()
|
||||
total := h + m
|
||||
if total == 0 {
|
||||
return 0
|
||||
}
|
||||
return int((h*100 + total/2) / total)
|
||||
}
|
||||
|
||||
// VerifyComplete checks that the .complete marker is present AND the
|
||||
// essential files (init.mp4 + last segment) exist with non-zero size. A
|
||||
// dir that passes HasComplete but fails VerifyComplete is treated as
|
||||
// corrupted — typically external `rm` or a partial-disk-failure scenario.
|
||||
// When it returns false, callers should Invalidate and re-encode.
|
||||
func (c *HLSCache) VerifyComplete(key string, segmentCount int) bool {
|
||||
if !c.HasComplete(key) {
|
||||
return false
|
||||
}
|
||||
dir := c.DirFor(key)
|
||||
if fi, err := os.Stat(filepath.Join(dir, "video", "init.mp4")); err != nil || fi.Size() == 0 {
|
||||
return false
|
||||
}
|
||||
if segmentCount > 0 {
|
||||
lastSeg := filepath.Join(dir, "video", fmt.Sprintf("seg-%d.m4s", segmentCount-1))
|
||||
if fi, err := os.Stat(lastSeg); err != nil || fi.Size() == 0 {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// Pin increments the ref counter for a key. The sweeper checks this before
|
||||
// evicting, so a pinned dir is safe even if its mtime is old.
|
||||
func (c *HLSCache) Pin(key string) {
|
||||
c.mu.Lock()
|
||||
c.refs[key]++
|
||||
c.mu.Unlock()
|
||||
}
|
||||
|
||||
// Unpin decrements; safe to call on unknown keys (no-op).
|
||||
func (c *HLSCache) Unpin(key string) {
|
||||
c.mu.Lock()
|
||||
if c.refs[key] > 0 {
|
||||
c.refs[key]--
|
||||
if c.refs[key] == 0 {
|
||||
delete(c.refs, key)
|
||||
}
|
||||
}
|
||||
c.mu.Unlock()
|
||||
}
|
||||
|
||||
func (c *HLSCache) isPinned(key string) bool {
|
||||
c.mu.Lock()
|
||||
defer c.mu.Unlock()
|
||||
return c.refs[key] > 0
|
||||
}
|
||||
|
||||
// Touch updates the directory mtime so LRU picks fresher entries as recently
|
||||
// used. Called when a session starts reading from a cached dir.
|
||||
func (c *HLSCache) Touch(key string) error {
|
||||
dir := c.DirFor(key)
|
||||
now := time.Now()
|
||||
return os.Chtimes(dir, now, now)
|
||||
}
|
||||
|
||||
// Sweep enforces the size budget by deleting the least-recently-used cache
|
||||
// dirs (ignoring pinned ones) until the total size is at or below maxBytes.
|
||||
// Returns the number of bytes freed.
|
||||
func (c *HLSCache) Sweep() (int64, error) {
|
||||
entries, err := os.ReadDir(c.root)
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return 0, nil
|
||||
}
|
||||
return 0, fmt.Errorf("hls_cache: read root: %w", err)
|
||||
}
|
||||
|
||||
type item struct {
|
||||
key string
|
||||
path string
|
||||
size int64
|
||||
mtime time.Time
|
||||
}
|
||||
items := make([]item, 0, len(entries))
|
||||
var total, pinned int64
|
||||
for _, e := range entries {
|
||||
if !e.IsDir() {
|
||||
continue
|
||||
}
|
||||
info, err := e.Info()
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
key := e.Name()
|
||||
path := filepath.Join(c.root, key)
|
||||
size, err := dirSize(path)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
items = append(items, item{key: key, path: path, size: size, mtime: info.ModTime()})
|
||||
total += size
|
||||
if c.isPinned(key) {
|
||||
pinned += size
|
||||
}
|
||||
}
|
||||
|
||||
if total <= c.maxBytes {
|
||||
return 0, nil
|
||||
}
|
||||
if pinned >= c.maxBytes {
|
||||
// Every pinned byte already exceeds the budget — even evicting
|
||||
// every unpinned dir won't bring us under. Warn loudly so the
|
||||
// operator knows to bump size_gb (or kill the long-running session).
|
||||
log.Printf("[hls_cache] warn: pinned bytes (%.1f MB) exceed budget (%.1f MB) — cannot enforce limit until sessions release",
|
||||
float64(pinned)/(1024*1024), float64(c.maxBytes)/(1024*1024))
|
||||
return 0, nil
|
||||
}
|
||||
|
||||
// Oldest first.
|
||||
sort.Slice(items, func(i, j int) bool {
|
||||
return items[i].mtime.Before(items[j].mtime)
|
||||
})
|
||||
|
||||
var freed int64
|
||||
for _, it := range items {
|
||||
if total-freed <= c.maxBytes {
|
||||
break
|
||||
}
|
||||
if c.isPinned(it.key) {
|
||||
continue
|
||||
}
|
||||
if err := os.RemoveAll(it.path); err != nil {
|
||||
log.Printf("[hls_cache] evict %s failed: %v", it.key, err)
|
||||
continue
|
||||
}
|
||||
log.Printf("[hls_cache] evicted %s (%.1f MB, age %s)",
|
||||
it.key, float64(it.size)/(1024*1024), time.Since(it.mtime).Round(time.Second))
|
||||
freed += it.size
|
||||
}
|
||||
return freed, nil
|
||||
}
|
||||
|
||||
// StartSweeper kicks off the LRU sweeper goroutine. Cancels on ctx done.
|
||||
// In addition to enforcing the size budget, logs a daily summary of hit-rate
|
||||
// + disk usage so operators can see the cache's value at a glance.
|
||||
func (c *HLSCache) StartSweeper(ctx context.Context, interval time.Duration) {
|
||||
if interval <= 0 {
|
||||
interval = time.Hour
|
||||
}
|
||||
go func() {
|
||||
t := time.NewTicker(interval)
|
||||
defer t.Stop()
|
||||
statsTick := time.NewTicker(24 * time.Hour)
|
||||
defer statsTick.Stop()
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return
|
||||
case <-t.C:
|
||||
if _, err := c.Sweep(); err != nil {
|
||||
log.Printf("[hls_cache] sweep error: %v", err)
|
||||
}
|
||||
case <-statsTick.C:
|
||||
s := c.Stats()
|
||||
log.Printf("[hls_cache] day-stats: hits=%d misses=%d ratio=%d%% entries=%d size=%.1fMB",
|
||||
s.Hits, s.Misses, c.hitRatePercent(), s.EntryCount,
|
||||
float64(s.TotalBytes)/(1024*1024))
|
||||
}
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
// Invalidate removes a cache entry — used when ffmpeg fails to encode the
|
||||
// source so we don't reuse a half-written dir next time.
|
||||
func (c *HLSCache) Invalidate(key string) error {
|
||||
return os.RemoveAll(c.DirFor(key))
|
||||
}
|
||||
|
||||
|
|
@ -1,134 +0,0 @@
|
|||
//go:build smoke
|
||||
|
||||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// TestHLSCacheSmoke exercises the end-to-end cache flow against real ffmpeg:
|
||||
// - First session encodes a 5s test pattern; expect MISS, ffmpeg runs,
|
||||
// .complete written, MarkComplete logs.
|
||||
// - Second session for identical (source, quality, audio); expect HIT,
|
||||
// no ffmpeg, instant Start.
|
||||
//
|
||||
// Build tag `smoke` keeps it out of the default `go test ./...` run because
|
||||
// it depends on a working ffmpeg/ffprobe and takes ~5–10 s.
|
||||
//
|
||||
// go test -tags=smoke -run TestHLSCacheSmoke -v ./internal/engine/
|
||||
func TestHLSCacheSmoke(t *testing.T) {
|
||||
ffmpeg, err := exec.LookPath("ffmpeg")
|
||||
if err != nil {
|
||||
t.Skipf("ffmpeg not on PATH: %v", err)
|
||||
}
|
||||
ffprobe, err := exec.LookPath("ffprobe")
|
||||
if err != nil {
|
||||
t.Skipf("ffprobe not on PATH: %v", err)
|
||||
}
|
||||
|
||||
tmp := t.TempDir()
|
||||
source := filepath.Join(tmp, "source.mp4")
|
||||
t.Logf("generating 5 s test pattern → %s", source)
|
||||
if out, err := exec.Command(ffmpeg,
|
||||
"-y", "-loglevel", "error",
|
||||
"-f", "lavfi", "-i", "testsrc=duration=5:size=640x480:rate=30",
|
||||
"-f", "lavfi", "-i", "sine=frequency=1000:duration=5",
|
||||
"-c:v", "libx264", "-preset", "ultrafast", "-pix_fmt", "yuv420p",
|
||||
"-c:a", "aac",
|
||||
source,
|
||||
).CombinedOutput(); err != nil {
|
||||
t.Fatalf("ffmpeg generate: %v\n%s", err, out)
|
||||
}
|
||||
|
||||
cacheRoot := filepath.Join(tmp, "cache")
|
||||
cache, err := NewHLSCache(cacheRoot, 1)
|
||||
if err != nil {
|
||||
t.Fatalf("NewHLSCache: %v", err)
|
||||
}
|
||||
|
||||
cfg := HLSSessionConfig{
|
||||
SessionID: "smoke1",
|
||||
SourcePath: source,
|
||||
FileName: "source.mp4",
|
||||
Quality: "720p",
|
||||
AudioIndex: 0,
|
||||
Transcode: TranscodeRuntime{
|
||||
FFmpegPath: ffmpeg,
|
||||
FFprobePath: ffprobe,
|
||||
Preset: "ultrafast",
|
||||
},
|
||||
Cache: cache,
|
||||
}
|
||||
|
||||
// First run — expect MISS, ffmpeg runs.
|
||||
t.Log("session 1: expect MISS")
|
||||
t0 := time.Now()
|
||||
s1, err := StartHLSSession(context.Background(), cfg)
|
||||
if err != nil {
|
||||
t.Fatalf("StartHLSSession #1: %v", err)
|
||||
}
|
||||
if s1.fromCache {
|
||||
t.Fatal("session 1 reported cache HIT on a fresh cache")
|
||||
}
|
||||
|
||||
// Wait for all segments to land. 5 s source @ 4 s segments → 2 segments.
|
||||
deadline := time.Now().Add(60 * time.Second)
|
||||
for {
|
||||
s1.readyMu.Lock()
|
||||
ready := s1.readyMax
|
||||
exited := s1.exited
|
||||
s1.readyMu.Unlock()
|
||||
if ready >= s1.segmentCount-1 && exited {
|
||||
break
|
||||
}
|
||||
if time.Now().After(deadline) {
|
||||
_ = s1.Close()
|
||||
t.Fatalf("session 1 didn't finish in 60 s (readyMax=%d/%d, exited=%v)",
|
||||
ready, s1.segmentCount-1, exited)
|
||||
}
|
||||
time.Sleep(100 * time.Millisecond)
|
||||
}
|
||||
if err := s1.Close(); err != nil {
|
||||
t.Fatalf("Close #1: %v", err)
|
||||
}
|
||||
encodeDur := time.Since(t0)
|
||||
t.Logf("session 1: MISS completed in %s", encodeDur.Round(time.Millisecond))
|
||||
|
||||
key := cache.KeyFor(source, "720p", 0)
|
||||
if !cache.HasComplete(key) {
|
||||
t.Fatalf("cache.HasComplete(%s) is false after successful encode", key)
|
||||
}
|
||||
|
||||
// Second run — expect HIT, no ffmpeg.
|
||||
t.Log("session 2: expect HIT")
|
||||
cfg.SessionID = "smoke2"
|
||||
t1 := time.Now()
|
||||
s2, err := StartHLSSession(context.Background(), cfg)
|
||||
if err != nil {
|
||||
t.Fatalf("StartHLSSession #2: %v", err)
|
||||
}
|
||||
if !s2.fromCache {
|
||||
t.Fatal("session 2 should have reported cache HIT")
|
||||
}
|
||||
if s2.cmd != nil {
|
||||
t.Fatal("session 2 should not have spawned ffmpeg (s.cmd != nil)")
|
||||
}
|
||||
hitDur := time.Since(t1)
|
||||
t.Logf("session 2: HIT in %s (%.1f× faster than MISS)",
|
||||
hitDur.Round(time.Millisecond), float64(encodeDur)/float64(hitDur))
|
||||
if hitDur > 500*time.Millisecond {
|
||||
t.Errorf("HIT path too slow: %s — expected <500 ms", hitDur)
|
||||
}
|
||||
if err := s2.Close(); err != nil {
|
||||
t.Fatalf("Close #2: %v", err)
|
||||
}
|
||||
|
||||
// After the HIT session closes, the cache dir + .complete must still exist.
|
||||
if !cache.HasComplete(key) {
|
||||
t.Fatal(".complete disappeared after HIT session closed")
|
||||
}
|
||||
}
|
||||
|
|
@ -1,361 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func newTestCache(t *testing.T, sizeGB int) *HLSCache {
|
||||
t.Helper()
|
||||
root := t.TempDir()
|
||||
c, err := NewHLSCache(root, sizeGB)
|
||||
if err != nil {
|
||||
t.Fatalf("NewHLSCache: %v", err)
|
||||
}
|
||||
return c
|
||||
}
|
||||
|
||||
func TestKeyForStable(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
k1 := c.KeyFor("/a/b/movie.mkv", "1080p", 0)
|
||||
k2 := c.KeyFor("/a/b/movie.mkv", "1080p", 0)
|
||||
if k1 != k2 {
|
||||
t.Fatalf("expected stable keys, got %q vs %q", k1, k2)
|
||||
}
|
||||
if c.KeyFor("/a/b/movie.mkv", "720p", 0) == k1 {
|
||||
t.Fatal("quality should change key")
|
||||
}
|
||||
if c.KeyFor("/a/b/movie.mkv", "1080p", 1) == k1 {
|
||||
t.Fatal("audio index should change key")
|
||||
}
|
||||
if c.KeyFor("/x/y/other.mkv", "1080p", 0) == k1 {
|
||||
t.Fatal("path should change key")
|
||||
}
|
||||
}
|
||||
|
||||
func TestMarkCompleteAndHas(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
key := "abc123"
|
||||
if c.HasComplete(key) {
|
||||
t.Fatal("fresh cache should not report complete")
|
||||
}
|
||||
// Production callers create the dir during StartHLSSession; MarkComplete
|
||||
// trusts that invariant and fails if the dir was wiped meanwhile.
|
||||
if err := os.MkdirAll(c.DirFor(key), 0o755); err != nil {
|
||||
t.Fatalf("mkdir: %v", err)
|
||||
}
|
||||
if err := c.MarkComplete(key); err != nil {
|
||||
t.Fatalf("MarkComplete: %v", err)
|
||||
}
|
||||
if !c.HasComplete(key) {
|
||||
t.Fatal("after MarkComplete, HasComplete must be true")
|
||||
}
|
||||
}
|
||||
|
||||
func TestMarkCompleteFailsWithoutDir(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
if err := c.MarkComplete("never-created"); err == nil {
|
||||
t.Fatal("MarkComplete should error when dir doesn't exist")
|
||||
}
|
||||
}
|
||||
|
||||
func TestPinPreventsEviction(t *testing.T) {
|
||||
c := newTestCache(t, 1) // 1 GB budget, but min clamp keeps it usable
|
||||
c.maxBytes = 1024 // squeeze budget for the test
|
||||
|
||||
// Write two entries past the budget.
|
||||
for i, key := range []string{"old", "new"} {
|
||||
dir := c.DirFor(key)
|
||||
if err := os.MkdirAll(dir, 0o755); err != nil {
|
||||
t.Fatalf("mkdir %s: %v", dir, err)
|
||||
}
|
||||
path := filepath.Join(dir, "seg.bin")
|
||||
if err := os.WriteFile(path, make([]byte, 800), 0o644); err != nil {
|
||||
t.Fatalf("write %s: %v", path, err)
|
||||
}
|
||||
now := time.Now().Add(time.Duration(i) * time.Hour) // "old" mtime < "new"
|
||||
_ = os.Chtimes(dir, now, now)
|
||||
}
|
||||
|
||||
c.Pin("old") // protect the older one
|
||||
freed, err := c.Sweep()
|
||||
if err != nil {
|
||||
t.Fatalf("Sweep: %v", err)
|
||||
}
|
||||
if freed == 0 {
|
||||
t.Fatal("expected some eviction")
|
||||
}
|
||||
if _, err := os.Stat(c.DirFor("old")); err != nil {
|
||||
t.Fatal("pinned 'old' was evicted")
|
||||
}
|
||||
if _, err := os.Stat(c.DirFor("new")); err == nil {
|
||||
t.Fatal("'new' should have been evicted to make room")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSweepNoOpUnderBudget(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
dir := c.DirFor("small")
|
||||
_ = os.MkdirAll(dir, 0o755)
|
||||
_ = os.WriteFile(filepath.Join(dir, "x"), []byte("tiny"), 0o644)
|
||||
freed, err := c.Sweep()
|
||||
if err != nil {
|
||||
t.Fatalf("Sweep: %v", err)
|
||||
}
|
||||
if freed != 0 {
|
||||
t.Fatalf("expected 0 freed under budget, got %d", freed)
|
||||
}
|
||||
if _, err := os.Stat(dir); err != nil {
|
||||
t.Fatal("under-budget entry was wrongly evicted")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSweepEmptyRoot(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
freed, err := c.Sweep()
|
||||
if err != nil {
|
||||
t.Fatalf("Sweep empty: %v", err)
|
||||
}
|
||||
if freed != 0 {
|
||||
t.Fatalf("freed=%d, want 0", freed)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInvalidateRemovesDir(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
key := "drop"
|
||||
dir := c.DirFor(key)
|
||||
_ = os.MkdirAll(dir, 0o755)
|
||||
_ = os.WriteFile(filepath.Join(dir, "x"), []byte("y"), 0o644)
|
||||
if err := c.Invalidate(key); err != nil {
|
||||
t.Fatalf("Invalidate: %v", err)
|
||||
}
|
||||
if _, err := os.Stat(dir); err == nil {
|
||||
t.Fatal("dir still present after Invalidate")
|
||||
}
|
||||
}
|
||||
|
||||
func TestTouchUpdatesMtime(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
key := "touch"
|
||||
dir := c.DirFor(key)
|
||||
_ = os.MkdirAll(dir, 0o755)
|
||||
old := time.Now().Add(-2 * time.Hour)
|
||||
_ = os.Chtimes(dir, old, old)
|
||||
|
||||
if err := c.Touch(key); err != nil {
|
||||
t.Fatalf("Touch: %v", err)
|
||||
}
|
||||
info, err := os.Stat(dir)
|
||||
if err != nil {
|
||||
t.Fatalf("stat: %v", err)
|
||||
}
|
||||
if !info.ModTime().After(old.Add(time.Minute)) {
|
||||
t.Fatalf("mtime not refreshed: %v", info.ModTime())
|
||||
}
|
||||
}
|
||||
|
||||
func TestPinUnpinSymmetry(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
c.Pin("k")
|
||||
c.Pin("k")
|
||||
if !c.isPinned("k") {
|
||||
t.Fatal("Pin twice should leave pinned")
|
||||
}
|
||||
c.Unpin("k")
|
||||
if !c.isPinned("k") {
|
||||
t.Fatal("Unpin once should keep pinned (refs=1)")
|
||||
}
|
||||
c.Unpin("k")
|
||||
if c.isPinned("k") {
|
||||
t.Fatal("Unpin twice should drop pin")
|
||||
}
|
||||
c.Unpin("k") // safe no-op
|
||||
}
|
||||
|
||||
func TestConcurrentPinUnpin(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
var wg sync.WaitGroup
|
||||
for i := 0; i < 100; i++ {
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
c.Pin("race")
|
||||
time.Sleep(time.Microsecond)
|
||||
c.Unpin("race")
|
||||
}()
|
||||
}
|
||||
wg.Wait()
|
||||
if c.isPinned("race") {
|
||||
t.Fatal("refs leaked")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSweeperLoopExits(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
c.StartSweeper(ctx, 10*time.Millisecond)
|
||||
time.Sleep(30 * time.Millisecond)
|
||||
cancel()
|
||||
// If StartSweeper doesn't exit on cancel the test would leak a goroutine;
|
||||
// the leak detector in the test runner will surface it.
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
}
|
||||
|
||||
func TestMinBudgetClamp(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
c, err := NewHLSCache(root, 0) // below floor
|
||||
if err != nil {
|
||||
t.Fatalf("NewHLSCache: %v", err)
|
||||
}
|
||||
if c.maxBytes != int64(hlsCacheMinBudgetGB)*1024*1024*1024 {
|
||||
t.Fatalf("budget not clamped to min: got %d", c.maxBytes)
|
||||
}
|
||||
}
|
||||
|
||||
func TestTryAcquireWriterExclusive(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
if !c.TryAcquireWriter("k") {
|
||||
t.Fatal("first acquire should succeed")
|
||||
}
|
||||
if c.TryAcquireWriter("k") {
|
||||
t.Fatal("second acquire for same key must fail")
|
||||
}
|
||||
if !c.TryAcquireWriter("other") {
|
||||
t.Fatal("different key should not conflict")
|
||||
}
|
||||
c.ReleaseWriter("k")
|
||||
if !c.TryAcquireWriter("k") {
|
||||
t.Fatal("acquire after release should succeed")
|
||||
}
|
||||
c.ReleaseWriter("k")
|
||||
c.ReleaseWriter("k") // idempotent
|
||||
}
|
||||
|
||||
func TestStartupOrphanCleanup(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
|
||||
// Pre-seed: one sealed dir + one orphan old enough + one orphan fresh.
|
||||
sealed := filepath.Join(root, "sealed")
|
||||
_ = os.MkdirAll(sealed, 0o755)
|
||||
_ = os.WriteFile(filepath.Join(sealed, hlsCacheCompleteMarker), nil, 0o644)
|
||||
|
||||
staleOrphan := filepath.Join(root, "stale_orphan")
|
||||
_ = os.MkdirAll(staleOrphan, 0o755)
|
||||
old := time.Now().Add(-2 * hlsCacheStartupOrphanAge)
|
||||
_ = os.Chtimes(staleOrphan, old, old)
|
||||
|
||||
freshOrphan := filepath.Join(root, "fresh_orphan")
|
||||
_ = os.MkdirAll(freshOrphan, 0o755)
|
||||
|
||||
if _, err := NewHLSCache(root, 1); err != nil {
|
||||
t.Fatalf("NewHLSCache: %v", err)
|
||||
}
|
||||
|
||||
if _, err := os.Stat(sealed); err != nil {
|
||||
t.Fatal("sealed dir was wrongly removed")
|
||||
}
|
||||
if _, err := os.Stat(staleOrphan); err == nil {
|
||||
t.Fatal("stale orphan should have been removed at startup")
|
||||
}
|
||||
if _, err := os.Stat(freshOrphan); err != nil {
|
||||
t.Fatal("fresh orphan should be kept (might be a mid-restart encode)")
|
||||
}
|
||||
}
|
||||
|
||||
func TestHitMissCounters(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
if s := c.Stats(); s.Hits != 0 || s.Misses != 0 {
|
||||
t.Fatalf("fresh cache stats not zero: %+v", s)
|
||||
}
|
||||
c.RecordHit()
|
||||
c.RecordHit()
|
||||
c.RecordMiss()
|
||||
s := c.Stats()
|
||||
if s.Hits != 2 || s.Misses != 1 {
|
||||
t.Fatalf("counters wrong: %+v", s)
|
||||
}
|
||||
// 2/3 = 67%
|
||||
if got := c.hitRatePercent(); got != 67 {
|
||||
t.Fatalf("hitRatePercent=%d, want 67", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStatsEntryCount(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
for _, k := range []string{"a", "b", "c"} {
|
||||
dir := c.DirFor(k)
|
||||
_ = os.MkdirAll(dir, 0o755)
|
||||
_ = os.WriteFile(filepath.Join(dir, "x"), []byte("hello"), 0o644)
|
||||
}
|
||||
s := c.Stats()
|
||||
if s.EntryCount != 3 {
|
||||
t.Fatalf("EntryCount=%d, want 3", s.EntryCount)
|
||||
}
|
||||
if s.TotalBytes != 15 {
|
||||
t.Fatalf("TotalBytes=%d, want 15", s.TotalBytes)
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerifyCompleteRejectsMissingFiles(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
key := "v"
|
||||
dir := c.DirFor(key)
|
||||
_ = os.MkdirAll(filepath.Join(dir, "video"), 0o755)
|
||||
|
||||
// No .complete yet → reject.
|
||||
if c.VerifyComplete(key, 2) {
|
||||
t.Fatal("VerifyComplete should reject without .complete")
|
||||
}
|
||||
|
||||
// Mark complete but no files → reject.
|
||||
if err := c.MarkComplete(key); err != nil {
|
||||
t.Fatalf("MarkComplete: %v", err)
|
||||
}
|
||||
if c.VerifyComplete(key, 2) {
|
||||
t.Fatal("VerifyComplete should reject when init.mp4 missing")
|
||||
}
|
||||
|
||||
// Write init.mp4, last seg missing → reject.
|
||||
_ = os.WriteFile(filepath.Join(dir, "video", "init.mp4"), []byte("..."), 0o644)
|
||||
if c.VerifyComplete(key, 2) {
|
||||
t.Fatal("VerifyComplete should reject when last segment missing")
|
||||
}
|
||||
|
||||
// Write last seg → pass.
|
||||
_ = os.WriteFile(filepath.Join(dir, "video", "seg-1.m4s"), []byte("..."), 0o644)
|
||||
if !c.VerifyComplete(key, 2) {
|
||||
t.Fatal("VerifyComplete should pass with all files present")
|
||||
}
|
||||
|
||||
// Zero-size last seg → reject.
|
||||
_ = os.WriteFile(filepath.Join(dir, "video", "seg-1.m4s"), nil, 0o644)
|
||||
if c.VerifyComplete(key, 2) {
|
||||
t.Fatal("VerifyComplete should reject zero-size last segment")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSweepRespectsPinnedExceedsBudget(t *testing.T) {
|
||||
c := newTestCache(t, 1)
|
||||
c.maxBytes = 256 // squeeze
|
||||
|
||||
pinned := c.DirFor("pinned")
|
||||
_ = os.MkdirAll(pinned, 0o755)
|
||||
_ = os.WriteFile(filepath.Join(pinned, "x"), make([]byte, 1024), 0o644)
|
||||
c.Pin("pinned")
|
||||
|
||||
freed, err := c.Sweep()
|
||||
if err != nil {
|
||||
t.Fatalf("Sweep: %v", err)
|
||||
}
|
||||
if freed != 0 {
|
||||
t.Fatalf("nothing should have been freed: got %d", freed)
|
||||
}
|
||||
if _, err := os.Stat(pinned); err != nil {
|
||||
t.Fatal("pinned dir wrongly removed despite over-budget pin")
|
||||
}
|
||||
}
|
||||
|
|
@ -1,294 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestYnBool(t *testing.T) {
|
||||
if got := ynBool(true); got != "YES" {
|
||||
t.Errorf("ynBool(true) = %q, want YES", got)
|
||||
}
|
||||
if got := ynBool(false); got != "NO" {
|
||||
t.Errorf("ynBool(false) = %q, want NO", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBitrateForQuality(t *testing.T) {
|
||||
cases := map[string]int{
|
||||
"2160p": 25_000_000,
|
||||
"1080p": 6_000_000,
|
||||
"720p": 3_500_000,
|
||||
"480p": 1_500_000,
|
||||
"unknown": 6_000_000,
|
||||
"": 6_000_000,
|
||||
}
|
||||
for q, want := range cases {
|
||||
if got := bitrateForQuality(q); got != want {
|
||||
t.Errorf("bitrateForQuality(%q) = %d, want %d", q, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestQualityHeight(t *testing.T) {
|
||||
cases := map[string]int{
|
||||
"2160p": 2160,
|
||||
"1080p": 1080,
|
||||
"720p": 720,
|
||||
"480p": 480,
|
||||
"": 0,
|
||||
"unknown": 0,
|
||||
}
|
||||
for q, want := range cases {
|
||||
if got := qualityHeight(q); got != want {
|
||||
t.Errorf("qualityHeight(%q) = %d, want %d", q, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestScaledDimensions(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
srcW, srcH, capH int
|
||||
wantW, wantH int
|
||||
}{
|
||||
{"no_cap_returns_source", 1920, 1080, 0, 1920, 1080},
|
||||
{"under_cap_returns_source", 1280, 720, 1080, 1280, 720},
|
||||
{"4k_capped_to_1080", 3840, 2160, 1080, 1920, 1080},
|
||||
{"even_width_stays_even", 1003, 750, 720, 962, 720},
|
||||
{"odd_width_bumps_up", 1001, 700, 500, 716, 500},
|
||||
{"invalid_returns_default", 0, 0, 0, 1920, 1080},
|
||||
{"negative_returns_default", -10, 100, 0, 1920, 1080},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
gotW, gotH := scaledDimensions(tt.srcW, tt.srcH, tt.capH)
|
||||
if gotW != tt.wantW || gotH != tt.wantH {
|
||||
t.Errorf("scaledDimensions(%d,%d,%d) = (%d,%d), want (%d,%d)",
|
||||
tt.srcW, tt.srcH, tt.capH, gotW, gotH, tt.wantW, tt.wantH)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestShortHLSID(t *testing.T) {
|
||||
if got := shortHLSID("abcdef1234567890"); got != "abcdef12" {
|
||||
t.Errorf("got %q, want abcdef12", got)
|
||||
}
|
||||
if got := shortHLSID("short"); got != "short" {
|
||||
t.Errorf("got %q, want short", got)
|
||||
}
|
||||
if got := shortHLSID(""); got != "" {
|
||||
t.Errorf("got %q, want empty", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestHlsTmpDirRoot(t *testing.T) {
|
||||
root := hlsTmpDirRoot()
|
||||
if root == "" {
|
||||
t.Fatal("hlsTmpDirRoot returned empty")
|
||||
}
|
||||
if !strings.Contains(root, "hls-sessions") && !strings.Contains(root, "unarr-hls-sessions") {
|
||||
t.Errorf("expected path to contain hls-sessions, got %q", root)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRenderVideoPlaylist(t *testing.T) {
|
||||
out := renderVideoPlaylist(10.0, 3)
|
||||
required := []string{
|
||||
"#EXTM3U",
|
||||
"#EXT-X-VERSION:7",
|
||||
"#EXT-X-PLAYLIST-TYPE:VOD",
|
||||
`#EXT-X-MAP:URI="init.mp4"`,
|
||||
"seg-0.m4s",
|
||||
"seg-1.m4s",
|
||||
"seg-2.m4s",
|
||||
"#EXT-X-ENDLIST",
|
||||
}
|
||||
for _, want := range required {
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("playlist missing %q\n%s", want, out)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRenderVideoPlaylistShortFinalSegment(t *testing.T) {
|
||||
// 9.5s total, 2s segments → 5 segs of 2/2/2/2/1.5
|
||||
segCount := segmentCountForDuration(9.5)
|
||||
out := renderVideoPlaylist(9.5, segCount)
|
||||
if !strings.Contains(out, "#EXTINF:1.500,") {
|
||||
t.Errorf("expected final segment 1.5s in playlist (segCount=%d), got:\n%s", segCount, out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRenderMasterPlaylist(t *testing.T) {
|
||||
probe := &StreamProbe{
|
||||
Width: 1920,
|
||||
Height: 1080,
|
||||
SubtitleTracks: []ProbeSubtitleTrack{
|
||||
{Index: 0, Lang: "es", Codec: "subrip", Title: "Spanish"},
|
||||
{Index: 1, Lang: "en", Codec: "subrip", Title: "English", Forced: true},
|
||||
{Index: 2, Lang: "ja", Codec: "hdmv_pgs_subtitle"}, // bitmap, skipped
|
||||
},
|
||||
}
|
||||
out := renderMasterPlaylist(probe, "1080p")
|
||||
|
||||
if !strings.HasPrefix(out, "#EXTM3U") {
|
||||
t.Errorf("must start with #EXTM3U, got:\n%s", out)
|
||||
}
|
||||
if !strings.Contains(out, "BANDWIDTH=6000000") {
|
||||
t.Errorf("expected 1080p bandwidth, got:\n%s", out)
|
||||
}
|
||||
if !strings.Contains(out, "RESOLUTION=1920x1080") {
|
||||
t.Errorf("expected 1920x1080 resolution, got:\n%s", out)
|
||||
}
|
||||
if !strings.Contains(out, `SUBTITLES="subs"`) {
|
||||
t.Errorf("expected subtitles group attached, got:\n%s", out)
|
||||
}
|
||||
if !strings.Contains(out, `LANGUAGE="es"`) || !strings.Contains(out, `LANGUAGE="en"`) {
|
||||
t.Errorf("expected text subs included, got:\n%s", out)
|
||||
}
|
||||
if strings.Contains(out, "hdmv_pgs") || strings.Contains(out, `LANGUAGE="ja"`) {
|
||||
t.Errorf("bitmap subs should be excluded, got:\n%s", out)
|
||||
}
|
||||
if !strings.Contains(out, "(forced)") {
|
||||
t.Errorf("expected forced suffix on English track, got:\n%s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRenderMasterPlaylistNoSubs(t *testing.T) {
|
||||
probe := &StreamProbe{Width: 1280, Height: 720}
|
||||
out := renderMasterPlaylist(probe, "720p")
|
||||
if strings.Contains(out, "SUBTITLES=") {
|
||||
t.Errorf("no subs should produce no SUBTITLES attr, got:\n%s", out)
|
||||
}
|
||||
if !strings.Contains(out, "BANDWIDTH=3500000") {
|
||||
t.Errorf("expected 720p bandwidth, got:\n%s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestHLSSessionRegistry(t *testing.T) {
|
||||
r := NewHLSSessionRegistry()
|
||||
if r.Get("missing") != nil {
|
||||
t.Error("Get on empty registry should return nil")
|
||||
}
|
||||
|
||||
s1 := &HLSSession{cfg: HLSSessionConfig{SessionID: "a"}, lastTouch: time.Now()}
|
||||
r.Register(s1)
|
||||
if got := r.Get("a"); got != s1 {
|
||||
t.Errorf("Get(a) = %v, want %v", got, s1)
|
||||
}
|
||||
|
||||
// Registering a different session evicts (and Closes) the previous one.
