split: betoniarka (radio operator) colocated with liquidsoap; musician goes Discord-only

Permissions post-mortem that motivated this: the musician wrote radio
playlists AS ROOT onto a ROOT-OWNED network share which liquidsoap then
read AS USER 'radio' - chown fails on such shares by design (root squash /
uid mapping), so the radio came up and died on the playlists. The fix is
structural: the playlist WRITER now lives in the same container as the
READER, as the same user, on a local volume. No shared partition, no
chown, no uid mapping.

New: conjurer_betoniarka/betoniarka.py - runs inside the radio container
(started by the entrypoint as user 'radio', port 5005):
- library scan -> all_playlist/hit playlists with LOCAL container paths
  (start + every 24h + authenticated GET /rescan)
- bot-facing radio API moved from the musician: /add_to_priority,
  /create_priority_playlist, /request_radio_file, /clear_pr_pls,
  plus GET /ping (health) and /stream (web page)
- radio_log/persistence tailer forwarding play events to the bot's
  /prepped_tracks with the shared API key (bot-unreachable = logged, not fatal)

Musician: pure Discord music player now - keeps /mp3, /update_mp3,
/get_music and the file-share endpoints; all radio playlist writing, radio
paths/env and the tailer removed.

Bot: new CONJURER_RADIO_SERVICE (defaults to CONJURER_FILE_SERVICE so
un-split deployments keep working); radio_commands targets it; separate
'radio' health-gate group on betoniarka /ping (musician group now covers
music_commands + file_search_commands only).

Docker: betoniarka baked into the radio image (python3 + flask/waitress/
requests from Debian debs), port 5005 exposed, entrypoint starts it via
setpriv as 'radio'; data-volume chown is now best-effort with a loud
warning (keep the volume local); docs get the post-mortem + wiring.

Verified: py_compile everything; functional stub tests - rescan writes
local-path playlists, wyszukaj scores and appends to priority, auth
401/ok, tailer forward carries the API key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/Dockerfile.radio

@@ -45,6 +45,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         ffmpeg \
         pulseaudio pulseaudio-utils \
         icecast2 jq \
+        python3 python3-flask python3-waitress python3-requests \
     && rm -rf /var/lib/apt/lists/*
 
 # Liquidsoap refuses to run as root (security exit), so it gets a dedicated
@@ -88,6 +89,8 @@ COPY docker/pulse-system.pa /etc/pulse/system.pa
 WORKDIR /app
 COPY conjurer_musician/radio_conjurer.liq ./radio_conjurer.liq
 COPY conjurer_musician/script.params ./script.params
+COPY conjurer_musician/stream.html ./stream.html
+COPY conjurer_betoniarka/betoniarka.py ./betoniarka.py
 COPY docker/icecast.xml.tpl ./icecast.xml.tpl
 COPY docker/entrypoint.radio.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh
@@ -98,9 +101,10 @@ RUN chmod +x /usr/local/bin/entrypoint.sh
 #   /srv/betoniarka/secrets - icecast_credentials.json (provisioned at install)
 VOLUME ["/srv/betoniarka/data", "/srv/betoniarka/music", "/srv/betoniarka/secrets"]
 
-# 8000 = icecast (listeners), 54321 = harbor /skip (the bot's RADIO_HARBOR),
+# 8000 = icecast (listeners), 5005 = betoniarka HTTP API (the bot's
+# CONJURER_RADIO_SERVICE), 54321 = harbor /skip (the bot's RADIO_HARBOR),
 # 9999 = interactive harbor.
-EXPOSE 8000 54321 9999
+EXPOSE 8000 5005 54321 9999
 
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 CMD ["liquidsoap", "/srv/betoniarka/data/radio_conjurer.liq"]

docker/compose.radio.yaml

@@ -23,8 +23,12 @@ services:
       # PULSE_SERVER: unix:/tmp/pulseaudio.socket
       # Hostname icecast reports in its status/YP pages:
       ICECAST_HOSTNAME: ${ICECAST_HOSTNAME:-localhost}
+      # Betoniarka (radio-operator API + log forwarder):
+      CONJURER_MAIN_BOT: ${CONJURER_MAIN_BOT:-http://127.0.0.1:5000}
+      CONJURER_API_KEY: ${CONJURER_API_KEY:-}
     ports:
       - "8000:8000"     # icecast - listeners tune in here
+      - "5005:5005"     # betoniarka API - the bot's CONJURER_RADIO_SERVICE
       - "54321:54321"   # harbor /skip - the bot's CONJURER_RADIO_HARBOR
       - "9999:9999"     # interactive harbor (keep LAN-only!)
     volumes:

docker/entrypoint.radio.sh

@@ -91,13 +91,23 @@ esac
 
 # Liquidsoap refuses to run as root (init: security exit), so hand the data
 # volume to the dedicated 'radio' user and drop privileges for the main
-# process. The script parses the icecast secret directly, so make that one
-# file group-readable for 'radio' (kept 640, root-owned).
-chown -R radio:radio "$DATA"
+# process. chown is best-effort: on local volumes it always works (the
+# supported layout); network filesystems with root-squash reject it, hence
+# the warning instead of a fatal abort.
+chown -R radio:radio "$DATA" 2>/dev/null \
+    || echo "WARNING: chown of $DATA failed (network FS?) - keep this volume LOCAL to the radio VM" >&2
 chgrp radio "$CREDS" 2>/dev/null && chmod 640 "$CREDS" || true
 if ! setpriv --reuid radio --regid radio --init-groups -- test -r "$MUSIC"; then
     echo "WARNING: music dir $MUSIC is not readable by the 'radio' user" >&2
 fi
 
+# Betoniarka: the radio-operator API + radio-log forwarder, running as the
+# SAME user as liquidsoap on the SAME volume - this is what makes the old
+# musician-writes-as-root-over-network-share permission mess go away.
+BETONIARKA_DATA="$DATA" BETONIARKA_MUSIC="$MUSIC" \
+    setpriv --reuid radio --regid radio --init-groups -- \
+    python3 /app/betoniarka.py &
+echo "betoniarka started (pid $!)"
+
 cd "$DATA"
 exec setpriv --reuid radio --regid radio --init-groups -- "$@"

docker/env/bot.env.example

@@ -24,7 +24,10 @@ CONJURER_API_KEY=
 
 # --- Where the bot reaches the other services (other Proxmox VMs) --------
 CONJURER_FILE_SERVICE=http://MUSICIAN_VM_IP:5000
-CONJURER_RADIO_HARBOR=http://MUSICIAN_VM_IP:54321
+# Betoniarka (radio-operator API, runs in the radio container):
+CONJURER_RADIO_SERVICE=http://RADIO_VM_IP:5005
+# Liquidsoap harbor /skip (same radio container):
+CONJURER_RADIO_HARBOR=http://RADIO_VM_IP:54321
 CONJURER_LIBRARIAN_SERVICE=http://LIBRARIAN_VM_IP:5001
 
 # --- Conan Exiles bridge (optional; empty/0 = disabled) -----------------