Hands-on 07-connecting-prowlarr-to-sonarr-and-radarr: Lab

scope

This lab creates a non-secret integration worksheet and a validator. It does not contact or modify live Prowlarr, Sonarr, Radarr, proxy, DNS, or download-client services.

mutation_boundary

/opt/lab-classroom/class55/

steps

step

1

instruction

Create the isolated classroom directory and write a synthetic integration plan. The records deliberately state that credentials must be entered interactively rather than stored in the worksheet.

command

python3 - <<'PY'
import json
from pathlib import Path
root = Path('/opt/lab-classroom/class55')
root.mkdir(parents=True, exist_ok=True)
plan = {
'prowlarr_url': 'http://prowlarr:9696',
'credential_policy': 'Enter API keys interactively in Prowlarr; do not store them in this worksheet.',
'applications': [
{
'name': 'Sonarr Internal',
'type': 'sonarr',
'application_url': 'http://sonarr:8989',
'sync_level': 'full-sync',
'required_categories': ['tv'],
'tags': ['television']
},
{
'name': 'Radarr Internal',
'type': 'radarr',
'application_url': 'http://radarr:7878',
'sync_level': 'full-sync',
'required_categories': ['movies'],
'tags': ['movies']
}
]
}
(root / 'integration-plan.json').write_text(json.dumps(plan, indent=2) + '\n', encoding='utf-8')
PY

step

2

instruction

Create a validator that checks URL structure, application uniqueness, media categories, tags, synchronization levels, and credential-handling policy.

command

cat > /opt/lab-classroom/class55/validate_plan.py <<'PY'
import json
from pathlib import Path
from urllib.parse import urlparse

root = Path('/opt/lab-classroom/class55')
plan = json.loads((root / 'integration-plan.json').read_text(encoding='utf-8'))
errors = []
allowed_types = {'sonarr', 'radarr'}
allowed_sync = {'full-sync', 'add-remove-only'}
expected_category = {'sonarr': 'tv', 'radarr': 'movies'}

prowlarr = urlparse(plan.get('prowlarr_url', ''))
if prowlarr.scheme not in {'http', 'https'} or not prowlarr.hostname:
errors.append('Prowlarr URL must contain an HTTP or HTTPS scheme and hostname.')

policy = plan.get('credential_policy', '').lower()
if 'interactively' not in policy or 'do not store' not in policy:
errors.append('Credential policy must require interactive entry and prohibit worksheet storage.')

apps = plan.get('applications', [])
if not isinstance(apps, list) or not apps:
errors.append('At least one application is required.')

seen_names = set()
seen_types = set()
for app in apps:
name = app.get('name', '')
app_type = app.get('type', '')
parsed = urlparse(app.get('application_url', ''))
if not name or name in seen_names:
errors.append('Application names must be present and unique.')
seen_names.add(name)
if app_type not in allowed_types:
errors.append(f'{name or "Unnamed application"} has an unsupported type.')
else:
seen_types.add(app_type)
if expected_category[app_type] not in app.get('required_categories', []):
errors.append(f'{name} is missing its expected media category.')
if parsed.scheme not in {'http', 'https'} or not parsed.hostname:
errors.append(f'{name or "Unnamed application"} has an invalid application URL.')
if parsed.hostname in {'localhost', '127.0.0.1'}:
errors.append(f'{name} uses a loopback address that is unsafe for a separate-service design.')
if app.get('sync_level') not in allowed_sync:
errors.append(f'{name} has an unsupported synchronization level.')
tags = app.get('tags')
if not isinstance(tags, list) or not tags or not all(isinstance(tag, str) and tag for tag in tags):
errors.append(f'{name} must have at least one non-empty tag.')
if any(key in app for key in ('api_key', 'apikey', 'token', 'password')):
errors.append(f'{name} stores a credential-like field in the worksheet.')

if seen_types != allowed_types:
errors.append('The plan must contain one Sonarr design and one Radarr design.')

if errors:
print('PLAN INVALID')
for error in errors:
print(f'- {error}')
raise SystemExit(1)

print('PLAN VALID')
print(f'Applications checked: {len(apps)}')
print('Credential-like fields stored: 0')
for app in apps:
print(f"{app['type']}: {app['application_url']} -> {app['sync_level']}")
PY

step

3

instruction

Run the validator from the classroom directory.

command

cd /opt/lab-classroom/class55 && python3 validate_plan.py

step

4

instruction

Review the plan and explain which system must be able to resolve each hostname. This command only reads the classroom artifact.

command

python3 -m json.tool /opt/lab-classroom/class55/integration-plan.json

step

5

instruction

As a controlled negative test, change Sonarr's synthetic URL to a loopback address, confirm that validation fails, and restore the valid plan.

command

python3 - <<'PY'
import json
from pathlib import Path
path = Path('/opt/lab-classroom/class55/integration-plan.json')
plan = json.loads(path.read_text(encoding='utf-8'))
for app in plan['applications']:
if app['type'] == 'sonarr':
app['application_url'] = 'http://localhost:8989'
path.write_text(json.dumps(plan, indent=2) + '\n', encoding='utf-8')
PY
cd /opt/lab-classroom/class55
python3 validate_plan.py; test $? -eq 1
python3 - <<'PY'
import json
from pathlib import Path
path = Path('/opt/lab-classroom/class55/integration-plan.json')
plan = json.loads(path.read_text(encoding='utf-8'))
for app in plan['applications']:
if app['type'] == 'sonarr':
app['application_url'] = 'http://sonarr:8989'
path.write_text(json.dumps(plan, indent=2) + '\n', encoding='utf-8')
PY
python3 validate_plan.py

production_transfer

Confirm that each proposed hostname resolves from the Prowlarr runtime environment.
Retrieve Sonarr and Radarr API keys through their authenticated administration interfaces.
Add one application integration at a time in Prowlarr.
Run the Prowlarr Test action before saving.
Save only after the test succeeds.
Inspect synchronized indexers in the target application.
Run one target-side indexer test and one manual search before expanding automation.