|
||||
s2 := &HLSSession{cfg: HLSSessionConfig{SessionID: "b"}, lastTouch: time.Now()}
|
||||
r.Register(s2)
|
||||
if r.Get("a") != nil {
|
||||
t.Error("registering different session should evict prior entries")
|
||||
}
|
||||
if r.Get("b") != s2 {
|
||||
t.Error("Get(b) should return s2")
|
||||
}
|
||||
|
||||
r.Remove("b")
|
||||
if r.Get("b") != nil {
|
||||
t.Error("Remove should drop the session")
|
||||
}
|
||||
}
|
||||
|
||||
func TestHLSSessionAccessors(t *testing.T) {
|
||||
probe := &StreamProbe{VideoCodec: "h264", Width: 1280, Height: 720}
|
||||
s := &HLSSession{
|
||||
cfg: HLSSessionConfig{SessionID: "abcdef1234"},
|
||||
probe: probe,
|
||||
manifestRoot: "MASTER",
|
||||
manifestVideo: "VIDEO",
|
||||
durationSec: 42.5,
|
||||
lastTouch: time.Now().Add(-1 * time.Hour),
|
||||
}
|
||||
if s.MasterPlaylist() != "MASTER" {
|
||||
t.Errorf("MasterPlaylist mismatch")
|
||||
}
|
||||
if s.VideoPlaylist() != "VIDEO" {
|
||||
t.Errorf("VideoPlaylist mismatch")
|
||||
}
|
||||
if s.DurationSeconds() != 42.5 {
|
||||
t.Errorf("DurationSeconds mismatch")
|
||||
}
|
||||
if s.Probe() != probe {
|
||||
t.Errorf("Probe mismatch")
|
||||
}
|
||||
|
||||
old := s.lastTouch
|
||||
s.Touch()
|
||||
if !s.lastTouch.After(old) {
|
||||
t.Errorf("Touch did not advance lastTouch")
|
||||
}
|
||||
|
||||
info := s.ProbeInfo()
|
||||
if info["videoCodec"] != "h264" || info["width"] != 1280 {
|
||||
t.Errorf("ProbeInfo missing fields: %v", info)
|
||||
}
|
||||
}
|
||||
|
||||
func TestHLSSessionProbeInfoNil(t *testing.T) {
|
||||
s := &HLSSession{}
|
||||
info := s.ProbeInfo()
|
||||
if len(info) != 0 {
|
||||
t.Errorf("nil probe should produce empty info, got %v", info)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSweepIdle(t *testing.T) {
|
||||
r := NewHLSSessionRegistry()
|
||||
idleSession := &HLSSession{
|
||||
cfg: HLSSessionConfig{SessionID: "old"},
|
||||
lastTouch: time.Now().Add(-2 * hlsSessionTTL),
|
||||
}
|
||||
r.Register(idleSession)
|
||||
if got := r.SweepIdle(); got != 1 {
|
||||
t.Errorf("SweepIdle = %d, want 1", got)
|
||||
}
|
||||
if r.Get("old") != nil {
|
||||
t.Errorf("idle session should have been removed")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCleanupHLSOrphanDirsMissingRoot(t *testing.T) {
|
||||
// Directory does not exist — should not error.
|
||||
t.Setenv("XDG_CACHE_HOME", filepath.Join(t.TempDir(), "nonexistent"))
|
||||
if err := CleanupHLSOrphanDirs(); err != nil {
|
||||
t.Errorf("CleanupHLSOrphanDirs on missing root = %v, want nil", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidSessionID(t *testing.T) {
|
||||
good := []string{
|
||||
"abc",
|
||||
"7b8c4f12-9d3e-4a1b-9c2f-aabbccddeeff",
|
||||
"ABC_123-xyz",
|
||||
strings.Repeat("a", 128),
|
||||
}
|
||||
bad := []string{
|
||||
"",
|
||||
"../etc/passwd",
|
||||
"foo/bar",
|
||||
"foo\\bar",
|
||||
"foo.bar",
|
||||
"with spaces",
|
||||
"with\nnewline",
|
||||
strings.Repeat("a", 129),
|
||||
"héctor", // non-ascii
|
||||
}
|
||||
for _, id := range good {
|
||||
if !validSessionID.MatchString(id) {
|
||||
t.Errorf("validSessionID rejected good id %q", id)
|
||||
}
|
||||
}
|
||||
for _, id := range bad {
|
||||
if validSessionID.MatchString(id) {
|
||||
t.Errorf("validSessionID accepted bad id %q", id)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,273 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"os/exec"
|
||||
"runtime"
|
||||
"strings"
|
||||
"sync"
|
||||
)
|
||||
|
||||
// HWAccel identifies a hardware-accelerated ffmpeg encoder family.
|
||||
type HWAccel string
|
||||
|
||||
const (
|
||||
HWAccelNone HWAccel = "none"
|
||||
HWAccelNVENC HWAccel = "nvenc" // NVIDIA — h264_nvenc / hevc_nvenc
|
||||
HWAccelQSV HWAccel = "qsv" // Intel Quick Sync — h264_qsv / hevc_qsv
|
||||
HWAccelVAAPI HWAccel = "vaapi" // Linux open-source — h264_vaapi / hevc_vaapi
|
||||
HWAccelVideoToolbox HWAccel = "videotoolbox" // macOS — h264_videotoolbox
|
||||
)
|
||||
|
||||
var (
|
||||
hwOnce sync.Once
|
||||
hwCache HWAccel
|
||||
)
|
||||
|
||||
// DetectHWAccel returns the most capable hardware encoder available on this
|
||||
// host, or HWAccelNone if software-only. Cached after first call — adding /
|
||||
// removing a GPU at runtime is rare and the cost of probing isn't free.
|
||||
func DetectHWAccel(ctx context.Context, ffmpegPath string) HWAccel {
|
||||
hwOnce.Do(func() {
|
||||
hwCache = detectHWAccelFresh(ctx, ffmpegPath)
|
||||
})
|
||||
return hwCache
|
||||
}
|
||||
|
||||
// ResetHWAccelCache clears the singleton — only used in tests.
|
||||
func ResetHWAccelCache() {
|
||||
hwOnce = sync.Once{}
|
||||
hwCache = ""
|
||||
}
|
||||
|
||||
func detectHWAccelFresh(ctx context.Context, ffmpegPath string) HWAccel {
|
||||
if ffmpegPath == "" {
|
||||
return HWAccelNone
|
||||
}
|
||||
encoders := listFFmpegEncoders(ctx, ffmpegPath)
|
||||
if encoders == "" {
|
||||
return HWAccelNone
|
||||
}
|
||||
|
||||
// macOS — VideoToolbox is always available on Apple Silicon + recent Intel.
|
||||
if runtime.GOOS == "darwin" && strings.Contains(encoders, "h264_videotoolbox") {
|
||||
return HWAccelVideoToolbox
|
||||
}
|
||||
|
||||
// NVIDIA — encoder presence + a CUDA-capable device. We rely on the
|
||||
// existence of the device file rather than running nvidia-smi to keep
|
||||
// startup quick on hosts without nvidia tooling.
|
||||
if strings.Contains(encoders, "h264_nvenc") &&
|
||||
(fileExists("/dev/nvidia0") || hasNvidiaDriver()) {
|
||||
return HWAccelNVENC
|
||||
}
|
||||
|
||||
// Intel Quick Sync — needs /dev/dri (also used by VA-API). Distinguish by
|
||||
// checking whether the QSV-specific encoder is built in.
|
||||
if strings.Contains(encoders, "h264_qsv") && fileExists("/dev/dri/renderD128") {
|
||||
return HWAccelQSV
|
||||
}
|
||||
|
||||
// Linux generic VA-API — works on Intel + AMD with mesa drivers.
|
||||
if strings.Contains(encoders, "h264_vaapi") && fileExists("/dev/dri/renderD128") {
|
||||
return HWAccelVAAPI
|
||||
}
|
||||
|
||||
return HWAccelNone
|
||||
}
|
||||
|
||||
func listFFmpegEncoders(ctx context.Context, ffmpegPath string) string {
|
||||
cmd := exec.CommandContext(ctx, ffmpegPath, "-hide_banner", "-encoders")
|
||||
out, err := cmd.CombinedOutput()
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return string(out)
|
||||
}
|
||||
|
||||
// HWAccelDiagnostic bundles what we know about the host's ffmpeg + HW encode
|
||||
// capabilities so the daemon can log a single coherent line at startup and the
|
||||
// web side can surface "this agent is software-only" without re-running probes.
|
||||
type HWAccelDiagnostic struct {
|
||||
Pick HWAccel // backend selected by DetectHWAccel
|
||||
FFmpegPath string // resolved ffmpeg binary
|
||||
FFmpegVersion string // first line of `ffmpeg -version` (e.g. "ffmpeg version 6.1.1")
|
||||
Encoders []string // HW + libsvtav1/libvpx9-class encoders found in -encoders output
|
||||
Devices []string // device files / drivers detected at probe time
|
||||
}
|
||||
|
||||
// DetectHWAccelDiagnostic returns the full diagnostic picture for the host's
|
||||
// transcode pipeline. Unlike DetectHWAccel, this is NOT cached — callers pay
|
||||
// for an ffmpeg subprocess on each call (one `-encoders`, one `-version`).
|
||||
// Daemon startup is the natural caller; per-session lookups should keep using
|
||||
// DetectHWAccel (cached) and only re-probe diagnostics if the user runs an
|
||||
// explicit doctor command.
|
||||
func DetectHWAccelDiagnostic(ctx context.Context, ffmpegPath string) HWAccelDiagnostic {
|
||||
d := HWAccelDiagnostic{Pick: HWAccelNone, FFmpegPath: ffmpegPath}
|
||||
if ffmpegPath == "" {
|
||||
return d
|
||||
}
|
||||
d.FFmpegVersion = ffmpegVersionLine(ctx, ffmpegPath)
|
||||
encoders := listFFmpegEncoders(ctx, ffmpegPath)
|
||||
for _, name := range hwEncoderNames {
|
||||
if strings.Contains(encoders, name) {
|
||||
d.Encoders = append(d.Encoders, name)
|
||||
}
|
||||
}
|
||||
// Device-file checks mirror the picks below so the log line tells the
|
||||
// reader why a present encoder might still have been rejected (e.g. NVENC
|
||||
// compiled in but /dev/nvidia0 missing inside a container).
|
||||
if fileExists("/dev/nvidia0") {
|
||||
d.Devices = append(d.Devices, "/dev/nvidia0")
|
||||
}
|
||||
if fileExists("/dev/dri/renderD128") {
|
||||
d.Devices = append(d.Devices, "/dev/dri/renderD128")
|
||||
}
|
||||
if hasNvidiaDriver() {
|
||||
d.Devices = append(d.Devices, "nvidia-smi")
|
||||
}
|
||||
d.Pick = DetectHWAccel(ctx, ffmpegPath)
|
||||
return d
|
||||
}
|
||||
|
||||
// LogLine returns a one-line human-readable summary of the diagnostic,
|
||||
// suitable for daemon startup output. Format:
|
||||
//
|
||||
// "[transcode] ffmpeg 6.1.1 at /usr/bin/ffmpeg, HW=nvenc (h264_nvenc), devices=/dev/nvidia0,nvidia-smi"
|
||||
// "[transcode] ffmpeg 6.1.1 at /home/linuxbrew/.../ffmpeg, HW=none (software libx264) — no HW encoders compiled in"
|
||||
func (d HWAccelDiagnostic) LogLine() string {
|
||||
var b strings.Builder
|
||||
b.WriteString("[transcode] ")
|
||||
if d.FFmpegVersion != "" {
|
||||
b.WriteString(d.FFmpegVersion)
|
||||
} else {
|
||||
b.WriteString("ffmpeg")
|
||||
}
|
||||
if d.FFmpegPath != "" {
|
||||
b.WriteString(" at ")
|
||||
b.WriteString(d.FFmpegPath)
|
||||
}
|
||||
b.WriteString(", HW=")
|
||||
b.WriteString(string(d.Pick))
|
||||
if d.Pick == HWAccelNone {
|
||||
if len(d.Encoders) == 0 {
|
||||
b.WriteString(" (software libx264) — no HW encoders compiled in")
|
||||
} else {
|
||||
b.WriteString(" (software libx264) — encoders found but no matching device: ")
|
||||
b.WriteString(strings.Join(d.Encoders, ","))
|
||||
}
|
||||
} else {
|
||||
b.WriteString(" (")
|
||||
b.WriteString(d.Pick.FFmpegVideoCodec("h264"))
|
||||
b.WriteString(")")
|
||||
if len(d.Devices) > 0 {
|
||||
b.WriteString(", devices=")
|
||||
b.WriteString(strings.Join(d.Devices, ","))
|
||||
}
|
||||
}
|
||||
return b.String()
|
||||
}
|
||||
|
||||
// hwEncoderNames lists the HW-accelerated encoders we care about for the
|
||||
// startup log. Kept in lookup order so the output reads predictably across
|
||||
// hosts.
|
||||
var hwEncoderNames = []string{
|
||||
"h264_nvenc", "hevc_nvenc",
|
||||
"h264_qsv", "hevc_qsv",
|
||||
"h264_vaapi", "hevc_vaapi",
|
||||
"h264_videotoolbox", "hevc_videotoolbox",
|
||||
}
|
||||
|
||||
// ffmpegVersionLine extracts the "ffmpeg version X.Y.Z" prefix from
|
||||
// `ffmpeg -version`. Bounded to avoid hanging the daemon on a misbehaving
|
||||
// binary.
|
||||
func ffmpegVersionLine(ctx context.Context, ffmpegPath string) string {
|
||||
cmd := exec.CommandContext(ctx, ffmpegPath, "-hide_banner", "-version")
|
||||
out, err := cmd.CombinedOutput()
|
||||
if err != nil || len(out) == 0 {
|
||||
return ""
|
||||
}
|
||||
line, _, _ := strings.Cut(string(out), "\n")
|
||||
// "ffmpeg version 6.1.1-some-build-suffix Copyright..." → keep up to first
|
||||
// space after "version 6.x" to avoid spamming build flags into the log.
|
||||
if idx := strings.Index(line, "Copyright"); idx > 0 {
|
||||
line = strings.TrimSpace(line[:idx])
|
||||
}
|
||||
return strings.TrimSpace(line)
|
||||
}
|
||||
|
||||
func fileExists(path string) bool {
|
||||
_, err := os.Stat(path)
|
||||
return err == nil
|
||||
}
|
||||
|
||||
func hasNvidiaDriver() bool {
|
||||
// Cheap proxy — if the user has nvidia-smi on PATH they presumably also
|
||||
// have a working driver / runtime libraries.
|
||||
_, err := exec.LookPath("nvidia-smi")
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// FFmpegVideoCodec returns the encoder name to pass to `-c:v` for the
|
||||
// requested HW accel + target (h264 or hevc).
|
||||
func (h HWAccel) FFmpegVideoCodec(target string) string {
|
||||
target = strings.ToLower(target)
|
||||
switch h {
|
||||
case HWAccelNVENC:
|
||||
if target == "hevc" {
|
||||
return "hevc_nvenc"
|
||||
}
|
||||
return "h264_nvenc"
|
||||
case HWAccelQSV:
|
||||
if target == "hevc" {
|
||||
return "hevc_qsv"
|
||||
}
|
||||
return "h264_qsv"
|
||||
case HWAccelVAAPI:
|
||||
if target == "hevc" {
|
||||
return "hevc_vaapi"
|
||||
}
|
||||
return "h264_vaapi"
|
||||
case HWAccelVideoToolbox:
|
||||
if target == "hevc" {
|
||||
return "hevc_videotoolbox"
|
||||
}
|
||||
return "h264_videotoolbox"
|
||||
default:
|
||||
// Software fallback. libx264 ships with every ffmpeg build.
|
||||
return "libx264"
|
||||
}
|
||||
}
|
||||
|
||||
// H264LevelForHeight returns the lowest H.264 profile level capable of
|
||||
// encoding a stream at the given output pixel height. Each tier carries
|
||||
// enough macroblock headroom to handle ANAMORPHIC content (up to ~2.4:1
|
||||
// cinemascope) at 30 fps — a fixed 16:9 assumption used to silently bust
|
||||
// the level on a 720p movie shot in 2.4:1 (1728×720 = 4860 MBs > 3.1's
|
||||
// 3600 limit; libx264 logs "frame MB size > level limit" and emits a
|
||||
// corrupt stream).
|
||||
func H264LevelForHeight(height int) string {
|
||||
switch {
|
||||
case height <= 0:
|
||||
// Unknown source — pick a level that covers up to 4K so we never
|
||||
// re-introduce the silent-failure mode that motivated this helper.
|
||||
return "5.1"
|
||||
case height <= 480:
|
||||
return "3.1"
|
||||
case height <= 720:
|
||||
// 4.0 instead of 3.1: covers 720p anamorphic (e.g. 1728×720) +
|
||||
// MB rate up to 245k/s (3.1 caps at 108k/s — broken at 24 fps).
|
||||
return "4.0"
|
||||
case height <= 1080:
|
||||
// 4.1 instead of 4.0: covers 1080p anamorphic + 30 fps (~245k MBs/s).
|
||||
return "4.1"
|
||||
case height <= 1440:
|
||||
return "5.0"
|
||||
case height <= 2160:
|
||||
return "5.1"
|
||||
default:
|
||||
// 4K @ 60 fps and 8K all fall under 6.x.
|
||||
return "6.0"
|
||||
}
|
||||
}
|
||||
|
|
@ -1,156 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestHWAccelFFmpegVideoCodec(t *testing.T) {
|
||||
cases := []struct {
|
||||
hw HWAccel
|
||||
target string
|
||||
want string
|
||||
}{
|
||||
{HWAccelNone, "h264", "libx264"},
|
||||
{HWAccelNone, "hevc", "libx264"},
|
||||
{HWAccelNVENC, "h264", "h264_nvenc"},
|
||||
{HWAccelNVENC, "hevc", "hevc_nvenc"},
|
||||
{HWAccelQSV, "h264", "h264_qsv"},
|
||||
{HWAccelQSV, "hevc", "hevc_qsv"},
|
||||
{HWAccelVAAPI, "h264", "h264_vaapi"},
|
||||
{HWAccelVAAPI, "hevc", "hevc_vaapi"},
|
||||
{HWAccelVideoToolbox, "h264", "h264_videotoolbox"},
|
||||
{HWAccelVideoToolbox, "hevc", "hevc_videotoolbox"},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
if got := tc.hw.FFmpegVideoCodec(tc.target); got != tc.want {
|
||||
t.Errorf("%s.FFmpegVideoCodec(%q) = %q want %q", tc.hw, tc.target, got, tc.want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestDetectHWAccelEmptyPathReturnsNone(t *testing.T) {
|
||||
ResetHWAccelCache()
|
||||
if got := detectHWAccelFresh(t.Context(), ""); got != HWAccelNone {
|
||||
t.Errorf("got %s, want %s", got, HWAccelNone)
|
||||
}
|
||||
}
|
||||
|
||||
func TestResolveEncoderProfileDefaults(t *testing.T) {
|
||||
cases := []struct {
|
||||
hw HWAccel
|
||||
configured string
|
||||
wantCodec string
|
||||
wantPreset string
|
||||
wantHint string
|
||||
}{
|
||||
// Empty configured preset → pick latency-biased default per backend.
|
||||
// DecodeHwAccel matches the encoder family for HW encoders; libx264 +
|
||||
// VideoToolbox have no demuxer hint.
|
||||
{HWAccelNone, "", "libx264", "superfast", ""},
|
||||
{HWAccelNVENC, "", "h264_nvenc", "p3", "cuda"},
|
||||
{HWAccelQSV, "", "h264_qsv", "veryfast", "qsv"},
|
||||
// VAAPI: decoder hint set, no preset, no `-hwaccel_output_format vaapi`
|
||||
// (so the CPU filter chain can consume the decoded frames).
|
||||
{HWAccelVAAPI, "", "h264_vaapi", "", "vaapi"},
|
||||
// VideoToolbox has no preset knob — Preset should be "" regardless of input.
|
||||
// VideoToolbox uses per-encoder flags, not a demuxer `-hwaccel` hint.
|
||||
{HWAccelVideoToolbox, "p4", "h264_videotoolbox", "", ""},
|
||||
{HWAccelVideoToolbox, "", "h264_videotoolbox", "", ""},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
got := ResolveEncoderProfile(tc.hw, tc.configured)
|
||||
if got.Codec != tc.wantCodec || got.Preset != tc.wantPreset || got.DecodeHwAccel != tc.wantHint {
|
||||
t.Errorf("ResolveEncoderProfile(%s, %q) = {codec=%s preset=%s hint=%s}, want {codec=%s preset=%s hint=%s}",
|
||||
tc.hw, tc.configured,
|
||||
got.Codec, got.Preset, got.DecodeHwAccel,
|
||||
tc.wantCodec, tc.wantPreset, tc.wantHint)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestResolveEncoderProfileHonoursConfiguredPreset(t *testing.T) {
|
||||
// Only libx264 honours the configured preset — the libx264 vocabulary
|
||||
// (ultrafast…veryslow) doesn't apply to vendor encoders. NVENC has its
|
||||
// own p1-p7 scale; QSV uses a different subset; VideoToolbox has no
|
||||
// preset knob. Passing a libx264 preset to them would have ffmpeg reject
|
||||
// the argv, so ResolveEncoderProfile always falls back to the hardcoded
|
||||
// vendor preset for non-libx264 codecs.
|
||||
cases := []struct {
|
||||
hw HWAccel
|
||||
configured string
|
||||
wantPreset string
|
||||
}{
|
||||
{HWAccelNone, "ultrafast", "ultrafast"}, // libx264 honours
|
||||
{HWAccelNone, "medium", "medium"}, // libx264 honours
|
||||
{HWAccelNVENC, "p1", "p3"}, // NVENC ignores, sticks to p3
|
||||
{HWAccelNVENC, "veryfast", "p3"}, // NVENC ignores libx264 vocab
|
||||
{HWAccelQSV, "veryslow", "veryfast"}, // QSV ignores, sticks to veryfast
|
||||
{HWAccelVideoToolbox, "veryfast", ""}, // VideoToolbox has no preset
|
||||
}
|
||||
for _, tc := range cases {
|
||||
got := ResolveEncoderProfile(tc.hw, tc.configured)
|
||||
if got.Preset != tc.wantPreset {
|
||||
t.Errorf("ResolveEncoderProfile(%s, %q).Preset = %q, want %q",
|
||||
tc.hw, tc.configured, got.Preset, tc.wantPreset)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestHWAccelDiagnosticLogLineNone(t *testing.T) {
|
||||
d := HWAccelDiagnostic{
|
||||
Pick: HWAccelNone,
|
||||
FFmpegPath: "/usr/local/bin/ffmpeg",
|
||||
FFmpegVersion: "ffmpeg version 6.1.1",
|
||||
Encoders: nil,
|
||||
Devices: nil,
|
||||
}
|
||||
line := d.LogLine()
|
||||
wantSubstrings := []string{
|
||||
"ffmpeg version 6.1.1",
|
||||
"/usr/local/bin/ffmpeg",
|
||||
"HW=none",
|
||||
"software libx264",
|
||||
"no HW encoders compiled in",
|
||||
}
|
||||
for _, want := range wantSubstrings {
|
||||
if !strings.Contains(line, want) {
|
||||
t.Errorf("expected substring %q in log line; got %q", want, line)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestHWAccelDiagnosticLogLineNVENCWithDevices(t *testing.T) {
|
||||
d := HWAccelDiagnostic{
|
||||
Pick: HWAccelNVENC,
|
||||
FFmpegPath: "/usr/bin/ffmpeg",
|
||||
FFmpegVersion: "ffmpeg version 6.0",
|
||||
Encoders: []string{"h264_nvenc", "hevc_nvenc", "h264_qsv"},
|
||||
Devices: []string{"/dev/nvidia0", "nvidia-smi"},
|
||||
}
|
||||
line := d.LogLine()
|
||||
for _, want := range []string{"HW=nvenc", "h264_nvenc", "/dev/nvidia0", "nvidia-smi"} {
|
||||
if !strings.Contains(line, want) {
|
||||
t.Errorf("expected substring %q in log line; got %q", want, line)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestHWAccelDiagnosticLogLineSoftwareButEncodersFound(t *testing.T) {
|
||||
// Edge case: ffmpeg compiled WITH nvenc but no /dev/nvidia0 (container w/o GPU).
|
||||
// LogLine should flag the encoders so the user knows where the gap is.
|
||||
d := HWAccelDiagnostic{
|
||||
Pick: HWAccelNone,
|
||||
FFmpegPath: "/usr/bin/ffmpeg",
|
||||
FFmpegVersion: "ffmpeg version 6.0",
|
||||
Encoders: []string{"h264_nvenc"},
|
||||
Devices: nil,
|
||||
}
|
||||
line := d.LogLine()
|
||||
for _, want := range []string{"HW=none", "encoders found but no matching device", "h264_nvenc"} {
|
||||
if !strings.Contains(line, want) {
|
||||
t.Errorf("expected substring %q in log line; got %q", want, line)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -1,186 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/torrentclaw/unarr/internal/library/mediainfo"
|
||||
)
|
||||
|
||||
// StreamProbe summarises the codec / container shape of a file as it relates
|
||||
// to the HLS streaming pipeline. It tells the transcoder whether bytes can
|
||||
// be streamed as-is, just remuxed to fragmented MP4, or fully transcoded.
|
||||
type StreamProbe struct {
|
||||
// VideoCodec lowercased — e.g. "h264", "hevc", "av1", "vp9", "mpeg4".
|
||||
VideoCodec string
|
||||
// AudioCodec lowercased — e.g. "aac", "ac3", "dts", "eac3", "opus".
|
||||
// Reflects the default/first audio track for legacy single-track callers.
|
||||
AudioCodec string
|
||||
// Width / Height of the primary video stream.
|
||||
Width int
|
||||
Height int
|
||||
// BitDepth — 8, 10 or 12. 0 if unknown.
|
||||
BitDepth int
|
||||
// HDR signalling string ("HDR10" / "DV" / "HLG" / etc, or "" for SDR).
|
||||
HDR string
|
||||
// DurationSec is the file length, used to sanity-check seek targets.
|
||||
DurationSec float64
|
||||
// Container is the file extension lowercased (".mp4", ".mkv", ".avi").
|
||||
Container string
|
||||
// AudioTracks lists every audio stream in source order. Index in this
|
||||
// slice == ffmpeg `-map 0:a:N` index (where N starts at 0).
|
||||
AudioTracks []ProbeAudioTrack
|
||||
// SubtitleTracks lists every subtitle stream in source order. Index in
|
||||
// this slice == ffmpeg `-map 0:s:N` index.
|
||||
SubtitleTracks []ProbeSubtitleTrack
|
||||
}
|
||||
|
||||
// ProbeAudioTrack is a slimmed AudioTrack view tied to ffmpeg stream index.
|
||||
type ProbeAudioTrack struct {
|
||||
Index int // 0-based audio stream index (ffmpeg -map 0:a:Index)
|
||||
Lang string // ISO 639-1
|
||||
Codec string // lowercased
|
||||
Channels int
|
||||
Title string
|
||||
Default bool
|
||||
}
|
||||
|
||||
// ProbeSubtitleTrack is a slimmed SubtitleTrack view tied to ffmpeg stream index.
|
||||
// Codec discriminates text (srt/ass/webvtt → extract to WebVTT) vs bitmap
|
||||
// (pgs/dvbsub → require burn-in).
|
||||
type ProbeSubtitleTrack struct {
|
||||
Index int // 0-based subtitle stream index (ffmpeg -map 0:s:Index)
|
||||
Lang string // ISO 639-1
|
||||
Codec string // lowercased — "subrip", "ass", "webvtt", "hdmv_pgs_subtitle", ...
|
||||
Title string
|
||||
Forced bool
|
||||
}
|
||||
|
||||
// IsTextSubtitle reports whether a subtitle codec can be extracted to WebVTT
|
||||
// without re-rendering. Bitmap subs (PGS, DVB) need burn-in.
|
||||
func (s ProbeSubtitleTrack) IsTextSubtitle() bool {
|
||||
switch s.Codec {
|
||||
case "subrip", "srt", "ass", "ssa", "webvtt", "mov_text":
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// TranscodeAction tells the streaming pipeline how to feed the file to
|
||||
// the browser <video> element. The decision matrix is documented in the
|
||||
// project plan (Fase 2.5 — Transcoding on-the-fly).
|
||||
type TranscodeAction string
|
||||
|
||||
const (
|
||||
// ActionPassthrough — file is already browser-playable as-is. Stream the
|
||||
// raw bytes via ReadAt; no ffmpeg involved.
|
||||
ActionPassthrough TranscodeAction = "passthrough"
|
||||
// ActionRemux — codecs are browser-compatible but the container or moov
|
||||
// placement is not. Run ffmpeg with `-c copy -movflags frag_keyframe`.
|
||||
ActionRemux TranscodeAction = "remux"
|
||||
// ActionRemuxAudio — video is fine but audio needs a re-encode (AC3/DTS
|
||||
// → AAC). `-c:v copy -c:a aac`.
|
||||
ActionRemuxAudio TranscodeAction = "remux-audio"
|
||||
// ActionTranscodeVideo — full re-encode. Used for HEVC/AV1 and any
|
||||
// 10-bit content if the browser refuses the codec.
|
||||
ActionTranscodeVideo TranscodeAction = "transcode-video"
|
||||
)
|
||||
|
||||
// ProbeFile runs ffprobe and returns a StreamProbe view of the file.
|
||||
//
|
||||
// Result is memoised by (path, mtime, size) for probeCacheTTL — repeat plays
|
||||
// of the same file at the same quality (the HLS cache HIT path) skip ffprobe
|
||||
// entirely. ffprobe on a 50 GB MKV can cost 1-3 s; first-segment latency
|
||||
// shrinks by the same amount on the second play.
|
||||
func ProbeFile(ctx context.Context, ffprobePath, filePath string) (*StreamProbe, error) {
|
||||
if cached, ok := lookupProbeCache(filePath); ok {
|
||||
return cached, nil
|
||||
}
|
||||
mi, err := mediainfo.ExtractMediaInfo(ctx, ffprobePath, filePath)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("probe: %w", err)
|
||||
}
|
||||
probe := &StreamProbe{Container: lowerExt(filePath)}
|
||||
if mi.Video != nil {
|
||||
probe.VideoCodec = strings.ToLower(mi.Video.Codec)
|
||||
probe.Width = mi.Video.Width
|
||||
probe.Height = mi.Video.Height
|
||||
probe.BitDepth = mi.Video.BitDepth
|
||||
probe.HDR = mi.Video.HDR
|
||||
probe.DurationSec = mi.Video.Duration
|
||||
}
|
||||
if len(mi.Audio) > 0 {
|
||||
// Default to the first track marked "Default", else the first track.
|
||||
picked := mi.Audio[0]
|
||||
for _, a := range mi.Audio {
|
||||
if a.Default {
|
||||
picked = a
|
||||
break
|
||||
}
|
||||
}
|
||||
probe.AudioCodec = strings.ToLower(picked.Codec)
|
||||
probe.AudioTracks = make([]ProbeAudioTrack, 0, len(mi.Audio))
|
||||
for i, a := range mi.Audio {
|
||||
probe.AudioTracks = append(probe.AudioTracks, ProbeAudioTrack{
|
||||
Index: i,
|
||||
Lang: a.Lang,
|
||||
Codec: strings.ToLower(a.Codec),
|
||||
Channels: a.Channels,
|
||||
Title: a.Title,
|
||||
Default: a.Default,
|
||||
})
|
||||
}
|
||||
}
|
||||
if len(mi.Subtitles) > 0 {
|
||||
probe.SubtitleTracks = make([]ProbeSubtitleTrack, 0, len(mi.Subtitles))
|
||||
for i, s := range mi.Subtitles {
|
||||
probe.SubtitleTracks = append(probe.SubtitleTracks, ProbeSubtitleTrack{
|
||||
Index: i,
|
||||
Lang: s.Lang,
|
||||
Codec: strings.ToLower(s.Codec),
|
||||
Title: s.Title,
|
||||
Forced: s.Forced,
|
||||
})
|
||||
}
|
||||
}
|
||||
storeProbeCache(filePath, probe)
|
||||
return probe, nil
|
||||
}
|
||||
|
||||
// DecideAction maps a probe to the transcoding action the streaming pipeline
|
||||
// should take. Browsers consume MP4/h264+AAC natively; everything else needs
|
||||
// some level of re-shaping.
|
||||
func DecideAction(p *StreamProbe) TranscodeAction {
|
||||
if p == nil {
|
||||
return ActionPassthrough
|
||||
}
|
||||
video := p.VideoCodec
|
||||
audio := p.AudioCodec
|
||||
container := p.Container
|
||||
|
||||
// 10-bit / HDR is a hard no for browser playback even if h264 — needs SW transcode.
|
||||
tenBitOrHDR := p.BitDepth >= 10 || p.HDR != ""
|
||||
|
||||
if !tenBitOrHDR && video == "h264" {
|
||||
if audio == "aac" {
|
||||
if container == ".mp4" {
|
||||
return ActionPassthrough
|
||||
}
|
||||
return ActionRemux
|
||||
}
|
||||
// Audio incompatible (AC3/DTS/TrueHD/EAC3) → remux video, transcode audio.
|
||||
return ActionRemuxAudio
|
||||
}
|
||||
|
||||
// HEVC / AV1 / VP9 / 10-bit / unknown → full re-encode video.
|
||||
return ActionTranscodeVideo
|
||||
}
|
||||
|
||||
func lowerExt(filePath string) string {
|
||||
dot := strings.LastIndex(filePath, ".")
|
||||
if dot < 0 {
|
||||
return ""
|
||||
}
|
||||
return strings.ToLower(filePath[dot:])
|
||||
}
|
||||
|
|
@ -1,141 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"os"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
// probeCacheTTL is how long a cached probe stays usable. The cache key
|
||||
// already incorporates mtime + size, so the TTL is a defense against
|
||||
// runaway memory growth from stale paths, not a freshness guarantee — a
|
||||
// rename + recreate at the same inode (rare) would still be caught by the
|
||||
// mtime delta.
|
||||
const probeCacheTTL = 30 * time.Minute
|
||||
|
||||
// probeCacheJanitorInterval is how often the background sweeper wakes to
|
||||
// drop expired entries. Lookup-time eviction handles hot paths, but a
|
||||
// user who browses 5k files and then stops would leak entries until each
|
||||
// is individually re-touched. 5 min ≈ 6 sweeps per TTL window — enough
|
||||
// to keep memory bounded without burning CPU.
|
||||
const probeCacheJanitorInterval = 5 * time.Minute
|
||||
|
||||
type probeCacheEntry struct {
|
||||
probe *StreamProbe
|
||||
expires time.Time
|
||||
}
|
||||
|
||||
type probeCacheKey struct {
|
||||
path string
|
||||
mtime int64 // ModTime().UnixNano()
|
||||
size int64
|
||||
}
|
||||
|
||||
var (
|
||||
probeCacheMu sync.RWMutex
|
||||
probeCache = make(map[probeCacheKey]probeCacheEntry)
|
||||
probeCacheJanitor sync.Once
|
||||
)
|
||||
|
||||
// startProbeCacheJanitor launches the background sweeper exactly once per
|
||||
// process. Lazy — fired on first storeProbeCache. Drops expired entries
|
||||
// every probeCacheJanitorInterval. Idempotent (sync.Once).
|
||||
func startProbeCacheJanitor() {
|
||||
probeCacheJanitor.Do(func() {
|
||||
go func() {
|
||||
ticker := time.NewTicker(probeCacheJanitorInterval)
|
||||
defer ticker.Stop()
|
||||
for range ticker.C {
|
||||
sweepProbeCache(time.Now())
|
||||
}
|
||||
}()
|
||||
})
|
||||
}
|
||||
|
||||
// sweepProbeCache removes every entry whose expiry is at or before `now`.
|
||||
// Exposed for tests; production code calls it indirectly via the janitor
|
||||
// goroutine.
|
||||
func sweepProbeCache(now time.Time) int {
|
||||
probeCacheMu.Lock()
|
||||
defer probeCacheMu.Unlock()
|
||||
removed := 0
|
||||
for k, e := range probeCache {
|
||||
if !now.Before(e.expires) {
|
||||
delete(probeCache, k)
|
||||
removed++
|
||||
}
|
||||
}
|
||||
return removed
|
||||
}
|
||||
|
||||
// lookupProbeCache returns the cached StreamProbe for the given path if its
|
||||
// mtime + size still match the value recorded at insert time, AND the cache
|
||||
// entry hasn't expired. Any stat failure / mismatch returns (nil, false) so
|
||||
// the caller falls through to a fresh ffprobe run.
|
||||
func lookupProbeCache(path string) (*StreamProbe, bool) {
|
||||
fi, err := os.Stat(path)
|
||||
if err != nil {
|
||||
return nil, false
|
||||
}
|
||||
key := probeCacheKey{
|
||||
path: path,
|
||||
mtime: fi.ModTime().UnixNano(),
|
||||
size: fi.Size(),
|
||||
}
|
||||
probeCacheMu.RLock()
|
||||
entry, ok := probeCache[key]
|
||||
probeCacheMu.RUnlock()
|
||||
if !ok {
|
||||
return nil, false
|
||||
}
|
||||
if time.Now().After(entry.expires) {
|
||||
// Re-check under the write lock so a concurrent re-insert (same key,
|
||||
// fresh expiry) isn't accidentally evicted.
|
||||
probeCacheMu.Lock()
|
||||
if cur, stillThere := probeCache[key]; stillThere && time.Now().After(cur.expires) {
|
||||
delete(probeCache, key)
|
||||
}
|
||||
probeCacheMu.Unlock()
|
||||
return nil, false
|
||||
}
|
||||
return entry.probe, true
|
||||
}
|
||||
|
||||
// storeProbeCache stashes a fresh probe result under the (path, mtime, size)
|
||||
// key. A subsequent ffprobe-skipping HIT requires the file to still have the
|
||||
// same mtime + size — anything else (re-encoded, renamed+recreated at the
|
||||
// same path, truncated) misses and triggers a re-probe.
|
||||
func storeProbeCache(path string, probe *StreamProbe) {
|
||||
fi, err := os.Stat(path)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
key := probeCacheKey{
|
||||
path: path,
|
||||
mtime: fi.ModTime().UnixNano(),
|
||||
size: fi.Size(),
|
||||
}
|
||||
probeCacheMu.Lock()
|
||||
probeCache[key] = probeCacheEntry{
|
||||
probe: probe,
|
||||
expires: time.Now().Add(probeCacheTTL),
|
||||
}
|
||||
probeCacheMu.Unlock()
|
||||
// Lazy janitor — fires once per process. No-op after first call.
|
||||
startProbeCacheJanitor()
|
||||
}
|
||||
|
||||
// ResetProbeCache clears the in-memory probe cache. Test-only.
|
||||
func ResetProbeCache() {
|
||||
probeCacheMu.Lock()
|
||||
probeCache = make(map[probeCacheKey]probeCacheEntry)
|
||||
probeCacheMu.Unlock()
|
||||
}
|
||||
|
||||
// ProbeCacheSize returns the number of entries currently cached. Exposed
|
||||
// for diagnostics + tests.
|
||||
func ProbeCacheSize() int {
|
||||
probeCacheMu.RLock()
|
||||
defer probeCacheMu.RUnlock()
|
||||
return len(probeCache)
|
||||
}
|
||||
|
|
@ -1,202 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestProbeCache_LookupMissNonexistent(t *testing.T) {
|
||||
ResetProbeCache()
|
||||
t.Cleanup(ResetProbeCache)
|
||||
|
||||
if _, ok := lookupProbeCache("/path/that/does/not/exist"); ok {
|
||||
t.Fatal("expected MISS for non-existent path")
|
||||
}
|
||||
}
|
||||
|
||||
func TestProbeCache_StoreThenLookupHit(t *testing.T) {
|
||||
ResetProbeCache()
|
||||
t.Cleanup(ResetProbeCache)
|
||||
|
||||
dir := t.TempDir()
|
||||
path := filepath.Join(dir, "movie.mkv")
|
||||
if err := os.WriteFile(path, []byte("fake content"), 0o644); err != nil {
|
||||
t.Fatalf("write tmp file: %v", err)
|
||||
}
|
||||
|
||||
probe := &StreamProbe{VideoCodec: "h264", Width: 1920, Height: 1080, DurationSec: 5400}
|
||||
storeProbeCache(path, probe)
|
||||
|
||||
got, ok := lookupProbeCache(path)
|
||||
if !ok {
|
||||
t.Fatal("expected HIT after store")
|
||||
}
|
||||
if got != probe {
|
||||
t.Fatalf("expected pointer-identical probe; got different")
|
||||
}
|
||||
}
|
||||
|
||||
func TestProbeCache_MtimeChangeInvalidates(t *testing.T) {
|
||||
ResetProbeCache()
|
||||
t.Cleanup(ResetProbeCache)
|
||||
|
||||
dir := t.TempDir()
|
||||
path := filepath.Join(dir, "movie.mkv")
|
||||
if err := os.WriteFile(path, []byte("original"), 0o644); err != nil {
|
||||
t.Fatalf("write: %v", err)
|
||||
}
|
||||
|
||||
probe := &StreamProbe{VideoCodec: "h264", DurationSec: 100}
|
||||
storeProbeCache(path, probe)
|
||||
|
||||
// Force mtime change. WriteFile doesn't guarantee a different mtime if
|
||||
// the filesystem timestamp resolution is coarse, so set it explicitly
|
||||
// to a value 1 hour in the future.
|
||||
future := time.Now().Add(1 * time.Hour)
|
||||
if err := os.Chtimes(path, future, future); err != nil {
|
||||
t.Fatalf("chtimes: %v", err)
|
||||
}
|
||||
|
||||
if _, ok := lookupProbeCache(path); ok {
|
||||
t.Fatal("expected MISS after mtime change")
|
||||
}
|
||||
}
|
||||
|
||||
func TestProbeCache_SizeChangeInvalidates(t *testing.T) {
|
||||
ResetProbeCache()
|
||||
t.Cleanup(ResetProbeCache)
|
||||
|
||||
dir := t.TempDir()
|
||||
path := filepath.Join(dir, "movie.mkv")
|
||||
if err := os.WriteFile(path, []byte("aaaaa"), 0o644); err != nil {
|
||||
t.Fatalf("write: %v", err)
|
||||
}
|
||||
originalMtime := time.Now().Add(-1 * time.Hour) // stable, in the past
|
||||
if err := os.Chtimes(path, originalMtime, originalMtime); err != nil {
|
||||
t.Fatalf("chtimes original: %v", err)
|
||||
}
|
||||
|
||||
probe := &StreamProbe{VideoCodec: "h264", DurationSec: 100}
|
||||
storeProbeCache(path, probe)
|
||||
|
||||
// Truncate to a different size, then reset mtime to the original so
|
||||
// only `size` differs between store and lookup keys — isolates the
|
||||
// size-check path. Without the Chtimes, WriteFile bumps mtime and the
|
||||
// test would pass via mtime invalidation regardless of size logic.
|
||||
if err := os.WriteFile(path, []byte("a"), 0o644); err != nil {
|
||||
t.Fatalf("rewrite: %v", err)
|
||||
}
|
||||
if err := os.Chtimes(path, originalMtime, originalMtime); err != nil {
|
||||
t.Fatalf("chtimes restore: %v", err)
|
||||
}
|
||||
|
||||
if _, ok := lookupProbeCache(path); ok {
|
||||
t.Fatal("expected MISS after size change")
|
||||
}
|
||||
}
|
||||
|
||||
func TestProbeCache_ExpiryDropsEntry(t *testing.T) {
|
||||
ResetProbeCache()
|
||||
t.Cleanup(ResetProbeCache)
|
||||
|
||||
dir := t.TempDir()
|
||||
path := filepath.Join(dir, "movie.mkv")
|
||||
if err := os.WriteFile(path, []byte("content"), 0o644); err != nil {
|
||||
t.Fatalf("write: %v", err)
|
||||
}
|
||||
|
||||
// Stash an entry whose expires is already in the past — simulates TTL
|
||||
// having elapsed without sleeping for 30 min.
|
||||
fi, err := os.Stat(path)
|
||||
if err != nil {
|
||||
t.Fatalf("stat: %v", err)
|
||||
}
|
||||
key := probeCacheKey{path: path, mtime: fi.ModTime().UnixNano(), size: fi.Size()}
|
||||
probeCacheMu.Lock()
|
||||
probeCache[key] = probeCacheEntry{
|
||||
probe: &StreamProbe{VideoCodec: "h264"},
|
||||
expires: time.Now().Add(-1 * time.Minute),
|
||||
}
|
||||
probeCacheMu.Unlock()
|
||||
|
||||
if _, ok := lookupProbeCache(path); ok {
|
||||
t.Fatal("expected MISS for expired entry")
|
||||
}
|
||||
// Side-effect: lookup should have evicted the stale entry.
|
||||
if ProbeCacheSize() != 0 {
|
||||
t.Fatalf("expected cache size 0 after expiry eviction; got %d", ProbeCacheSize())
|
||||
}
|
||||
}
|
||||
|
||||
func TestProbeCache_ResetClears(t *testing.T) {
|
||||
ResetProbeCache()
|
||||
|
||||
dir := t.TempDir()
|
||||
path := filepath.Join(dir, "movie.mkv")
|
||||
if err := os.WriteFile(path, []byte("x"), 0o644); err != nil {
|
||||
t.Fatalf("write: %v", err)
|
||||
}
|
||||
|
||||
storeProbeCache(path, &StreamProbe{VideoCodec: "h264"})
|
||||
if ProbeCacheSize() != 1 {
|
||||
t.Fatalf("expected size 1 after store; got %d", ProbeCacheSize())
|
||||
}
|
||||
|
||||
ResetProbeCache()
|
||||
if ProbeCacheSize() != 0 {
|
||||
t.Fatalf("expected size 0 after reset; got %d", ProbeCacheSize())
|
||||
}
|
||||
}
|
||||
|
||||
func TestProbeCache_StoreNonexistentNoOp(t *testing.T) {
|
||||
ResetProbeCache()
|
||||
t.Cleanup(ResetProbeCache)
|
||||
|
||||
// Store on a non-existent path should silently do nothing (stat fails),
|
||||
// not panic, and not poison the cache with a zero key.
|
||||
storeProbeCache("/nope/never/exists.mkv", &StreamProbe{VideoCodec: "h264"})
|
||||
if ProbeCacheSize() != 0 {
|
||||
t.Fatalf("expected 0 entries; got %d", ProbeCacheSize())
|
||||
}
|
||||
}
|
||||
|
||||
func TestProbeCache_SweepDropsExpired(t *testing.T) {
|
||||
ResetProbeCache()
|
||||
t.Cleanup(ResetProbeCache)
|
||||
|
||||
dir := t.TempDir()
|
||||
// Two entries: one expired, one fresh.
|
||||
expiredPath := filepath.Join(dir, "old.mkv")
|
||||
freshPath := filepath.Join(dir, "new.mkv")
|
||||
if err := os.WriteFile(expiredPath, []byte("a"), 0o644); err != nil {
|
||||
t.Fatalf("write expired: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(freshPath, []byte("b"), 0o644); err != nil {
|
||||
t.Fatalf("write fresh: %v", err)
|
||||
}
|
||||
|
||||
now := time.Now()
|
||||
fiExp, _ := os.Stat(expiredPath)
|
||||
fiFresh, _ := os.Stat(freshPath)
|
||||
|
||||
probeCacheMu.Lock()
|
||||
probeCache[probeCacheKey{path: expiredPath, mtime: fiExp.ModTime().UnixNano(), size: fiExp.Size()}] = probeCacheEntry{
|
||||
probe: &StreamProbe{VideoCodec: "h264"},
|
||||
expires: now.Add(-1 * time.Minute), // expired
|
||||
}
|
||||
probeCache[probeCacheKey{path: freshPath, mtime: fiFresh.ModTime().UnixNano(), size: fiFresh.Size()}] = probeCacheEntry{
|
||||
probe: &StreamProbe{VideoCodec: "h264"},
|
||||
expires: now.Add(10 * time.Minute), // fresh
|
||||
}
|
||||
probeCacheMu.Unlock()
|
||||
|
||||
removed := sweepProbeCache(now)
|
||||
if removed != 1 {
|
||||
t.Fatalf("expected 1 expired entry removed; got %d", removed)
|
||||
}
|
||||
if ProbeCacheSize() != 1 {
|
||||
t.Fatalf("expected 1 fresh entry kept; got %d", ProbeCacheSize())
|
||||
}
|
||||
}
|
||||
|
|
@ -1,96 +0,0 @@
|
|||
package engine
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestDecideAction(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
p StreamProbe
|
||||
want TranscodeAction
|
||||
}{
|
||||
{
|
||||
name: "MP4 + h264 + AAC = passthrough",
|
||||
p: StreamProbe{VideoCodec: "h264", AudioCodec: "aac", Container: ".mp4"},
|
||||
want: ActionPassthrough,
|
||||
},
|
||||
{
|
||||
name: "MKV + h264 + AAC = remux",
|
||||
p: StreamProbe{VideoCodec: "h264", AudioCodec: "aac", Container: ".mkv"},
|
||||
want: ActionRemux,
|
||||
},
|
||||
{
|
||||
name: "MKV + h264 + AC3 = remux audio",
|
||||
p: StreamProbe{VideoCodec: "h264", AudioCodec: "ac3", Container: ".mkv"},
|
||||
want: ActionRemuxAudio,
|
||||
},
|
||||
{
|
||||
name: "MP4 + h264 + EAC3 = remux audio",
|
||||
p: StreamProbe{VideoCodec: "h264", AudioCodec: "eac3", Container: ".mp4"},
|
||||
want: ActionRemuxAudio,
|
||||
},
|
||||
{
|
||||
name: "MKV + HEVC = transcode video",
|
||||
p: StreamProbe{VideoCodec: "hevc", AudioCodec: "aac", Container: ".mkv"},
|
||||
want: ActionTranscodeVideo,
|
||||
},
|
||||
{
|
||||
name: "MP4 + AV1 = transcode video",
|
||||
p: StreamProbe{VideoCodec: "av1", AudioCodec: "aac", Container: ".mp4"},
|
||||
want: ActionTranscodeVideo,
|
||||
},
|
||||
{
|
||||
name: "h264 10-bit = transcode video (browser refuses)",
|
||||
p: StreamProbe{VideoCodec: "h264", AudioCodec: "aac", BitDepth: 10, Container: ".mp4"},
|
||||
want: ActionTranscodeVideo,
|
||||
},
|
||||
{
|
||||
name: "h264 + HDR10 = transcode video",
|
||||
p: StreamProbe{VideoCodec: "h264", AudioCodec: "aac", HDR: "HDR10", Container: ".mp4"},
|
||||
want: ActionTranscodeVideo,
|
||||
},
|
||||
{
|
||||
name: "AVI + h264 + AAC = remux",
|
||||
p: StreamProbe{VideoCodec: "h264", AudioCodec: "aac", Container: ".avi"},
|
||||
want: ActionRemux,
|
||||
},
|
||||
{
|
||||
name: "Unknown codec = transcode video",
|
||||
p: StreamProbe{VideoCodec: "mpeg4", AudioCodec: "mp3", Container: ".avi"},
|
||||
want: ActionTranscodeVideo,
|
||||
},
|
||||
{
|
||||
name: "Empty probe falls through to transcode (unknown codec)",
|
||||
p: StreamProbe{},
|
||||
want: ActionTranscodeVideo,
|
||||
},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
got := DecideAction(&tc.p)
|
||||
if got != tc.want {
|
||||
t.Errorf("got %s, want %s", got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestDecideActionNil(t *testing.T) {
|
||||
if DecideAction(nil) != ActionPassthrough {
|
||||
t.Error("nil probe should default passthrough")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLowerExt(t *testing.T) {
|
||||
cases := map[string]string{
|
||||
"foo.MP4": ".mp4",
|
||||
"path/to/movie.MKV": ".mkv",
|
||||
"weird.name.with.dots": ".dots",
|
||||
"": "",
|
||||
"noext": "",
|
||||
}
|
||||
for in, want := range cases {
|
||||
if got := lowerExt(in); got != want {
|
||||
t.Errorf("lowerExt(%q) = %q want %q", in, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -45,19 +45,10 @@ type ProgressReporter struct {
|
|||
lastCheckAt time.Time // last time we reported for control-signal polling
|
||||
}
|
||||
|
||||
// NewProgressReporter creates a reporter that flushes every interval. A nil
|
||||
// client yields a local-only reporter that tracks progress for terminal output
|
||||
// but never calls the API — used by one-shot `unarr download`, which has no
|
||||
// server-side task to report against (its synthetic "oneshot-" id is not a UUID
|
||||
// and the /api/internal/agent/status endpoint 400s it). Passing the typed nil
|
||||
// straight into the interface field would make it non-nil, so guard explicitly.
|
||||
// NewProgressReporter creates a reporter that flushes every interval.
|
||||
func NewProgressReporter(ac *agent.Client, interval time.Duration) *ProgressReporter {
|
||||
var rep StatusReporter
|
||||
if ac != nil {
|
||||
rep = ac
|
||||
}
|
||||
return &ProgressReporter{
|
||||
reporter: rep,
|
||||
reporter: ac,
|
||||
interval: interval,
|
||||
latest: make(map[string]*Task),
|
||||
lastReported: make(map[string]TaskStatus),
|
||||
|
|
@ -117,9 +108,6 @@ func (r *ProgressReporter) Run(ctx context.Context) error {
|
|||
}
|
||||
|
||||
func (r *ProgressReporter) flush(ctx context.Context) {
|
||||
if r.reporter == nil {
|
||||
return // local-only reporter (one-shot): nothing to send
|
||||
}
|
||||
r.mu.Lock()
|
||||
tasks := make([]*Task, 0, len(r.latest))
|
||||
for _, t := range r.latest {
|
||||
|
|
@ -251,10 +239,6 @@ func (r *ProgressReporter) handleResponse(task *Task, resp *agent.StatusResponse
|
|||
|
||||
// ReportFinal sends a final status update for a completed/failed task.
|
||||
func (r *ProgressReporter) ReportFinal(ctx context.Context, task *Task) {
|
||||
if r.reporter == nil {
|
||||
r.Untrack(task.ID)
|
||||
return // local-only reporter (one-shot)
|
||||
}
|
||||
update := task.ToStatusUpdate()
|
||||
if _, err := r.reporter.ReportStatus(ctx, update); err != nil {
|
||||
log.Printf("[%s] final report failed: %v", task.ID[:8], err)
|
||||
|
|
|
|||
|
|
@ -4,23 +4,14 @@ import (
|
|||
"fmt"
|
||||
"os/exec"
|
||||
"runtime"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// OpenPlayer attempts to open a media player with the given stream URL.
|
||||
// Returns the player name and the running command.
|
||||
// If override is set, it uses that command directly.
|
||||
//
|
||||
// The URL is required to be http(s) so a hostile-looking value (e.g. starting
|
||||
// with `--`) is not interpreted as a switch by mpv/vlc/xdg-open/open. The
|
||||
// `--` separator is also appended before the URL where the helper supports
|
||||
// it.
|
||||
func OpenPlayer(url, override string) (string, *exec.Cmd, error) {
|
||||
if !isSafePlayerURL(url) {
|
||||
return "", nil, fmt.Errorf("refusing to open non-http(s) URL")
|
||||
}
|
||||
if override != "" {
|
||||
cmd := exec.Command(override, "--", url)
|
||||
cmd := exec.Command(override, url)
|
||||
if err := cmd.Start(); err != nil {
|
||||
return override, nil, fmt.Errorf("start %s: %w", override, err)
|
||||
}
|
||||
|
|
@ -29,7 +20,7 @@ func OpenPlayer(url, override string) (string, *exec.Cmd, error) {
|
|||
|
||||
// Try mpv first (best streaming support)
|
||||
if path, err := exec.LookPath("mpv"); err == nil {
|
||||
cmd := exec.Command(path, "--no-terminal", "--", url)
|
||||
cmd := exec.Command(path, "--no-terminal", url)
|
||||
if err := cmd.Start(); err == nil {
|
||||
return "mpv", cmd, nil
|
||||
}
|
||||
|
|
@ -37,7 +28,7 @@ func OpenPlayer(url, override string) (string, *exec.Cmd, error) {
|
|||
|
||||
// Try VLC
|
||||
if path, err := exec.LookPath("vlc"); err == nil {
|
||||
cmd := exec.Command(path, "--", url)
|
||||
cmd := exec.Command(path, url)
|
||||
if err := cmd.Start(); err == nil {
|
||||
return "vlc", cmd, nil
|
||||
}
|
||||
|
|
@ -45,7 +36,7 @@ func OpenPlayer(url, override string) (string, *exec.Cmd, error) {
|
|||
|
||||
// Try cvlc (VLC headless)
|
||||
if path, err := exec.LookPath("cvlc"); err == nil {
|
||||
cmd := exec.Command(path, "--", url)
|
||||
cmd := exec.Command(path, url)
|
||||
if err := cmd.Start(); err == nil {
|
||||
return "vlc (headless)", cmd, nil
|
||||
}
|
||||
|
|
@ -60,9 +51,6 @@ func OpenPlayer(url, override string) (string, *exec.Cmd, error) {
|
|||
}
|
||||
|
||||
func openBrowser(url string) (string, *exec.Cmd, error) {
|
||||
if !isSafePlayerURL(url) {
|
||||
return "", nil, fmt.Errorf("refusing to open non-http(s) URL")
|
||||
}
|
||||
switch runtime.GOOS {
|
||||
case "linux":
|
||||
if path, err := exec.LookPath("xdg-open"); err == nil {
|
||||
|
|
@ -72,7 +60,7 @@ func openBrowser(url string) (string, *exec.Cmd, error) {
|
|||
}
|
||||
}
|
||||
case "darwin":
|
||||
cmd := exec.Command("/usr/bin/open", "--", url)
|
||||
cmd := exec.Command("/usr/bin/open", url)
|
||||
if err := cmd.Start(); err == nil {
|
||||
return "browser", cmd, nil
|
||||
}
|
||||
|
|
@ -84,9 +72,3 @@ func openBrowser(url string) (string, *exec.Cmd, error) {
|
|||
}
|
||||
return "", nil, fmt.Errorf("no browser opener found")
|
||||
}
|
||||
|
||||
// isSafePlayerURL guards the helpers above against URLs that could be
|
||||
// interpreted as command-line switches by the launched player.
|
||||
func isSafePlayerURL(url string) bool {
|
||||
return strings.HasPrefix(url, "http://") || strings.HasPrefix(url, "https://")
|
||||
}
|
||||
|
|
|
|||
|
|
@ -50,20 +50,7 @@ type StreamServer struct {
|
|||
url string // best single URL (backward compat)
|
||||
urls StreamURLs // all available URLs by network type
|
||||
upnpMapping *UPnPMapping
|
||||
// enableUPnP gates whether Listen() asks the gateway to publish the
|
||||
// stream port to the WAN. UPnP is opt-in (false by default) because
|
||||
// /stream and /hls have no auth — exposing them on the public internet
|
||||
// would let any scanner enumerate active downloads. LAN and Tailscale
|
||||
// access keep working without UPnP.
|
||||
enableUPnP bool
|
||||
// corsExtraOrigins are operator-configured origins added to the default
|
||||
// allowlist defined in validate.go. Set before Listen().
|
||||
corsExtraOrigins []string
|
||||
// corsAllowlist is computed at Listen() time and treated as read-only
|
||||
// thereafter so per-request reads need no locking.
|
||||
corsAllowlist map[string]struct{}
|
||||
|
||||
hls *HLSSessionRegistry // HLS sessions served on /hls/<id>/...
|
||||
disableUPnP bool
|
||||
|
||||
lastActivity atomic.Int64
|
||||
maxByteOffset atomic.Int64 // highest sequential read position (main playback connection)
|
||||
|
|
@ -76,78 +63,16 @@ type StreamServer struct {
|
|||
|
||||
// NewStreamServer creates a stream server bound to the given port.
|
||||
// Call Listen() to start accepting connections, then SetFile() to serve content.
|
||||
//
|
||||
// UPnP is opt-in: call SetUPnPEnabled(true) before Listen() to publish the
|
||||
// stream port on the WAN. Without it, only LAN and Tailscale clients can
|
||||
// reach the server. This matches the security default — /stream and /hls
|
||||
// have no auth, so exposing them to the public internet is something the
|
||||
// operator must explicitly request.
|
||||
func NewStreamServer(port int) *StreamServer {
|
||||
return &StreamServer{port: port, hls: NewHLSSessionRegistry()}
|
||||
return &StreamServer{port: port}
|
||||
}
|
||||
|
||||
// SetUPnPEnabled toggles WAN publishing of the stream port. Call before
|
||||
// Listen(); changes after Listen() are ignored for the active server.
|
||||
func (ss *StreamServer) SetUPnPEnabled(enabled bool) {
|
||||
ss.enableUPnP = enabled
|
||||
}
|
||||
|
||||
// SetCORSAllowedOrigins replaces the operator-supplied extra origins. The
|
||||
// default allowlist (torrentclaw.com / app.torrentclaw.com / localhost dev
|
||||
// ports) is always merged in. Call before Listen().
|
||||
func (ss *StreamServer) SetCORSAllowedOrigins(origins []string) {
|
||||
ss.corsExtraOrigins = origins
|
||||
}
|
||||
|
||||
// writeCORSHeaders writes the per-origin CORS response headers when the
|
||||
// request carries an Origin header that matches the allowlist. Returns true
|
||||
// if the handler must short-circuit (preflight OPTIONS). Media-tag requests
|
||||
// (no Origin header) bypass this entirely.
|
||||
//
|
||||
// `Vary: Origin` is emitted whenever an Origin header is present (matched
|
||||
// or not) so any intermediate cache keys the response per-origin and a
|
||||
// later request with a different origin cannot be served a stale ACAO.
|
||||
func (ss *StreamServer) writeCORSHeaders(w http.ResponseWriter, r *http.Request, expose string) (preflight bool) {
|
||||
origin := r.Header.Get("Origin")
|
||||
if origin == "" {
|
||||
return false
|
||||
}
|
||||
w.Header().Add("Vary", "Origin")
|
||||
if _, ok := ss.corsAllowlist[origin]; !ok {
|
||||
// Unknown origin — do not emit CORS headers so the browser blocks
|
||||
// the response. Still return without short-circuiting so a non-CORS
|
||||
// caller (e.g. curl) keeps working.
|
||||
return false
|
||||
}
|
||||
w.Header().Set("Access-Control-Allow-Origin", origin)
|
||||
w.Header().Set("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS")
|
||||
w.Header().Set("Access-Control-Allow-Headers", "Range")
|
||||
if expose != "" {
|
||||
w.Header().Set("Access-Control-Expose-Headers", expose)
|
||||
}
|
||||
if r.Method == http.MethodOptions {
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// HLS returns the HLS session registry for this server. Daemon code uses it
|
||||
// to register a session when the backend asks for HLS playback.
|
||||
func (ss *StreamServer) HLS() *HLSSessionRegistry { return ss.hls }
|
||||
|
||||
// Listen starts the HTTP server on the configured port. Call once at daemon startup.
|
||||
func (ss *StreamServer) Listen(ctx context.Context) error {
|
||||
// Freeze the CORS allowlist before the first request can land. After
|
||||
// this point the map is treated as read-only so handlers can probe it
|
||||
// without locking.
|
||||
ss.corsAllowlist = buildCORSAllowlist(ss.corsExtraOrigins)
|
||||
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("/stream", ss.handler)
|
||||
mux.HandleFunc("/health", ss.healthHandler)
|
||||
mux.HandleFunc("/playlist.m3u", ss.playlistHandler)
|
||||
mux.HandleFunc("/hls/", ss.hlsHandler)
|
||||
|
||||
// SO_REUSEADDR allows immediate rebind if the port is in TIME_WAIT (e.g. after agent restart)
|
||||
lc := net.ListenConfig{
|
||||
|
|
@ -190,16 +115,11 @@ func (ss *StreamServer) Listen(ctx context.Context) error {
|
|||
if tsIP := TailscaleIP(); tsIP != "" {
|
||||
ss.urls.Tailscale = fmt.Sprintf("http://%s:%d/stream", tsIP, ss.port)
|
||||
}
|
||||
if ss.enableUPnP {
|
||||
mapping, err := SetupUPnP(ss.port)
|
||||
if err != nil {
|
||||
log.Printf("[stream] UPnP setup failed: %v (only LAN/Tailscale clients will reach port %d)", err, ss.port)
|
||||
} else {
|
||||
if !ss.disableUPnP {
|
||||
if mapping, err := SetupUPnP(ss.port); err == nil {
|
||||
ss.upnpMapping = mapping
|
||||
ss.urls.Public = fmt.Sprintf("http://%s:%d/stream", mapping.ExternalIP, mapping.ExternalPort)
|
||||
}
|
||||
} else {
|
||||
log.Printf("[stream] UPnP disabled — port %d not published to WAN (set downloads.enable_upnp = true to opt in)", ss.port)
|
||||
}
|
||||
|
||||
// Best single URL for backward compat: Tailscale > LAN > Public > localhost
|
||||
|
|
@ -310,173 +230,23 @@ func (ss *StreamServer) IdleSince() time.Duration {
|
|||
// Call only at daemon shutdown — NOT between file swaps.
|
||||
func (ss *StreamServer) Shutdown(ctx context.Context) error {
|
||||
ss.upnpMapping.Remove()
|
||||
if ss.hls != nil {
|
||||
ss.hls.CloseAll()
|
||||
}
|
||||
if ss.server != nil {
|
||||
return ss.server.Shutdown(ctx)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// hlsBaseURLs returns the per-network HLS base URLs for a given session.
|
||||
// The web client picks the first reachable one — same fallback strategy as
|
||||
// the legacy /stream URLs.
|
||||
func (ss *StreamServer) hlsBaseURLs(sessionID string) StreamURLs {
|
||||
var out StreamURLs
|
||||
if ss.urls.LAN != "" {
|
||||
out.LAN = strings.Replace(ss.urls.LAN, "/stream", "/hls/"+sessionID, 1)
|
||||
}
|
||||
if ss.urls.Tailscale != "" {
|
||||
out.Tailscale = strings.Replace(ss.urls.Tailscale, "/stream", "/hls/"+sessionID, 1)
|
||||
}
|
||||
if ss.urls.Public != "" {
|
||||
out.Public = strings.Replace(ss.urls.Public, "/stream", "/hls/"+sessionID, 1)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// HLSURLsJSON returns base URLs for an HLS session as a JSON string for the
|
||||
// session response payload.
|
||||
func (ss *StreamServer) HLSURLsJSON(sessionID string) string {
|
||||
urls := ss.hlsBaseURLs(sessionID)
|
||||
b, _ := json.Marshal(urls)
|
||||
return string(b)
|
||||
}
|
||||
|
||||
// hlsHandler routes /hls/<sessionID>/<resource> to the matching HLSSession.
|
||||
//
|
||||
// Recognised resources:
|
||||
//
|
||||
// master.m3u8 — top-level playlist
|
||||
// video/index.m3u8 — video media playlist
|
||||
// video/init.mp4 — fMP4 init segment
|
||||
// video/seg-<n>.m4s — video segment
|
||||
// subs/sub-<n>.m3u8 — per-subtitle media playlist (synthesised)
|
||||
// subs/sub-<n>.vtt — WebVTT subtitle (extracted by ffmpeg)
|
||||
func (ss *StreamServer) hlsHandler(w http.ResponseWriter, r *http.Request) {
|
||||
ss.lastActivity.Store(time.Now().UnixNano())
|
||||
|
||||
if ss.writeCORSHeaders(w, r, "Content-Length, Content-Range, Accept-Ranges") {
|
||||
return
|
||||
}
|
||||
|
||||
rest := strings.TrimPrefix(r.URL.Path, "/hls/")
|
||||
parts := strings.SplitN(rest, "/", 2)
|
||||
if len(parts) == 0 || parts[0] == "" {
|
||||
http.Error(w, "missing session id", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
sessionID := parts[0]
|
||||
// Reject malformed IDs with the same 404 we return for unknown sessions —
|
||||
// no oracle for the accepted format.
|
||||
if !validSessionID.MatchString(sessionID) {
|
||||
http.Error(w, "hls session not found", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
session := ss.hls.Get(sessionID)
|
||||
if session == nil {
|
||||
http.Error(w, "hls session not found", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
if len(parts) == 1 {
|
||||
http.Error(w, "missing resource", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
resource := parts[1]
|
||||
|
||||
switch {
|
||||
case resource == "master.m3u8":
|
||||
session.ServeMaster(w, r)
|
||||
case resource == "probe.json":
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.Header().Set("Cache-Control", "no-cache")
|
||||
_ = json.NewEncoder(w).Encode(session.ProbeInfo())
|
||||
case resource == "video/index.m3u8":
|
||||
session.ServeVideoPlaylist(w, r)
|
||||
case resource == "video/init.mp4":
|
||||
session.ServeInit(w, r)
|
||||
case strings.HasPrefix(resource, "video/seg-") && strings.HasSuffix(resource, ".m4s"):
|
||||
idxStr := strings.TrimSuffix(strings.TrimPrefix(resource, "video/seg-"), ".m4s")
|
||||
idx, err := strconv.Atoi(idxStr)
|
||||
if err != nil {
|
||||
http.Error(w, "bad segment index", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
session.ServeSegment(w, r, idx)
|
||||
case strings.HasPrefix(resource, "subs/sub-") && strings.HasSuffix(resource, ".m3u8"):
|
||||
idxStr := strings.TrimSuffix(strings.TrimPrefix(resource, "subs/sub-"), ".m3u8")
|
||||
idx, err := strconv.Atoi(idxStr)
|
||||
if err != nil {
|
||||
http.Error(w, "bad subtitle index", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
ss.serveSubtitlePlaylist(w, r, session, idx)
|
||||
case strings.HasPrefix(resource, "subs/sub-") && strings.HasSuffix(resource, ".vtt"):
|
||||
idxStr := strings.TrimSuffix(strings.TrimPrefix(resource, "subs/sub-"), ".vtt")
|
||||
idx, err := strconv.Atoi(idxStr)
|
||||
if err != nil {
|
||||
http.Error(w, "bad subtitle index", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
session.ServeSubtitle(w, r, idx)
|
||||
default:
|
||||
http.Error(w, "unknown hls resource", http.StatusNotFound)
|
||||
}
|
||||
}
|
||||
|
||||
// serveSubtitlePlaylist generates a single-VTT-segment HLS playlist on the
|
||||
// fly so hls.js can consume it as a regular subtitle rendition. The VTT file
|
||||
// itself is extracted asynchronously by HLSSession.extractSubtitles.
|
||||
func (ss *StreamServer) serveSubtitlePlaylist(w http.ResponseWriter, r *http.Request, session *HLSSession, idx int) {
|
||||
if idx < 0 || idx >= len(session.probe.SubtitleTracks) {
|
||||
http.Error(w, "subtitle out of range", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
dur := session.durationSec
|
||||
if dur < 1 {
|
||||
dur = 1
|
||||
}
|
||||
body := strings.Builder{}
|
||||
body.WriteString("#EXTM3U\n")
|
||||
body.WriteString("#EXT-X-VERSION:3\n")
|
||||
body.WriteString("#EXT-X-PLAYLIST-TYPE:VOD\n")
|
||||
body.WriteString(fmt.Sprintf("#EXT-X-TARGETDURATION:%d\n", int(dur)+1))
|
||||
body.WriteString("#EXT-X-MEDIA-SEQUENCE:0\n")
|
||||
body.WriteString(fmt.Sprintf("#EXTINF:%.3f,\n", dur))
|
||||
body.WriteString(fmt.Sprintf("sub-%d.vtt\n", idx))
|
||||
body.WriteString("#EXT-X-ENDLIST\n")
|
||||
|
||||
w.Header().Set("Content-Type", "application/vnd.apple.mpegurl")
|
||||
w.Header().Set("Cache-Control", "no-cache")
|
||||
_, _ = io.WriteString(w, body.String())
|
||||
}
|
||||
|
||||
// healthHandler responde con el estado del servidor en JSON.
|
||||
// Útil para diagnosticar conectividad desde redes remotas o Tailscale:
|
||||
//
|
||||
// curl http://<tailscale-ip>:<port>/health
|
||||
func (ss *StreamServer) healthHandler(w http.ResponseWriter, r *http.Request) {
|
||||
if ss.writeCORSHeaders(w, r, "") {
|
||||
return
|
||||
}
|
||||
ss.mu.RLock()
|
||||
provider := ss.provider
|
||||
taskID := ss.taskID
|
||||
ss.mu.RUnlock()
|
||||
|
||||
clientIP, _, _ := net.SplitHostPort(r.RemoteAddr)
|
||||
// Only expose filename/taskID/client to loopback callers (local diagnostics).
|
||||
// Remote callers (LAN, Tailscale, UPnP public) get a minimal probe response
|
||||
// so that scanners and unauthenticated peers cannot fingerprint the active
|
||||
// download. The web stream-probe only checks HTTP 200 + Content-Type.
|
||||
//
|
||||
// Use net.IP.IsLoopback so we also accept ::ffff:127.0.0.1 (Linux dual-stack
|
||||
// IPv4-mapped form) and reject the empty-string fallthrough when
|
||||
// SplitHostPort fails on a malformed RemoteAddr — both would otherwise
|
||||
// silently bypass the disclosure boundary.
|
||||
parsedIP := net.ParseIP(clientIP)
|
||||
isLocal := parsedIP != nil && parsedIP.IsLoopback()
|
||||
|
||||
type healthResponse struct {
|
||||
Status string `json:"status"`
|
||||
|
|
@ -484,23 +254,19 @@ func (ss *StreamServer) healthHandler(w http.ResponseWriter, r *http.Request) {
|
|||
File string `json:"file,omitempty"`
|
||||
Task string `json:"task,omitempty"`
|
||||
Port int `json:"port"`
|
||||
Client string `json:"client,omitempty"`
|
||||
Client string `json:"client"`
|
||||
}
|
||||
resp := healthResponse{
|
||||
Status: "ok",
|
||||
Port: ss.port,
|
||||
Client: clientIP,
|
||||
}
|
||||
if provider != nil {
|
||||
resp.Streaming = true
|
||||
}
|
||||
if isLocal {
|
||||
resp.Client = clientIP
|
||||
if provider != nil {
|
||||
resp.File = provider.FileName()
|
||||
resp.Task = taskID
|
||||
if len(resp.Task) > 8 {
|
||||
resp.Task = resp.Task[:8]
|
||||
}
|
||||
resp.File = provider.FileName()
|
||||
resp.Task = taskID
|
||||
if len(resp.Task) > 8 {
|
||||
resp.Task = resp.Task[:8]
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -516,8 +282,15 @@ func (ss *StreamServer) healthHandler(w http.ResponseWriter, r *http.Request) {
|
|||
// VLC fetches this playlist and applies the EXTVLCOPT directives automatically,
|
||||
// enabling automatic audio/subtitle track selection on all VLC platforms (desktop + mobile).
|
||||
func (ss *StreamServer) playlistHandler(w http.ResponseWriter, r *http.Request) {
|
||||
if ss.writeCORSHeaders(w, r, "") {
|
||||
return
|
||||
// CORS — handle preflight before doing any work (consistent with handler)
|
||||
if origin := r.Header.Get("Origin"); origin != "" {
|
||||
w.Header().Set("Access-Control-Allow-Origin", "*")
|
||||
w.Header().Set("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS")
|
||||
w.Header().Set("Access-Control-Allow-Headers", "Range")
|
||||
if r.Method == http.MethodOptions {
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
q := r.URL.Query()
|
||||
|
|
@ -587,8 +360,17 @@ func (ss *StreamServer) handler(w http.ResponseWriter, r *http.Request) {
|
|||
return
|
||||
}
|
||||
|
||||
if ss.writeCORSHeaders(w, r, "Content-Length, Content-Range, Accept-Ranges") {
|
||||
return
|
||||
// CORS headers — only when browser sends Origin (HTTPS site → localhost)
|
||||
if origin := r.Header.Get("Origin"); origin != "" {
|
||||
w.Header().Set("Access-Control-Allow-Origin", "*")
|
||||
w.Header().Set("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS")
|
||||
w.Header().Set("Access-Control-Allow-Headers", "Range")
|
||||
w.Header().Set("Access-Control-Expose-Headers", "Content-Length, Content-Range, Accept-Ranges")
|
||||
|
||||
if r.Method == http.MethodOptions {
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
rawReader := provider.NewFileReader(r.Context())
|
||||
|
|
|
|||
|
|
@ -1,119 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestStreamServerURLsJSON(t *testing.T) {
|
||||
ss := &StreamServer{}
|
||||
ss.urls = StreamURLs{LAN: "http://10.0.0.1:8000/stream", Tailscale: "http://100.64.0.1:8000/stream"}
|
||||
got := ss.URLsJSON()
|
||||
if !strings.Contains(got, `"lan":"http://10.0.0.1:8000/stream"`) {
|
||||
t.Errorf("URLsJSON missing LAN: %s", got)
|
||||
}
|
||||
if !strings.Contains(got, `"ts":"http://100.64.0.1:8000/stream"`) {
|
||||
t.Errorf("URLsJSON missing Tailscale: %s", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStreamServerHLSBaseURLs(t *testing.T) {
|
||||
ss := &StreamServer{}
|
||||
ss.urls = StreamURLs{
|
||||
LAN: "http://10.0.0.1:8000/stream",
|
||||
Tailscale: "http://100.64.0.1:8000/stream",
|
||||
Public: "http://1.2.3.4:9000/stream",
|
||||
}
|
||||
out := ss.hlsBaseURLs("sess-1")
|
||||
if out.LAN != "http://10.0.0.1:8000/hls/sess-1" {
|
||||
t.Errorf("LAN swap = %q", out.LAN)
|
||||
}
|
||||
if out.Tailscale != "http://100.64.0.1:8000/hls/sess-1" {
|
||||
t.Errorf("Tailscale swap = %q", out.Tailscale)
|
||||
}
|
||||
if out.Public != "http://1.2.3.4:9000/hls/sess-1" {
|
||||
t.Errorf("Public swap = %q", out.Public)
|
||||
}
|
||||
|
||||
js := ss.HLSURLsJSON("sess-1")
|
||||
if !strings.Contains(js, "/hls/sess-1") {
|
||||
t.Errorf("HLSURLsJSON output unexpected: %s", js)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStreamServerIdleSinceZeroBeforeActivity(t *testing.T) {
|
||||
ss := &StreamServer{}
|
||||
if got := ss.IdleSince(); got != 0 {
|
||||
t.Errorf("IdleSince before any activity = %v, want 0", got)
|
||||
}
|
||||
ss.lastActivity.Store(time.Now().Add(-1 * time.Second).UnixNano())
|
||||
if got := ss.IdleSince(); got <= 0 {
|
||||
t.Errorf("IdleSince after activity should be > 0, got %v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDiskFileProvider(t *testing.T) {
|
||||
tmp := t.TempDir() + "/movie.mp4"
|
||||
data := []byte("hello stream")
|
||||
if err := os.WriteFile(tmp, data, 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
p := NewDiskFileProvider(tmp)
|
||||
if got := p.FileName(); got != "movie.mp4" {
|
||||
t.Errorf("FileName = %q", got)
|
||||
}
|
||||
if got := p.FileSize(); got != int64(len(data)) {
|
||||
t.Errorf("FileSize = %d, want %d", got, len(data))
|
||||
}
|
||||
rdr := p.NewFileReader(context.Background())
|
||||
if rdr == nil {
|
||||
t.Fatal("NewFileReader = nil")
|
||||
}
|
||||
defer rdr.Close()
|
||||
buf := make([]byte, len(data))
|
||||
n, _ := rdr.Read(buf)
|
||||
if string(buf[:n]) != string(data) {
|
||||
t.Errorf("read = %q, want %q", buf[:n], data)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDiskFileProviderMissing(t *testing.T) {
|
||||
p := NewDiskFileProvider("/nonexistent/file.mp4")
|
||||
if rdr := p.NewFileReader(context.Background()); rdr != nil {
|
||||
t.Errorf("NewFileReader on missing file should return nil")
|
||||
}
|
||||
if got := p.FileSize(); got != 0 {
|
||||
t.Errorf("FileSize on missing file = %d, want 0", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFindVideoFile(t *testing.T) {
|
||||
tmp := t.TempDir()
|
||||
os.WriteFile(tmp+"/readme.txt", make([]byte, 1000), 0o644) //nolint:errcheck
|
||||
os.WriteFile(tmp+"/sample.mkv", make([]byte, 10*1024*1024), 0o644) //nolint:errcheck
|
||||
os.WriteFile(tmp+"/clip.mp4", make([]byte, 1024*1024), 0o644) //nolint:errcheck
|
||||
os.MkdirAll(tmp+"/sub", 0o755) //nolint:errcheck
|
||||
os.WriteFile(tmp+"/sub/extra.mp4", make([]byte, 5*1024*1024), 0o644) //nolint:errcheck
|
||||
|
||||
got := FindVideoFile(tmp)
|
||||
if !strings.HasSuffix(got, "sample.mkv") {
|
||||
t.Errorf("FindVideoFile = %q, want largest *.mkv", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFindVideoFileEmpty(t *testing.T) {
|
||||
tmp := t.TempDir()
|
||||
if got := FindVideoFile(tmp); got != "" {
|
||||
t.Errorf("FindVideoFile on empty dir = %q, want ''", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLanIPReturnsValidOrEmpty(t *testing.T) {
|
||||
ip := LanIP()
|
||||
if ip != "" && !strings.Contains(ip, ".") && !strings.Contains(ip, ":") {
|
||||
t.Errorf("LanIP returned non-empty non-IP: %q", ip)
|
||||
}
|
||||
}
|
||||
|
|
@ -5,7 +5,6 @@ import (
|
|||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
|
|
@ -380,149 +379,6 @@ func TestStreamServer_Health_WithFile(t *testing.T) {
|
|||
}
|
||||
}
|
||||
|
||||
// TestStreamServer_Health_NonLoopback_NoLeak verifica que /health no revela
|
||||
// nombre de fichero, taskID ni client IP cuando el caller no es loopback.
|
||||
// Protección contra reconnaissance vía LAN / UPnP / Tailscale.
|
||||
func TestStreamServer_Health_NonLoopback_NoLeak(t *testing.T) {
|
||||
srv := NewStreamServer(0) // UPnP off by default — keep test hermetic
|
||||
ctx := context.Background()
|
||||
if err := srv.Listen(ctx); err != nil {
|
||||
t.Fatalf("Listen() error: %v", err)
|
||||
}
|
||||
defer srv.Shutdown(ctx)
|
||||
|
||||
provider := newFakeProvider("secret.mkv", []byte("data"))
|
||||
srv.SetFile(provider, "secret-task-id")
|
||||
|
||||
cases := []struct {
|
||||
name string
|
||||
remoteAddr string
|
||||
}{
|
||||
{"lan_ipv4", "192.168.1.50:54321"},
|
||||
{"empty_host_no_bypass", ":54321"},
|
||||
{"public_ipv4", "203.0.113.10:443"},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
rr := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodGet, "/health", nil)
|
||||
req.RemoteAddr = tc.remoteAddr
|
||||
srv.healthHandler(rr, req)
|
||||
|
||||
body := rr.Body.String()
|
||||
if !strings.Contains(body, `"status":"ok"`) {
|
||||
t.Errorf("body missing status:ok: %q", body)
|
||||
}
|
||||
if !strings.Contains(body, `"streaming":true`) {
|
||||
t.Errorf("body should report streaming bool: %q", body)
|
||||
}
|
||||
if strings.Contains(body, "secret.mkv") {
|
||||
t.Errorf("body leaked filename: %q", body)
|
||||
}
|
||||
if strings.Contains(body, "secret-t") {
|
||||
t.Errorf("body leaked task id: %q", body)
|
||||
}
|
||||
if strings.Contains(body, "192.168.1.50") || strings.Contains(body, "203.0.113.10") {
|
||||
t.Errorf("body leaked client ip: %q", body)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestStreamServer_CORS_Allowlist verifica que sólo los origenes en la
|
||||
// allowlist reciben Access-Control-Allow-Origin y que ningún otro origen
|
||||
// es eco-reflejado.
|
||||
func TestStreamServer_CORS_Allowlist(t *testing.T) {
|
||||
srv := NewStreamServer(0)
|
||||
ctx := context.Background()
|
||||
if err := srv.Listen(ctx); err != nil {
|
||||
t.Fatalf("Listen: %v", err)
|
||||
}
|
||||
defer srv.Shutdown(ctx)
|
||||
|
||||
cases := []struct {
|
||||
origin string
|
||||
wantAllow bool
|
||||
}{
|
||||
{"https://app.torrentclaw.com", true},
|
||||
{"https://torrentclaw.com", true},
|
||||
{"http://localhost:3030", true},
|
||||
{"http://127.0.0.1:3030", true},
|
||||
{"https://evil.example", false},
|
||||
{"null", false},
|
||||
{"", false},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.origin, func(t *testing.T) {
|
||||
rr := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodOptions, "/health", nil)
|
||||
if tc.origin != "" {
|
||||
req.Header.Set("Origin", tc.origin)
|
||||
}
|
||||
srv.healthHandler(rr, req)
|
||||
got := rr.Header().Get("Access-Control-Allow-Origin")
|
||||
if tc.wantAllow {
|
||||
if got != tc.origin {
|
||||
t.Errorf("origin %q: ACAO = %q, want %q", tc.origin, got, tc.origin)
|
||||
}
|
||||
} else if got != "" {
|
||||
t.Errorf("origin %q: ACAO leaked as %q, expected empty", tc.origin, got)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestStreamServer_CORS_ExtraOrigin verifica que SetCORSAllowedOrigins añade
|
||||
// origins al baseline sin removerlos.
|
||||
func TestStreamServer_CORS_ExtraOrigin(t *testing.T) {
|
||||
srv := NewStreamServer(0)
|
||||
srv.SetCORSAllowedOrigins([]string{"https://custom.example"})
|
||||
ctx := context.Background()
|
||||
if err := srv.Listen(ctx); err != nil {
|
||||
t.Fatalf("Listen: %v", err)
|
||||
}
|
||||
defer srv.Shutdown(ctx)
|
||||
|
||||
for _, origin := range []string{"https://custom.example", "https://torrentclaw.com"} {
|
||||
rr := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodGet, "/health", nil)
|
||||
req.Header.Set("Origin", origin)
|
||||
srv.healthHandler(rr, req)
|
||||
if got := rr.Header().Get("Access-Control-Allow-Origin"); got != origin {
|
||||
t.Errorf("origin %q: ACAO = %q", origin, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestStreamServer_HLS_InvalidSessionID verifica que el hlsHandler rechaza
|
||||
// session IDs con caracteres ilegales devolviendo 404 (uniforme con sesión
|
||||
// inexistente) para no filtrar el formato aceptado a un attacker.
|
||||
func TestStreamServer_HLS_InvalidSessionID(t *testing.T) {
|
||||
srv := NewStreamServer(0) // UPnP off by default — keep test hermetic
|
||||
ctx := context.Background()
|
||||
if err := srv.Listen(ctx); err != nil {
|
||||
t.Fatalf("Listen() error: %v", err)
|
||||
}
|
||||
defer srv.Shutdown(ctx)
|
||||
|
||||
bad := []string{
|
||||
"/hls/..%2Fetc%2Fpasswd/master.m3u8",
|
||||
"/hls/foo.bar/master.m3u8",
|
||||
"/hls/foo%20bar/master.m3u8",
|
||||
"/hls/foo%2Fbar/master.m3u8",
|
||||
}
|
||||
for _, path := range bad {
|
||||
t.Run(path, func(t *testing.T) {
|
||||
rr := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodGet, path, nil)
|
||||
srv.hlsHandler(rr, req)
|
||||
if rr.Code != http.StatusNotFound {
|
||||
t.Errorf("path %q: status = %d, want 404", path, rr.Code)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestStreamServer_MKV_ContentType verifica que el Content-Type para .mkv
|
||||
// es el correcto.
|
||||
func TestStreamServer_MKV_ContentType(t *testing.T) {
|
||||
|
|
|
|||
|
|
@ -1,347 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
)
|
||||
|
||||
// streamSource abstracts the byte source consumed by the HLS transcoder.
|
||||
// Two implementations:
|
||||
// - diskFileSource — direct passthrough of the on-disk file.
|
||||
// - transcodeSource — ffmpeg writes a fragmented MP4 to a temp file in
|
||||
// real time; reads block briefly when callers ask for bytes ahead of
|
||||
// the writer.
|
||||
type streamSource interface {
|
||||
ReadAt(p []byte, off int64) (int, error)
|
||||
// Size returns the currently known size. For transcoded sources this
|
||||
// grows as ffmpeg produces output; on Final() it's the final size.
|
||||
Size() int64
|
||||
// Final reports whether the source size is now stable (passthrough is
|
||||
// always final, transcoder becomes final when ffmpeg exits).
|
||||
Final() bool
|
||||
// EstimatedSize returns the final size we expect to converge on. For
|
||||
// passthrough it's the same as Size(). For transcoder it's a bitrate
|
||||
// × duration estimate so the browser scrubber has something to anchor
|
||||
// on; the real size will differ ±20%.
|
||||
EstimatedSize() int64
|
||||
FileName() string
|
||||
Transcoded() bool
|
||||
Close() error
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────────
|
||||
// disk passthrough
|
||||
// ─────────────────────────────────────────────────────────────────────────────
|
||||
|
||||
type diskFileSource struct {
|
||||
f *os.File
|
||||
size int64
|
||||
name string
|
||||
}
|
||||
|
||||
func newDiskFileSource(path string) (*diskFileSource, error) {
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("stream source: open %s: %w", path, err)
|
||||
}
|
||||
stat, err := f.Stat()
|
||||
if err != nil {
|
||||
f.Close()
|
||||
return nil, fmt.Errorf("stream source: stat %s: %w", path, err)
|
||||
}
|
||||
return &diskFileSource{f: f, size: stat.Size(), name: filepath.Base(path)}, nil
|
||||
}
|
||||
|
||||
func (d *diskFileSource) ReadAt(p []byte, off int64) (int, error) {
|
||||
return d.f.ReadAt(p, off)
|
||||
}
|
||||
func (d *diskFileSource) Size() int64 { return d.size }
|
||||
func (d *diskFileSource) Final() bool { return true }
|
||||
func (d *diskFileSource) EstimatedSize() int64 { return d.size }
|
||||
func (d *diskFileSource) FileName() string { return d.name }
|
||||
func (d *diskFileSource) Transcoded() bool { return false }
|
||||
func (d *diskFileSource) Close() error { return d.f.Close() }
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────────
|
||||
// transcode source — ffmpeg → tmp file
|
||||
// ─────────────────────────────────────────────────────────────────────────────
|
||||
|
||||
type transcodeSource struct {
|
||||
tmpPath string
|
||||
tmpFile *os.File
|
||||
cmd *Transcoder
|
||||
name string
|
||||
estimate int64
|
||||
|
||||
ctx context.Context
|
||||
notify chan struct{} // size grew or final flipped; cap=1, non-blocking send
|
||||
size atomic.Int64
|
||||
final atomic.Bool
|
||||
failure atomic.Pointer[error]
|
||||
startedAt time.Time
|
||||
}
|
||||
|
||||
const (
|
||||
// readBlockTimeout caps how long ReadAt waits for bytes that haven't
|
||||
// been transcoded yet before returning EOF/io.ErrUnexpectedEOF. The
|
||||
// pump treats EOF as "respond with whatever we have so far + RangeEnd"
|
||||
// so the browser can re-request once more bytes appear.
|
||||
readBlockTimeout = 30 * time.Second
|
||||
)
|
||||
|
||||
func newTranscodeSource(
|
||||
ctx context.Context,
|
||||
srcPath string,
|
||||
probe *StreamProbe,
|
||||
action TranscodeAction,
|
||||
opts TranscodeOpts,
|
||||
displayName string,
|
||||
) (*transcodeSource, error) {
|
||||
tmpFile, err := os.CreateTemp("", "tc-stream-*.mp4")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("transcode source: tmp file: %w", err)
|
||||
}
|
||||
tmpPath := tmpFile.Name()
|
||||
tmpFile.Close()
|
||||
|
||||
args := buildFFmpegArgs(srcPath, opts)
|
||||
// Override -f mp4 pipe:1 with output to our tmp file path (last 3 args).
|
||||
if len(args) >= 3 && args[len(args)-1] == "pipe:1" {
|
||||
args[len(args)-1] = tmpPath
|
||||
}
|
||||
|
||||
// Spawn ffmpeg directly (not via NewTranscoder pipe) so it writes to
|
||||
// disk in real time. We re-use the rest of TranscodeOpts wiring.
|
||||
cmd, err := startTranscoderToFile(ctx, opts.FFmpegPath, args, nil)
|
||||
if err != nil {
|
||||
os.Remove(tmpPath)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
estimate := estimateOutputSize(probe, opts)
|
||||
|
||||
t := &transcodeSource{
|
||||
tmpPath: tmpPath,
|
||||
cmd: cmd,
|
||||
name: displayName,
|
||||
estimate: estimate,
|
||||
ctx: ctx,
|
||||
notify: make(chan struct{}, 1),
|
||||
startedAt: time.Now(),
|
||||
}
|
||||
|
||||
// Re-open the tmp file for reading; ffmpeg keeps writing to it.
|
||||
rf, err := os.Open(tmpPath)
|
||||
if err != nil {
|
||||
_ = cmd.Close()
|
||||
os.Remove(tmpPath)
|
||||
return nil, fmt.Errorf("transcode source: reopen tmp: %w", err)
|
||||
}
|
||||
t.tmpFile = rf
|
||||
|
||||
go t.watchSize(ctx)
|
||||
go t.watchExit()
|
||||
return t, nil
|
||||
}
|
||||
|
||||
// signalNotify wakes any goroutine blocked in ReadAt. Non-blocking: if a
|
||||
// notification is already pending the new event is folded into it (callers
|
||||
// always re-check size + final after waking, so a coalesced signal still
|
||||
// produces correct behaviour).
|
||||
func (t *transcodeSource) signalNotify() {
|
||||
select {
|
||||
case t.notify <- struct{}{}:
|
||||
default:
|
||||
}
|
||||
}
|
||||
|
||||
// watchSize polls the temp file size every 200 ms and wakes any blocked
|
||||
// ReadAt callers once new bytes arrive.
|
||||
func (t *transcodeSource) watchSize(ctx context.Context) {
|
||||
ticker := time.NewTicker(200 * time.Millisecond)
|
||||
defer ticker.Stop()
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
t.signalNotify()
|
||||
return
|
||||
case <-ticker.C:
|
||||
}
|
||||
if t.final.Load() {
|
||||
t.signalNotify()
|
||||
return
|
||||
}
|
||||
stat, err := os.Stat(t.tmpPath)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
current := stat.Size()
|
||||
if current > t.size.Load() {
|
||||
t.size.Store(current)
|
||||
t.signalNotify()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// watchExit waits for ffmpeg to exit (via Transcoder's single-Wait goroutine)
|
||||
// and locks in the final size. A kill triggered by Close() is NOT a failure.
|
||||
func (t *transcodeSource) watchExit() {
|
||||
<-t.cmd.Done()
|
||||
err := t.cmd.WaitErr()
|
||||
if err != nil && !t.cmd.IsClosing() {
|
||||
failure := fmt.Errorf("ffmpeg exited: %w (%s)", err, t.cmd.Stderr())
|
||||
t.failure.Store(&failure)
|
||||
}
|
||||
if stat, err := os.Stat(t.tmpPath); err == nil {
|
||||
t.size.Store(stat.Size())
|
||||
}
|
||||
t.final.Store(true)
|
||||
t.signalNotify()
|
||||
}
|
||||
|
||||
// loadFailure returns the current failure (or nil) without taking a lock.
|
||||
func (t *transcodeSource) loadFailure() error {
|
||||
if p := t.failure.Load(); p != nil {
|
||||
return *p
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (t *transcodeSource) ReadAt(p []byte, off int64) (int, error) {
|
||||
if err := t.loadFailure(); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
if len(p) == 0 {
|
||||
return 0, nil
|
||||
}
|
||||
if off < 0 {
|
||||
return 0, fmt.Errorf("transcode source: negative offset %d", off)
|
||||
}
|
||||
want := int64(len(p))
|
||||
|
||||
deadline := time.Now().Add(readBlockTimeout)
|
||||
for {
|
||||
if t.final.Load() {
|
||||
break
|
||||
}
|
||||
size := t.size.Load()
|
||||
// Overflow-safe form of "off + want <= size":
|
||||
if size >= off && size-off >= want {
|
||||
break
|
||||
}
|
||||
remaining := time.Until(deadline)
|
||||
if remaining <= 0 {
|
||||
break
|
||||
}
|
||||
wait := 500 * time.Millisecond
|
||||
if remaining < wait {
|
||||
wait = remaining
|
||||
}
|
||||
select {
|
||||
case <-t.ctx.Done():
|
||||
return 0, t.ctx.Err()
|
||||
case <-t.notify:
|
||||
case <-time.After(wait):
|
||||
}
|
||||
}
|
||||
|
||||
if err := t.loadFailure(); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
n, err := t.tmpFile.ReadAt(p, off)
|
||||
// On a growing file ReadAt returns io.EOF when reading past current size.
|
||||
// Translate that into "send what we have, RangeEnd will follow" by
|
||||
// returning (n, nil) so the pump treats the data as a partial chunk and
|
||||
// caller re-requests once more bytes appear. Only true EOF (final=true)
|
||||
// propagates as io.EOF.
|
||||
if err == io.EOF && !t.final.Load() {
|
||||
if n > 0 {
|
||||
return n, nil
|
||||
}
|
||||
return 0, errors.New("transcode source: read timed out waiting for ffmpeg output")
|
||||
}
|
||||
return n, err
|
||||
}
|
||||
|
||||
func (t *transcodeSource) Size() int64 { return t.size.Load() }
|
||||
func (t *transcodeSource) Final() bool { return t.final.Load() }
|
||||
func (t *transcodeSource) EstimatedSize() int64 {
|
||||
if t.final.Load() {
|
||||
return t.size.Load()
|
||||
}
|
||||
return t.estimate
|
||||
}
|
||||
func (t *transcodeSource) FileName() string {
|
||||
// Output is always fragmented MP4 regardless of source extension.
|
||||
return strings.TrimSuffix(t.name, filepath.Ext(t.name)) + ".mp4"
|
||||
}
|
||||
func (t *transcodeSource) Transcoded() bool { return true }
|
||||
func (t *transcodeSource) Close() error {
|
||||
var errs []error
|
||||
if err := t.cmd.Close(); err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
if t.tmpFile != nil {
|
||||
if err := t.tmpFile.Close(); err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
}
|
||||
if t.tmpPath != "" {
|
||||
if err := os.Remove(t.tmpPath); err != nil && !os.IsNotExist(err) {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
}
|
||||
return errors.Join(errs...)
|
||||
}
|
||||
|
||||
// estimateOutputSize converts probed bitrate × duration into a byte estimate
|
||||
// so the browser scrubber has something to anchor on while transcoding.
|
||||
func estimateOutputSize(probe *StreamProbe, opts TranscodeOpts) int64 {
|
||||
if probe == nil || probe.DurationSec <= 0 {
|
||||
return 0
|
||||
}
|
||||
videoKbps := parseBitrateKbps(opts.VideoBitrate, 5000)
|
||||
audioKbps := parseBitrateKbps(opts.AudioBitrate, 192)
|
||||
totalKbps := videoKbps + audioKbps
|
||||
bytesPerSec := int64(totalKbps) * 1000 / 8
|
||||
return int64(probe.DurationSec) * bytesPerSec
|
||||
}
|
||||
|
||||
// parseBitrateKbps converts ffmpeg-style bitrate strings ("5M", "192k") to
|
||||
// kilobits per second. Unknown formats fall back to fallback.
|
||||
func parseBitrateKbps(s string, fallback int) int {
|
||||
if s == "" {
|
||||
return fallback
|
||||
}
|
||||
last := s[len(s)-1]
|
||||
num := s
|
||||
mult := 1
|
||||
switch last {
|
||||
case 'k', 'K':
|
||||
num = s[:len(s)-1]
|
||||
case 'M', 'm':
|
||||
num = s[:len(s)-1]
|
||||
mult = 1000
|
||||
default:
|
||||
// already in bps? treat as kbps
|
||||
}
|
||||
v := 0
|
||||
for _, c := range num {
|
||||
if c < '0' || c > '9' {
|
||||
return fallback
|
||||
}
|
||||
v = v*10 + int(c-'0')
|
||||
}
|
||||
if v == 0 {
|
||||
return fallback
|
||||
}
|
||||
return v * mult
|
||||
}
|
||||
|
|
@ -1,90 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestParseBitrateKbps(t *testing.T) {
|
||||
cases := []struct {
|
||||
in string
|
||||
fb int
|
||||
want int
|
||||
}{
|
||||
{"", 5000, 5000},
|
||||
{"192k", 0, 192},
|
||||
{"192K", 0, 192},
|
||||
{"5M", 0, 5000},
|
||||
{"5m", 0, 5000},
|
||||
{"4500", 0, 4500},
|
||||
{"bogus", 100, 100},
|
||||
{"0k", 100, 100},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.in, func(t *testing.T) {
|
||||
if got := parseBitrateKbps(tc.in, tc.fb); got != tc.want {
|
||||
t.Errorf("parseBitrateKbps(%q,%d) = %d, want %d", tc.in, tc.fb, got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestEstimateOutputSize(t *testing.T) {
|
||||
if got := estimateOutputSize(nil, TranscodeOpts{}); got != 0 {
|
||||
t.Errorf("nil probe -> 0, got %d", got)
|
||||
}
|
||||
if got := estimateOutputSize(&StreamProbe{}, TranscodeOpts{}); got != 0 {
|
||||
t.Errorf("zero duration -> 0, got %d", got)
|
||||
}
|
||||
probe := &StreamProbe{DurationSec: 60}
|
||||
opts := TranscodeOpts{VideoBitrate: "5M", AudioBitrate: "192k"}
|
||||
// (5000 + 192) * 1000 / 8 = 649_000 bytes/s; *60 = 38_940_000
|
||||
got := estimateOutputSize(probe, opts)
|
||||
if got != 38_940_000 {
|
||||
t.Errorf("estimateOutputSize = %d, want 38_940_000", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDiskFileSourceLifecycle(t *testing.T) {
|
||||
tmp := t.TempDir()
|
||||
path := filepath.Join(tmp, "movie.bin")
|
||||
data := []byte("hello world")
|
||||
if err := os.WriteFile(path, data, 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
src, err := newDiskFileSource(path)
|
||||
if err != nil {
|
||||
t.Fatalf("newDiskFileSource: %v", err)
|
||||
}
|
||||
defer src.Close()
|
||||
|
||||
if src.Size() != int64(len(data)) {
|
||||
t.Errorf("Size = %d, want %d", src.Size(), len(data))
|
||||
}
|
||||
if src.EstimatedSize() != src.Size() {
|
||||
t.Errorf("EstimatedSize should equal Size for disk source")
|
||||
}
|
||||
if !src.Final() {
|
||||
t.Errorf("disk source should be Final")
|
||||
}
|
||||
if src.Transcoded() {
|
||||
t.Errorf("disk source should not report Transcoded")
|
||||
}
|
||||
if src.FileName() != "movie.bin" {
|
||||
t.Errorf("FileName = %q", src.FileName())
|
||||
}
|
||||
|
||||
buf := make([]byte, 5)
|
||||
n, err := src.ReadAt(buf, 6)
|
||||
if err != nil || n != 5 || string(buf) != "world" {
|
||||
t.Errorf("ReadAt = (%d,%v,%q), want (5,nil,'world')", n, err, buf)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDiskFileSourceMissing(t *testing.T) {
|
||||
if _, err := newDiskFileSource("/nonexistent/movie.bin"); err == nil {
|
||||
t.Error("expected error opening nonexistent file")
|
||||
}
|
||||
}
|
||||
|
|
@ -4,7 +4,6 @@ import (
|
|||
"fmt"
|
||||
"sync"
|
||||
"time"
|
||||
"unicode/utf8"
|
||||
|
||||
"github.com/torrentclaw/unarr/internal/agent"
|
||||
)
|
||||
|
|
@ -230,25 +229,10 @@ func (t *Task) ToStatusUpdate() agent.StatusUpdate {
|
|||
FileName: t.FileName,
|
||||
FilePath: t.FilePath,
|
||||
StreamURL: t.StreamURL,
|
||||
// Cap to the server's stored length. A failed extract can carry a
|
||||
// multi-KB unrar/par2 dump; sending it raw made /agent/status 400
|
||||
// the whole report, leaving the task stuck non-terminal.
|
||||
ErrorMessage: truncateMsg(t.ErrorMessage, 2000),
|
||||
ErrorMessage: t.ErrorMessage,
|
||||
}
|
||||
}
|
||||
|
||||
// truncateMsg caps s to at most max bytes without splitting a UTF-8 rune.
|
||||
func truncateMsg(s string, max int) string {
|
||||
if len(s) <= max {
|
||||
return s
|
||||
}
|
||||
cut := max
|
||||
for cut > 0 && !utf8.RuneStart(s[cut]) {
|
||||
cut--
|
||||
}
|
||||
return s[:cut]
|
||||
}
|
||||
|
||||
// MagnetURI builds a magnet link from the info hash.
|
||||
func (t *Task) MagnetURI() string {
|
||||
return "magnet:?xt=urn:btih:" + t.InfoHash
|
||||
|
|
|
|||
|
|
@ -17,7 +17,6 @@ import (
|
|||
"github.com/anacrolix/torrent"
|
||||
"github.com/anacrolix/torrent/storage"
|
||||
"github.com/torrentclaw/unarr/internal/config"
|
||||
"github.com/torrentclaw/unarr/internal/vpn"
|
||||
"golang.org/x/term"
|
||||
"golang.org/x/time/rate"
|
||||
)
|
||||
|
|
@ -61,12 +60,7 @@ var defaultTrackers = []string{
|
|||
|
||||
// TorrentConfig holds settings for the BitTorrent downloader.
|
||||
type TorrentConfig struct {
|
||||
DataDir string
|
||||
// PieceCompletionDir, when non-empty, stores the piece-completion SQLite DB
|
||||
// in this directory instead of DataDir. Use the agent's local state dir
|
||||
// (not the download dir) so the DB never lands on NFS/SMB volumes where
|
||||
// SQLite locking times out.
|
||||
PieceCompletionDir string
|
||||
DataDir string
|
||||
MetadataTimeout time.Duration // how long to wait for torrent metadata (default 15m, 0 = unlimited)
|
||||
StallTimeout time.Duration // no progress during download for this long = stall (default 10m)
|
||||
MaxTimeout time.Duration // absolute maximum per torrent (default 0 = unlimited)
|
||||
|
|
@ -76,11 +70,6 @@ type TorrentConfig struct {
|
|||
SeedEnabled bool
|
||||
SeedRatio float64 // target seed ratio (default 0, meaning seed until SeedTime)
|
||||
SeedTime time.Duration // min seed time after completion (default 0)
|
||||
|
||||
// VPNTunnel, when set, split-tunnels the torrent client's peer + tracker
|
||||
// traffic through an in-process userspace WireGuard tunnel (managed-VPN
|
||||
// add-on). nil = downloads in the clear. Brought up by the daemon.
|
||||
VPNTunnel *vpn.Tunnel
|
||||
}
|
||||
|
||||
// TorrentDownloader downloads torrents via BitTorrent P2P.
|
||||
|
|
@ -108,33 +97,14 @@ func NewTorrentDownloader(cfg TorrentConfig) (*TorrentDownloader, error) {
|
|||
tcfg.DataDir = cfg.DataDir
|
||||
tcfg.Seed = cfg.SeedEnabled
|
||||
tcfg.NoUpload = !cfg.SeedEnabled
|
||||
tcfg.Logger = alog.Default.FilterLevel(alog.Warning)
|
||||
|
||||
// No browser-facing WebTorrent peer; daemon never seeds via WSS.
|
||||
tcfg.DisableWebtorrent = true
|
||||
tcfg.Logger = alog.Default.FilterLevel(alog.Critical)
|
||||
|
||||
// --- Performance optimizations ---
|
||||
|
||||
// Storage: mmap instead of default file backend.
|
||||
// The library author notes file storage has "very high system overhead".
|
||||
// mmap improves I/O throughput and piece verification speed significantly.
|
||||
//
|
||||
// When PieceCompletionDir is set (daemon always passes the agent state dir),
|
||||
// keep the piece-completion SQLite DB off the download dir so it never lands
|
||||
// on NFS/SMB where SQLite's file locking times out and emits a warning.
|
||||
if cfg.PieceCompletionDir != "" {
|
||||
if mkErr := os.MkdirAll(cfg.PieceCompletionDir, 0o755); mkErr != nil {
|
||||
log.Printf("[torrent] piece-completion dir create failed (%v), DB stays in download dir", mkErr)
|
||||
tcfg.DefaultStorage = storage.NewMMap(cfg.DataDir)
|
||||
} else if pc, pcErr := storage.NewDefaultPieceCompletionForDir(cfg.PieceCompletionDir); pcErr != nil {
|
||||
log.Printf("[torrent] piece-completion db in %q failed (%v), falling back to download dir", cfg.PieceCompletionDir, pcErr)
|
||||
tcfg.DefaultStorage = storage.NewMMap(cfg.DataDir)
|
||||
} else {
|
||||
tcfg.DefaultStorage = storage.NewMMapWithCompletion(cfg.DataDir, pc)
|
||||
}
|
||||
} else {
|
||||
tcfg.DefaultStorage = storage.NewMMap(cfg.DataDir)
|
||||
}
|
||||
tcfg.DefaultStorage = storage.NewMMap(cfg.DataDir)
|
||||
|
||||
// Fixed port for incoming peer connections (enables UPnP port mapping).
|
||||
// With ListenPort=0, only ~30% of peers can connect to us.
|
||||
|
|
@ -221,20 +191,6 @@ func NewTorrentDownloader(cfg TorrentConfig) (*TorrentDownloader, error) {
|
|||
// Re-announce active torrents to DHT periodically (keeps routing table healthy).
|
||||
tcfg.PeriodicallyAnnounceTorrentsToDht = true
|
||||
|
||||
// --- Managed-VPN split-tunnel ---
|
||||
// Route the torrent client's outbound peer + tracker traffic through the
|
||||
// in-process WireGuard tunnel so the swarm + trackers see the VPN IP, not
|
||||
// the user's. unarr's control plane keeps using the normal net. uTP (UDP
|
||||
// peers) is disabled — TCP peers + HTTP/UDP tracker announces are tunnelled;
|
||||
// inbound peers don't apply (leech-only, no port forward).
|
||||
if cfg.VPNTunnel != nil {
|
||||
tcfg.DisableUTP = true
|
||||
tcfg.TrackerDialContext = cfg.VPNTunnel.Net.DialContext
|
||||
tcfg.HTTPDialContext = cfg.VPNTunnel.Net.DialContext
|
||||
tcfg.TrackerListenPacket = cfg.VPNTunnel.ListenPacket
|
||||
log.Printf("[torrent] VPN split-tunnel enabled (peer + tracker traffic routed through WireGuard)")
|
||||
}
|
||||
|
||||
// Try to create client; if the port is in use, try the next few ports.
|
||||
var client *torrent.Client
|
||||
var err error
|
||||
|
|
@ -256,12 +212,6 @@ func NewTorrentDownloader(cfg TorrentConfig) (*TorrentDownloader, error) {
|
|||
log.Printf("[torrent] listening on port %d (configured: %d was busy)", tcfg.ListenPort, listenPort)
|
||||
}
|
||||
|
||||
// Route outgoing peer dials through the VPN tunnel (TCP). Added after client
|
||||
// creation; DialForPeerConns defaults to true so this is used for peers.
|
||||
if cfg.VPNTunnel != nil {
|
||||
client.AddDialer(torrent.NetworkDialer{Network: "tcp", Dialer: cfg.VPNTunnel.Net})
|
||||
}
|
||||
|
||||
// Restore DHT nodes with full node IDs (direct routing table insertion, no async pings).
|
||||
for _, s := range client.DhtServers() {
|
||||
if w, ok := s.(torrent.AnacrolixDhtServerWrapper); ok {
|
||||
|
|
@ -285,7 +235,7 @@ func (d *TorrentDownloader) Available(_ context.Context, task *Task) (bool, erro
|
|||
}
|
||||
|
||||
func (d *TorrentDownloader) Download(ctx context.Context, task *Task, outputDir string, progressCh chan<- Progress) (*Result, error) {
|
||||
magnet := d.buildMagnet(task.InfoHash)
|
||||
magnet := buildMagnet(task.InfoHash)
|
||||
|
||||
t, err := d.client.AddMagnet(magnet)
|
||||
if err != nil {
|
||||
|
|
@ -373,13 +323,6 @@ func (d *TorrentDownloader) Download(ctx context.Context, task *Task, outputDir
|
|||
result.Method = MethodTorrent
|
||||
result.Size = totalBytes
|
||||
|
||||
// anacrolix mmap storage (storage.NewMMap) creates completed files with mode
|
||||
// 0000 — the running process keeps its own mmap handle so the download works,
|
||||
// but any fresh open (streaming, ffprobe/HLS, organize-then-reopen) hits
|
||||
// "permission denied". Relax perms now, before organize moves the file, so the
|
||||
// readable mode is preserved through the rename.
|
||||
makeReadable(filePath)
|
||||
|
||||
// If seeding enabled, keep alive (don't cleanup).
|
||||
// The manager handles seeding lifecycle.
|
||||
if !d.cfg.SeedEnabled {
|
||||
|
|
@ -487,41 +430,6 @@ func (d *TorrentDownloader) pollDownload(ctx context.Context, t *torrent.Torrent
|
|||
}
|
||||
}
|
||||
|
||||
// makeReadable relaxes permissions on a completed download so it can be
|
||||
// re-opened by streaming/ffprobe/organize. anacrolix mmap storage creates
|
||||
// files with mode 0000; we set files to 0644 and directories to 0755. Errors
|
||||
// are logged but non-fatal (e.g. NFS root_squash) — the file may still be
|
||||
// readable depending on the export.
|
||||
func makeReadable(path string) {
|
||||
info, err := os.Stat(path)
|
||||
if err != nil {
|
||||
log.Printf("[organize] makeReadable stat %q: %v", path, err)
|
||||
return
|
||||
}
|
||||
if !info.IsDir() {
|
||||
if err := os.Chmod(path, 0o644); err != nil {
|
||||
log.Printf("[organize] makeReadable chmod %q: %v", path, err)
|
||||
}
|
||||
return
|
||||
}
|
||||
err = filepath.WalkDir(path, func(p string, d os.DirEntry, walkErr error) error {
|
||||
if walkErr != nil {
|
||||
return nil // skip unreadable entries, keep going
|
||||
}
|
||||
mode := os.FileMode(0o644)
|
||||
if d.IsDir() {
|
||||
mode = 0o755
|
||||
}
|
||||
if err := os.Chmod(p, mode); err != nil {
|
||||
log.Printf("[organize] makeReadable chmod %q: %v", p, err)
|
||||
}
|
||||
return nil
|
||||
})
|
||||
if err != nil {
|
||||
log.Printf("[organize] makeReadable walk %q: %v", path, err)
|
||||
}
|
||||
}
|
||||
|
||||
// Pause drops the torrent handle but keeps partial files on disk for resume.
|
||||
func (d *TorrentDownloader) Pause(taskID string) error {
|
||||
d.activeMu.Lock()
|
||||
|
|
@ -696,8 +604,6 @@ func (d *TorrentDownloader) selectFiles(t *torrent.Torrent, taskID string) (tota
|
|||
return totalBytes, fileName
|
||||
}
|
||||
|
||||
// buildMagnet composes a magnet URI for the info hash with the static
|
||||
// tracker list.
|
||||
func buildMagnet(infoHash string) string {
|
||||
params := []string{"xt=urn:btih:" + infoHash}
|
||||
for _, tracker := range defaultTrackers {
|
||||
|
|
@ -706,10 +612,6 @@ func buildMagnet(infoHash string) string {
|
|||
return "magnet:?" + strings.Join(params, "&")
|
||||
}
|
||||
|
||||
func (d *TorrentDownloader) buildMagnet(infoHash string) string {
|
||||
return buildMagnet(infoHash)
|
||||
}
|
||||
|
||||
func formatBytes(b int64) string {
|
||||
const unit = 1024
|
||||
if b < unit {
|
||||
|
|
|
|||
|
|
@ -1,64 +0,0 @@
|
|||
package engine
|
||||
|
||||
// TranscodeRuntime carries the resolved ffmpeg/ffprobe paths + tunables so
|
||||
// each session can decide whether to passthrough or pipe through ffmpeg.
|
||||
type TranscodeRuntime struct {
|
||||
FFmpegPath string
|
||||
FFprobePath string
|
||||
HWAccel HWAccel
|
||||
Preset string
|
||||
VideoBitrate string
|
||||
AudioBitrate string
|
||||
MaxHeight int
|
||||
// Disabled forces passthrough for every file even when codecs are not
|
||||
// browser-friendly. Useful when the user explicitly turns transcoding
|
||||
// off in config.
|
||||
Disabled bool
|
||||
}
|
||||
|
||||
// qualityCap maps a session's Quality label to a (MaxHeight, VideoBitrate)
|
||||
// pair. An empty label or "original" returns zero-values, signalling "no
|
||||
// override" to the caller.
|
||||
type qualityCap struct {
|
||||
MaxHeight int
|
||||
VideoBitrate string // ffmpeg -b:v string, e.g. "3500k"
|
||||
}
|
||||
|
||||
func resolveQualityCap(label string) qualityCap {
|
||||
switch label {
|
||||
case "2160p":
|
||||
return qualityCap{MaxHeight: 2160, VideoBitrate: "25000k"}
|
||||
case "1080p":
|
||||
return qualityCap{MaxHeight: 1080, VideoBitrate: "6000k"}
|
||||
case "720p":
|
||||
return qualityCap{MaxHeight: 720, VideoBitrate: "3500k"}
|
||||
case "480p":
|
||||
return qualityCap{MaxHeight: 480, VideoBitrate: "1500k"}
|
||||
default:
|
||||
// "original", "auto", "" → defer to config.
|
||||
return qualityCap{}
|
||||
}
|
||||
}
|
||||
|
||||
// capForHeight returns the bitrate-cap pair appropriate for an effective
|
||||
// output height. Used after clamping outputHeight to the source's resolution:
|
||||
// asking ffmpeg for "2160p" bitrate (25 Mbps) on a 1080p source overshoots
|
||||
// the H.264 level we derived from the EFFECTIVE height (4.0, max 20 Mbps) and
|
||||
// makes libx264 refuse with "VBV bitrate > level limit". This helper picks
|
||||
// the bitrate that matches the level libx264 will actually accept.
|
||||
func capForHeight(height int) qualityCap {
|
||||
switch {
|
||||
case height <= 0:
|
||||
return qualityCap{}
|
||||
case height <= 480:
|
||||
return qualityCap{MaxHeight: 480, VideoBitrate: "1500k"}
|
||||
case height <= 720:
|
||||
return qualityCap{MaxHeight: 720, VideoBitrate: "3500k"}
|
||||
case height <= 1080:
|
||||
return qualityCap{MaxHeight: 1080, VideoBitrate: "6000k"}
|
||||
case height <= 1440:
|
||||
return qualityCap{MaxHeight: 1440, VideoBitrate: "12000k"}
|
||||
default:
|
||||
return qualityCap{MaxHeight: 2160, VideoBitrate: "25000k"}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,306 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"io"
|
||||
"os/exec"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
// TranscodeOpts steers how Transcoder builds its ffmpeg command line.
|
||||
//
|
||||
// - Output: fragmented MP4 chunked into HLS segments by the muxer.
|
||||
// - Audio: AAC stereo @ 192kbps unless source already AAC (then -c:a copy).
|
||||
// - Video: copy when h264 8-bit; otherwise transcode to h264 with HW encode
|
||||
// when available, software fallback at "veryfast" preset.
|
||||
type TranscodeOpts struct {
|
||||
Action TranscodeAction
|
||||
HWAccel HWAccel
|
||||
Preset string // "veryfast" / "fast" / "medium"
|
||||
VideoBitrate string // e.g. "5M"
|
||||
AudioBitrate string // e.g. "192k"
|
||||
MaxHeight int // optional downscale cap (e.g. 720)
|
||||
SourceHeight int // probed source height — used to derive a sane H.264 level
|
||||
StartSeconds float64
|
||||
FFmpegPath string
|
||||
}
|
||||
|
||||
// Transcoder wraps a long-running ffmpeg child process whose stdout streams
|
||||
// fragmented MP4 bytes; the HLS muxer slices them into segments served over HTTP.
|
||||
//
|
||||
// One Transcoder == one playback position. A seek beyond the buffered window
|
||||
// requires Close()ing this transcoder and starting a new one with a higher
|
||||
// StartSeconds (handled by the HLS session at ffmpeg start time).
|
||||
//
|
||||
// A single internal goroutine owns cmd.Wait() — never call cmd.Wait()
|
||||
// directly from outside (os/exec forbids concurrent Wait callers). Use
|
||||
// Done() / WaitErr() instead.
|
||||
type Transcoder struct {
|
||||
cmd *exec.Cmd
|
||||
out io.ReadCloser
|
||||
|
||||
mu sync.Mutex
|
||||
closed bool
|
||||
stderr strings.Builder
|
||||
|
||||
done chan struct{} // closed once cmd.Wait returns; nil if cmd never started
|
||||
waitErr error // populated before done is closed; read-only after
|
||||
}
|
||||
|
||||
// NewTranscoder spawns ffmpeg and returns a Transcoder whose Read() yields
|
||||
// fragmented MP4 bytes from stdin. Callers MUST call Close() when done.
|
||||
func NewTranscoder(ctx context.Context, filePath string, opts TranscodeOpts) (*Transcoder, error) {
|
||||
if opts.FFmpegPath == "" {
|
||||
return nil, fmt.Errorf("transcoder: empty ffmpeg path")
|
||||
}
|
||||
args := buildFFmpegArgs(filePath, opts)
|
||||
cmd := exec.CommandContext(ctx, opts.FFmpegPath, args...)
|
||||
stdout, err := cmd.StdoutPipe()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("transcoder: stdout pipe: %w", err)
|
||||
}
|
||||
t := &Transcoder{cmd: cmd, out: stdout}
|
||||
cmd.Stderr = &errWriter{t: t}
|
||||
if err := cmd.Start(); err != nil {
|
||||
return nil, fmt.Errorf("transcoder: start ffmpeg: %w", err)
|
||||
}
|
||||
t.startWaitGoroutine()
|
||||
return t, nil
|
||||
}
|
||||
|
||||
// startTranscoderToFile spawns ffmpeg with a pre-built argv where the last
|
||||
// argument is an output file path (instead of pipe:1). Used by streamSource
|
||||
// when we want random-access reads against a growing temp file rather than
|
||||
// sequential pipe consumption.
|
||||
func startTranscoderToFile(ctx context.Context, ffmpegPath string, args []string, t *Transcoder) (*Transcoder, error) {
|
||||
if ffmpegPath == "" {
|
||||
return nil, fmt.Errorf("transcoder: empty ffmpeg path")
|
||||
}
|
||||
cmd := exec.CommandContext(ctx, ffmpegPath, args...)
|
||||
if t == nil {
|
||||
t = &Transcoder{}
|
||||
}
|
||||
t.cmd = cmd
|
||||
cmd.Stderr = &errWriter{t: t}
|
||||
if err := cmd.Start(); err != nil {
|
||||
return nil, fmt.Errorf("transcoder: start ffmpeg: %w", err)
|
||||
}
|
||||
t.startWaitGoroutine()
|
||||
return t, nil
|
||||
}
|
||||
|
||||
// startWaitGoroutine launches the single goroutine that owns cmd.Wait().
|
||||
// Idempotent — protected by sync.Once-via-nil-check on done.
|
||||
func (t *Transcoder) startWaitGoroutine() {
|
||||
if t.done != nil {
|
||||
return
|
||||
}
|
||||
t.done = make(chan struct{})
|
||||
go func() {
|
||||
t.waitErr = t.cmd.Wait()
|
||||
close(t.done)
|
||||
}()
|
||||
}
|
||||
|
||||
// Done returns a channel that closes when ffmpeg exits. Returns nil for a
|
||||
// Transcoder whose cmd never started.
|
||||
func (t *Transcoder) Done() <-chan struct{} { return t.done }
|
||||
|
||||
// WaitErr blocks until ffmpeg exits and returns the wait error. Safe to
|
||||
// call concurrently from multiple goroutines.
|
||||
func (t *Transcoder) WaitErr() error {
|
||||
if t.done == nil {
|
||||
return nil
|
||||
}
|
||||
<-t.done
|
||||
return t.waitErr
|
||||
}
|
||||
|
||||
// Read implements io.Reader.
|
||||
func (t *Transcoder) Read(p []byte) (int, error) { return t.out.Read(p) }
|
||||
|
||||
// Close kills the child process if still running and waits up to 2s for exit.
|
||||
// IsClosing reports true after Close has been invoked — used by streamSource
|
||||
// to distinguish a kill-by-Close from a genuine ffmpeg crash.
|
||||
func (t *Transcoder) Close() error {
|
||||
t.mu.Lock()
|
||||
if t.closed {
|
||||
t.mu.Unlock()
|
||||
return nil
|
||||
}
|
||||
t.closed = true
|
||||
t.mu.Unlock()
|
||||
|
||||
// out is nil for the file-output flow (startTranscoderToFile) — that
|
||||
// pipeline writes directly to a temp file via -i ... output_path so we
|
||||
// never wired a stdout pipe. Only close when present.
|
||||
if t.out != nil {
|
||||
_ = t.out.Close()
|
||||
}
|
||||
if t.cmd != nil && t.cmd.Process != nil {
|
||||
_ = t.cmd.Process.Kill()
|
||||
}
|
||||
if t.done == nil {
|
||||
return nil
|
||||
}
|
||||
select {
|
||||
case <-t.done:
|
||||
case <-time.After(2 * time.Second):
|
||||
// Process refused to die — leak it; the OS will clean up on exit.
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// IsClosing reports whether Close has been invoked. Cheap atomic-ish check
|
||||
// for callers that want to distinguish a kill-by-Close exit from a real
|
||||
// ffmpeg failure when reading WaitErr.
|
||||
func (t *Transcoder) IsClosing() bool {
|
||||
t.mu.Lock()
|
||||
defer t.mu.Unlock()
|
||||
return t.closed
|
||||
}
|
||||
|
||||
// Stderr returns the accumulated ffmpeg stderr so far. Useful for surfacing
|
||||
// failure reasons in logs after Close().
|
||||
func (t *Transcoder) Stderr() string {
|
||||
t.mu.Lock()
|
||||
defer t.mu.Unlock()
|
||||
return t.stderr.String()
|
||||
}
|
||||
|
||||
// errWriter funnels ffmpeg stderr into the Transcoder buffer so it can be
|
||||
// inspected post-mortem. Capped so a misbehaving ffmpeg can't grow memory.
|
||||
type errWriter struct{ t *Transcoder }
|
||||
|
||||
func (w *errWriter) Write(p []byte) (int, error) {
|
||||
w.t.mu.Lock()
|
||||
defer w.t.mu.Unlock()
|
||||
const maxBuf = 64 * 1024
|
||||
if w.t.stderr.Len() < maxBuf {
|
||||
w.t.stderr.Write(p)
|
||||
}
|
||||
return len(p), nil
|
||||
}
|
||||
|
||||
// buildFFmpegArgs assembles the command line for the requested action.
|
||||
// Exposed package-level so tests can lock the flag matrix independently of
|
||||
// process spawning.
|
||||
func buildFFmpegArgs(filePath string, opts TranscodeOpts) []string {
|
||||
// -y: overwrite output without asking (the file-output flow uses an
|
||||
// already-created tmp file from os.CreateTemp, so the default "do you
|
||||
// want to overwrite?" prompt would deadlock on stdin and ffmpeg dies
|
||||
// before producing a single byte). Pipe flow doesn't need it but it's
|
||||
// harmless there.
|
||||
args := []string{"-y", "-hide_banner", "-loglevel", "warning"}
|
||||
|
||||
// Seek BEFORE input (-ss before -i) for fast keyframe-aligned start.
|
||||
if opts.StartSeconds > 0 {
|
||||
args = append(args, "-ss", strconv.FormatFloat(opts.StartSeconds, 'f', 3, 64))
|
||||
}
|
||||
|
||||
// HW accel hint on the demuxer side improves throughput for HEVC inputs
|
||||
// even when we end up encoding in software. Skip on macOS (videotoolbox
|
||||
// uses a different flag shape).
|
||||
switch opts.HWAccel {
|
||||
case HWAccelNVENC:
|
||||
args = append(args, "-hwaccel", "cuda")
|
||||
case HWAccelQSV:
|
||||
args = append(args, "-hwaccel", "qsv")
|
||||
case HWAccelVAAPI:
|
||||
args = append(args, "-hwaccel", "vaapi", "-hwaccel_output_format", "vaapi")
|
||||
case HWAccelNone, HWAccelVideoToolbox:
|
||||
// No demuxer-side hint: software decode (None) or per-encoder flags
|
||||
// already applied separately by FFmpegVideoCodec (VideoToolbox).
|
||||
}
|
||||
|
||||
args = append(args, "-i", filePath)
|
||||
|
||||
switch opts.Action {
|
||||
case ActionPassthrough, ActionRemux:
|
||||
args = append(args, "-c:v", "copy", "-c:a", "copy")
|
||||
case ActionRemuxAudio:
|
||||
args = append(args, "-c:v", "copy", "-c:a", "aac", "-b:a", coalesce(opts.AudioBitrate, "192k"))
|
||||
case ActionTranscodeVideo:
|
||||
videoCodec := opts.HWAccel.FFmpegVideoCodec("h264")
|
||||
args = append(args, "-c:v", videoCodec)
|
||||
if videoCodec == "libx264" {
|
||||
args = append(args, "-preset", coalesce(opts.Preset, "veryfast"))
|
||||
}
|
||||
// Force the broadest browser-compatible h264 profile. `high` (libx264
|
||||
// default) makes Chrome try its hardware decoder path first, which
|
||||
// can fail with "VaapiWrapper: failed initializing" on Linux boxes
|
||||
// where VA-API isn't fully wired up. `main` keeps a clean software
|
||||
// decode fallback on every desktop + mobile platform.
|
||||
//
|
||||
// Level is derived from the actual output height — a fixed "4.0"
|
||||
// silently rejects 4K and 1440p sources at the libx264 macroblock
|
||||
// limits and produces unplayable streams. opts.MaxHeight is the
|
||||
// downscale cap when set; falling through means "encode at source".
|
||||
levelHeight := opts.MaxHeight
|
||||
if levelHeight == 0 || (opts.SourceHeight > 0 && opts.SourceHeight < levelHeight) {
|
||||
levelHeight = opts.SourceHeight
|
||||
}
|
||||
args = append(args, "-profile:v", "main", "-level:v", H264LevelForHeight(levelHeight))
|
||||
args = append(args, "-b:v", coalesce(opts.VideoBitrate, "5M"))
|
||||
// Filter chain:
|
||||
// 1. scale (optional) — cap height + force even width.
|
||||
// 2. format=yuv420p — drop 10-bit + reset pix_fmt to 8-bit before
|
||||
// libx264 (which refuses 10-bit unless built with --bit-depth=10).
|
||||
// 3. setparams — REWRITE the color metadata in the output stream's
|
||||
// VUI/SEI without touching pixels. This is what makes HDR HEVC
|
||||
// sources (color_primaries=bt2020, color_transfer=arib-std-b67)
|
||||
// decodeable in browsers that reject anything but Rec.709. We
|
||||
// can't actually tonemap without libzimg/zscale (most ffmpeg
|
||||
// builds — including ours — ship without it), so colours look
|
||||
// desaturated on HDR sources, but the file plays. SDR sources
|
||||
// already match these params and are unaffected.
|
||||
var filterChain string
|
||||
if opts.MaxHeight > 0 {
|
||||
filterChain = fmt.Sprintf(
|
||||
"scale=-2:%d:force_original_aspect_ratio=decrease,format=yuv420p,setparams=colorspace=bt709:color_trc=bt709:color_primaries=bt709:range=tv",
|
||||
opts.MaxHeight,
|
||||
)
|
||||
} else {
|
||||
filterChain = "format=yuv420p,setparams=colorspace=bt709:color_trc=bt709:color_primaries=bt709:range=tv"
|
||||
}
|
||||
args = append(args, "-vf", filterChain)
|
||||
// Force AAC-LC stereo 48 kHz so the hls.js demuxer accepts the moov.
|
||||
// 5.1 / 7.1 source streams produce a moov shape the demuxer refuses
|
||||
// to parse, so always downmix to stereo + resample to 48 kHz here.
|
||||
args = append(args,
|
||||
"-c:a", "aac",
|
||||
"-b:a", coalesce(opts.AudioBitrate, "192k"),
|
||||
"-ar", "48000",
|
||||
"-ac", "2",
|
||||
)
|
||||
}
|
||||
|
||||
// Common output flags — fragmented MP4 to a single pipe.
|
||||
//
|
||||
// * empty_moov + default_base_moof: header-only init segment up front
|
||||
// so the demuxer can start decoding before the file is finished.
|
||||
// * frag_duration=1s: cap each moof+mdat at ~1 second of media.
|
||||
// Without it ffmpeg only splits at keyframes; a high-bitrate 1080p
|
||||
// stream produces 8 MiB+ mdat boxes that delay the first fragment
|
||||
// until the whole mdat lands and playback never starts.
|
||||
// * negative_cts_offsets: lets b-frames carry the right pts/dts so
|
||||
// decoders don't reset the playhead to 0 every fragment.
|
||||
args = append(args,
|
||||
"-movflags", "+frag_keyframe+empty_moov+default_base_moof+negative_cts_offsets",
|
||||
"-frag_duration", "1000000",
|
||||
"-f", "mp4",
|
||||
"pipe:1",
|
||||
)
|
||||
return args
|
||||
}
|
||||
|
||||
func coalesce(s, fallback string) string {
|
||||
if s == "" {
|
||||
return fallback
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
|
@ -1,210 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func sliceContains(args []string, want string) bool {
|
||||
for _, a := range args {
|
||||
if a == want {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func sliceContainsPair(args []string, key, val string) bool {
|
||||
for i := 0; i < len(args)-1; i++ {
|
||||
if args[i] == key && args[i+1] == val {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func TestBuildFFmpegArgsPassthroughCopy(t *testing.T) {
|
||||
args := buildFFmpegArgs("/tmp/movie.mp4", TranscodeOpts{
|
||||
Action: ActionPassthrough,
|
||||
HWAccel: HWAccelNone,
|
||||
FFmpegPath: "ffmpeg",
|
||||
})
|
||||
if !sliceContainsPair(args, "-c:v", "copy") {
|
||||
t.Errorf("passthrough should keep -c:v copy. args=%v", args)
|
||||
}
|
||||
if !sliceContainsPair(args, "-c:a", "copy") {
|
||||
t.Error("passthrough should keep -c:a copy")
|
||||
}
|
||||
if !sliceContainsPair(args, "-f", "mp4") {
|
||||
t.Error("output container must be mp4")
|
||||
}
|
||||
movflags := ""
|
||||
for i := 0; i < len(args)-1; i++ {
|
||||
if args[i] == "-movflags" {
|
||||
movflags = args[i+1]
|
||||
}
|
||||
}
|
||||
if !strings.Contains(movflags, "frag_keyframe") {
|
||||
t.Errorf("movflags must include frag_keyframe, got %q", movflags)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildFFmpegArgsRemuxAudio(t *testing.T) {
|
||||
args := buildFFmpegArgs("/tmp/movie.mkv", TranscodeOpts{
|
||||
Action: ActionRemuxAudio,
|
||||
AudioBitrate: "256k",
|
||||
FFmpegPath: "ffmpeg",
|
||||
})
|
||||
if !sliceContainsPair(args, "-c:v", "copy") {
|
||||
t.Error("remux-audio keeps video copy")
|
||||
}
|
||||
if !sliceContainsPair(args, "-c:a", "aac") {
|
||||
t.Error("remux-audio must transcode audio to aac")
|
||||
}
|
||||
if !sliceContainsPair(args, "-b:a", "256k") {
|
||||
t.Error("audio bitrate override not honored")
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildFFmpegArgsTranscodeVideoSoftware(t *testing.T) {
|
||||
args := buildFFmpegArgs("/tmp/movie.mkv", TranscodeOpts{
|
||||
Action: ActionTranscodeVideo,
|
||||
HWAccel: HWAccelNone,
|
||||
Preset: "fast",
|
||||
VideoBitrate: "6M",
|
||||
FFmpegPath: "ffmpeg",
|
||||
})
|
||||
if !sliceContainsPair(args, "-c:v", "libx264") {
|
||||
t.Error("software fallback must use libx264")
|
||||
}
|
||||
if !sliceContainsPair(args, "-preset", "fast") {
|
||||
t.Error("custom preset not honored")
|
||||
}
|
||||
if !sliceContainsPair(args, "-b:v", "6M") {
|
||||
t.Error("video bitrate not honored")
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildFFmpegArgsTranscodeVideoNVENC(t *testing.T) {
|
||||
args := buildFFmpegArgs("/tmp/movie.mkv", TranscodeOpts{
|
||||
Action: ActionTranscodeVideo,
|
||||
HWAccel: HWAccelNVENC,
|
||||
FFmpegPath: "ffmpeg",
|
||||
})
|
||||
if !sliceContainsPair(args, "-hwaccel", "cuda") {
|
||||
t.Error("NVENC must request -hwaccel cuda")
|
||||
}
|
||||
if !sliceContainsPair(args, "-c:v", "h264_nvenc") {
|
||||
t.Error("NVENC must use h264_nvenc encoder")
|
||||
}
|
||||
if sliceContains(args, "-preset") {
|
||||
// HW encoders ignore software preset; we should NOT pass it.
|
||||
t.Error("HW encoder path should not include -preset")
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildFFmpegArgsAddsStartSeek(t *testing.T) {
|
||||
args := buildFFmpegArgs("/tmp/movie.mp4", TranscodeOpts{
|
||||
Action: ActionPassthrough,
|
||||
StartSeconds: 90.5,
|
||||
FFmpegPath: "ffmpeg",
|
||||
})
|
||||
idxSs, idxIn := -1, -1
|
||||
for i, a := range args {
|
||||
if a == "-ss" {
|
||||
idxSs = i
|
||||
}
|
||||
if a == "-i" {
|
||||
idxIn = i
|
||||
}
|
||||
}
|
||||
if idxSs < 0 {
|
||||
t.Fatal("missing -ss flag")
|
||||
}
|
||||
if idxIn < 0 {
|
||||
t.Fatal("missing -i flag")
|
||||
}
|
||||
if idxSs >= idxIn {
|
||||
t.Errorf("expected -ss BEFORE -i for fast seek; got -ss@%d -i@%d", idxSs, idxIn)
|
||||
}
|
||||
if args[idxSs+1] != "90.500" {
|
||||
t.Errorf("expected seek 90.500s, got %q", args[idxSs+1])
|
||||
}
|
||||
}
|
||||
|
||||
func TestTranscoderZeroValueLifecycle(t *testing.T) {
|
||||
var tr Transcoder
|
||||
if tr.IsClosing() {
|
||||
t.Errorf("zero-value Transcoder should not report IsClosing")
|
||||
}
|
||||
if tr.Stderr() != "" {
|
||||
t.Errorf("zero-value Stderr should be empty")
|
||||
}
|
||||
if err := tr.WaitErr(); err != nil {
|
||||
t.Errorf("WaitErr without started cmd should be nil, got %v", err)
|
||||
}
|
||||
if err := tr.Close(); err != nil {
|
||||
t.Errorf("Close without started cmd should be nil, got %v", err)
|
||||
}
|
||||
// Second Close is idempotent and must remain nil.
|
||||
if err := tr.Close(); err != nil {
|
||||
t.Errorf("repeat Close should be nil, got %v", err)
|
||||
}
|
||||
if !tr.IsClosing() {
|
||||
t.Errorf("after Close, IsClosing should be true")
|
||||
}
|
||||
if tr.Done() != nil {
|
||||
t.Errorf("Done() should be nil for never-started Transcoder")
|
||||
}
|
||||
}
|
||||
|
||||
func TestErrWriterCapturesStderr(t *testing.T) {
|
||||
tr := &Transcoder{}
|
||||
w := &errWriter{t: tr}
|
||||
n, err := w.Write([]byte("ffmpeg failed: bad codec"))
|
||||
if err != nil || n != 24 {
|
||||
t.Errorf("Write returned (%d,%v)", n, err)
|
||||
}
|
||||
if got := tr.Stderr(); got != "ffmpeg failed: bad codec" {
|
||||
t.Errorf("Stderr captured %q", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestErrWriterCapsBuffer(t *testing.T) {
|
||||
tr := &Transcoder{}
|
||||
w := &errWriter{t: tr}
|
||||
// Write a chunk under the cap, then a huge chunk: total should stop growing past 64KB.
|
||||
w.Write(make([]byte, 32*1024)) //nolint:errcheck
|
||||
w.Write(make([]byte, 32*1024)) //nolint:errcheck
|
||||
w.Write(make([]byte, 32*1024)) //nolint:errcheck
|
||||
if got := len(tr.Stderr()); got > 64*1024 {
|
||||
t.Errorf("stderr exceeded 64KB cap: %d bytes", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCoalesce(t *testing.T) {
|
||||
if got := coalesce("", "fallback"); got != "fallback" {
|
||||
t.Errorf("empty -> fallback, got %q", got)
|
||||
}
|
||||
if got := coalesce("value", "fallback"); got != "value" {
|
||||
t.Errorf("non-empty -> value, got %q", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildFFmpegArgsDownscale(t *testing.T) {
|
||||
args := buildFFmpegArgs("/tmp/movie.mkv", TranscodeOpts{
|
||||
Action: ActionTranscodeVideo,
|
||||
HWAccel: HWAccelNone,
|
||||
MaxHeight: 720,
|
||||
FFmpegPath: "ffmpeg",
|
||||
})
|
||||
hasVF := false
|
||||
for i := 0; i < len(args)-1; i++ {
|
||||
if args[i] == "-vf" && strings.Contains(args[i+1], "720") {
|
||||
hasVF = true
|
||||
}
|
||||
}
|
||||
if !hasVF {
|
||||
t.Errorf("expected -vf scale containing 720; args=%v", args)
|
||||
}
|
||||
}
|
||||
|
|
@ -2,7 +2,6 @@ package engine
|
|||
|
||||
import (
|
||||
"context"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
|
@ -75,63 +74,3 @@ func TestUsenetDownloader_Pause_NonExistent(t *testing.T) {
|
|||
t.Errorf("Pause non-existent task = %v, want nil", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUsenetDownloader_MethodAndAvailable(t *testing.T) {
|
||||
u := NewUsenetDownloader(agent.NewClient("http://localhost", "", "test"))
|
||||
if got := u.Method(); got != MethodUsenet {
|
||||
t.Errorf("Method = %v, want %v", got, MethodUsenet)
|
||||
}
|
||||
|
||||
// Disabled → never available, no error.
|
||||
u.SetEnabled(false)
|
||||
ok, err := u.Available(context.Background(), &Task{Title: "Foo"})
|
||||
if err != nil || ok {
|
||||
t.Errorf("disabled Available = (%v,%v), want (false,nil)", ok, err)
|
||||
}
|
||||
|
||||
u.SetEnabled(true)
|
||||
// No IMDb / no title → not available, no error.
|
||||
ok, err = u.Available(context.Background(), &Task{})
|
||||
if err != nil || ok {
|
||||
t.Errorf("empty task Available = (%v,%v), want (false,nil)", ok, err)
|
||||
}
|
||||
|
||||
// Pre-resolved NzbID → available immediately.
|
||||
ok, err = u.Available(context.Background(), &Task{NzbID: "preresolved", Title: "Bar"})
|
||||
if err != nil || !ok {
|
||||
t.Errorf("preresolved NzbID Available = (%v,%v), want (true,nil)", ok, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUsenetDownloader_Shutdown(t *testing.T) {
|
||||
u := NewUsenetDownloader(agent.NewClient("http://localhost", "", "test"))
|
||||
// Inject a fake active download — Shutdown should cancel it and clear the map.
|
||||
_, cancel := context.WithCancel(context.Background())
|
||||
u.active["t1"] = &activeDownload{cancel: cancel}
|
||||
if err := u.Shutdown(context.Background()); err != nil {
|
||||
t.Errorf("Shutdown = %v, want nil", err)
|
||||
}
|
||||
if len(u.active) != 0 {
|
||||
t.Errorf("Shutdown should clear active downloads, got %d", len(u.active))
|
||||
}
|
||||
}
|
||||
|
||||
func TestSanitizeDir(t *testing.T) {
|
||||
cases := map[string]string{
|
||||
"": "usenet_download",
|
||||
"normal_name": "normal_name",
|
||||
"path/with/slashes": "path_with_slashes",
|
||||
`win\\bad:name*?"<>|`: "win__bad_name______",
|
||||
"con:tains/all\\bad?chars*": "con_tains_all_bad_chars_",
|
||||
}
|
||||
for in, want := range cases {
|
||||
if got := sanitizeDir(in); got != want {
|
||||
t.Errorf("sanitizeDir(%q) = %q, want %q", in, got, want)
|
||||
}
|
||||
}
|
||||
|
||||
long := strings.Repeat("a", 300)
|
||||
if got := sanitizeDir(long); len(got) != 200 {
|
||||
t.Errorf("expected sanitizeDir to truncate to 200, got %d", len(got))
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,97 +0,0 @@
|
|||
package engine
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestBuildHLSFFmpegArgsVAAPI(t *testing.T) {
|
||||
cfg := HLSSessionConfig{
|
||||
SessionID: "test",
|
||||
SourcePath: "/tmp/test.mkv",
|
||||
Quality: "720p",
|
||||
AudioIndex: 0,
|
||||
Transcode: TranscodeRuntime{
|
||||
FFmpegPath: "/usr/bin/ffmpeg",
|
||||
FFprobePath: "/usr/bin/ffprobe",
|
||||
HWAccel: HWAccelVAAPI,
|
||||
},
|
||||
}
|
||||
probe := &StreamProbe{Width: 1920, Height: 1080, DurationSec: 100}
|
||||
args := buildHLSFFmpegArgsAt(cfg, probe, "/tmp/tmpdir", 0, 0)
|
||||
got := strings.Join(args, " ")
|
||||
|
||||
wants := []string{
|
||||
"-hwaccel vaapi",
|
||||
"-vaapi_device /dev/dri/renderD128",
|
||||
"-c:v h264_vaapi",
|
||||
"format=nv12",
|
||||
"hwupload",
|
||||
}
|
||||
for _, want := range wants {
|
||||
if !strings.Contains(got, want) {
|
||||
t.Errorf("argv missing %q\n%s", want, got)
|
||||
}
|
||||
}
|
||||
if strings.Contains(got, "scale_vaapi") {
|
||||
t.Errorf("argv unexpectedly contains scale_vaapi (mesa bug): %s", got)
|
||||
}
|
||||
if strings.Contains(got, "format=yuv420p") {
|
||||
t.Errorf("argv contains format=yuv420p (libx264 path) for VAAPI codec: %s", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildHLSFFmpegArgsLibx264NoRegression(t *testing.T) {
|
||||
cfg := HLSSessionConfig{
|
||||
SessionID: "test",
|
||||
SourcePath: "/tmp/test.mkv",
|
||||
Quality: "720p",
|
||||
AudioIndex: 0,
|
||||
Transcode: TranscodeRuntime{
|
||||
FFmpegPath: "/usr/bin/ffmpeg",
|
||||
FFprobePath: "/usr/bin/ffprobe",
|
||||
HWAccel: HWAccelNone,
|
||||
},
|
||||
}
|
||||
probe := &StreamProbe{Width: 1920, Height: 1080, DurationSec: 100}
|
||||
args := buildHLSFFmpegArgsAt(cfg, probe, "/tmp/tmpdir", 0, 0)
|
||||
got := strings.Join(args, " ")
|
||||
for _, want := range []string{"-c:v libx264", "format=yuv420p", "setparams=colorspace=bt709"} {
|
||||
if !strings.Contains(got, want) {
|
||||
t.Errorf("libx264 argv missing %q: %s", want, got)
|
||||
}
|
||||
}
|
||||
for _, bad := range []string{"-vaapi_device", "format=nv12", "hwupload"} {
|
||||
if strings.Contains(got, bad) {
|
||||
t.Errorf("libx264 argv unexpectedly contains %q: %s", bad, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestBuildHLSFFmpegArgsVAAPIDump prints the full argv buildHLSFFmpegArgsAt
|
||||
// emits for a typical VAAPI session. Mimics the daemon spawn step so the
|
||||
// operator can verify the ffmpeg command-line shape without booting the
|
||||
// stack — equivalent to `journalctl --user -u unarr-dev | grep ffmpeg`
|
||||
// but without waiting for a real player session.
|
||||
func TestBuildHLSFFmpegArgsVAAPIDump(t *testing.T) {
|
||||
cfg := HLSSessionConfig{
|
||||
SessionID: "vaapi-smoke",
|
||||
SourcePath: "/mnt/nas/peliculas/sample.mkv",
|
||||
Quality: "720p",
|
||||
AudioIndex: -1,
|
||||
Transcode: TranscodeRuntime{
|
||||
FFmpegPath: "/usr/bin/ffmpeg",
|
||||
FFprobePath: "/usr/bin/ffprobe",
|
||||
HWAccel: HWAccelVAAPI,
|
||||
},
|
||||
}
|
||||
probe := &StreamProbe{
|
||||
VideoCodec: "hevc",
|
||||
Width: 3840,
|
||||
Height: 2160,
|
||||
DurationSec: 5400,
|
||||
AudioTracks: []ProbeAudioTrack{{Index: 0, Lang: "en", Codec: "ac3"}},
|
||||
}
|
||||
args := buildHLSFFmpegArgsAt(cfg, probe, "/tmp/smoke-tmpdir", 0, 0)
|
||||
t.Logf("ffmpeg %s", strings.Join(args, " "))
|
||||
}
|
||||
|
|
@ -1,63 +0,0 @@
|
|||
// Package engine — validate.go centralises input validators used by the
|
||||
// stream/HLS HTTP handlers and the daemon glue. Keep new validators in this
|
||||
// file so a future reviewer can audit the trust boundary in one place.
|
||||
package engine
|
||||
|
||||
import "regexp"
|
||||
|
||||
// validSessionID restricts session IDs to characters safe for use as a single
|
||||
// filesystem path component. Server-issued UUIDs and hex strings match this;
|
||||
// anything containing slashes, dots, or path separators is rejected so a
|
||||
// compromised or buggy server cannot escape hlsTmpDirRoot via os.MkdirAll.
|
||||
var validSessionID = regexp.MustCompile(`^[a-zA-Z0-9_-]{1,128}$`)
|
||||
|
||||
// defaultCORSAllowedOrigins is the baseline of browser origins that may
|
||||
// XHR-probe `/health` and friends on the local daemon. Production hosts are
|
||||
// hardcoded; localhost on the dev port used by torrentclaw-web is included
|
||||
// so dev builds work without extra configuration. Operators may add more
|
||||
// origins via the [downloads] cors_extra_origins TOML key.
|
||||
//
|
||||
// The dev port matches `next dev -p 3030` in torrentclaw-web/package.json.
|
||||
// 127.0.0.1 is listed in addition to localhost because some browsers treat
|
||||
// them as distinct origins for CORS.
|
||||
//
|
||||
// Mirrors (`.to`, `staging.torrentclaw.com`, `www.`) are listed so a user
|
||||
// playing from any official mirror succeeds the HEAD probe; without these
|
||||
// the browser drops the response for "missing ACAO" and the player reports
|
||||
// "404 todos los canales" even though the daemon returned 200.
|
||||
//
|
||||
// Note: media tags (<video src>, <audio src>) do not send the Origin
|
||||
// header so they are not gated by CORS at all; this allowlist only
|
||||
// affects fetch()/XHR.
|
||||
var defaultCORSAllowedOrigins = []string{
|
||||
"https://torrentclaw.com",
|
||||
"https://www.torrentclaw.com",
|
||||
"https://app.torrentclaw.com",
|
||||
"https://staging.torrentclaw.com",
|
||||
"https://torrentclaw.to",
|
||||
"https://www.torrentclaw.to",
|
||||
// Tor mirror — Tor Browser sends `Origin: http://<addr>.onion` (plain
|
||||
// http, no port). Mirror address is the BUILT_IN_ONION constant from
|
||||
// torrentclaw-web/src/lib/mirrors-config.ts; rotates rarely, kept in
|
||||
// sync by hand. Daemon also dynamically merges /api/mirrors at startup
|
||||
// (see daemon.go) so a new key doesn't need a CLI rebuild.
|
||||
"http://torrentf3aifidcsaaanmnmuhv2s53r6hqsl3zkmfidiaxainkeqk5id.onion",
|
||||
"http://localhost:3030",
|
||||
"http://127.0.0.1:3030",
|
||||
}
|
||||
|
||||
// buildCORSAllowlist merges the default origins with any extras supplied by
|
||||
// the operator. Returned map is intended to be installed once at Listen()
|
||||
// and treated as read-only afterwards.
|
||||
func buildCORSAllowlist(extra []string) map[string]struct{} {
|
||||
out := make(map[string]struct{}, len(defaultCORSAllowedOrigins)+len(extra))
|
||||
for _, o := range defaultCORSAllowedOrigins {
|
||||
out[o] = struct{}{}
|
||||
}
|
||||
for _, o := range extra {
|
||||
if o != "" {
|
||||
out[o] = struct{}{}
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
|
@ -2,16 +2,10 @@ package engine
|
|||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/torrentclaw/unarr/internal/agent"
|
||||
)
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
|
|
@ -75,105 +69,6 @@ func TestMaxByteOffsetNeverRegresses(t *testing.T) {
|
|||
// End-to-end: real HTTP server with Range requests
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// WatchReporter.sendReport via the agent API
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
func TestWatchReporter_NewWatchReporter(t *testing.T) {
|
||||
c := agent.NewClient("http://localhost", "", "test")
|
||||
ss := &StreamServer{}
|
||||
wr := NewWatchReporter(c, ss, "task-1")
|
||||
if wr.taskID != "task-1" || wr.client != c || wr.server != ss {
|
||||
t.Errorf("NewWatchReporter fields not wired: %+v", wr)
|
||||
}
|
||||
}
|
||||
|
||||
func TestWatchReporter_sendReportSkipsZeroProgress(t *testing.T) {
|
||||
var hits atomic.Int32
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
||||
hits.Add(1)
|
||||
_ = json.NewEncoder(w).Encode(map[string]any{"ok": true})
|
||||
}))
|
||||
defer srv.Close()
|
||||
|
||||
ss := &StreamServer{}
|
||||
// totalFileSize == 0 → EstimatedProgress returns (0, 0) → sendReport skips.
|
||||
c := agent.NewClient(srv.URL, "", "test")
|
||||
wr := NewWatchReporter(c, ss, "task-1")
|
||||
wr.sendReport(context.Background())
|
||||
if hits.Load() != 0 {
|
||||
t.Errorf("expected no API calls when progress=0, got %d", hits.Load())
|
||||
}
|
||||
}
|
||||
|
||||
func TestWatchReporter_sendReportPostsProgress(t *testing.T) {
|
||||
var captured atomic.Pointer[agent.WatchProgressUpdate]
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
var update agent.WatchProgressUpdate
|
||||
_ = json.NewDecoder(r.Body).Decode(&update)
|
||||
captured.Store(&update)
|
||||
_, _ = w.Write([]byte(`{"ok":true}`))
|
||||
}))
|
||||
defer srv.Close()
|
||||
|
||||
ss := &StreamServer{}
|
||||
ss.totalFileSize.Store(1000)
|
||||
ss.maxByteOffset.Store(250) // 25%
|
||||
ss.durationSec.Store(120)
|
||||
|
||||
c := agent.NewClient(srv.URL, "", "test")
|
||||
wr := NewWatchReporter(c, ss, "task-12345678")
|
||||
wr.sendReport(context.Background())
|
||||
|
||||
got := captured.Load()
|
||||
if got == nil {
|
||||
t.Fatal("expected a watch-progress POST")
|
||||
}
|
||||
if got.TaskID != "task-12345678" {
|
||||
t.Errorf("TaskID = %q", got.TaskID)
|
||||
}
|
||||
if got.Progress == nil || *got.Progress != 25 {
|
||||
t.Errorf("Progress = %v, want 25", got.Progress)
|
||||
}
|
||||
if got.Duration == nil || *got.Duration != 120 {
|
||||
t.Errorf("Duration = %v, want 120", got.Duration)
|
||||
}
|
||||
if got.Position == nil || *got.Position != 30 {
|
||||
t.Errorf("Position = %v, want 30", got.Position)
|
||||
}
|
||||
|
||||
// Repeat report at same percentage — should NOT POST again.
|
||||
captured.Store(nil)
|
||||
wr.sendReport(context.Background())
|
||||
if captured.Load() != nil {
|
||||
t.Errorf("repeat sendReport at same pct should be a no-op")
|
||||
}
|
||||
}
|
||||
|
||||
func TestWatchReporter_RunStopsOnContextCancel(t *testing.T) {
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
||||
_, _ = w.Write([]byte(`{"ok":true}`))
|
||||
}))
|
||||
defer srv.Close()
|
||||
|
||||
ss := &StreamServer{}
|
||||
c := agent.NewClient(srv.URL, "", "test")
|
||||
wr := NewWatchReporter(c, ss, "task-x")
|
||||
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
done := make(chan struct{})
|
||||
go func() {
|
||||
wr.Run(ctx)
|
||||
close(done)
|
||||
}()
|
||||
cancel()
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("Run did not return after context cancellation")
|
||||
}
|
||||
}
|
||||
|
||||
func TestStreamServerByteTracking(t *testing.T) {
|
||||
// Create temp file (10 KB)
|
||||
tmpFile := t.TempDir() + "/test.mp4"
|
||||
|
|
@ -185,7 +80,8 @@ func TestStreamServerByteTracking(t *testing.T) {
|
|||
t.Fatal(err)
|
||||
}
|
||||
|
||||
srv := NewStreamServer(0) // UPnP off by default — keep test hermetic
|
||||
srv := NewStreamServer(0)
|
||||
srv.disableUPnP = true
|
||||
ctx := context.Background()
|
||||
if err := srv.Listen(ctx); err != nil {
|
||||
t.Fatalf("listen: %v", err)
|
||||
|
|
|
|||
|
|
@ -1,203 +0,0 @@
|
|||
// Package funnel manages the optional CloudFlare Quick Tunnel subprocess
|
||||
// that gives the daemon a public HTTPS hostname for cross-network playback
|
||||
// from browser-based clients (web player on torrentclaw.com / torrentclaw.to).
|
||||
//
|
||||
// Why: HTTPS pages can't fetch HTTP resources (mixed content). Without a
|
||||
// tunnel the daemon is only reachable from the same machine (localhost is
|
||||
// exempt) or via Tailscale (which users can install themselves but most
|
||||
// won't). CF Quick Tunnels are anonymous — no CF account, no DNS, no port
|
||||
// forwarding — and assign a one-shot `https://<random>.trycloudflare.com`
|
||||
// URL. Bytes flow through CF, never through our infra (legal posture: we
|
||||
// don't relay; CF does).
|
||||
//
|
||||
// Lifecycle:
|
||||
//
|
||||
// t, err := funnel.Start(ctx, funnel.Config{Port: 11819})
|
||||
// defer t.Close()
|
||||
// url, err := t.WaitURL(30 * time.Second) // blocks until cloudflared emits the URL
|
||||
//
|
||||
// The tunnel runs until the context is cancelled or t.Close() is called.
|
||||
package funnel
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os/exec"
|
||||
"regexp"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
// urlPattern matches the `https://<random>.trycloudflare.com` URL cloudflared
|
||||
// prints when a Quick Tunnel is registered. Quick Tunnel hostnames are always
|
||||
// several hyphen-joined dictionary words (e.g.
|
||||
// `make-appointments-negotiation-blacks`), so we require at least one hyphen.
|
||||
// This deliberately excludes cloudflared's control-plane endpoint
|
||||
// `https://api.trycloudflare.com`, which appears earlier in the log stream — a
|
||||
// permissive `[a-z0-9-]+` matched `api` first and we advertised a dead URL.
|
||||
var urlPattern = regexp.MustCompile(`https://[a-z0-9]+(?:-[a-z0-9]+)+\.trycloudflare\.com`)
|
||||
|
||||
// Config controls how the tunnel is launched.
|
||||
type Config struct {
|
||||
// Port is the local upstream port cloudflared will tunnel to. Required.
|
||||
Port int
|
||||
// Binary is the cloudflared executable path. When empty the package looks
|
||||
// it up via $PATH.
|
||||
Binary string
|
||||
}
|
||||
|
||||
// Tunnel is a handle on a running cloudflared Quick Tunnel.
|
||||
type Tunnel struct {
|
||||
cmd *exec.Cmd
|
||||
cancel context.CancelFunc
|
||||
urlCh chan string
|
||||
exitCh chan error
|
||||
mu sync.Mutex
|
||||
url string
|
||||
stopped bool
|
||||
}
|
||||
|
||||
// Start launches cloudflared as a subprocess. The returned *Tunnel exposes the
|
||||
// public URL via WaitURL once cloudflared registers it (usually 2–5 s).
|
||||
//
|
||||
// The subprocess inherits the cancellation of the supplied context. Closing
|
||||
// the *Tunnel sends SIGTERM and waits for the subprocess to exit.
|
||||
func Start(ctx context.Context, cfg Config) (*Tunnel, error) {
|
||||
if cfg.Port <= 0 {
|
||||
return nil, fmt.Errorf("funnel: invalid Port %d", cfg.Port)
|
||||
}
|
||||
binary := cfg.Binary
|
||||
if binary == "" {
|
||||
resolved, err := ResolveBinary()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
binary = resolved
|
||||
}
|
||||
|
||||
subCtx, cancel := context.WithCancel(ctx)
|
||||
// `--no-autoupdate` disables cloudflared's daily self-update check (the
|
||||
// daemon manages binary rotation). `--metrics 127.0.0.1:0` suppresses the
|
||||
// default `:9090` listener that would collide on a shared box.
|
||||
cmd := exec.CommandContext(subCtx, binary,
|
||||
"tunnel",
|
||||
"--no-autoupdate",
|
||||
"--metrics", "127.0.0.1:0",
|
||||
"--url", fmt.Sprintf("http://localhost:%d", cfg.Port),
|
||||
)
|
||||
|
||||
// cloudflared writes the connect log + assigned URL to stderr.
|
||||
stderr, err := cmd.StderrPipe()
|
||||
if err != nil {
|
||||
cancel()
|
||||
return nil, fmt.Errorf("funnel: pipe stderr: %w", err)
|
||||
}
|
||||
cmd.Stdout = io.Discard // quick tunnels print nothing useful on stdout
|
||||
|
||||
if err := cmd.Start(); err != nil {
|
||||
cancel()
|
||||
return nil, fmt.Errorf("funnel: start cloudflared: %w", err)
|
||||
}
|
||||
|
||||
t := &Tunnel{
|
||||
cmd: cmd,
|
||||
cancel: cancel,
|
||||
urlCh: make(chan string, 1),
|
||||
exitCh: make(chan error, 1),
|
||||
}
|
||||
|
||||
// Reader goroutine: scan cloudflared's stderr for the URL, surface the
|
||||
// rest as a single string we don't try to interpret.
|
||||
go t.scanStderr(stderr)
|
||||
|
||||
// Waiter goroutine: signal exit so callers can react (e.g. restart).
|
||||
go func() {
|
||||
t.exitCh <- cmd.Wait()
|
||||
}()
|
||||
|
||||
return t, nil
|
||||
}
|
||||
|
||||
// WaitURL blocks until cloudflared has registered the tunnel and emitted the
|
||||
// public URL, or `timeout` elapses, or the subprocess exits. The returned URL
|
||||
// has the form `https://<random>.trycloudflare.com`.
|
||||
func (t *Tunnel) WaitURL(timeout time.Duration) (string, error) {
|
||||
t.mu.Lock()
|
||||
if t.url != "" {
|
||||
u := t.url
|
||||
t.mu.Unlock()
|
||||
return u, nil
|
||||
}
|
||||
t.mu.Unlock()
|
||||
|
||||
select {
|
||||
case u := <-t.urlCh:
|
||||
return u, nil
|
||||
case err := <-t.exitCh:
|
||||
if err == nil {
|
||||
return "", errors.New("funnel: cloudflared exited before URL")
|
||||
}
|
||||
return "", fmt.Errorf("funnel: cloudflared exited: %w", err)
|
||||
case <-time.After(timeout):
|
||||
return "", fmt.Errorf("funnel: timed out waiting for URL after %s", timeout)
|
||||
}
|
||||
}
|
||||
|
||||
// URL returns the assigned tunnel URL, or "" if not yet emitted.
|
||||
func (t *Tunnel) URL() string {
|
||||
t.mu.Lock()
|
||||
defer t.mu.Unlock()
|
||||
return t.url
|
||||
}
|
||||
|
||||
// Done returns a channel that closes once the subprocess exits. The error sent
|
||||
// before close describes the exit reason (nil = clean shutdown via Close).
|
||||
func (t *Tunnel) Done() <-chan error {
|
||||
return t.exitCh
|
||||
}
|
||||
|
||||
// Close terminates the subprocess and waits for it to exit. Safe to call
|
||||
// multiple times.
|
||||
func (t *Tunnel) Close() error {
|
||||
t.mu.Lock()
|
||||
if t.stopped {
|
||||
t.mu.Unlock()
|
||||
return nil
|
||||
}
|
||||
t.stopped = true
|
||||
t.mu.Unlock()
|
||||
t.cancel()
|
||||
// Drain the exit channel so the Wait goroutine doesn't leak.
|
||||
select {
|
||||
case <-t.exitCh:
|
||||
case <-time.After(5 * time.Second):
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (t *Tunnel) scanStderr(r io.Reader) {
|
||||
scanner := bufio.NewScanner(r)
|
||||
// Some cloudflared lines exceed the default 64KiB scanner buffer (when it
|
||||
// prints connection diagnostics). Bump to 1MiB.
|
||||
scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
|
||||
for scanner.Scan() {
|
||||
line := scanner.Text()
|
||||
if t.URL() == "" {
|
||||
if m := urlPattern.FindString(line); m != "" {
|
||||
t.mu.Lock()
|
||||
t.url = m
|
||||
t.mu.Unlock()
|
||||
// Non-blocking send: if no one is listening, just drop —
|
||||
// the URL field carries the value for any later WaitURL call.
|
||||
select {
|
||||
case t.urlCh <- m:
|
||||
default:
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
package funnel
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestURLPattern(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
line string
|
||||
want string
|
||||
}{
|
||||
{
|
||||
name: "real quick tunnel banner",
|
||||
line: "2026-05-29T22:18:33Z INF | https://make-appointments-negotiation-blacks.trycloudflare.com |",
|
||||
want: "https://make-appointments-negotiation-blacks.trycloudflare.com",
|
||||
},
|
||||
{
|
||||
name: "two-word hostname",
|
||||
line: "https://blue-river.trycloudflare.com is ready",
|
||||
want: "https://blue-river.trycloudflare.com",
|
||||
},
|
||||
{
|
||||
name: "control-plane api endpoint is ignored",
|
||||
line: `2026-05-29T22:17:59Z DBG POST https://api.trycloudflare.com/tunnel`,
|
||||
want: "",
|
||||
},
|
||||
{
|
||||
name: "no trycloudflare url",
|
||||
line: "2026-05-29T22:17:44Z INF Requesting new quick Tunnel on trycloudflare.com...",
|
||||
want: "",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
if got := urlPattern.FindString(tc.line); got != tc.want {
|
||||
t.Fatalf("FindString(%q) = %q, want %q", tc.line, got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
|
@ -1,167 +0,0 @@
|
|||
package funnel
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"time"
|
||||
|
||||
"github.com/torrentclaw/unarr/internal/config"
|
||||
)
|
||||
|
||||
// ResolveBinary returns the path to a usable cloudflared executable, downloading
|
||||
// one into the unarr data dir if neither $PATH nor the cached location has it.
|
||||
// This makes the funnel feature usable on headless installs (NAS / Docker)
|
||||
// where the user can't easily install cloudflared via the OS package manager.
|
||||
//
|
||||
// Resolution order:
|
||||
//
|
||||
// 1. cloudflared on $PATH (operator already installed it)
|
||||
// 2. <data-dir>/bin/cloudflared (we cached it on a previous run)
|
||||
// 3. download from GitHub releases (Linux-only fallback; macOS / Windows
|
||||
// return a clear error pointing at brew / winget)
|
||||
func ResolveBinary() (string, error) {
|
||||
if p, err := exec.LookPath("cloudflared"); err == nil {
|
||||
return p, nil
|
||||
}
|
||||
cached := cachedBinaryPath()
|
||||
if _, err := os.Stat(cached); err == nil {
|
||||
return cached, nil
|
||||
}
|
||||
return downloadCloudflared(cached)
|
||||
}
|
||||
|
||||
func cachedBinaryPath() string {
|
||||
name := "cloudflared"
|
||||
if runtime.GOOS == "windows" {
|
||||
name += ".exe"
|
||||
}
|
||||
return filepath.Join(config.DataDir(), "bin", name)
|
||||
}
|
||||
|
||||
// downloadCloudflared fetches the latest cloudflared release asset matching
|
||||
// the current GOOS/GOARCH into `dest`. Linux only — macOS/Windows return a
|
||||
// pointer at the OS package manager.
|
||||
//
|
||||
// Supply-chain caveat: we trust GitHub-over-TLS + cloudflare/cloudflared
|
||||
// repo integrity. The fetch is over HTTPS to api.github.com's release-asset
|
||||
// redirector, so a network MITM is bounded by Let's Encrypt + GitHub's cert
|
||||
// chain. We additionally verify the file is an ELF binary (Linux magic
|
||||
// bytes) so a generic 404 HTML page or a wrong-arch tarball is rejected at
|
||||
// rest. We do NOT verify a signature because Cloudflare doesn't sign release
|
||||
// assets at the moment — if you need stricter integrity, install cloudflared
|
||||
// from your distro's package manager (apt/brew/winget) and unarr will use
|
||||
// the PATH copy.
|
||||
func downloadCloudflared(dest string) (string, error) {
|
||||
if runtime.GOOS != "linux" {
|
||||
return "", fmt.Errorf("funnel: auto-download not supported on %s — install cloudflared manually or drop a binary at %s", runtime.GOOS, dest)
|
||||
}
|
||||
|
||||
var asset string
|
||||
switch runtime.GOARCH {
|
||||
case "amd64":
|
||||
asset = "cloudflared-linux-amd64"
|
||||
case "arm64":
|
||||
asset = "cloudflared-linux-arm64"
|
||||
case "arm":
|
||||
asset = "cloudflared-linux-armhf"
|
||||
case "386":
|
||||
asset = "cloudflared-linux-386"
|
||||
default:
|
||||
return "", fmt.Errorf("funnel: unsupported linux arch %q — install cloudflared manually", runtime.GOARCH)
|
||||
}
|
||||
|
||||
url := "https://github.com/cloudflare/cloudflared/releases/latest/download/" + asset
|
||||
if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
|
||||
return "", fmt.Errorf("funnel: create bin dir: %w", err)
|
||||
}
|
||||
|
||||
// O_EXCL so concurrent unarr-dev / prod daemons don't clobber each
|
||||
// other's partial download. The loser gets EEXIST → falls back to
|
||||
// polling for the winner to finish.
|
||||
tmp := dest + ".partial"
|
||||
out, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o755)
|
||||
if err != nil {
|
||||
if errors.Is(err, os.ErrExist) {
|
||||
// Another process is downloading. Wait briefly for them to finish.
|
||||
for range 60 {
|
||||
time.Sleep(time.Second)
|
||||
if _, statErr := os.Stat(dest); statErr == nil {
|
||||
return dest, nil
|
||||
}
|
||||
}
|
||||
return "", fmt.Errorf("funnel: another download in progress at %s (timed out)", tmp)
|
||||
}
|
||||
return "", fmt.Errorf("funnel: open dest: %w", err)
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: 5 * time.Minute}
|
||||
resp, err := client.Get(url)
|
||||
if err != nil {
|
||||
_ = out.Close()
|
||||
_ = os.Remove(tmp)
|
||||
return "", fmt.Errorf("funnel: download cloudflared: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
_ = out.Close()
|
||||
_ = os.Remove(tmp)
|
||||
return "", fmt.Errorf("funnel: download cloudflared: HTTP %d from %s", resp.StatusCode, url)
|
||||
}
|
||||
|
||||
if _, err := io.Copy(out, resp.Body); err != nil {
|
||||
_ = out.Close()
|
||||
_ = os.Remove(tmp)
|
||||
return "", fmt.Errorf("funnel: write dest: %w", err)
|
||||
}
|
||||
if err := out.Close(); err != nil {
|
||||
_ = os.Remove(tmp)
|
||||
return "", fmt.Errorf("funnel: close dest: %w", err)
|
||||
}
|
||||
|
||||
// Sanity check before promoting <partial> to <dest>: must be a Linux
|
||||
// ELF executable (rejects 404 HTML pages or wrong-arch payloads) and at
|
||||
// least 1 MB (real cloudflared is ~50 MB; anything smaller is corrupt).
|
||||
if err := verifyLinuxElf(tmp); err != nil {
|
||||
_ = os.Remove(tmp)
|
||||
return "", fmt.Errorf("funnel: downloaded file failed sanity check: %w", err)
|
||||
}
|
||||
|
||||
if err := os.Rename(tmp, dest); err != nil {
|
||||
_ = os.Remove(tmp)
|
||||
return "", fmt.Errorf("funnel: rename dest: %w", err)
|
||||
}
|
||||
return dest, nil
|
||||
}
|
||||
|
||||
// verifyLinuxElf returns nil when the file at `path` starts with the ELF
|
||||
// magic bytes and is at least 1 MB. Used as a low-cost guard against
|
||||
// downloading an HTML error page or a wrong-arch payload.
|
||||
func verifyLinuxElf(path string) error {
|
||||
st, err := os.Stat(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if st.Size() < 1024*1024 {
|
||||
return errors.New("file is suspiciously small (<1 MB)")
|
||||
}
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer f.Close()
|
||||
head := make([]byte, 4)
|
||||
if _, err := io.ReadFull(f, head); err != nil {
|
||||
return fmt.Errorf("read magic bytes: %w", err)
|
||||
}
|
||||
if !bytes.Equal(head, []byte{0x7f, 'E', 'L', 'F'}) {
|
||||
return errors.New("not an ELF binary")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
|
@ -1,79 +0,0 @@
|
|||
package mediainfo
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
)
|
||||
|
||||
// ResolveFFmpeg finds the ffmpeg binary. Search order mirrors ResolveFFprobe
|
||||
// so the same operator setup works for both:
|
||||
// 1. Explicit path (--ffmpeg flag / library.ffmpeg_path config)
|
||||
// 2. FFMPEG_PATH env var
|
||||
// 3. "ffmpeg" on PATH
|
||||
// 4. Adjacent to the current executable (release tarball bundles ffmpeg
|
||||
// next to the unarr binary — this is the preferred install path)
|
||||
// 5. Previously downloaded in the unarr cache dir
|
||||
// 6. Auto-download static binary as last resort (~50MB, slow start)
|
||||
//
|
||||
// ffmpeg is required for the HLS streaming pipeline; ffprobe alone can't
|
||||
// transcode HEVC/MKV to browser-friendly H.264/MP4 fragments.
|
||||
func ResolveFFmpeg(explicit string) (string, error) {
|
||||
if explicit != "" {
|
||||
if _, err := os.Stat(explicit); err == nil {
|
||||
return explicit, nil
|
||||
}
|
||||
return "", fmt.Errorf("ffmpeg not found at explicit path: %s", explicit)
|
||||
}
|
||||
|
||||
if envPath := os.Getenv("FFMPEG_PATH"); envPath != "" {
|
||||
if _, err := os.Stat(envPath); err == nil {
|
||||
return envPath, nil
|
||||
}
|
||||
}
|
||||
|
||||
if p, err := exec.LookPath("ffmpeg"); err == nil {
|
||||
return p, nil
|
||||
}
|
||||
|
||||
if exePath, err := os.Executable(); err == nil {
|
||||
name := "ffmpeg"
|
||||
if runtime.GOOS == "windows" {
|
||||
name = "ffmpeg.exe"
|
||||
}
|
||||
adjacent := filepath.Join(filepath.Dir(exePath), name)
|
||||
if _, err := os.Stat(adjacent); err == nil {
|
||||
return adjacent, nil
|
||||
}
|
||||
}
|
||||
|
||||
if cached, err := FFmpegCachePath(); err == nil {
|
||||
if _, err := os.Stat(cached); err == nil {
|
||||
return cached, nil
|
||||
}
|
||||
}
|
||||
|
||||
if p, err := DownloadFFmpeg(); err == nil {
|
||||
return p, nil
|
||||
}
|
||||
|
||||
if isDocker() {
|
||||
return "", fmt.Errorf(
|
||||
"ffmpeg not found and auto-download failed (read-only filesystem?).\n" +
|
||||
"Options:\n" +
|
||||
" • Use the official image: torrentclaw/unarr (includes ffmpeg)\n" +
|
||||
" • Set FFMPEG_PATH env var to point to a pre-installed ffmpeg binary\n" +
|
||||
" • Add to config.toml: [library]\\nffmpeg_path = \"/path/to/ffmpeg\"",
|
||||
)
|
||||
}
|
||||
return "", fmt.Errorf(
|
||||
"ffmpeg not found and auto-download failed.\n" +
|
||||
"Options:\n" +
|
||||
" • Install ffmpeg: sudo apt install ffmpeg (or brew install ffmpeg)\n" +
|
||||
" • Use the unarr release tarball — ffmpeg is bundled next to the binary\n" +
|
||||
" • Set FFMPEG_PATH env var to point to the ffmpeg binary\n" +
|
||||
" • Add to config.toml: [library]\\nffmpeg_path = \"/path/to/ffmpeg\"",
|
||||
)
|
||||
}
|
||||
|
|
@ -1,116 +0,0 @@
|
|||
package mediainfo
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
)
|
||||
|
||||
const maxFFmpegZipSize = 200 * 1024 * 1024 // 200MB — ffmpeg static is ~70-100MB compressed
|
||||
|
||||
// FFmpegCachePath returns the full path to the cached ffmpeg binary
|
||||
// (sibling of the cached ffprobe binary).
|
||||
func FFmpegCachePath() (string, error) {
|
||||
dir, err := FFprobeCacheDir()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
name := "ffmpeg"
|
||||
if runtime.GOOS == "windows" {
|
||||
name = "ffmpeg.exe"
|
||||
}
|
||||
return filepath.Join(dir, name), nil
|
||||
}
|
||||
|
||||
// DownloadFFmpeg downloads a static ffmpeg binary for the current platform
|
||||
// and caches it locally. Returns the path to the binary. Reuses
|
||||
// resolveFFprobeURL's ffbinaries.com discovery endpoint — that index ships
|
||||
// both ffprobe and ffmpeg per platform.
|
||||
func DownloadFFmpeg() (string, error) {
|
||||
dest, err := FFmpegCachePath()
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("cannot determine cache path: %w", err)
|
||||
}
|
||||
|
||||
if _, err := os.Stat(dest); err == nil {
|
||||
return dest, nil
|
||||
}
|
||||
|
||||
platform, err := ffprobePlatformKey()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
url, err := resolveFFmpegURL(platform)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
fmt.Fprintf(os.Stderr, "ffmpeg not found — downloading for %s (~70MB)...\n", platform)
|
||||
|
||||
resp, err := ffprobeDLClient.Get(url)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("download failed: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return "", fmt.Errorf("download failed: HTTP %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
zipData, err := io.ReadAll(io.LimitReader(resp.Body, maxFFmpegZipSize))
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("download read failed: %w", err)
|
||||
}
|
||||
|
||||
name := "ffmpeg"
|
||||
if runtime.GOOS == "windows" {
|
||||
name = "ffmpeg.exe"
|
||||
}
|
||||
|
||||
binary, err := extractFromZip(zipData, name)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
|
||||
return "", fmt.Errorf("cannot create cache directory: %w", err)
|
||||
}
|
||||
|
||||
if err := os.WriteFile(dest, binary, 0o755); err != nil {
|
||||
return "", fmt.Errorf("cannot write ffmpeg binary: %w", err)
|
||||
}
|
||||
|
||||
fmt.Fprintf(os.Stderr, "ffmpeg installed to %s\n", dest)
|
||||
return dest, nil
|
||||
}
|
||||
|
||||
// resolveFFmpegURL fetches the ffbinaries index and returns the ffmpeg
|
||||
// download URL for the requested platform key (e.g. "linux-64").
|
||||
func resolveFFmpegURL(platform string) (string, error) {
|
||||
resp, err := ffprobeAPIClient.Get(ffbinariesAPI)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("cannot reach ffbinaries.com: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
var data ffbinariesResponse
|
||||
if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
|
||||
return "", fmt.Errorf("cannot parse ffbinaries response: %w", err)
|
||||
}
|
||||
|
||||
bins, ok := data.Bin[platform]
|
||||
if !ok {
|
||||
return "", fmt.Errorf("no ffmpeg binary available for platform %q", platform)
|
||||
}
|
||||
|
||||
url, ok := bins["ffmpeg"]
|
||||
if !ok {
|
||||
return "", fmt.Errorf("no ffmpeg download URL for platform %q", platform)
|
||||
}
|
||||
|
||||
return url, nil
|
||||
}
|
||||
|
|
@ -1,78 +0,0 @@
|
|||
package mediainfo
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestResolveFFmpeg_ExplicitOK verifies the explicit-path branch returns
|
||||
// the requested binary if it exists on disk.
|
||||
func TestResolveFFmpeg_ExplicitOK(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
fake := filepath.Join(dir, "ffmpeg")
|
||||
if err := os.WriteFile(fake, []byte("#!/bin/sh\n"), 0o755); err != nil {
|
||||
t.Fatalf("write fake: %v", err)
|
||||
}
|
||||
|
||||
got, err := ResolveFFmpeg(fake)
|
||||
if err != nil {
|
||||
t.Fatalf("ResolveFFmpeg(explicit): %v", err)
|
||||
}
|
||||
if got != fake {
|
||||
t.Fatalf("got %q want %q", got, fake)
|
||||
}
|
||||
}
|
||||
|
||||
// TestResolveFFmpeg_ExplicitMissing returns a clear error when the path
|
||||
// the operator supplied doesn't exist — we do NOT silently fall back.
|
||||
func TestResolveFFmpeg_ExplicitMissing(t *testing.T) {
|
||||
_, err := ResolveFFmpeg("/nonexistent/path/ffmpeg-XXXXXX")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for missing explicit path")
|
||||
}
|
||||
}
|
||||
|
||||
// TestResolveFFmpeg_EnvVar honours FFMPEG_PATH when no explicit path is given.
|
||||
func TestResolveFFmpeg_EnvVar(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
fake := filepath.Join(dir, "ffmpeg")
|
||||
if err := os.WriteFile(fake, []byte("#!/bin/sh\n"), 0o755); err != nil {
|
||||
t.Fatalf("write fake: %v", err)
|
||||
}
|
||||
t.Setenv("FFMPEG_PATH", fake)
|
||||
// Hide the real ffmpeg from PATH so the env var is the next branch hit.
|
||||
t.Setenv("PATH", "/nonexistent")
|
||||
|
||||
got, err := ResolveFFmpeg("")
|
||||
if err != nil {
|
||||
t.Fatalf("ResolveFFmpeg(env): %v", err)
|
||||
}
|
||||
if got != fake {
|
||||
t.Fatalf("got %q want %q (env-var branch)", got, fake)
|
||||
}
|
||||
}
|
||||
|
||||
// TestFFmpegCachePath returns a sibling path to the ffprobe cache,
|
||||
// consistent with the install layout the tarball produces.
|
||||
func TestFFmpegCachePath(t *testing.T) {
|
||||
got, err := FFmpegCachePath()
|
||||
if err != nil {
|
||||
t.Fatalf("FFmpegCachePath: %v", err)
|
||||
}
|
||||
want := "ffmpeg"
|
||||
if runtime.GOOS == "windows" {
|
||||
want = "ffmpeg.exe"
|
||||
}
|
||||
if filepath.Base(got) != want {
|
||||
t.Fatalf("cache path basename = %q want %q", filepath.Base(got), want)
|
||||
}
|
||||
probeCache, err := FFprobeCachePath()
|
||||
if err != nil {
|
||||
t.Fatalf("FFprobeCachePath: %v", err)
|
||||
}
|
||||
if filepath.Dir(got) != filepath.Dir(probeCache) {
|
||||
t.Fatalf("ffmpeg cache (%s) and ffprobe cache (%s) should share a directory", got, probeCache)
|
||||
}
|
||||
}
|
||||
|
|
@ -13,17 +13,8 @@ var (
|
|||
altEpRegex = regexp.MustCompile(`(?i)(\d{1,2})x(\d{2})`)
|
||||
)
|
||||
|
||||
// ResolveResolution maps video dimensions to a standard resolution label.
|
||||
// Uses both width and height so cinematic aspect ratios (2.35:1, 2.39:1, 21:9)
|
||||
// are not misclassified — e.g. a 1080p source presented as 1920×804 letterboxed
|
||||
// would fall to 720p if classified by height alone.
|
||||
func ResolveResolution(width, height int) string {
|
||||
byHeight := resolutionByHeight(height)
|
||||
byWidth := resolutionByWidth(width)
|
||||
return maxResolution(byHeight, byWidth)
|
||||
}
|
||||
|
||||
func resolutionByHeight(height int) string {
|
||||
// ResolveResolution maps a pixel height to a standard resolution label.
|
||||
func ResolveResolution(height int) string {
|
||||
switch {
|
||||
case height >= 2000:
|
||||
return "2160p"
|
||||
|
|
@ -38,36 +29,6 @@ func resolutionByHeight(height int) string {
|
|||
}
|
||||
}
|
||||
|
||||
func resolutionByWidth(width int) string {
|
||||
switch {
|
||||
case width >= 3400:
|
||||
return "2160p"
|
||||
case width >= 1800:
|
||||
return "1080p"
|
||||
case width >= 1200:
|
||||
return "720p"
|
||||
case width >= 800:
|
||||
return "480p"
|
||||
default:
|
||||
return ""
|
||||
}
|
||||
}
|
||||
|
||||
var resolutionRank = map[string]int{
|
||||
"": 0,
|
||||
"480p": 1,
|
||||
"720p": 2,
|
||||
"1080p": 3,
|
||||
"2160p": 4,
|
||||
}
|
||||
|
||||
func maxResolution(a, b string) string {
|
||||
if resolutionRank[a] >= resolutionRank[b] {
|
||||
return a
|
||||
}
|
||||
return b
|
||||
}
|
||||
|
||||
// DeriveContentType guesses "movie" or "show" from parsed metadata.
|
||||
func DeriveContentType(item LibraryItem) string {
|
||||
if item.Season > 0 || item.Episode > 0 {
|
||||
|
|
|
|||
|
|
@ -8,31 +8,28 @@ import (
|
|||
|
||||
func TestResolveResolution(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
width int
|
||||
height int
|
||||
want string
|
||||
}{
|
||||
{"4K square", 3840, 2160, "2160p"},
|
||||
{"4K low height", 3840, 1600, "2160p"},
|
||||
{"1080p square", 1920, 1080, "1080p"},
|
||||
{"1080p cinematic 2.39:1", 1920, 804, "1080p"}, // anamorphic widescreen — must not fall to 720p
|
||||
{"1080p cinematic 2.35:1", 1920, 818, "1080p"},
|
||||
{"1080p 21:9", 2560, 1080, "1080p"},
|
||||
{"720p square", 1280, 720, "720p"},
|
||||
{"720p widescreen", 1280, 540, "720p"},
|
||||
{"480p", 854, 480, "480p"},
|
||||
{"sub-480", 640, 360, ""},
|
||||
{"zero", 0, 0, ""},
|
||||
{2160, "2160p"},
|
||||
{2000, "2160p"},
|
||||
{1080, "1080p"},
|
||||
{1920, "1080p"}, // 1920 is width, not height — height for 1080p is ~1080
|
||||
{900, "1080p"},
|
||||
{720, "720p"},
|
||||
{600, "720p"},
|
||||
{576, "480p"},
|
||||
{480, "480p"},
|
||||
{400, "480p"},
|
||||
{360, ""},
|
||||
{0, ""},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got := ResolveResolution(tt.width, tt.height)
|
||||
if got != tt.want {
|
||||
t.Errorf("ResolveResolution(%d, %d) = %q, want %q", tt.width, tt.height, got, tt.want)
|
||||
}
|
||||
})
|
||||
got := ResolveResolution(tt.height)
|
||||
if got != tt.want {
|
||||
t.Errorf("ResolveResolution(%d) = %q, want %q", tt.height, got, tt.want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ func BuildSyncItems(cache *LibraryCache) []agent.LibrarySyncItem {
|
|||
|
||||
if item.MediaInfo != nil {
|
||||
if item.MediaInfo.Video != nil {
|
||||
si.Resolution = ResolveResolution(item.MediaInfo.Video.Width, item.MediaInfo.Video.Height)
|
||||
si.Resolution = ResolveResolution(item.MediaInfo.Video.Height)
|
||||
si.VideoCodec = item.MediaInfo.Video.Codec
|
||||
si.HDR = item.MediaInfo.Video.HDR
|
||||
si.BitDepth = item.MediaInfo.Video.BitDepth
|
||||
|
|
|
|||
|
|
@ -1,14 +1,12 @@
|
|||
package sentry
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"os"
|
||||
"runtime"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
gosentry "github.com/getsentry/sentry-go"
|
||||
"github.com/spf13/pflag"
|
||||
)
|
||||
|
||||
// dsn is injected at build time via ldflags. If empty, Sentry is disabled.
|
||||
|
|
@ -46,16 +44,9 @@ func Close() {
|
|||
gosentry.Flush(flushTimeout)
|
||||
}
|
||||
|
||||
// daemonNotRunningMarker matches the message of agent.ErrDaemonNotRunning
|
||||
// without importing the agent package — avoids a sentry → agent dependency
|
||||
// that would risk a cycle if agent ever needed to report errors itself.
|
||||
const daemonNotRunningMarker = "daemon does not appear to be running"
|
||||
|
||||
// CaptureError sends a non-fatal error to Sentry with optional command context.
|
||||
// Expected non-bug errors (bad CLI input, daemon not running) are skipped to
|
||||
// keep the issue feed signal-heavy.
|
||||
func CaptureError(err error, command string) {
|
||||
if err == nil || shouldSkipSentry(err) {
|
||||
if err == nil {
|
||||
return
|
||||
}
|
||||
|
||||
|
|
@ -67,21 +58,6 @@ func CaptureError(err error, command string) {
|
|||
})
|
||||
}
|
||||
|
||||
func shouldSkipSentry(err error) bool {
|
||||
var notExist *pflag.NotExistError
|
||||
var valueReq *pflag.ValueRequiredError
|
||||
var invalidVal *pflag.InvalidValueError
|
||||
var invalidSyn *pflag.InvalidSyntaxError
|
||||
if errors.As(err, ¬Exist) || errors.As(err, &valueReq) ||
|
||||
errors.As(err, &invalidVal) || errors.As(err, &invalidSyn) {
|
||||
return true
|
||||
}
|
||||
msg := err.Error()
|
||||
return strings.HasPrefix(msg, "unknown command ") ||
|
||||
strings.HasPrefix(msg, "required flag(s)") ||
|
||||
strings.Contains(msg, daemonNotRunningMarker)
|
||||
}
|
||||
|
||||
// RecoverPanic captures a panic and re-panics after reporting.
|
||||
// Usage: defer sentry.RecoverPanic()
|
||||
func RecoverPanic() {
|
||||
|
|
|
|||
|
|
@ -1,10 +1,6 @@
|
|||
package sentry
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"testing"
|
||||
)
|
||||
import "testing"
|
||||
|
||||
func TestEnvironment(t *testing.T) {
|
||||
tests := []struct {
|
||||
|
|
@ -49,16 +45,3 @@ func TestSetUser(t *testing.T) {
|
|||
// Should not panic without initialization
|
||||
SetUser("agent-123")
|
||||
}
|
||||
|
||||
func TestShouldSkipSentryDaemonNotRunning(t *testing.T) {
|
||||
// String must stay in sync with agent.ErrDaemonNotRunning. If that sentinel
|
||||
// is reworded, this test fails loudly so the marker can be updated.
|
||||
err := errors.New("daemon does not appear to be running (state file not found)")
|
||||
if !shouldSkipSentry(err) {
|
||||
t.Error("ErrDaemonNotRunning message should be skipped")
|
||||
}
|
||||
wrapped := fmt.Errorf("read daemon state: %w", err)
|
||||
if !shouldSkipSentry(wrapped) {
|
||||
t.Error("wrapped ErrDaemonNotRunning message should be skipped")
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,10 +2,10 @@ package upgrade
|
|||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
|
|
@ -88,23 +88,7 @@ func download(ctx context.Context, version string) (string, error) {
|
|||
}
|
||||
|
||||
// verifyChecksum downloads checksums.txt and verifies the archive's SHA256.
|
||||
// When a release public key is embedded at build time (releasePubKeyBase64),
|
||||
// the function also verifies an ed25519 signature over checksums.txt before
|
||||
// trusting any hash inside it — this turns the checksum file from a passive
|
||||
// integrity check into an authenticated artifact that a maintainer or CI key
|
||||
// compromise cannot trivially forge.
|
||||
func verifyChecksum(ctx context.Context, version, archivePath string) error {
|
||||
return verifyChecksumWithOptions(ctx, version, archivePath, true)
|
||||
}
|
||||
|
||||
// verifyChecksumOnly skips the ed25519 signature step. Used by Upgrader
|
||||
// when --allow-unsigned is set and the release is known to predate signing
|
||||
// (or when a release accidentally shipped without a .sig file).
|
||||
func verifyChecksumOnly(ctx context.Context, version, archivePath string) error {
|
||||
return verifyChecksumWithOptions(ctx, version, archivePath, false)
|
||||
}
|
||||
|
||||
func verifyChecksumWithOptions(ctx context.Context, version, archivePath string, verifySignature bool) error {
|
||||
// Download checksums.txt
|
||||
url := releaseURL(version, "checksums.txt")
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
||||
|
|
@ -123,28 +107,11 @@ func verifyChecksumWithOptions(ctx context.Context, version, archivePath string,
|
|||
return fmt.Errorf("fetch checksums: HTTP %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
// Read the entire checksums.txt content first so we can both parse and
|
||||
// verify the signature over the same bytes.
|
||||
checksumsContent, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
|
||||
if err != nil {
|
||||
return fmt.Errorf("read checksums: %w", err)
|
||||
}
|
||||
|
||||
// Verify ed25519 signature over checksums.txt before trusting its
|
||||
// contents. Skipped silently when no key is embedded (handled by the
|
||||
// caller via SignatureVerificationConfigured) or when the caller
|
||||
// explicitly opts out via --allow-unsigned.
|
||||
if verifySignature {
|
||||
if err := verifyChecksumsSignature(ctx, version, checksumsContent); err != nil {
|
||||
return fmt.Errorf("verify signature: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Parse checksums.txt — format: "<sha256> <filename>"
|
||||
expectedName := archiveName(version)
|
||||
var expectedHash string
|
||||
|
||||
scanner := bufio.NewScanner(bytes.NewReader(checksumsContent))
|
||||
scanner := bufio.NewScanner(resp.Body)
|
||||
for scanner.Scan() {
|
||||
line := scanner.Text()
|
||||
parts := strings.Fields(line)
|
||||
|
|
@ -181,35 +148,36 @@ func verifyChecksumWithOptions(ctx context.Context, version, archivePath string,
|
|||
return nil
|
||||
}
|
||||
|
||||
// fetchLatestVersion queries the TorrentClaw release endpoint (/version) for the
|
||||
// latest version string (e.g. "0.8.1"). No GitHub dependency.
|
||||
// fetchLatestVersion queries GitHub API for the latest release tag.
|
||||
func fetchLatestVersion(ctx context.Context) (string, error) {
|
||||
url := updateBaseURL + "/version"
|
||||
url := fmt.Sprintf("https://api.github.com/repos/%s/releases/latest", githubRepo)
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
req.Header.Set("Accept", "application/vnd.github+json")
|
||||
req.Header.Set("User-Agent", "unarr-updater")
|
||||
|
||||
resp, err := httpClient.Do(req)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("fetch latest version: %w", err)
|
||||
return "", fmt.Errorf("fetch latest release: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return "", fmt.Errorf("version endpoint: HTTP %d", resp.StatusCode)
|
||||
return "", fmt.Errorf("GitHub API: HTTP %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
body, err := io.ReadAll(io.LimitReader(resp.Body, 64))
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("read version: %w", err)
|
||||
var release struct {
|
||||
TagName string `json:"tag_name"`
|
||||
}
|
||||
if err := json.NewDecoder(resp.Body).Decode(&release); err != nil {
|
||||
return "", fmt.Errorf("decode response: %w", err)
|
||||
}
|
||||
|
||||
version := strings.TrimPrefix(strings.TrimSpace(string(body)), "v")
|
||||
if version == "" {
|
||||
return "", fmt.Errorf("empty version from %s", url)
|
||||
if release.TagName == "" {
|
||||
return "", fmt.Errorf("empty tag_name in release")
|
||||
}
|
||||
|
||||
return version, nil
|
||||
return strings.TrimPrefix(release.TagName, "v"), nil
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,6 @@ import (
|
|||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
|
|
@ -86,22 +85,15 @@ func extractZip(archivePath, destDir string) (string, error) {
|
|||
|
||||
target := binaryName + ".exe"
|
||||
|
||||
// Resolve destDir to its absolute form once so the ZIP-slip check below
|
||||
// can compare canonical paths instead of fragile substring matches.
|
||||
absDest, err := filepath.Abs(destDir)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("resolve dest: %w", err)
|
||||
}
|
||||
|
||||
for _, f := range r.File {
|
||||
if f.FileInfo().IsDir() {
|
||||
name := filepath.Base(f.Name)
|
||||
|
||||
// Guard against path traversal
|
||||
if strings.Contains(f.Name, "..") {
|
||||
continue
|
||||
}
|
||||
if filepath.Base(f.Name) != target {
|
||||
continue
|
||||
}
|
||||
absDst, ok := safeZipPath(f.Name, target, absDest)
|
||||
if !ok {
|
||||
|
||||
if name != target {
|
||||
continue
|
||||
}
|
||||
|
||||
|
|
@ -110,7 +102,8 @@ func extractZip(archivePath, destDir string) (string, error) {
|
|||
return "", err
|
||||
}
|
||||
|
||||
out, err := os.OpenFile(absDst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o755)
|
||||
dst := filepath.Join(destDir, target)
|
||||
out, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o755)
|
||||
if err != nil {
|
||||
rc.Close()
|
||||
return "", err
|
||||
|
|
@ -123,41 +116,8 @@ func extractZip(archivePath, destDir string) (string, error) {
|
|||
}
|
||||
out.Close()
|
||||
rc.Close()
|
||||
return absDst, nil
|
||||
return dst, nil
|
||||
}
|
||||
|
||||
return "", fmt.Errorf("binary %q not found in archive", target)
|
||||
}
|
||||
|
||||
// safeZipPath validates that a ZIP entry name is safe to extract under
|
||||
// absDest, then returns the absolute destination path (always
|
||||
// absDest/target, never the raw entry name — we still only extract files
|
||||
// matched by Base name).
|
||||
//
|
||||
// Rejected: absolute paths, paths that resolve to "..", paths containing
|
||||
// a "../" or "..\\" component, and any entry whose final destination
|
||||
// would land outside absDest. The check uses path.Clean on the entry's
|
||||
// native separator (ZIP uses forward slashes by spec, but some authors
|
||||
// emit backslashes — we treat both as separators here so a hostile entry
|
||||
// on Linux can't bypass the substring scan).
|
||||
func safeZipPath(entryName, target, absDest string) (string, bool) {
|
||||
// Normalise both separators to "/" so the check works on Linux too,
|
||||
// where filepath.Separator is "/" and a hostile "..\\foo" string is
|
||||
// otherwise treated as a single filename component by filepath.Clean.
|
||||
normalised := strings.ReplaceAll(entryName, `\`, "/")
|
||||
cleaned := path.Clean(normalised)
|
||||
if cleaned == ".." ||
|
||||
strings.HasPrefix(cleaned, "../") ||
|
||||
strings.Contains(cleaned, "/../") ||
|
||||
path.IsAbs(cleaned) {
|
||||
return "", false
|
||||
}
|
||||
absDst, err := filepath.Abs(filepath.Join(absDest, target))
|
||||
if err != nil {
|
||||
return "", false
|
||||
}
|
||||
if !strings.HasPrefix(absDst+string(filepath.Separator), absDest+string(filepath.Separator)) {
|
||||
return "", false
|
||||
}
|
||||
return absDst, true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,112 +0,0 @@
|
|||
package upgrade
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// releasePubKeyBase64 is the base64-encoded ed25519 public key used to verify
|
||||
// `checksums.txt.sig` against `checksums.txt` during self-update.
|
||||
//
|
||||
// It is overridable at link time via ldflags so the same source compiles for
|
||||
// users who do not yet have a release-signing keypair in their CI:
|
||||
//
|
||||
// -X github.com/torrentclaw/unarr/internal/upgrade.releasePubKeyBase64=<base64-pubkey>
|
||||
//
|
||||
// When the variable is empty, signature verification is skipped and a warning
|
||||
// is logged — checksum-only verification remains in force. This is the
|
||||
// transitional default until the keypair is provisioned; flip to a non-empty
|
||||
// value (and enable the corresponding CI signing step) to make signature
|
||||
// verification mandatory.
|
||||
var releasePubKeyBase64 = ""
|
||||
|
||||
// ErrMissingSignature indicates the release does not ship a `.sig` file even
|
||||
// though signature verification is required by an embedded public key.
|
||||
var ErrMissingSignature = errors.New("release signature file is missing")
|
||||
|
||||
// verifyChecksumsSignature downloads `checksums.txt.sig` (raw 64-byte ed25519
|
||||
// signature over the checksums.txt content) and verifies it with the embedded
|
||||
// public key. Returns nil if verification succeeds or if no public key has
|
||||
// been embedded yet (caller is expected to surface a warning in that case).
|
||||
func verifyChecksumsSignature(ctx context.Context, version string, checksumsContent []byte) error {
|
||||
pubKey, err := loadReleasePubKey()
|
||||
if err != nil {
|
||||
return fmt.Errorf("load release pubkey: %w", err)
|
||||
}
|
||||
if pubKey == nil {
|
||||
// Signature verification not configured; caller decides what to do.
|
||||
return nil
|
||||
}
|
||||
|
||||
url := releaseURL(version, "checksums.txt.sig")
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
req.Header.Set("User-Agent", "unarr-updater")
|
||||
resp, err := httpClient.Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("fetch signature: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode == http.StatusNotFound {
|
||||
return ErrMissingSignature
|
||||
}
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("fetch signature: HTTP %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
// Signature file is base64(signature)\n — small and bounded.
|
||||
rawSig, err := io.ReadAll(io.LimitReader(resp.Body, 8*1024))
|
||||
if err != nil {
|
||||
return fmt.Errorf("read signature: %w", err)
|
||||
}
|
||||
sig, err := decodeSignature(rawSig)
|
||||
if err != nil {
|
||||
return fmt.Errorf("decode signature: %w", err)
|
||||
}
|
||||
if len(sig) != ed25519.SignatureSize {
|
||||
return fmt.Errorf("signature size %d, expected %d", len(sig), ed25519.SignatureSize)
|
||||
}
|
||||
if !ed25519.Verify(pubKey, checksumsContent, sig) {
|
||||
return errors.New("ed25519 signature verification failed")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// SignatureVerificationConfigured reports whether the build has a release
|
||||
// public key embedded. The CLI surfaces this so users running a non-signed
|
||||
// build get a clear warning rather than silent trust.
|
||||
func SignatureVerificationConfigured() bool {
|
||||
pubKey, err := loadReleasePubKey()
|
||||
return err == nil && pubKey != nil
|
||||
}
|
||||
|
||||
func loadReleasePubKey() (ed25519.PublicKey, error) {
|
||||
v := strings.TrimSpace(releasePubKeyBase64)
|
||||
if v == "" {
|
||||
return nil, nil
|
||||
}
|
||||
raw, err := base64.StdEncoding.DecodeString(v)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("base64 decode: %w", err)
|
||||
}
|
||||
if len(raw) != ed25519.PublicKeySize {
|
||||
return nil, fmt.Errorf("pubkey size %d, expected %d", len(raw), ed25519.PublicKeySize)
|
||||
}
|
||||
return ed25519.PublicKey(raw), nil
|
||||
}
|
||||
|
||||
// decodeSignature parses the base64-encoded signature emitted by
|
||||
// scripts/sign-checksums (always base64 + trailing newline). A single
|
||||
// expected format keeps the surface area minimal — a stricter parser is
|
||||
// less likely to accept a hostile mirror's coincidentally-sized payload.
|
||||
func decodeSignature(raw []byte) ([]byte, error) {
|
||||
return base64.StdEncoding.DecodeString(strings.TrimSpace(string(raw)))
|
||||
}
|
||||
|
|
@ -1,134 +0,0 @@
|
|||
package upgrade
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// withReleasePubKey temporarily swaps the embedded release public key and
|
||||
// restores the previous value on test exit.
|
||||
func withReleasePubKey(t *testing.T, encoded string) {
|
||||
t.Helper()
|
||||
prev := releasePubKeyBase64
|
||||
releasePubKeyBase64 = encoded
|
||||
t.Cleanup(func() { releasePubKeyBase64 = prev })
|
||||
}
|
||||
|
||||
func TestSignatureVerificationDisabledByDefault(t *testing.T) {
|
||||
withReleasePubKey(t, "")
|
||||
if SignatureVerificationConfigured() {
|
||||
t.Fatal("expected SignatureVerificationConfigured() to be false when pubkey is empty")
|
||||
}
|
||||
// verifyChecksumsSignature should be a no-op when no key is embedded.
|
||||
if err := verifyChecksumsSignature(context.Background(), "0.0.0", []byte("anything")); err != nil {
|
||||
t.Fatalf("expected nil when pubkey is empty, got %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSignatureRejectsMalformedPubKey(t *testing.T) {
|
||||
withReleasePubKey(t, "not-base64!!")
|
||||
if _, err := loadReleasePubKey(); err == nil {
|
||||
t.Fatal("expected error from malformed base64")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSignatureRejectsWrongSizePubKey(t *testing.T) {
|
||||
withReleasePubKey(t, base64.StdEncoding.EncodeToString([]byte("too-short")))
|
||||
if _, err := loadReleasePubKey(); err == nil {
|
||||
t.Fatal("expected error from wrong-size pubkey")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSignatureVerifiesGoodSignature(t *testing.T) {
|
||||
pub, priv, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Fatalf("generate keypair: %v", err)
|
||||
}
|
||||
withReleasePubKey(t, base64.StdEncoding.EncodeToString(pub))
|
||||
|
||||
checksumsBody := []byte("deadbeef unarr_0.0.0_linux_amd64.tar.gz\n")
|
||||
signature := ed25519.Sign(priv, checksumsBody)
|
||||
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if !strings.HasSuffix(r.URL.Path, "checksums.txt.sig") {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
fmt.Fprintln(w, base64.StdEncoding.EncodeToString(signature))
|
||||
}))
|
||||
defer srv.Close()
|
||||
|
||||
prevHost := updateBaseURL
|
||||
updateBaseURL = srv.URL
|
||||
t.Cleanup(func() { updateBaseURL = prevHost })
|
||||
|
||||
if err := verifyChecksumsSignature(context.Background(), "0.0.0", checksumsBody); err != nil {
|
||||
t.Fatalf("verifyChecksumsSignature(good) = %v, want nil", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSignatureRejectsBadSignature(t *testing.T) {
|
||||
pub, _, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Fatalf("generate keypair: %v", err)
|
||||
}
|
||||
withReleasePubKey(t, base64.StdEncoding.EncodeToString(pub))
|
||||
|
||||
// Sign with a DIFFERENT private key — should be rejected.
|
||||
_, other, _ := ed25519.GenerateKey(rand.Reader)
|
||||
body := []byte("checksum-line\n")
|
||||
badSig := ed25519.Sign(other, body)
|
||||
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
fmt.Fprintln(w, base64.StdEncoding.EncodeToString(badSig))
|
||||
}))
|
||||
defer srv.Close()
|
||||
|
||||
prevHost := updateBaseURL
|
||||
updateBaseURL = srv.URL
|
||||
t.Cleanup(func() { updateBaseURL = prevHost })
|
||||
|
||||
err = verifyChecksumsSignature(context.Background(), "0.0.0", body)
|
||||
if err == nil || !strings.Contains(err.Error(), "verification failed") {
|
||||
t.Fatalf("expected verification failure, got %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSignatureMissingFile(t *testing.T) {
|
||||
pub, _, _ := ed25519.GenerateKey(rand.Reader)
|
||||
withReleasePubKey(t, base64.StdEncoding.EncodeToString(pub))
|
||||
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
http.NotFound(w, r)
|
||||
}))
|
||||
defer srv.Close()
|
||||
prevHost := updateBaseURL
|
||||
updateBaseURL = srv.URL
|
||||
t.Cleanup(func() { updateBaseURL = prevHost })
|
||||
|
||||
err := verifyChecksumsSignature(context.Background(), "0.0.0", []byte("body"))
|
||||
if !errors.Is(err, ErrMissingSignature) {
|
||||
t.Fatalf("expected ErrMissingSignature, got %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDecodeSignatureRejectsRaw(t *testing.T) {
|
||||
// 64-byte payload that happens NOT to be valid base64 must error rather
|
||||
// than be silently accepted as a raw signature — the only legitimate
|
||||
// shape is base64-encoded text.
|
||||
raw := make([]byte, ed25519.SignatureSize)
|
||||
for i := range raw {
|
||||
raw[i] = 0xff
|
||||
}
|
||||
if _, err := decodeSignature(raw); err == nil {
|
||||
t.Fatal("expected error from non-base64 64-byte payload")
|
||||
}
|
||||
}
|
||||
|
|
@ -13,7 +13,6 @@ package upgrade
|
|||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
|
|
@ -25,6 +24,7 @@ import (
|
|||
)
|
||||
|
||||
const (
|
||||
githubRepo = "torrentclaw/unarr"
|
||||
binaryName = "unarr"
|
||||
smokeTestTO = 5 * time.Second
|
||||
)
|
||||
|
|
@ -43,13 +43,6 @@ type Upgrader struct {
|
|||
CurrentVersion string
|
||||
// OnProgress is called with status messages during the upgrade process.
|
||||
OnProgress func(msg string)
|
||||
// AllowUnsigned downgrades a missing checksums.txt.sig to a warning and
|
||||
// continues with SHA256-only verification. Required to downgrade to a
|
||||
// release published before signing was introduced, or to recover from
|
||||
// an accidental release where the workflow's signing step was skipped.
|
||||
// Default false — signature missing is a hard failure when a public
|
||||
// key is embedded.
|
||||
AllowUnsigned bool
|
||||
}
|
||||
|
||||
func (u *Upgrader) log(msg string) {
|
||||
|
|
@ -96,21 +89,10 @@ func (u *Upgrader) Execute(ctx context.Context, targetVersion string) Result {
|
|||
}
|
||||
defer os.Remove(archivePath)
|
||||
|
||||
// 5. Verify checksum (and signature, if configured)
|
||||
if SignatureVerificationConfigured() {
|
||||
u.log("Verifying checksum + ed25519 signature...")
|
||||
} else {
|
||||
u.log("Verifying checksum (release signature verification not configured for this build)...")
|
||||
}
|
||||
// 5. Verify checksum
|
||||
u.log("Verifying checksum...")
|
||||
if err := verifyChecksum(ctx, targetVersion, archivePath); err != nil {
|
||||
if errors.Is(err, ErrMissingSignature) && u.AllowUnsigned {
|
||||
u.log("WARNING: release is unsigned and --allow-unsigned was passed; continuing with SHA256-only verification")
|
||||
if err := verifyChecksumOnly(ctx, targetVersion, archivePath); err != nil {
|
||||
return u.fail("checksum: %v", err)
|
||||
}
|
||||
} else {
|
||||
return u.fail("checksum: %v", err)
|
||||
}
|
||||
return u.fail("checksum: %v", err)
|
||||
}
|
||||
|
||||
// 6. Extract binary
|
||||
|
|
@ -242,26 +224,7 @@ func archiveName(version string) string {
|
|||
return fmt.Sprintf("%s_%s_%s_%s.%s", binaryName, version, runtime.GOOS, runtime.GOARCH, ext)
|
||||
}
|
||||
|
||||
// updateBaseURL is the base URL the self-updater fetches releases from —
|
||||
// TorrentClaw's own app, no GitHub dependency (the org is shadow-banned, so
|
||||
// GitHub releases/raw/API all 404 to anonymous clients). Defaults to the
|
||||
// production apex; SetBaseURL points it at the configured host (cfg.Auth.APIURL)
|
||||
// so mirrors / onion / staging work, and tests can point it at an httptest.Server.
|
||||
var updateBaseURL = "https://torrentclaw.com"
|
||||
|
||||
// SetBaseURL overrides the release endpoint base (trailing slash trimmed).
|
||||
// No-op for empty input so a blank config can't break the default.
|
||||
func SetBaseURL(base string) {
|
||||
if base != "" {
|
||||
updateBaseURL = strings.TrimRight(base, "/")
|
||||
}
|
||||
}
|
||||
|
||||
// releaseURL returns the download URL for a release asset:
|
||||
//
|
||||
// {base}/releases/download/v{version}/{filename}
|
||||
//
|
||||
// served by the app's src/app/releases/download/[...seg] route handler.
|
||||
// releaseURL returns the download URL for a release asset.
|
||||
func releaseURL(version, filename string) string {
|
||||
return fmt.Sprintf("%s/releases/download/v%s/%s", updateBaseURL, version, filename)
|
||||
return fmt.Sprintf("https://github.com/%s/releases/download/v%s/%s", githubRepo, version, filename)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -57,7 +57,7 @@ func TestArchiveName(t *testing.T) {
|
|||
|
||||
func TestReleaseURL(t *testing.T) {
|
||||
url := releaseURL("0.3.0", "unarr_0.3.0_linux_amd64.tar.gz")
|
||||
want := "https://torrentclaw.com/releases/download/v0.3.0/unarr_0.3.0_linux_amd64.tar.gz"
|
||||
want := "https://github.com/torrentclaw/unarr/releases/download/v0.3.0/unarr_0.3.0_linux_amd64.tar.gz"
|
||||
if url != want {
|
||||
t.Errorf("releaseURL = %q, want %q", url, want)
|
||||
}
|
||||
|
|
@ -289,24 +289,21 @@ func TestUpgraderSameVersionWithPrefix(t *testing.T) {
|
|||
|
||||
func TestFetchLatestVersionMockServer(t *testing.T) {
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.URL.Path != "/version" {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
fmt.Fprintln(w, "v2.5.1")
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
fmt.Fprint(w, `{"tag_name":"v2.5.1","published_at":"2025-01-01T00:00:00Z"}`)
|
||||
}))
|
||||
defer srv.Close()
|
||||
|
||||
prev := updateBaseURL
|
||||
updateBaseURL = srv.URL
|
||||
t.Cleanup(func() { updateBaseURL = prev })
|
||||
|
||||
ver, err := fetchLatestVersion(context.Background())
|
||||
// We can't directly test fetchLatestVersion because it uses a hardcoded URL.
|
||||
// But we can test the JSON parsing logic by calling the endpoint ourselves.
|
||||
resp, err := http.Get(srv.URL)
|
||||
if err != nil {
|
||||
t.Fatalf("fetchLatestVersion() = %v", err)
|
||||
t.Fatal(err)
|
||||
}
|
||||
if ver != "2.5.1" {
|
||||
t.Errorf("fetchLatestVersion() = %q, want %q", ver, "2.5.1")
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != 200 {
|
||||
t.Errorf("status = %d, want 200", resp.StatusCode)
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -406,19 +403,19 @@ func TestReleaseURLEdgeCases(t *testing.T) {
|
|||
name: "pre-release version",
|
||||
version: "2.0.0-beta.1",
|
||||
filename: "unarr_2.0.0-beta.1_darwin_arm64.tar.gz",
|
||||
wantURL: "https://torrentclaw.com/releases/download/v2.0.0-beta.1/unarr_2.0.0-beta.1_darwin_arm64.tar.gz",
|
||||
wantURL: "https://github.com/torrentclaw/unarr/releases/download/v2.0.0-beta.1/unarr_2.0.0-beta.1_darwin_arm64.tar.gz",
|
||||
},
|
||||
{
|
||||
name: "checksums file",
|
||||
version: "3.0.0",
|
||||
filename: "checksums.txt",
|
||||
wantURL: "https://torrentclaw.com/releases/download/v3.0.0/checksums.txt",
|
||||
wantURL: "https://github.com/torrentclaw/unarr/releases/download/v3.0.0/checksums.txt",
|
||||
},
|
||||
{
|
||||
name: "windows zip",
|
||||
version: "1.2.3",
|
||||
filename: "unarr_1.2.3_windows_amd64.zip",
|
||||
wantURL: "https://torrentclaw.com/releases/download/v1.2.3/unarr_1.2.3_windows_amd64.zip",
|
||||
wantURL: "https://github.com/torrentclaw/unarr/releases/download/v1.2.3/unarr_1.2.3_windows_amd64.zip",
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
|
|
@ -533,19 +530,19 @@ func TestFetchLatestVersionWithHTTPTest(t *testing.T) {
|
|||
}{
|
||||
{
|
||||
name: "valid response",
|
||||
body: "v3.1.4\n",
|
||||
body: `{"tag_name":"v3.1.4"}`,
|
||||
statusCode: 200,
|
||||
wantVer: "3.1.4",
|
||||
},
|
||||
{
|
||||
name: "valid response without v prefix",
|
||||
body: "2.0.0",
|
||||
body: `{"tag_name":"2.0.0"}`,
|
||||
statusCode: 200,
|
||||
wantVer: "2.0.0",
|
||||
},
|
||||
{
|
||||
name: "empty body",
|
||||
body: "",
|
||||
name: "empty tag_name",
|
||||
body: `{"tag_name":""}`,
|
||||
statusCode: 200,
|
||||
wantErr: true,
|
||||
},
|
||||
|
|
@ -556,8 +553,8 @@ func TestFetchLatestVersionWithHTTPTest(t *testing.T) {
|
|||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "whitespace only",
|
||||
body: " \n",
|
||||
name: "invalid json",
|
||||
body: `{invalid`,
|
||||
statusCode: 200,
|
||||
wantErr: true,
|
||||
},
|
||||
|
|
@ -1088,40 +1085,3 @@ func TestDownloadSetsUserAgent(t *testing.T) {
|
|||
t.Errorf("User-Agent = %q, want 'unarr-updater'", gotUA)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSafeZipPath(t *testing.T) {
|
||||
dest := t.TempDir()
|
||||
absDest, err := filepath.Abs(dest)
|
||||
if err != nil {
|
||||
t.Fatalf("abs dest: %v", err)
|
||||
}
|
||||
|
||||
// Names that must extract successfully.
|
||||
good := []string{
|
||||
"unarr.exe",
|
||||
"bin/unarr.exe",
|
||||
"./unarr.exe",
|
||||
"folder/sub/unarr.exe",
|
||||
}
|
||||
for _, name := range good {
|
||||
if _, ok := safeZipPath(name, "unarr.exe", absDest); !ok {
|
||||
t.Errorf("safeZipPath(%q) = ok:false, want ok:true", name)
|
||||
}
|
||||
}
|
||||
|
||||
// Names that must be rejected for path-traversal reasons.
|
||||
bad := []string{
|
||||
"../unarr.exe",
|
||||
"..",
|
||||
"foo/../../unarr.exe",
|
||||
"/etc/passwd",
|
||||
"/abs/unarr.exe",
|
||||
`..\..\windows\system32\unarr.exe`, // backslash entries that escape
|
||||
"../../bin/unarr.exe",
|
||||
}
|
||||
for _, name := range bad {
|
||||
if _, ok := safeZipPath(name, "unarr.exe", absDest); ok {
|
||||
t.Errorf("safeZipPath(%q) = ok:true, want ok:false", name)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
package postprocess
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
|
|
@ -9,25 +8,8 @@ import (
|
|||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
// extractTimeout caps how long a single extractor invocation may run. Without
|
||||
// a cap, an encrypted archive that triggers a TTY-only prompt (or a corrupt
|
||||
// archive that confuses the tool) hangs the post-process pipeline forever.
|
||||
const extractTimeout = 30 * time.Minute
|
||||
|
||||
// validatePassword rejects passwords containing control characters that could
|
||||
// inject extra answers into unrar/7z prompts via stdin (e.g. a newline lets an
|
||||
// attacker-controlled NZB password feed a second response to overwrite or
|
||||
// rename prompts).
|
||||
func validatePassword(password string) error {
|
||||
if strings.ContainsAny(password, "\r\n\x00") {
|
||||
return fmt.Errorf("invalid password: contains control characters")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ExtractorType identifies which extraction tool is available.
|
||||
type ExtractorType string
|
||||
|
||||
|
|
@ -68,35 +50,18 @@ func Extract(archivePath string, outputDir string, password string) ([]string, e
|
|||
}
|
||||
|
||||
// extractUnrar extracts using unrar.
|
||||
//
|
||||
// Security: when a password is supplied it is sent via stdin rather than via
|
||||
// the `-p<password>` switch so it does not appear in `/proc/<pid>/cmdline`
|
||||
// (visible to any other process on the host). unrar prompts for the password
|
||||
// when no `-p` switch is given, and reads the prompt response from stdin when
|
||||
// no controlling TTY is attached (the usual case for a daemon-spawned child).
|
||||
func extractUnrar(unrarPath, archivePath, outputDir, password string) ([]string, error) {
|
||||
if err := validatePassword(password); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
args := []string{"x", "-o+", "-y"}
|
||||
if password == "" {
|
||||
// Tell unrar there is no password so it skips the prompt and fails
|
||||
// fast on encrypted archives instead of hanging.
|
||||
args = append(args, "-p-")
|
||||
if password != "" {
|
||||
args = append(args, "-p"+password)
|
||||
} else {
|
||||
args = append(args, "-p-") // no password, skip asking
|
||||
}
|
||||
args = append(args, archivePath, outputDir+"/")
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), extractTimeout)
|
||||
defer cancel()
|
||||
cmd := exec.CommandContext(ctx, unrarPath, args...)
|
||||
cmd := exec.Command(unrarPath, args...)
|
||||
cmd.Dir = outputDir
|
||||
if password != "" {
|
||||
cmd.Stdin = strings.NewReader(password + "\n")
|
||||
}
|
||||
output, err := cmd.CombinedOutput()
|
||||
if ctx.Err() == context.DeadlineExceeded {
|
||||
return nil, fmt.Errorf("unrar: timed out after %s", extractTimeout)
|
||||
}
|
||||
if err != nil {
|
||||
// Check for password error
|
||||
outStr := string(output)
|
||||
|
|
@ -110,33 +75,18 @@ func extractUnrar(unrarPath, archivePath, outputDir, password string) ([]string,
|
|||
}
|
||||
|
||||
// extract7z extracts using 7z.
|
||||
//
|
||||
// Security: same rationale as extractUnrar — passwords go through stdin to
|
||||
// avoid `/proc/<pid>/cmdline` exposure. 7z reads the password from stdin when
|
||||
// no `-p` switch is given and the archive is encrypted.
|
||||
func extract7z(szPath, archivePath, outputDir, password string) ([]string, error) {
|
||||
if err := validatePassword(password); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
args := []string{"x", "-y", "-o" + outputDir}
|
||||
if password == "" {
|
||||
// `-p` with no value tells 7z the password is empty so encrypted
|
||||
// archives fail fast instead of waiting for a prompt.
|
||||
args = append(args, "-p")
|
||||
if password != "" {
|
||||
args = append(args, "-p"+password)
|
||||
} else {
|
||||
args = append(args, "-p") // empty password
|
||||
}
|
||||
args = append(args, archivePath)
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), extractTimeout)
|
||||
defer cancel()
|
||||
cmd := exec.CommandContext(ctx, szPath, args...)
|
||||
cmd := exec.Command(szPath, args...)
|
||||
cmd.Dir = outputDir
|
||||
if password != "" {
|
||||
cmd.Stdin = strings.NewReader(password + "\n")
|
||||
}
|
||||
output, err := cmd.CombinedOutput()
|
||||
if ctx.Err() == context.DeadlineExceeded {
|
||||
return nil, fmt.Errorf("7z: timed out after %s", extractTimeout)
|
||||
}
|
||||
if err != nil {
|
||||
outStr := string(output)
|
||||
if strings.Contains(outStr, "Wrong password") || strings.Contains(outStr, "incorrect password") {
|
||||
|
|
|
|||
|
|
@ -1,333 +0,0 @@
|
|||
// Package vpn brings up an in-process WireGuard tunnel (userspace, via
|
||||
// wireguard-go + gVisor netstack) and exposes it as a dialer so the BitTorrent
|
||||
// client's peer/tracker traffic can be split-tunnelled through it — without
|
||||
// touching the OS routing table or requiring root.
|
||||
//
|
||||
// The config is a standard WireGuard .conf fetched from the web
|
||||
// (/api/internal/agent/vpn-config). Only the torrent client uses this tunnel;
|
||||
// unarr's control-plane traffic (API, heartbeats) keeps using the normal net.
|
||||
package vpn
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
neturl "net/url"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/conn"
|
||||
"golang.zx2c4.com/wireguard/device"
|
||||
"golang.zx2c4.com/wireguard/tun/netstack"
|
||||
)
|
||||
|
||||
// ErrCode classifies fetch failures the agent should react to differently.
|
||||
type ErrCode string
|
||||
|
||||
const (
|
||||
ErrDisabled ErrCode = "disabled" // 503 — VPN feature off server-side
|
||||
ErrNotProvisioned ErrCode = "not_provisioned" // 403 — user has no active VPN
|
||||
ErrSlotOnDevice ErrCode = "slot_on_device" // 409 — slot claimed by a device
|
||||
ErrUpstream ErrCode = "upstream" // network / 5xx / parse
|
||||
)
|
||||
|
||||
// FetchError carries an ErrCode so callers can decide whether to retry, warn, or
|
||||
// fall back to a clear (non-VPN) download.
|
||||
type FetchError struct {
|
||||
Code ErrCode
|
||||
Msg string
|
||||
}
|
||||
|
||||
func (e *FetchError) Error() string { return fmt.Sprintf("vpn fetch: %s (%s)", e.Msg, e.Code) }
|
||||
|
||||
type fetchResponse struct {
|
||||
Content string `json:"content"`
|
||||
Filename string `json:"filename"`
|
||||
ServerID int `json:"serverId"`
|
||||
Mode string `json:"mode"`
|
||||
Error string `json:"error"`
|
||||
CodeStr string `json:"code"`
|
||||
}
|
||||
|
||||
// FetchConfig retrieves the agent's WireGuard .conf from the web API. Auth is
|
||||
// `Authorization: Bearer <apiKey>` (the agent-auth scheme). agentId lets the web
|
||||
// arbitrate the single WireGuard slot (first agent to ask claims it; others get
|
||||
// 409 → ErrSlotOnDevice and should use OpenVPN on their host instead).
|
||||
func FetchConfig(ctx context.Context, apiURL, apiKey, userAgent, agentID string, probe bool) (string, error) {
|
||||
q := neturl.Values{}
|
||||
if agentID != "" {
|
||||
q.Set("agentId", agentID)
|
||||
}
|
||||
if probe {
|
||||
// Validate provisioning without claiming the WireGuard slot (status --check).
|
||||
q.Set("probe", "1")
|
||||
}
|
||||
url := strings.TrimSuffix(apiURL, "/") + "/api/internal/agent/vpn-config"
|
||||
if len(q) > 0 {
|
||||
url += "?" + q.Encode()
|
||||
}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
||||
if err != nil {
|
||||
return "", &FetchError{ErrUpstream, err.Error()}
|
||||
}
|
||||
req.Header.Set("Authorization", "Bearer "+apiKey)
|
||||
req.Header.Set("User-Agent", userAgent)
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
client := &http.Client{Timeout: 20 * time.Second}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", &FetchError{ErrUpstream, err.Error()}
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
var body fetchResponse
|
||||
_ = json.NewDecoder(resp.Body).Decode(&body)
|
||||
|
||||
switch resp.StatusCode {
|
||||
case http.StatusOK:
|
||||
if body.Content == "" {
|
||||
return "", &FetchError{ErrUpstream, "empty config"}
|
||||
}
|
||||
return body.Content, nil
|
||||
case http.StatusServiceUnavailable:
|
||||
return "", &FetchError{ErrDisabled, "VPN disabled server-side"}
|
||||
case http.StatusForbidden:
|
||||
return "", &FetchError{ErrNotProvisioned, "no active VPN for this account"}
|
||||
case http.StatusConflict:
|
||||
return "", &FetchError{ErrSlotOnDevice, "VPN slot is active on one of your devices"}
|
||||
default:
|
||||
msg := body.Error
|
||||
if msg == "" {
|
||||
msg = "unexpected status " + strconv.Itoa(resp.StatusCode)
|
||||
}
|
||||
return "", &FetchError{ErrUpstream, msg}
|
||||
}
|
||||
}
|
||||
|
||||
// Tunnel is a live userspace WireGuard tunnel. Net exposes a DialContext +
|
||||
// ListenUDP backed by the tunnel; wire these into the torrent client.
|
||||
type Tunnel struct {
|
||||
dev *device.Device
|
||||
Net *netstack.Net
|
||||
// Endpoint is the resolved ip:port of the WireGuard server this tunnel
|
||||
// exits through — surfaced in `unarr vpn status` so the user can see which
|
||||
// VPN server their torrent traffic is routed out of.
|
||||
Endpoint string
|
||||
}
|
||||
|
||||
// Up parses a WireGuard .conf and brings up the tunnel in userspace.
|
||||
func Up(confText string) (*Tunnel, error) {
|
||||
wc, err := parseConf(confText)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
mtu := wc.mtu
|
||||
if mtu == 0 {
|
||||
mtu = 1420
|
||||
}
|
||||
|
||||
tunDev, tnet, err := netstack.CreateNetTUN(wc.addresses, wc.dns, mtu)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("create netstack tun: %w", err)
|
||||
}
|
||||
|
||||
dev := device.NewDevice(tunDev, conn.NewDefaultBind(), device.NewLogger(device.LogLevelError, "wg-unarr "))
|
||||
if err := dev.IpcSet(wc.uapi()); err != nil {
|
||||
dev.Close()
|
||||
return nil, fmt.Errorf("wireguard ipc set: %w", err)
|
||||
}
|
||||
if err := dev.Up(); err != nil {
|
||||
dev.Close()
|
||||
return nil, fmt.Errorf("wireguard up: %w", err)
|
||||
}
|
||||
|
||||
return &Tunnel{dev: dev, Net: tnet, Endpoint: wc.endpoint}, nil
|
||||
}
|
||||
|
||||
// Close tears the tunnel down.
|
||||
func (t *Tunnel) Close() {
|
||||
if t != nil && t.dev != nil {
|
||||
t.dev.Close()
|
||||
}
|
||||
}
|
||||
|
||||
// ListenPacket adapts the tunnel's UDP for anacrolix TrackerListenPacket so UDP
|
||||
// tracker announces also go through the VPN (no IP leak to trackers).
|
||||
func (t *Tunnel) ListenPacket(_ string, _ string) (net.PacketConn, error) {
|
||||
return t.Net.ListenUDP(&net.UDPAddr{IP: net.IPv4zero, Port: 0})
|
||||
}
|
||||
|
||||
// --- .conf parsing ----------------------------------------------------------
|
||||
|
||||
type wgConf struct {
|
||||
privateKey string // hex
|
||||
addresses []netip.Addr
|
||||
dns []netip.Addr
|
||||
mtu int
|
||||
|
||||
peerPublicKey string // hex
|
||||
presharedKey string // hex (optional)
|
||||
endpoint string // resolved ip:port
|
||||
allowedIPs []string
|
||||
keepalive int
|
||||
}
|
||||
|
||||
func (w *wgConf) uapi() string {
|
||||
var b strings.Builder
|
||||
fmt.Fprintf(&b, "private_key=%s\n", w.privateKey)
|
||||
fmt.Fprintf(&b, "public_key=%s\n", w.peerPublicKey)
|
||||
if w.presharedKey != "" {
|
||||
fmt.Fprintf(&b, "preshared_key=%s\n", w.presharedKey)
|
||||
}
|
||||
if w.endpoint != "" {
|
||||
fmt.Fprintf(&b, "endpoint=%s\n", w.endpoint)
|
||||
}
|
||||
if w.keepalive > 0 {
|
||||
fmt.Fprintf(&b, "persistent_keepalive_interval=%d\n", w.keepalive)
|
||||
}
|
||||
for _, a := range w.allowedIPs {
|
||||
fmt.Fprintf(&b, "allowed_ip=%s\n", a)
|
||||
}
|
||||
return b.String()
|
||||
}
|
||||
|
||||
func b64ToHex(s string) (string, error) {
|
||||
raw, err := base64.StdEncoding.DecodeString(strings.TrimSpace(s))
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("invalid base64 key: %w", err)
|
||||
}
|
||||
if len(raw) != 32 {
|
||||
return "", fmt.Errorf("key must be 32 bytes, got %d", len(raw))
|
||||
}
|
||||
return hex.EncodeToString(raw), nil
|
||||
}
|
||||
|
||||
func parseConf(text string) (*wgConf, error) {
|
||||
w := &wgConf{keepalive: 25}
|
||||
section := ""
|
||||
sc := bufio.NewScanner(strings.NewReader(text))
|
||||
for sc.Scan() {
|
||||
line := strings.TrimSpace(sc.Text())
|
||||
if line == "" || strings.HasPrefix(line, "#") {
|
||||
continue
|
||||
}
|
||||
if strings.HasPrefix(line, "[") {
|
||||
section = strings.ToLower(strings.Trim(line, "[]"))
|
||||
continue
|
||||
}
|
||||
key, val, ok := strings.Cut(line, "=")
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
key = strings.ToLower(strings.TrimSpace(key))
|
||||
val = strings.TrimSpace(val)
|
||||
|
||||
switch section {
|
||||
case "interface":
|
||||
switch key {
|
||||
case "privatekey":
|
||||
hexKey, err := b64ToHex(val)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
w.privateKey = hexKey
|
||||
case "address":
|
||||
for _, part := range strings.Split(val, ",") {
|
||||
part = strings.TrimSpace(part)
|
||||
if part == "" {
|
||||
continue
|
||||
}
|
||||
pfx, err := netip.ParsePrefix(part)
|
||||
if err != nil {
|
||||
// allow bare address
|
||||
if a, e2 := netip.ParseAddr(part); e2 == nil {
|
||||
w.addresses = append(w.addresses, a)
|
||||
}
|
||||
continue
|
||||
}
|
||||
w.addresses = append(w.addresses, pfx.Addr())
|
||||
}
|
||||
case "dns":
|
||||
for _, part := range strings.Split(val, ",") {
|
||||
if a, err := netip.ParseAddr(strings.TrimSpace(part)); err == nil {
|
||||
w.dns = append(w.dns, a)
|
||||
}
|
||||
}
|
||||
case "mtu":
|
||||
w.mtu, _ = strconv.Atoi(val)
|
||||
}
|
||||
case "peer":
|
||||
switch key {
|
||||
case "publickey":
|
||||
hexKey, err := b64ToHex(val)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
w.peerPublicKey = hexKey
|
||||
case "presharedkey":
|
||||
if hexKey, err := b64ToHex(val); err == nil {
|
||||
w.presharedKey = hexKey
|
||||
}
|
||||
case "endpoint":
|
||||
ep, err := resolveEndpoint(val)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
w.endpoint = ep
|
||||
case "allowedips":
|
||||
for _, part := range strings.Split(val, ",") {
|
||||
part = strings.TrimSpace(part)
|
||||
if part != "" {
|
||||
w.allowedIPs = append(w.allowedIPs, part)
|
||||
}
|
||||
}
|
||||
case "persistentkeepalive":
|
||||
if k, err := strconv.Atoi(val); err == nil {
|
||||
w.keepalive = k
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if w.privateKey == "" || w.peerPublicKey == "" {
|
||||
return nil, fmt.Errorf("config missing keys")
|
||||
}
|
||||
if len(w.addresses) == 0 {
|
||||
return nil, fmt.Errorf("config missing interface address")
|
||||
}
|
||||
if len(w.dns) == 0 {
|
||||
// Resolve tracker hostnames through the tunnel rather than leaking to the
|
||||
// local resolver. Fall back to Cloudflare.
|
||||
w.dns = []netip.Addr{netip.MustParseAddr("1.1.1.1")}
|
||||
}
|
||||
if len(w.allowedIPs) == 0 {
|
||||
w.allowedIPs = []string{"0.0.0.0/0", "::/0"}
|
||||
}
|
||||
return w, nil
|
||||
}
|
||||
|
||||
// resolveEndpoint turns host:port into ip:port — wireguard-go's IpcSet endpoint
|
||||
// expects a literal IP (it does not resolve DNS). Resolution uses the real net.
|
||||
func resolveEndpoint(hostport string) (string, error) {
|
||||
host, port, err := net.SplitHostPort(hostport)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("invalid endpoint %q: %w", hostport, err)
|
||||
}
|
||||
if ip := net.ParseIP(host); ip != nil {
|
||||
return hostport, nil
|
||||
}
|
||||
ips, err := net.LookupIP(host)
|
||||
if err != nil || len(ips) == 0 {
|
||||
return "", fmt.Errorf("resolve endpoint %q: %w", host, err)
|
||||
}
|
||||
return net.JoinHostPort(ips[0].String(), port), nil
|
||||
}
|
||||
|
|
@ -1,117 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
# scripts/download-ffmpeg-static.sh — fetch static ffmpeg + ffprobe binaries
|
||||
# for every platform we ship. Run by goreleaser's `before.hooks` so each
|
||||
# tarball can bundle the binaries adjacent to `unarr`.
|
||||
#
|
||||
# Source: https://ffbinaries.com (same index the runtime fallback uses).
|
||||
# Output:
|
||||
# dist-ffbinaries/<goos>-<goarch>/{ffmpeg, ffprobe}[.exe]
|
||||
# Idempotent: skips downloads when the target file already exists.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# Map ffbinaries platform key → goreleaser {Os}-{Arch}. ffbinaries.com only
|
||||
# ships an x86_64 macOS build; for darwin-arm64 we fall back to evermeet.cx
|
||||
# universal binaries (handled separately below).
|
||||
PLATFORMS=(
|
||||
"linux-64:linux-amd64"
|
||||
"linux-arm64:linux-arm64"
|
||||
"osx-64:darwin-amd64"
|
||||
"windows-64:windows-amd64"
|
||||
)
|
||||
DEST_ROOT="${FFBINARIES_DEST:-dist-ffbinaries}"
|
||||
INDEX_URL="https://ffbinaries.com/api/v1/version/latest"
|
||||
|
||||
for cmd in curl jq unzip; do
|
||||
command -v "$cmd" >/dev/null 2>&1 || {
|
||||
echo "[ffbin] missing required tool: $cmd" >&2
|
||||
exit 2
|
||||
}
|
||||
done
|
||||
|
||||
mkdir -p "$DEST_ROOT"
|
||||
|
||||
echo "[ffbin] fetching index from $INDEX_URL"
|
||||
INDEX_JSON="$(curl -fsSL "$INDEX_URL")"
|
||||
VERSION="$(echo "$INDEX_JSON" | jq -r .version)"
|
||||
echo "[ffbin] ffbinaries version: $VERSION"
|
||||
|
||||
for entry in "${PLATFORMS[@]}"; do
|
||||
ffbkey="${entry%%:*}"
|
||||
goplat="${entry##*:}"
|
||||
outdir="$DEST_ROOT/$goplat"
|
||||
mkdir -p "$outdir"
|
||||
|
||||
for tool in ffmpeg ffprobe; do
|
||||
binname="$tool"
|
||||
[[ "$goplat" == windows-* ]] && binname="${tool}.exe"
|
||||
|
||||
if [ -f "$outdir/$binname" ]; then
|
||||
echo "[ffbin] skip $goplat/$binname (already present)"
|
||||
continue
|
||||
fi
|
||||
|
||||
url="$(echo "$INDEX_JSON" | jq -r ".bin[\"$ffbkey\"][\"$tool\"] // empty")"
|
||||
if [ -z "$url" ]; then
|
||||
echo "[ffbin] WARN $goplat/$tool: no download URL in index" >&2
|
||||
continue
|
||||
fi
|
||||
|
||||
tmpzip="$(mktemp --suffix=.zip)"
|
||||
echo "[ffbin] fetch $goplat/$tool from $url"
|
||||
curl -fsSL --retry 5 --retry-delay 3 --retry-all-errors "$url" -o "$tmpzip"
|
||||
unzip -p "$tmpzip" "$binname" > "$outdir/$binname"
|
||||
chmod +x "$outdir/$binname"
|
||||
rm -f "$tmpzip"
|
||||
done
|
||||
done
|
||||
|
||||
# --- darwin-arm64 via evermeet.cx (universal binary; ffbinaries lacks it) ---
|
||||
darwin_arm_dir="$DEST_ROOT/darwin-arm64"
|
||||
mkdir -p "$darwin_arm_dir"
|
||||
for tool in ffmpeg ffprobe; do
|
||||
out="$darwin_arm_dir/$tool"
|
||||
if [ -f "$out" ]; then
|
||||
echo "[ffbin] skip darwin-arm64/$tool (already present)"
|
||||
continue
|
||||
fi
|
||||
url="https://evermeet.cx/ffmpeg/getrelease/$tool/zip"
|
||||
tmpzip="$(mktemp --suffix=.zip)"
|
||||
echo "[ffbin] fetch darwin-arm64/$tool from $url"
|
||||
curl -fsSL --retry 5 --retry-delay 3 --retry-all-errors "$url" -o "$tmpzip"
|
||||
unzip -p "$tmpzip" "$tool" > "$out"
|
||||
chmod +x "$out"
|
||||
rm -f "$tmpzip"
|
||||
done
|
||||
|
||||
# --- windows-arm64 via BtbN/FFmpeg-Builds (ffbinaries lacks it) ---
|
||||
# BtbN ships a single zip per platform with ffmpeg.exe + ffprobe.exe under
|
||||
# ffmpeg-master-latest-winarm64-gpl/bin/. Extract both in one fetch.
|
||||
win_arm_dir="$DEST_ROOT/windows-arm64"
|
||||
mkdir -p "$win_arm_dir"
|
||||
needs_win_arm=0
|
||||
for tool in ffmpeg.exe ffprobe.exe; do
|
||||
[ -f "$win_arm_dir/$tool" ] || needs_win_arm=1
|
||||
done
|
||||
if [ "$needs_win_arm" = "1" ]; then
|
||||
url="https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-winarm64-gpl.zip"
|
||||
tmpzip="$(mktemp --suffix=.zip)"
|
||||
echo "[ffbin] fetch windows-arm64/{ffmpeg,ffprobe}.exe from $url"
|
||||
curl -fsSL --retry 5 --retry-delay 3 --retry-all-errors "$url" -o "$tmpzip"
|
||||
for tool in ffmpeg.exe ffprobe.exe; do
|
||||
out="$win_arm_dir/$tool"
|
||||
member="$(unzip -Z1 "$tmpzip" "*/bin/$tool" 2>/dev/null | head -1)"
|
||||
if [ -z "$member" ]; then
|
||||
echo "[ffbin] WARN windows-arm64/$tool: not found in BtbN zip" >&2
|
||||
continue
|
||||
fi
|
||||
unzip -p "$tmpzip" "$member" > "$out"
|
||||
chmod +x "$out"
|
||||
done
|
||||
rm -f "$tmpzip"
|
||||
else
|
||||
echo "[ffbin] skip windows-arm64 (already present)"
|
||||
fi
|
||||
|
||||
echo "[ffbin] done. layout:"
|
||||
find "$DEST_ROOT" -type f -printf " %p (%s bytes)\n"
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
// gen-release-key generates an ed25519 keypair for signing release artifacts.
|
||||
// Run once per repository, then store the printed values:
|
||||
//
|
||||
// RELEASE_SIGNING_KEY → GitHub Actions secret (private key, base64)
|
||||
// RELEASE_SIGNING_PUBKEY → GitHub Actions variable (public key, base64)
|
||||
//
|
||||
// The public key is injected into the binary at build time via the
|
||||
// goreleaser ldflags entry that resolves
|
||||
// `github.com/torrentclaw/unarr/internal/upgrade.releasePubKeyBase64`.
|
||||
// The private key is used by the workflow's "Sign checksums.txt" step.
|
||||
//
|
||||
// Build and run:
|
||||
//
|
||||
// go run ./scripts/gen-release-key
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
func main() {
|
||||
pub, priv, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
fmt.Println("# Add the following to your GitHub repository:")
|
||||
fmt.Println("# - Settings → Secrets and variables → Actions → New repository secret")
|
||||
fmt.Println("# RELEASE_SIGNING_KEY = <PRIVATE_KEY_BASE64 below>")
|
||||
fmt.Println("# - Settings → Secrets and variables → Actions → New repository variable")
|
||||
fmt.Println("# RELEASE_SIGNING_PUBKEY = <PUBLIC_KEY_BASE64 below>")
|
||||
fmt.Println()
|
||||
fmt.Printf("PUBLIC_KEY_BASE64=%s\n", base64.StdEncoding.EncodeToString(pub))
|
||||
fmt.Printf("PRIVATE_KEY_BASE64=%s\n", base64.StdEncoding.EncodeToString(priv))
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue